"AntiSpyCheck" website keeps popping up and will not close!

• Double-click SUPERAntiSpyware.exe and use the default settings for installation.
• An icon will be created on your desktop. Double-click that icon to launch the program.
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

• Click Start, click Control Panel, and then double-click Internet Options.
• On the General tab, click Delete... under Browsing History.
• Next to Temporary Internet Files, click Delete files, and then click OK.
• Next to Cookies, click Delete cookies, and then click OK.
• Next to History, click Delete history, and then click OK.
• Click the Close button.
• Click OK.

• Click Start, click Control Panel, and then double-click Internet Options.
• On the General tab, click Delete Files under Temporary Internet Files.
• In the Delete Files dialog box, tick the Delete all offline content check box, and then click OK.
• On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
• Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
• Click OK.

• Click Edit from the Netscape menubar.
• Click Preferences... from the Edit menu.
• Expand the Advanced menu by clicking the triangle sign.
• Click Cache.
• Click both the Clear Memory Cache and the Clear Disk Cache buttons.

• Click Edit from the Mozilla menubar.
• Click Preferences... from the Edit menu.
• Expand the Advanced menu by clicking the plus sign.
• Click Cache.
• Click the Clear Cache button.

• Click File from the Opera menubar.
• Click Preferences... from the File menu.
• Click the History and Cache menu.
• Click the two Clear buttons next to Typed in addresses and Visited addresses (history) and click the Empty now button to clear the Disk cache.
• Click Ok to close the Preferences menu.

• Open SUPERAntiSpyware.
• Under "Configuration and Preferences", click the Preferences button.
• Click the Scanning Control tab.
• Under Scanner Options make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
  • Scan for tracking cookies.
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen.
• Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
• On the left, make sure you check C:\Fixed Drive.
• On the right, under "Complete Scan", choose Perform Complete Scan.
• Click "Next" to start the scan. Please be patient while it scans your computer.
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
• Make sure everything has a checkmark next to it and click "Next".
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
• If asked if you want to reboot, click "Yes".
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

1. c:\rapport.txt
2. SUPERAntiSpyware log
3. A new HijackThis log

• Open the OTScanIt folder and double-click on OTScanIt.exe to start the program.
  
  • In the Files Created Within group click 30 days
  • In the Files Modified Within group select 30 days
  • In the File String Search group select Non-Microsoft
• Now click the Run Scan button on the toolbar.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

OTScanIt logfile created on: 8/26/2008 8:06:43 PM

OTScanIt by OldTimer - Version 1.0.16.2     Folder = C:\Documents and Settings\Sally\Desktop\OTScanIt

Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

1014.07 Mb Total Physical Memory | 536.36 Mb Available Physical Memory | 52.89% Memory free

2.38 Gb Paging File | 1.88 Gb Available in Paging File | 79.05% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048;

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 144.33 Gb Total Space | 125.18 Gb Free Space | 86.73% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded



Computer Name: ANGELA

Current User Name: Sally

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user



[Processes - Non-Microsoft Only]

hkcmd.exe -> %SystemRoot%\system32\hkcmd.exe -> Intel Corporation [Ver = 3.0.0.4410 | Size = 77824 bytes | Modified Date = 10/14/2005 10:46:34 PM | Attr =    ]

igfxpers.exe -> %SystemRoot%\system32\igfxpers.exe -> Intel Corporation [Ver = 3.0.0.4410 | Size = 114688 bytes | Modified Date = 10/14/2005 10:50:30 PM | Attr =    ]

jusched.exe -> %ProgramFiles%\Java\jre1.5.0_03\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.30.7 | Size = 36975 bytes | Modified Date = 4/13/2005 3:48:52 AM | Attr =    ]

dmxlauncher.exe -> %ProgramFiles%\Dell\Media Experience\DMXLauncher.exe ->  [Ver =  | Size = 94208 bytes | Modified Date = 10/5/2005 5:12:00 AM | Attr =    ]

realplay.exe -> %ProgramFiles%\Real\RealPlayer\realplay.exe -> RealNetworks, Inc. [Ver = 6.0.9.584 | Size = 26112 bytes | Modified Date = 2/23/2006 3:51:28 AM | Attr =    ]

jucheck.exe -> %ProgramFiles%\Java\jre1.5.0_03\bin\jucheck.exe -> Sun Microsystems, Inc. [Ver = 5.0.30.7 | Size = 241775 bytes | Modified Date = 4/13/2005 3:48:52 AM | Attr =    ]

mm_tray.exe -> %ProgramFiles%\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe -> Musicmatch, Inc. [Ver = 10.10.1038 | Size = 110592 bytes | Modified Date = 1/18/2006 3:00:30 PM | Attr =    ]

issch.exe -> %CommonProgramFiles%\InstallShield\UpdateService\issch.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 81920 bytes | Modified Date = 6/10/2005 12:44:02 PM | Attr =    ]

dlactrlw.exe -> %SystemRoot%\system32\DLA\DLACTRLW.EXE -> Sonic Solutions [Ver = 5.20.08a | Size = 122940 bytes | Modified Date = 9/8/2005 7:20:00 AM | Attr =    ]

googledesktop.exe -> %ProgramFiles%\Google\Google Desktop Search\GoogleDesktop.exe ->  [Ver =  | Size = 169472 bytes | Modified Date = 2/23/2006 3:59:06 AM | Attr =    ]

mmdiag.exe -> %ProgramFiles%\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe -> Musicmatch, Inc. [Ver = 10.10.1038 | Size = 102400 bytes | Modified Date = 1/18/2006 3:00:30 PM | Attr =    ]

googledesktopindex.exe -> %ProgramFiles%\Google\Google Desktop Search\GoogleDesktopIndex.exe ->  [Ver =  | Size = 554496 bytes | Modified Date = 2/23/2006 3:59:06 AM | Attr =    ]

dlccmon.exe -> %ProgramFiles%\Dell Photo AIO Printer 924\dlccmon.exe -> Dell [Ver = 2.6.65.22 | Size = 430080 bytes | Modified Date = 10/21/2005 4:40:26 AM | Attr =    ]

mskagent.exe -> %ProgramFiles%\McAfee\MSK\mskagent.exe -> McAfee Inc. [Ver = 8.2.125.0 | Size = 152144 bytes | Modified Date = 1/17/2007 4:30:24 PM | Attr =    ]

googledesktopdisplay.exe -> %ProgramFiles%\Google\Google Desktop Search\GoogleDesktopDisplay.exe ->  [Ver =  | Size = 415744 bytes | Modified Date = 2/23/2006 3:59:06 AM | Attr =    ]

siteadv.exe -> %ProgramFiles%\SiteAdvisor\6261\SiteAdv.exe ->  [Ver =  | Size = 36640 bytes | Modified Date = 8/24/2007 5:57:48 PM | Attr =    ]

mim.exe -> %ProgramFiles%\MUSICMATCH\Musicmatch Jukebox\mim.exe -> Musicmatch, Inc. [Ver = 10.10.1038 | Size = 479232 bytes | Modified Date = 1/18/2006 3:00:28 PM | Attr =    ]

mediadetect.exe -> %ProgramFiles%\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 1:06:18 PM | Attr =    ]

qttask.exe -> %ProgramFiles%\QuickTime\QTTask.exe -> Apple Inc. [Ver = 7.4.1 | Size = 385024 bytes | Modified Date = 2/1/2008 12:13:08 AM | Attr =    ]

ituneshelper.exe -> %ProgramFiles%\iTunes\iTunesHelper.exe -> Apple Inc. [Ver = 7.6.0.29 | Size = 267048 bytes | Modified Date = 2/4/2008 3:18:40 PM | Attr =    ]

mcagent.exe -> %ProgramFiles%\McAfee.com\Agent\mcagent.exe -> McAfee, Inc. [Ver = 8,0,237,0 | Size = 582992 bytes | Modified Date = 11/1/2007 7:12:38 PM | Attr =    ]

googletoolbarnotifier.exe -> %ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -> Google Inc. [Ver = 2, 0, 301, 1654 | Size = 68856 bytes | Modified Date = 6/21/2007 7:14:59 PM | Attr =    ]

dsagnt.exe -> %ProgramFiles%\DellSupport\DSAgnt.exe -> Gteko Ltd. [Ver = 3, 0, 0, 197 | Size = 460784 bytes | Modified Date = 3/15/2007 11:09:36 AM | Attr =    ]

superantispyware.exe -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 4, 20, 0, 1046 | Size = 1576176 bytes | Modified Date = 8/19/2008 11:34:18 PM | Attr =    ]

aolacsd.exe -> %CommonProgramFiles%\AOL\ACS\AOLacsd.exe -> America Online, Inc. [Ver = 2.0.20.1.US.1         | Size = 1135728 bytes | Modified Date = 4/7/2004 2:07:32 PM | Attr =    ]

applemobiledeviceservice.exe -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> Apple Inc. [Ver = 2.0.28.0 | Size = 116040 bytes | Modified Date = 7/10/2008 9:47:18 AM | Attr =    ]

mdnsresponder.exe -> %ProgramFiles%\Bonjour\mDNSResponder.exe -> Apple Inc. [Ver = 1,0,4,12 | Size = 229376 bytes | Modified Date = 7/24/2007 4:17:08 PM | Attr =    ]

aoltray.exe -> %ProgramFiles%\America Online 9.0\aoltray.exe -> America Online, Inc. [Ver = 9.00.001 | Size = 156784 bytes | Modified Date = 9/1/2004 1:56:34 PM | Attr =  H ]

dlg.exe -> %ProgramFiles%\Digital Line Detect\DLG.exe -> BVRP Software [Ver = 1, 0, 0, 1 | Size = 24576 bytes | Modified Date = 10/29/2003 4:06:00 AM | Attr = R  ]

hwapi.exe -> %CommonProgramFiles%\McAfee\HackerWatch\HWAPI.exe -> McAfee, Inc. [Ver = 8.3.105.0 | Size = 540776 bytes | Modified Date = 2/13/2007 1:09:12 PM | Attr =    ]

mcmscsvc.exe -> %ProgramFiles%\McAfee\MSC\mcmscsvc.exe -> McAfee, Inc. [Ver = 8,1,159,0 | Size = 767976 bytes | Modified Date = 1/9/2008 4:50:22 PM | Attr =    ]

mcnasvc.exe -> %CommonProgramFiles%\McAfee\MNA\McNASvc.exe -> McAfee, Inc. [Ver = 2,1,143,0 | Size = 2458128 bytes | Modified Date = 1/25/2008 1:38:12 AM | Attr =    ]

mcods.exe -> %ProgramFiles%\McAfee\VirusScan\mcods.exe -> McAfee, Inc. [Ver = 11,2,121,0 | Size = 362064 bytes | Modified Date = 1/16/2007 7:03:36 PM | Attr =    ]

mcproxy.exe -> %CommonProgramFiles%\McAfee\McProxy\McProxy.exe -> McAfee, Inc. [Ver = 1,2,138,0 | Size = 353368 bytes | Modified Date = 4/12/2007 10:33:42 AM | Attr =    ]

redirsvc.exe -> %CommonProgramFiles%\McAfee\RedirSvc\RedirSvc.exe -> McAfee, Inc. [Ver = 1,3,109,0 | Size = 256096 bytes | Modified Date = 3/8/2007 4:42:42 PM | Attr =    ]

mcshield.exe -> %ProgramFiles%\McAfee\VirusScan\Mcshield.exe -> McAfee, Inc. [Ver = VSCORE.13.3.2.116.x86 | Size = 144960 bytes | Modified Date = 6/25/2007 11:56:42 AM | Attr =    ]

mcsysmon.exe -> %ProgramFiles%\McAfee\VirusScan\mcsysmon.exe -> McAfee, Inc. [Ver = 11,2,131,0 | Size = 643664 bytes | Modified Date = 1/25/2007 5:01:58 PM | Attr =    ]

mpfsrv.exe -> %ProgramFiles%\McAfee\MPF\MpfSrv.exe -> McAfee, Inc. [Ver = 8.2.122.0 | Size = 841256 bytes | Modified Date = 6/19/2007 9:55:24 AM | Attr =    ]

mps.exe -> %ProgramFiles%\McAfee\MPS\mps.exe -> McAfee, Inc. [Ver = 9.2.134.0 | Size = 906792 bytes | Modified Date = 4/18/2007 3:08:06 PM | Attr =    ]

msksrver.exe -> %ProgramFiles%\McAfee\MSK\msksrver.exe -> McAfee Inc. [Ver = 8.2.125.0 | Size = 29264 bytes | Modified Date = 1/17/2007 4:30:34 PM | Attr =    ]

saservice.exe -> %ProgramFiles%\SiteAdvisor\6261\SAService.exe ->  [Ver =  | Size = 345376 bytes | Modified Date = 5/23/2008 8:17:38 AM | Attr =    ]

mpsevh.exe -> %ProgramFiles%\McAfee\MPS\mpsevh.exe -> McAfee, Inc. [Ver = 9.2.134.0 | Size = 304680 bytes | Modified Date = 4/18/2007 3:08:10 PM | Attr =    ]

dlcccoms.exe -> %SystemRoot%\system32\dlcccoms.exe ->   [Ver = 1.154.24.0 | Size = 491520 bytes | Modified Date = 10/28/2005 1:41:52 AM | Attr =    ]

ipodservice.exe -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.6.0.29 | Size = 504104 bytes | Modified Date = 2/4/2008 3:18:32 PM | Attr =    ]

mcuimgr.exe -> %ProgramFiles%\McAfee\MSC\mcuimgr.exe -> McAfee, Inc. [Ver = 8,0,226,0 | Size = 265040 bytes | Modified Date = 11/1/2007 7:12:38 PM | Attr =    ]

otscanit.exe -> %UserProfile%\Desktop\OTScanIt\OTScanIt.exe -> OldTimer Tools [Ver = 1.0.16.2 | Size = 397312 bytes | Modified Date = 7/12/2008 9:29:54 AM | Attr =    ]



[Win32 Services - Non-Microsoft Only]

(AOL ACS) AOL Connectivity Service [Win32_Own | Auto | Running] -> %CommonProgramFiles%\AOL\ACS\AOLacsd.exe -> America Online, Inc. [Ver = 2.0.20.1.US.1         | Size = 1135728 bytes | Modified Date = 4/7/2004 2:07:32 PM | Attr =    ]

(Apple Mobile Device) Apple Mobile Device [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> Apple Inc. [Ver = 2.0.28.0 | Size = 116040 bytes | Modified Date = 7/10/2008 9:47:18 AM | Attr =    ]

(Bonjour Service) Bonjour Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Bonjour\mDNSResponder.exe -> Apple Inc. [Ver = 1,0,4,12 | Size = 229376 bytes | Modified Date = 7/24/2007 4:17:08 PM | Attr =    ]

(dlcc_device) dlcc_device [Win32_Own | On_Demand | Running] -> %SystemRoot%\system32\dlcccoms.exe ->   [Ver = 1.154.24.0 | Size = 491520 bytes | Modified Date = 10/28/2005 1:41:52 AM | Attr =    ]

(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %SystemRoot%\system32\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/10/2004 7:00:00 AM | Attr =    ]

(DSBrokerService) DSBrokerService [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\DellSupport\brkrsvc.exe ->  [Ver = 1, 0, 0, 8 | Size = 76848 bytes | Modified Date = 3/7/2007 3:47:46 PM | Attr =    ]

(Emproxy) McAfee E-mail Proxy [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\McAfee\EmProxy\emproxy.exe -> McAfee, Inc. [Ver = 11,2,214,0 | Size = 341328 bytes | Modified Date = 10/5/2007 6:33:26 PM | Attr =    ]

(gusvc) Google Updater Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe -> Google [Ver = 2.2.1175.1406.beta | Size = 156656 bytes | Modified Date = 7/19/2008 2:34:39 PM | Attr =    ]

(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.6.0.29 | Size = 504104 bytes | Modified Date = 2/4/2008 3:18:32 PM | Attr =    ]

(McAfee HackerWatch Service) McAfee HackerWatch Service [Win32_Own | Auto | Running] -> %CommonProgramFiles%\McAfee\HackerWatch\HWAPI.exe -> McAfee, Inc. [Ver = 8.3.105.0 | Size = 540776 bytes | Modified Date = 2/13/2007 1:09:12 PM | Attr =    ]

(mcmscsvc) McAfee Services [Win32_Own | Auto | Running] -> %ProgramFiles%\McAfee\MSC\mcmscsvc.exe -> McAfee, Inc. [Ver = 8,1,159,0 | Size = 767976 bytes | Modified Date = 1/9/2008 4:50:22 PM | Attr =    ]

(McNASvc) McAfee Network Agent [Win32_Own | Auto | Running] -> %CommonProgramFiles%\McAfee\MNA\McNASvc.exe -> McAfee, Inc. [Ver = 2,1,143,0 | Size = 2458128 bytes | Modified Date = 1/25/2008 1:38:12 AM | Attr =    ]

(McODS) McAfee Scanner [Win32_Own | Auto | Running] -> %ProgramFiles%\McAfee\VirusScan\mcods.exe -> McAfee, Inc. [Ver = 11,2,121,0 | Size = 362064 bytes | Modified Date = 1/16/2007 7:03:36 PM | Attr =    ]

(McProxy) McAfee Proxy Service [Win32_Own | Auto | Running] -> %CommonProgramFiles%\McAfee\McProxy\McProxy.exe -> McAfee, Inc. [Ver = 1,2,138,0 | Size = 353368 bytes | Modified Date = 4/12/2007 10:33:42 AM | Attr =    ]

(McRedirector) McAfee Redirector Service [Win32_Own | Auto | Running] -> %CommonProgramFiles%\McAfee\RedirSvc\RedirSvc.exe -> McAfee, Inc. [Ver = 1,3,109,0 | Size = 256096 bytes | Modified Date = 3/8/2007 4:42:42 PM | Attr =    ]

(McShield) McAfee Real-time Scanner [Win32_Own | Unknown | Running] -> %SystemDrive%\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe -> McAfee, Inc. [Ver = VSCORE.13.3.2.116.x86 | Size = 144960 bytes | Modified Date = 6/25/2007 11:56:42 AM | Attr =    ]

(McSysmon) McAfee SystemGuards [Win32_Own | Auto | Running] -> %ProgramFiles%\McAfee\VirusScan\mcsysmon.exe -> McAfee, Inc. [Ver = 11,2,131,0 | Size = 643664 bytes | Modified Date = 1/25/2007 5:01:58 PM | Attr =    ]

(MpfService) McAfee Personal Firewall Service [Win32_Own | Auto | Running] -> %ProgramFiles%\McAfee\MPF\MpfSrv.exe -> McAfee, Inc. [Ver = 8.2.122.0 | Size = 841256 bytes | Modified Date = 6/19/2007 9:55:24 AM | Attr =    ]

(MPS9) McAfee Privacy Service [Win32_Own | Auto | Running] -> %ProgramFiles%\McAfee\MPS\mps.exe -> McAfee, Inc. [Ver = 9.2.134.0 | Size = 906792 bytes | Modified Date = 4/18/2007 3:08:06 PM | Attr =    ]

(MSK80Service) McAfee SpamKiller Service [Win32_Own | Auto | Running] -> %ProgramFiles%\McAfee\MSK\msksrver.exe -> McAfee Inc. [Ver = 8.2.125.0 | Size = 29264 bytes | Modified Date = 1/17/2007 4:30:34 PM | Attr =    ]

(NetSvc) Intel NCS NetService [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Intel\PROSetWired\NCS\Sync\NetSvc.exe -> Intel(R) Corporation [Ver = 2.2.7.0 | Size = 147456 bytes | Modified Date = 11/19/2004 1:26:40 PM | Attr =    ]

(SiteAdvisor Service) SiteAdvisor Service [Win32_Own | Auto | Running] -> %ProgramFiles%\SiteAdvisor\6261\SAService.exe ->  [Ver =  | Size = 345376 bytes | Modified Date = 5/23/2008 8:17:38 AM | Attr =    ]



[Registry - Non-Microsoft Only]

< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 

AppleSyncNotifier -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe] -> Apple Inc. [Ver = 1, 0, 0, 9 | Size = 116040 bytes | Modified Date = 7/10/2008 9:47:28 AM | Attr =    ]

Corel Photo Downloader -> %ProgramFiles%\Corel\Corel Photo Album 6\MediaDetect.exe [C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe] -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 1:06:18 PM | Attr =    ]

DLA -> %SystemRoot%\system32\DLA\DLACTRLW.EXE [C:\WINDOWS\System32\DLA\DLACTRLW.EXE] -> Sonic Solutions [Ver = 5.20.08a | Size = 122940 bytes | Modified Date = 9/8/2005 7:20:00 AM | Attr =    ]

DLCCCATS -> %SystemRoot%\system32\spool\drivers\w32x86\3\dlcctime.dll [rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16] ->  [Ver = 0.1.11.5 | Size = 73728 bytes | Modified Date = 9/14/2005 2:50:38 AM | Attr =    ]

dlccmon.exe -> %ProgramFiles%\Dell Photo AIO Printer 924\dlccmon.exe ["C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"] -> Dell [Ver = 2.6.65.22 | Size = 430080 bytes | Modified Date = 10/21/2005 4:40:26 AM | Attr =    ]

DMXLauncher -> %ProgramFiles%\Dell\Media Experience\DMXLauncher.exe [C:\Program Files\Dell\Media Experience\DMXLauncher.exe] ->  [Ver =  | Size = 94208 bytes | Modified Date = 10/5/2005 5:12:00 AM | Attr =    ]

dscactivate -> %ProgramFiles%\Dell Support Center\gs_agent\custom\dsca.exe ["C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"] ->   [Ver = 1.0.2767.18581 | Size = 16384 bytes | Modified Date = 11/15/2007 9:24:00 AM | Attr =    ]

Google Desktop Search -> %ProgramFiles%\Google\Google Desktop Search\GoogleDesktop.exe ["C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup] ->  [Ver =  | Size = 169472 bytes | Modified Date = 2/23/2006 3:59:06 AM | Attr =    ]

igfxhkcmd -> %SystemRoot%\system32\hkcmd.exe [C:\WINDOWS\system32\hkcmd.exe] -> Intel Corporation [Ver = 3.0.0.4410 | Size = 77824 bytes | Modified Date = 10/14/2005 10:46:34 PM | Attr =    ]

igfxpers -> %SystemRoot%\system32\igfxpers.exe [C:\WINDOWS\system32\igfxpers.exe] -> Intel Corporation [Ver = 3.0.0.4410 | Size = 114688 bytes | Modified Date = 10/14/2005 10:50:30 PM | Attr =    ]

igfxtray -> %SystemRoot%\system32\igfxtray.exe [C:\WINDOWS\system32\igfxtray.exe] -> Intel Corporation [Ver = 3.0.0.4410 | Size = 94208 bytes | Modified Date = 10/14/2005 10:49:46 PM | Attr =    ]

ISUSPM Startup -> %CommonProgramFiles%\InstallShield\UpdateService\ISUSPM.exe ["C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup] -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 249856 bytes | Modified Date = 6/10/2005 12:44:02 PM | Attr =    ]

ISUSScheduler -> %CommonProgramFiles%\InstallShield\UpdateService\issch.exe ["C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start] -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 81920 bytes | Modified Date = 6/10/2005 12:44:02 PM | Attr =    ]

iTunesHelper -> %ProgramFiles%\iTunes\iTunesHelper.exe ["C:\Program Files\iTunes\iTunesHelper.exe"] -> Apple Inc. [Ver = 7.6.0.29 | Size = 267048 bytes | Modified Date = 2/4/2008 3:18:40 PM | Attr =    ]

mcagent_exe -> %ProgramFiles%\McAfee.com\Agent\mcagent.exe [C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey] -> McAfee, Inc. [Ver = 8,0,237,0 | Size = 582992 bytes | Modified Date = 11/1/2007 7:12:38 PM | Attr =    ]

MimBoot -> %ProgramFiles%\MUSICMATCH\Musicmatch Jukebox\mimboot.exe [C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe] -> Musicmatch, Inc. [Ver = 10.10.1038 | Size = 8192 bytes | Modified Date = 1/18/2006 3:00:28 PM | Attr =    ]

MMTray -> %ProgramFiles%\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe ["C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"] -> Musicmatch, Inc. [Ver = 10.10.1038 | Size = 110592 bytes | Modified Date = 1/18/2006 3:00:30 PM | Attr =    ]

MskAgentexe -> %ProgramFiles%\McAfee\MSK\mskagent.exe [C:\Program Files\McAfee\MSK\MskAgent.exe] -> McAfee Inc. [Ver = 8.2.125.0 | Size = 152144 bytes | Modified Date = 1/17/2007 4:30:24 PM | Attr =    ]

QuickTime Task -> %ProgramFiles%\QuickTime\QTTask.exe ["C:\Program Files\QuickTime\QTTask.exe" -atboottime] -> Apple Inc. [Ver = 7.4.1 | Size = 385024 bytes | Modified Date = 2/1/2008 12:13:08 AM | Attr =    ]

RealTray -> %ProgramFiles%\Real\RealPlayer\realplay.exe [C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER] -> RealNetworks, Inc. [Ver = 6.0.9.584 | Size = 26112 bytes | Modified Date = 2/23/2006 3:51:28 AM | Attr =    ]

SiteAdvisor -> %ProgramFiles%\SiteAdvisor\6261\SiteAdv.exe ["C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"] ->  [Ver =  | Size = 36640 bytes | Modified Date = 8/24/2007 5:57:48 PM | Attr =    ]

SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.5.0_03\bin\jusched.exe [C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe] -> Sun Microsystems, Inc. [Ver = 5.0.30.7 | Size = 36975 bytes | Modified Date = 4/13/2005 3:48:52 AM | Attr =    ]

< OptionalComponents [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\ -> 

IMAIL-> Installed = 1 -> 

MAPI-> Installed = 1 -> 

MSFS-> Installed = 1 -> 

< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 

DellSupport -> %ProgramFiles%\DellSupport\DSAgnt.exe ["C:\Program Files\DellSupport\DSAgnt.exe" /startup] -> Gteko Ltd. [Ver = 3, 0, 0, 197 | Size = 460784 bytes | Modified Date = 3/15/2007 11:09:36 AM | Attr =    ]

SUPERAntiSpyware -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe [C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe] -> SUPERAntiSpyware.com [Ver = 4, 20, 0, 1046 | Size = 1576176 bytes | Modified Date = 8/19/2008 11:34:18 PM | Attr =    ]

swg -> %ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] -> Google Inc. [Ver = 2, 0, 301, 1654 | Size = 68856 bytes | Modified Date = 6/21/2007 7:14:59 PM | Attr =    ]

updateMgr -> %ProgramFiles%\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe ["C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9] -> Adobe Systems Incorporated [Ver = 3.1.0.10 | Size = 313472 bytes | Modified Date = 3/30/2006 5:45:08 PM | Attr = R  ]

< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 

%AllUsersProfile%\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk -> %ProgramFiles%\Adobe\Acrobat 7.0\Reader\reader_sl.exe -> Adobe Systems Incorporated [Ver = 7.0.5.2005092300 | Size = 29696 bytes | Modified Date = 9/23/2005 11:05:26 PM | Attr =    ]

%AllUsersProfile%\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk -> %ProgramFiles%\America Online 9.0\aoltray.exe -> America Online, Inc. [Ver = 9.00.001 | Size = 156784 bytes | Modified Date = 9/1/2004 1:56:34 PM | Attr =  H ]

%AllUsersProfile%\Start Menu\Programs\Startup\Digital Line Detect.lnk -> %ProgramFiles%\Digital Line Detect\DLG.exe -> BVRP Software [Ver = 1, 0, 0, 1 | Size = 24576 bytes | Modified Date = 10/29/2003 4:06:00 AM | Attr = R  ]

< Sally Startup Folder > -> C:\Documents and Settings\Sally\Start Menu\Programs\Startup -> 

< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs -> 

*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls -> 

C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL -> %ProgramFiles%\Google\Google Desktop Search\GoogleDesktopNetwork3.dll ->  [Ver =  | Size = 111616 bytes | Modified Date = 2/23/2006 3:59:06 AM | Attr =    ]

*MultiFile Done* -> -> 

< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> 

{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\SUPERAntiSpyware\SASSEH.DLL [] -> SuperAdBlocker.com [Ver = 1, 0, 0, 1012 | Size = 77824 bytes | Modified Date = 5/13/2008 10:13:36 AM | Attr =    ]

< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders -> 

< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 

*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 

Explorer.exe -> %SystemRoot%\explorer.exe -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 6/13/2007 6:23:07 AM | Attr =    ]

*MultiFile Done* -> -> 

*UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit -> 

C:\WINDOWS\system32\userinit.exe -> %SystemRoot%\system32\userinit.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 24576 bytes | Modified Date = 8/10/2004 7:00:00 AM | Attr =    ]

*MultiFile Done* -> -> 

*UIHost* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost -> 

logonui.exe -> %SystemRoot%\system32\logonui.exe -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 514560 bytes | Modified Date = 8/10/2004 7:00:00 AM | Attr =    ]

*MultiFile Done* -> -> 

*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> 

rundll32 shell32 -> %SystemRoot%\system32\shell32.dll -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 10/25/2007 11:34:01 PM | Attr =    ]

Control_RunDLL "sysdm.cpl" -> %SystemRoot%\system32\sysdm.cpl -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 298496 bytes | Modified Date = 8/10/2004 7:00:00 AM | Attr =    ]

*MultiFile Done* -> -> 

< Winlogon settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 

< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 

!SASWinLogon -> %ProgramFiles%\SUPERAntiSpyware\SASWINLO.dll -> SUPERAntiSpyware.com [Ver = 1, 0, 0, 1048 | Size = 352256 bytes | Modified Date = 7/23/2008 4:28:18 PM | Attr =    ]

igfxcui -> %SystemRoot%\system32\igfxdev.dll -> Intel Corporation [Ver = 3.0.0.4410 | Size = 135168 bytes | Modified Date = 10/14/2005 10:45:38 PM | Attr =    ]

vtututs ->  -> File not found

WgaLogon ->  -> File not found

< CurrentVersion Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoCDBurning -> 0 -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption ->  -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext ->  -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\undockwithoutlogon -> 1 -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\InstallVisualStyle -> %SystemRoot%\Resources\Themes\Royale\Royale.mss [C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles] -> File not found

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\InstallTheme -> %SystemRoot%\Resources\Themes\Royale.the [C:\WINDOWS\Resources\Themes\Royale.theme] -> File not found

< CurrentVersion Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> -> 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> -> 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 -> 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> -> 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> -> 

< CDROM Autorun Settings > [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\ -> ->

*DependOnGroup* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DependOnGroup -> 

SCSI miniport ->  -> File not found

*MultiFile Done* -> -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ErrorControl -> 1 -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Group -> SCSI CDROM Class -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Start -> 1 -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Tag -> 2 -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Type -> 1 -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DisplayName -> CD-ROM Driver -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ImagePath -> %SystemRoot%\system32\drivers\cdrom.sys [system32\DRIVERS\cdrom.sys] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 49536 bytes | Modified Date = 8/10/2004 7:00:00 AM | Attr =    ]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun -> 1 -> 

*AutoRunAlwaysDisable* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRunAlwaysDisable -> 

NEC     MBR-7    ->  -> File not found

NEC     MBR-7.4  ->  -> File not found

PIONEER CHANGR DRM-1804X ->  -> File not found

PIONEER CD-ROM DRM-6324X ->  -> File not found

PIONEER CD-ROM DRM-624X  ->  -> File not found

TORiSAN CD-ROM CDR_C36 ->  -> File not found

*MultiFile Done* -> -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\ -> -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\0 -> IDE\CdRomHL-DT-ST_DVD+-RW_GWA4164B_______________D108____\5&2b88f5e5&0&0.0.0 -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\Count -> 1 -> 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\NextInstance -> 1 -> 

< Drives - Autoruns > ->  -> 

AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ] ->  [Ver =  | Size = 0 bytes | Modified Date = 8/16/2005 6:43:04 AM | Attr =    ]

< HOSTS File > (734 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts -> 

< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 

HKEY_LOCAL_MACHINE\: Main\\Default_Page_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> 

HKEY_LOCAL_MACHINE\: Main\\Default_Search_URL -> http://www.google.com/ie -> 

HKEY_LOCAL_MACHINE\: Main\\Local Page -> C:\windows\system32\blank.htm -> 

HKEY_LOCAL_MACHINE\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 

HKEY_LOCAL_MACHINE\: Main\\Start Page -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home -> 

HKEY_LOCAL_MACHINE\: Search\\CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 

HKEY_LOCAL_MACHINE\: Search\\Default_Search_URL -> http://www.google.com/ie -> 

HKEY_LOCAL_MACHINE\: Search\\SearchAssistant -> http://www.google.com/ie -> 

< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> 

HKEY_CURRENT_USER\: Main\\Default_Search_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 

HKEY_CURRENT_USER\: Main\\Local Page -> C:\windows\system32\blank.htm -> 

HKEY_CURRENT_USER\: Main\\Search Bar -> http://www.google.com/ie -> 

HKEY_CURRENT_USER\: Main\\Search Page -> http://www.google.com -> 

HKEY_CURRENT_USER\: Main\\Start Page -> http://www.msn.com/ -> 

HKEY_CURRENT_USER\: Search\\SearchAssistant -> http://www.google.com/ie -> 

HKEY_CURRENT_USER\: SearchURL\\ -> http://www.google.com/search?q=%s[gogl] -> 

HKEY_CURRENT_USER\: ProxyEnable -> 0 -> 

< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 2 domain(s) found. -> 

online_musicmatch.com [https] -> Trusted sites -> 

2 domain(s) and sub-domain(s) not assigned to a zone.

< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 53 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 30 range(s) found. -> 

< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 7.0.9.2006121800 | Size = 59032 bytes | Modified Date = 12/18/2006 5:16:42 AM | Attr =    ]

{089FD14D-132B-48FC-8861-0048AE113215} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\SiteAdvisor\6261\SiteAdv.dll [Reg Error: Value  does not exist or could not be read.] ->  [Ver =  | Size = 927008 bytes | Modified Date = 5/16/2008 12:49:40 PM | Attr =    ]

{5CA3D70E-1895-11CF-8E15-001234567890} [HKEY_LOCAL_MACHINE] -> %SystemRoot%\system32\DLA\DLASHX_W.DLL [DriveLetterAccess] -> Sonic Solutions [Ver = 5.20.08a | Size = 110652 bytes | Modified Date = 9/8/2005 7:20:00 AM | Attr =    ]

{7DB2D5A0-7241-4E79-B68D-6309F01C5231} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\McAfee\VirusScan\scriptcl.dll [scriptproxy] -> McAfee, Inc. [Ver = VSCORE.13.3.2.116.x86 | Size = 67136 bytes | Modified Date = 6/25/2007 11:57:44 AM | Attr =    ]

{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\Google Toolbar\GoogleToolbar.dll [Google Toolbar Helper] ->  [Ver =  | Size = 193136 bytes | Modified Date = 7/19/2008 1:59:16 PM | Attr =    ]

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll [Google Toolbar Notifier BHO] -> Google Inc. [Ver = 4, 1, 509, 5470 | Size = 651760 bytes | Modified Date = 7/19/2008 2:34:40 PM | Attr =    ]

{CA6319C0-31B7-401E-A518-A07C3DB8F777} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\GoogleAFE\GoogleAE.dll [CBrowserHelperObject Object] -> Google [Ver = 1.0.0.2 | Size = 90112 bytes | Modified Date = 1/25/2006 9:36:16 PM | Attr =    ]

< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 

{0BF43445-2F28-4351-9252-17FE6E806AA0} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\SiteAdvisor\6261\SiteAdv.dll [McAfee SiteAdvisor] ->  [Ver =  | Size = 927008 bytes | Modified Date = 5/16/2008 12:49:40 PM | Attr =    ]

< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ -> 

WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\Google Toolbar\GoogleToolbar.dll [&Google Toolbar] ->  [Ver =  | Size = 193136 bytes | Modified Date = 7/19/2008 1:59:16 PM | Attr =    ]

< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Sun Java Console] -> File not found

< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> 

CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] ->  [Sun Java Console] -> File not found

CmdMapping\\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} [HKEY_LOCAL_MACHINE] ->  [Reg Error: Key does not exist or could not be opened.] -> File not found

CmdMapping\\{9034A523-D068-4BE8-A284-9DF278BE776E} [HKEY_LOCAL_MACHINE] ->  [Reg Error: Key does not exist or could not be opened.] -> File not found

< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 

PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 

PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 

< User Agent Post Platform [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform -> 

GoogleT5 ->  -> 

SV1 ->  -> 

< DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 

{7B70340E-2436-4AD3-97F3-01D01960CD5A} ->    (Intel(R) PRO/100 VE Network Connection) -> 

< Winsock2 Catalogs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\ -> 

NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] -> %ProgramFiles%\Bonjour\mdnsNSP.dll -> Apple Inc. [Ver = 1,0,4,12 | Size = 147456 bytes | Modified Date = 7/24/2007 4:17:08 PM | Attr =    ]

< Protocol Handlers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ -> 

ipp: [HKEY_LOCAL_MACHINE] -> No CLSID value

msdaipp: [HKEY_LOCAL_MACHINE] -> No CLSID value

siteadvisor:{3A5DC592-7723-4EAA-9EE6-AF4222BCF879} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\SiteAdvisor\6261\SiteAdv.dll[Reg Error: Value  does not exist or could not be read.] ->  [Ver =  | Size = 927008 bytes | Modified Date = 5/16/2008 12:49:40 PM | Attr =    ]

< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 

{6F750203-1362-4815-A476-88533DE61D0C}[HKEY_LOCAL_MACHINE] -> http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab[Kodak Gallery Easy Upload Manager Class] -> 

{8AD9C840-044E-11D1-B3E9-00805F499D93}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab[Java Plug-in 1.5.0_03] -> 

{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab[Java Plug-in 1.4.2_03] -> 

{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab[Java Plug-in 1.5.0_03] -> 

{D27CDB6E-AE6D-11CF-96B8-444553540000}[HKEY_LOCAL_MACHINE] -> http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab[Shockwave Flash Object] -> 

< Module Usage Keys [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/axofupld.dll\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/axofupld.dll\\.Owner -> {6F750203-1362-4815-A476-88533DE61D0C} -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/axofupld.dll\\{6F750203-1362-4815-A476-88533DE61D0C} ->  -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/easyupld.dll\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/easyupld.dll\\.Owner -> {6F750203-1362-4815-A476-88533DE61D0C} -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/easyupld.dll\\{6F750203-1362-4815-A476-88533DE61D0C} ->  -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/liborca.dll\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/liborca.dll\\.Owner -> {6F750203-1362-4815-A476-88533DE61D0C} -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/liborca.dll\\{6F750203-1362-4815-A476-88533DE61D0C} ->  -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/liborca_comm.dll\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/liborca_comm.dll\\.Owner -> {6F750203-1362-4815-A476-88533DE61D0C} -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/liborca_comm.dll\\{6F750203-1362-4815-A476-88533DE61D0C} ->  -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ofutils.dll\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ofutils.dll\\.Owner -> {6F750203-1362-4815-A476-88533DE61D0C} -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ofutils.dll\\{6F750203-1362-4815-A476-88533DE61D0C} ->  -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ofxml.dll\ -> -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ofxml.dll\\.Owner -> {6F750203-1362-4815-A476-88533DE61D0C} -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ofxml.dll\\{6F750203-1362-4815-A476-88533DE61D0C} ->  -> 







[Files/Folders - Created Within 30 days]

All three -> %SystemDrive%\All three ->  [Folder | Created Date = 8/24/2008 9:33:40 PM | Attr =    ]

hiberfil.sys -> %SystemDrive%\hiberfil.sys ->  [Ver =  | Size = 1063407616 bytes | Created Date = 8/25/2008 7:32:21 AM | Attr =  HS]

404Fix.exe -> %SystemRoot%\System32\404Fix.exe -> S!Ri.URZ [Ver =  | Size = 82432 bytes | Created Date = 8/20/2008 9:03:27 PM | Attr =    ]

857060 -> %SystemRoot%\System32\857060 ->  [Folder | Created Date = 8/17/2008 12:24:16 PM | Attr =    ]

2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 

dumphive.exe -> %SystemRoot%\System32\dumphive.exe ->  [Ver =  | Size = 51200 bytes | Created Date = 8/20/2008 9:03:25 PM | Attr =    ]

IEDFix.C.exe -> %SystemRoot%\System32\IEDFix.C.exe -> S!Ri.URZ [Ver =  | Size = 82432 bytes | Created Date = 8/20/2008 9:03:27 PM | Attr =    ]

IEDFix.exe -> %SystemRoot%\System32\IEDFix.exe -> S!Ri.URZ [Ver =  | Size = 82944 bytes | Created Date = 8/20/2008 9:03:26 PM | Attr =    ]

Process.exe -> %SystemRoot%\System32\Process.exe ->  [Ver =  | Size = 53248 bytes | Created Date = 8/24/2008 9:29:41 PM | Attr =    ]

SrchSTS.exe -> %SystemRoot%\System32\SrchSTS.exe -> S!Ri [Ver =  | Size = 288417 bytes | Created Date = 8/20/2008 9:03:25 PM | Attr =    ]

swreg.exe -> %SystemRoot%\System32\swreg.exe -> SteelWerX [Ver = 2.0.1.0 | Size = 135168 bytes | Created Date = 8/20/2008 9:03:24 PM | Attr =    ]

swsc.exe -> %SystemRoot%\System32\swsc.exe ->  [Ver =  | Size = 40960 bytes | Created Date = 8/20/2008 9:03:25 PM | Attr =    ]

swxcacls.exe -> %SystemRoot%\System32\swxcacls.exe -> SteelWerX [Ver = 1.0.1.1 | Size = 79360 bytes | Created Date = 8/20/2008 9:03:25 PM | Attr =    ]

tmp.reg -> %SystemRoot%\System32\tmp.reg ->  [Ver =  | Size = 4616 bytes | Created Date = 8/20/2008 9:04:22 PM | Attr =    ]

VACFix.exe -> %SystemRoot%\System32\VACFix.exe -> S!Ri.URZ [Ver =  | Size = 86528 bytes | Created Date = 8/20/2008 9:03:26 PM | Attr =    ]

VCCLSID.exe -> %SystemRoot%\System32\VCCLSID.exe -> S!Ri [Ver =  | Size = 289144 bytes | Created Date = 8/20/2008 9:03:25 PM | Attr =    ]

WS2Fix.exe -> %SystemRoot%\System32\WS2Fix.exe ->  [Ver =  | Size = 25600 bytes | Created Date = 8/20/2008 9:03:26 PM | Attr =    ]

LastGood -> %SystemRoot%\LastGood ->  [Folder | Created Date = 8/26/2008 8:01:24 PM | Attr =    ]



[Files/Folders - Modified Within 30 days]

All three -> %SystemDrive%\All three ->  [Folder | Modified Date = 8/24/2008 9:35:10 PM | Attr =    ]

Config.Msi -> %SystemDrive%\Config.Msi ->  [Folder | Modified Date = 8/24/2008 9:22:27 PM | Attr =  HS]

hiberfil.sys -> %SystemDrive%\hiberfil.sys ->  [Ver =  | Size = 1063407616 bytes | Modified Date = 8/26/2008 7:59:36 PM | Attr =  HS]

Program Files -> %ProgramFiles% ->  [Folder | Modified Date = 8/24/2008 9:30:06 PM | Attr =    ]

WINDOWS -> %SystemRoot% ->  [Folder | Modified Date = 8/26/2008 8:01:24 PM | Attr =    ]

404Fix.exe -> %SystemRoot%\System32\404Fix.exe -> S!Ri.URZ [Ver =  | Size = 82432 bytes | Modified Date = 8/18/2008 12:19:03 PM | Attr =    ]

857060 -> %SystemRoot%\System32\857060 ->  [Folder | Modified Date = 8/25/2008 7:30:45 AM | Attr =    ]

2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 

ADB816E197.sys -> %SystemRoot%\System32\ADB816E197.sys ->  [Ver =  | Size = 104 bytes | Modified Date = 8/15/2008 6:36:10 PM | Attr = RHS]

CatRoot2 -> %SystemRoot%\System32\CatRoot2 ->  [Folder | Modified Date = 8/26/2008 8:01:22 PM | Attr =    ]

Config.MPF -> %SystemRoot%\System32\Config.MPF ->  [Ver =  | Size = 9346 bytes | Modified Date = 8/26/2008 8:00:54 PM | Attr =    ]

dllcache -> %SystemRoot%\System32\dllcache ->  [Folder | Modified Date = 8/26/2008 8:01:40 PM | Attr = RHS]

IEDFix.C.exe -> %SystemRoot%\System32\IEDFix.C.exe -> S!Ri.URZ [Ver =  | Size = 82432 bytes | Modified Date = 8/14/2008 9:52:23 PM | Attr =    ]

KGyGaAvL.sys -> %SystemRoot%\System32\KGyGaAvL.sys ->  [Ver =  | Size = 5852 bytes | Modified Date = 8/15/2008 6:36:11 PM | Attr =  HS]

tmp.reg -> %SystemRoot%\System32\tmp.reg ->  [Ver =  | Size = 4616 bytes | Modified Date = 8/24/2008 9:30:05 PM | Attr =    ]

wpa.dbl -> %SystemRoot%\System32\wpa.dbl ->  [Ver =  | Size = 2206 bytes | Modified Date = 8/26/2008 7:59:40 PM | Attr =    ]

$hf_mig$ -> %SystemRoot%\$hf_mig$ ->  [Folder | Modified Date = 8/16/2008 3:01:17 AM | Attr =  H ]

bootstat.dat -> %SystemRoot%\bootstat.dat ->  [Ver =  | Size = 2048 bytes | Modified Date = 8/26/2008 7:59:37 PM | Attr =   S]

Help -> %SystemRoot%\Help ->  [Folder | Modified Date = 8/26/2008 8:01:31 PM | Attr =    ]

imsins.BAK -> %SystemRoot%\imsins.BAK ->  [Ver =  | Size = 1374 bytes | Modified Date = 8/16/2008 3:01:21 AM | Attr =    ]

inf -> %SystemRoot%\inf ->  [Folder | Modified Date = 8/26/2008 8:01:30 PM | Attr =  H ]

Installer -> %SystemRoot%\Installer ->  [Folder | Modified Date = 8/24/2008 9:22:25 PM | Attr =  HS]

LastGood -> %SystemRoot%\LastGood ->  [Folder | Modified Date = 8/26/2008 8:01:31 PM | Attr =    ]

Prefetch -> %SystemRoot%\Prefetch ->  [Folder | Modified Date = 8/25/2008 6:33:10 PM | Attr =    ]

QTFont.qfn -> %SystemRoot%\QTFont.qfn ->  [Ver =  | Size = 54156 bytes | Modified Date = 8/26/2008 7:59:53 PM | Attr =  H ]

Registration -> %SystemRoot%\Registration ->  [Folder | Modified Date = 8/26/2008 8:00:50 PM | Attr =    ]

system32 -> %SystemRoot%\system32 ->  [Folder | Modified Date = 8/26/2008 8:01:32 PM | Attr =    ]

Temp -> %SystemRoot%\Temp ->  [Folder | Modified Date = 8/26/2008 8:02:00 PM | Attr =    ]

AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job ->  [Ver =  | Size = 284 bytes | Modified Date = 8/21/2008 5:33:03 PM | Attr =    ]

SA.DAT -> %SystemRoot%\tasks\SA.DAT ->  [Ver =  | Size = 6 bytes | Modified Date = 8/26/2008 7:59:43 PM | Attr =  H ]

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader ->  [Folder | Modified Date = 2/23/2006 3:43:46 AM | Attr =    ]

qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat ->  [Ver =  | Size = 4232 bytes | Modified Date = 8/26/2008 8:05:52 PM | Attr =    ]

qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat ->  [Ver =  | Size = 5528 bytes | Modified Date = 8/26/2008 8:02:21 PM | Attr =    ]

C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA ->  [Folder | Modified Date = 2/23/2006 3:48:50 AM | Attr =    ]

opa11.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa11.dat ->  [Ver =  | Size = 11094 bytes | Modified Date = 4/23/2006 9:52:05 AM | Attr =    ]

C:\WINDOWS\Temp\mcu12.tmp\ -> C:\WINDOWS\Temp\mcu12.tmp\ ->  [Folder | Modified Date = 10/30/2007 10:14:40 PM | Attr =    ]

McAppIns.exe -> C:\WINDOWS\Temp\mcu12.tmp\McAppIns.exe -> McAfee, Inc [Ver = 6, 0, 0, 22 | Size = 131072 bytes | Modified Date = 1/23/2006 5:55:06 PM | Attr =    ]

C:\WINDOWS\Temp\mcu3.tmp\ -> C:\WINDOWS\Temp\mcu3.tmp\ ->  [Folder | Modified Date = 9/8/2007 11:35:02 AM | Attr =    ]

McAppIns.exe -> C:\WINDOWS\Temp\mcu3.tmp\McAppIns.exe -> McAfee, Inc [Ver = 6, 0, 0, 22 | Size = 131072 bytes | Modified Date = 1/23/2006 5:55:06 PM | Attr =    ]

C:\WINDOWS\Temp\mcu50.tmp\ -> C:\WINDOWS\Temp\mcu50.tmp\ ->  [Folder | Modified Date = 9/26/2007 7:30:10 AM | Attr =    ]

McAppIns.exe -> C:\WINDOWS\Temp\mcu50.tmp\McAppIns.exe -> McAfee, Inc [Ver = 6, 0, 0, 22 | Size = 131072 bytes | Modified Date = 1/23/2006 5:55:06 PM | Attr =    ]

C:\WINDOWS\Temp\mcu74.tmp\ -> C:\WINDOWS\Temp\mcu74.tmp\ ->  [Folder | Modified Date = 9/12/2007 10:28:19 PM | Attr =    ]

McAppIns.exe -> C:\WINDOWS\Temp\mcu74.tmp\McAppIns.exe -> McAfee, Inc [Ver = 6, 0, 0, 22 | Size = 131072 bytes | Modified Date = 1/23/2006 5:55:06 PM | Attr =    ]

C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2J5QXQTI\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2J5QXQTI ->  [Folder | Modified Date = 11/7/2007 7:47:26 AM | Attr =   S]

DMSetup[1].exe -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2J5QXQTI\DMSetup[1].exe -> McAfee, Inc. [Ver = 2,0,132,0 | Size = 636192 bytes | Modified Date = 11/7/2007 7:43:39 AM | Attr =    ]

@Alternate Data Stream - 26 bytes -> %SystemRoot%\Temp\Temporary Internet Files\Content.IE5\2J5QXQTI\DMSetup[1].exe:Zone.Identifier

C:\WINDOWS\Temp\mcu12.tmp\ -> C:\WINDOWS\Temp\mcu12.tmp\ ->  [Folder | Modified Date = 10/30/2007 10:14:40 PM | Attr =    ]

mcinsres.dll -> C:\WINDOWS\Temp\mcu12.tmp\mcinsres.dll -> McAfee, Inc [Ver = 6, 0, 0, 22 | Size = 33280 bytes | Modified Date = 1/23/2006 5:54:54 PM | Attr =    ]

C:\WINDOWS\Temp\mcu3.tmp\ -> C:\WINDOWS\Temp\mcu3.tmp\ ->  [Folder | Modified Date = 9/8/2007 11:35:02 AM | Attr =    ]

mcinsres.dll -> C:\WINDOWS\Temp\mcu3.tmp\mcinsres.dll -> McAfee, Inc [Ver = 6, 0, 0, 22 | Size = 33280 bytes | Modified Date = 1/23/2006 5:54:54 PM | Attr =    ]

C:\WINDOWS\Temp\mcu50.tmp\ -> C:\WINDOWS\Temp\mcu50.tmp\ ->  [Folder | Modified Date = 9/26/2007 7:30:10 AM | Attr =    ]

mcinsres.dll -> C:\WINDOWS\Temp\mcu50.tmp\mcinsres.dll -> McAfee, Inc [Ver = 6, 0, 0, 22 | Size = 33280 bytes | Modified Date = 1/23/2006 5:54:54 PM | Attr =    ]

C:\WINDOWS\Temp\mcu74.tmp\ -> C:\WINDOWS\Temp\mcu74.tmp\ ->  [Folder | Modified Date = 9/12/2007 10:28:19 PM | Attr =    ]

mcinsres.dll -> C:\WINDOWS\Temp\mcu74.tmp\mcinsres.dll -> McAfee, Inc [Ver = 6, 0, 0, 22 | Size = 33280 bytes | Modified Date = 1/23/2006 5:54:54 PM | Attr =    ]

C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp ->  [Folder | Modified Date = 8/26/2008 8:06:02 PM | Attr =    ]

Perflib_Perfdata_11c.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_11c.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 6/20/2008 4:55:20 AM | Attr =    ]

Perflib_Perfdata_4e8.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_4e8.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 2/22/2008 5:56:36 AM | Attr =    ]

Perflib_Perfdata_520.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_520.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 7/18/2008 4:54:44 AM | Attr =    ]

Perflib_Perfdata_7dc.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_7dc.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 6/13/2008 4:56:13 AM | Attr =    ]

Perflib_Perfdata_7e0.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_7e0.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 3/9/2008 7:45:35 AM | Attr =    ]

Perflib_Perfdata_7f0.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_7f0.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 5/31/2008 3:04:34 PM | Attr =    ]

Perflib_Perfdata_7f4.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_7f4.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 4/9/2008 4:05:55 AM | Attr =    ]

Perflib_Perfdata_98c.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_98c.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 8/2/2008 2:30:13 PM | Attr =    ]

Perflib_Perfdata_a28.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_a28.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 10/10/2007 7:05:48 PM | Attr =    ]

Perflib_Perfdata_bc.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_bc.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 5/16/2008 4:57:40 AM | Attr =    ]

Perflib_Perfdata_f20.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_f20.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 10/30/2007 10:08:29 PM | Attr =    ]

31 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> 

C:\WINDOWS\Temp\Cookies\ -> C:\WINDOWS\Temp\Cookies ->  [Folder | Modified Date = 11/7/2007 7:43:21 AM | Attr =   S]

index.dat -> C:\WINDOWS\Temp\Cookies\index.dat ->  [Ver =  | Size = 32768 bytes | Modified Date = 11/7/2007 7:49:54 AM | Attr =    ]

C:\WINDOWS\Temp\History\History.IE5\ -> C:\WINDOWS\Temp\History\History.IE5\ ->  [Folder | Modified Date = 11/12/2007 8:58:29 AM | Attr =   S]

index.dat -> C:\WINDOWS\Temp\History\History.IE5\index.dat ->  [Ver =  | Size = 49152 bytes | Modified Date = 11/7/2007 7:49:54 AM | Attr =    ]

C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ ->  [Folder | Modified Date = 3/14/2006 9:34:15 AM | Attr =   S]

index.dat -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat ->  [Ver =  | Size = 65536 bytes | Modified Date = 11/7/2007 7:49:54 AM | Attr =    ]

C:\WINDOWS\Temp\History\History.IE5\ -> C:\WINDOWS\Temp\History\History.IE5\ ->  [Folder | Modified Date = 11/12/2007 8:58:29 AM | Attr =   S]

desktop.ini -> C:\WINDOWS\Temp\History\History.IE5\desktop.ini ->  [Ver =  | Size = 113 bytes | Modified Date = 3/14/2006 9:34:16 AM | Attr =  HS]

C:\WINDOWS\Temp\mcu10.tmp\vso\ -> C:\WINDOWS\Temp\mcu10.tmp\vso ->  [Folder | Modified Date = 11/6/2007 10:37:14 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu10.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 996 bytes | Modified Date = 11/6/2007 10:37:13 PM | Attr =    ]

C:\WINDOWS\Temp\mcu15.tmp\vso\ -> C:\WINDOWS\Temp\mcu15.tmp\vso ->  [Folder | Modified Date = 9/26/2007 5:06:15 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu15.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 997 bytes | Modified Date = 9/26/2007 5:06:15 PM | Attr =    ]

C:\WINDOWS\Temp\mcu16.tmp\vso\ -> C:\WINDOWS\Temp\mcu16.tmp\vso ->  [Folder | Modified Date = 9/19/2007 10:31:52 AM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu16.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 997 bytes | Modified Date = 9/19/2007 10:31:51 AM | Attr =    ]

C:\WINDOWS\Temp\mcu1C.tmp\vso\ -> C:\WINDOWS\Temp\mcu1C.tmp\vso ->  [Folder | Modified Date = 9/19/2007 3:12:13 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu1C.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 997 bytes | Modified Date = 9/19/2007 3:12:13 PM | Attr =    ]

C:\WINDOWS\Temp\mcu2.tmp\vso\ -> C:\WINDOWS\Temp\mcu2.tmp\vso ->  [Folder | Modified Date = 10/30/2007 10:13:05 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu2.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 993 bytes | Modified Date = 10/30/2007 10:12:57 PM | Attr =    ]

C:\WINDOWS\Temp\mcu23.tmp\vso\ -> C:\WINDOWS\Temp\mcu23.tmp\vso ->  [Folder | Modified Date = 9/20/2007 5:34:21 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu23.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 997 bytes | Modified Date = 9/20/2007 5:34:21 PM | Attr =    ]

C:\WINDOWS\Temp\mcu24.tmp\vso\ -> C:\WINDOWS\Temp\mcu24.tmp\vso ->  [Folder | Modified Date = 9/27/2007 3:06:23 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu24.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 997 bytes | Modified Date = 9/27/2007 3:06:22 PM | Attr =    ]

C:\WINDOWS\Temp\mcu2A.tmp\vso\ -> C:\WINDOWS\Temp\mcu2A.tmp\vso ->  [Folder | Modified Date = 11/1/2007 9:25:50 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu2A.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 993 bytes | Modified Date = 11/1/2007 9:25:50 PM | Attr =    ]

C:\WINDOWS\Temp\mcu3C.tmp\vso\ -> C:\WINDOWS\Temp\mcu3C.tmp\vso ->  [Folder | Modified Date = 9/25/2007 12:19:37 AM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu3C.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 997 bytes | Modified Date = 9/25/2007 12:19:37 AM | Attr =    ]

C:\WINDOWS\Temp\mcu3F.tmp\vso\ -> C:\WINDOWS\Temp\mcu3F.tmp\vso ->  [Folder | Modified Date = 9/13/2007 4:08:17 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu3F.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 999 bytes | Modified Date = 9/13/2007 4:08:17 PM | Attr =    ]

C:\WINDOWS\Temp\mcu53.tmp\vso\ -> C:\WINDOWS\Temp\mcu53.tmp\vso ->  [Folder | Modified Date = 9/10/2007 2:25:43 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu53.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 999 bytes | Modified Date = 9/10/2007 2:25:42 PM | Attr =    ]

C:\WINDOWS\Temp\mcu55.tmp\vso\ -> C:\WINDOWS\Temp\mcu55.tmp\vso ->  [Folder | Modified Date = 9/25/2007 6:31:27 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu55.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 997 bytes | Modified Date = 9/25/2007 6:31:26 PM | Attr =    ]

C:\WINDOWS\Temp\mcu57.tmp\vso\ -> C:\WINDOWS\Temp\mcu57.tmp\vso ->  [Folder | Modified Date = 9/14/2007 6:07:52 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu57.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 998 bytes | Modified Date = 9/14/2007 6:07:51 PM | Attr =    ]

C:\WINDOWS\Temp\mcu5A.tmp\vso\ -> C:\WINDOWS\Temp\mcu5A.tmp\vso ->  [Folder | Modified Date = 11/2/2007 4:10:54 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu5A.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 993 bytes | Modified Date = 11/2/2007 4:10:54 PM | Attr =    ]

C:\WINDOWS\Temp\mcu6.tmp\vso\ -> C:\WINDOWS\Temp\mcu6.tmp\vso ->  [Folder | Modified Date = 9/8/2007 11:28:13 AM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu6.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 999 bytes | Modified Date = 9/8/2007 11:28:12 AM | Attr =    ]

C:\WINDOWS\Temp\mcu72.tmp\vso\ -> C:\WINDOWS\Temp\mcu72.tmp\vso ->  [Folder | Modified Date = 9/21/2007 4:17:27 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu72.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 997 bytes | Modified Date = 9/21/2007 4:17:25 PM | Attr =    ]

C:\WINDOWS\Temp\mcu78.tmp\vso\ -> C:\WINDOWS\Temp\mcu78.tmp\vso ->  [Folder | Modified Date = 9/12/2007 10:26:49 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcu78.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 999 bytes | Modified Date = 9/12/2007 10:26:48 PM | Attr =    ]

C:\WINDOWS\Temp\mcuB6.tmp\vso\ -> C:\WINDOWS\Temp\mcuB6.tmp\vso ->  [Folder | Modified Date = 11/1/2007 12:21:55 PM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcuB6.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 993 bytes | Modified Date = 11/1/2007 12:21:54 PM | Attr =    ]

C:\WINDOWS\Temp\mcuDB.tmp\vso\ -> C:\WINDOWS\Temp\mcuDB.tmp\vso ->  [Folder | Modified Date = 11/6/2007 12:20:15 AM | Attr =    ]

mcdelta.ini -> C:\WINDOWS\Temp\mcuDB.tmp\vso\mcdelta.ini ->  [Ver =  | Size = 995 bytes | Modified Date = 11/6/2007 12:20:15 AM | Attr =    ]

C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ ->  [Folder | Modified Date = 3/14/2006 9:34:15 AM | Attr =   S]

desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 3/14/2006 9:34:15 AM | Attr =  HS]

C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\0MA2MZ0G\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\0MA2MZ0G ->  [Folder | Modified Date = 11/7/2007 7:43:45 AM | Attr =   S]

desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\0MA2MZ0G\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 3/14/2006 9:34:15 AM | Attr =  HS]

C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2J5QXQTI\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2J5QXQTI ->  [Folder | Modified Date = 11/7/2007 7:47:26 AM | Attr =   S]

desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2J5QXQTI\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 3/14/2006 9:34:15 AM | Attr =  HS]

C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\PVERBERB\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\PVERBERB ->  [Folder | Modified Date = 11/7/2007 7:43:46 AM | Attr =   S]

desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\PVERBERB\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 3/14/2006 9:34:15 AM | Attr =  HS]

C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\YH7J5DMZ\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\YH7J5DMZ ->  [Folder | Modified Date = 11/7/2007 7:43:45 AM | Attr =   S]

desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\YH7J5DMZ\desktop.ini ->  [Ver =  | Size = 67 bytes | Modified Date = 3/14/2006 9:34:15 AM | Attr =  HS]

mcltvers[1].ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\YH7J5DMZ\mcltvers[1].ini ->  [Ver =  | Size = 2657 bytes | Modified Date = 4/4/2006 5:28:55 PM | Attr =    ]



< End of report >

[Registry - Non-Microsoft Only]

< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

YN -> vtututs -> 

[Files/Folders - Created Within 30 days]

NY -> 2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp

• Double-click on JavaRa.exe to start the program.
• From the drop-down menu, choose English and click on Select.
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
• A logfile will pop up. Please save it to a convenient location.

1. Read through the requirements and privacy statement and click on Accept button.
2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
3. When the downloads have finished, click on Settings.
4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
   Spyware, Adware, Dialers, and other potentially dangerous programs
   Archives
   
5. Click on My Computer under Scan.
6. Once the scan is complete, it will display the results. Click on View Scan Report.
7. You will see a list of infected items there. Click on Save Report As....
8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
9. Please post this log in your next reply along with a fresh HijackThis log.

• Double-click OTCleanIt.exe.
• Click the CleanUp! button.
• Select Yes when the "Begin cleanup Process?" prompt appears.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.

• Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
  
  You can find instructions on how to enable and re-enable system restore here:
  
  Windows XP System Restore Guide

• Make your Internet Explorer more secure - This can be done by following these simple instructions:
• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
  
• Change the Download unsigned ActiveX controls to Disable
  
• Change the Initialize and script ActiveX controls not marked as safe to Disable
  
• Change the Installation of desktop items to Prompt
  
• Change the Launching programs and files in an IFRAME to Prompt
  
• Change the Navigate sub-frames across different domains to Prompt
  
• When all these settings have been made, click on the OK button.
  
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
• Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
  totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:
  
  Malwarebytes' Anti-Malware Setup Guide
  
  Malwarebytes' Anti-Malware Scanning Guide
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software