Both of my browsers, Firefox and IE, are EXTREMELY slow when I am on the computer. Email, however, is either OK or only slightly slow, I can't distinguish for certain. However, when I switch users (I and my wife have access to the machine, both with full admin rights), the browsers seem only a little slow or normal - again, I'm not sure.
Also, I get an icon on my desktop named: fpfkbfxlzm.tmp This does not show up when I switch user to my wife. If I delete the icon, it comes back when I load Firefox.
I use the most up-to-date version of Firefox, but an older version of IE (I very rarely use IE).
I have an older machine running XP SP3 on a Pentium 4 processor.
I have run both my AVIRA anti-virus (the premium version) and Malwarbytes anti-malware (the free version) but neither has eliminated the problem.
Immediately below is my OTL Log. Thanks
---------------------------------------
OTL logfile created on: 10/1/2011 11:01:29 AM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\Luli\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.50 Gb Total Physical Memory | 0.86 Gb Available Physical Memory | 57.65% Memory free
2.11 Gb Paging File | 1.50 Gb Available in Paging File | 71.42% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOW2 | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 10.44 Gb Free Space | 14.00% Space Free | Partition Type: NTFS
Drive F: | 37.26 Gb Total Space | 33.17 Gb Free Space | 89.03% Space Free | Partition Type: FAT32
Computer Name: JAMES-HOME | User Name: Luli | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/10/01 10:58:19 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Luli\My Documents\Downloads\OTL.scr
PRC - [2011/09/07 01:15:53 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/07/02 02:18:55 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2011/07/02 02:18:55 | 000,340,136 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
PRC - [2011/07/02 02:18:55 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/04/27 17:31:44 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010/11/23 19:40:14 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2010/11/23 19:40:07 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/11/08 12:43:16 | 000,484,352 | ---- | M] () -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
PRC - [2010/11/08 12:40:52 | 003,986,944 | ---- | M] (Western Digital Technologies, Inc.) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
PRC - [2008/09/25 17:53:32 | 000,181,680 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton SystemWorks\Norton Utilities\Speed Disk\NOPDB.exe
PRC - [2008/09/25 17:53:16 | 000,095,600 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
PRC - [2008/09/25 17:52:04 | 000,085,360 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton SystemWorks\NswUiTray.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOW2\explorer.exe
PRC - [2007/01/31 15:55:42 | 000,096,370 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2005/02/16 12:15:20 | 000,581,632 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
PRC - [2003/05/08 08:00:58 | 000,049,152 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe
PRC - [2002/10/15 14:00:20 | 001,818,624 | ---- | M] (C-Media Electronic Inc. (www.cmedia.com.tw)) -- C:\WINDOW2\mixer.exe
========== Modules (No Company Name) ==========
MOD - [2011/09/28 10:40:36 | 006,277,280 | ---- | M] () -- C:\WINDOW2\system32\Macromed\Flash\NPSWF32.dll
MOD - [2011/09/07 01:15:52 | 001,846,232 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/07/02 02:00:04 | 000,212,992 | ---- | M] () -- C:\WINDOW2\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\0f3d321ebd65af974ff0ad424223276d\System.ServiceProcess.ni.dll
MOD - [2011/07/02 01:57:03 | 000,771,584 | ---- | M] () -- C:\WINDOW2\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\bdaf7904d223589a0f464de58d27e691\System.Runtime.Remoting.ni.dll
MOD - [2011/07/02 01:49:36 | 007,950,848 | ---- | M] () -- C:\WINDOW2\assembly\NativeImages_v2.0.50727_32\System\f6a9a002526806f3a5b745cf5c407cae\System.ni.dll
MOD - [2011/07/02 01:49:17 | 011,490,816 | ---- | M] () -- C:\WINDOW2\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2010/11/23 19:40:43 | 000,355,688 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2010/11/08 12:43:16 | 000,484,352 | ---- | M] () -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
MOD - [2009/04/23 22:55:14 | 000,176,235 | ---- | M] () -- C:\WINDOW2\system32\Primomonnt.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/07/02 02:18:55 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2011/07/02 02:18:55 | 000,340,136 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2011/07/02 02:18:55 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/27 17:31:44 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/11/08 12:43:34 | 001,060,352 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe -- (WDFME)
SRV - [2010/11/08 12:43:16 | 000,484,352 | ---- | M] () [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe -- (WDSC)
SRV - [2010/11/08 12:40:14 | 000,237,568 | ---- | M] (WDC) [Auto | Stopped] -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe -- (WDDMService)
SRV - [2008/09/25 17:53:32 | 000,181,680 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton SystemWorks\Norton Utilities\Speed Disk\NOPDB.exe -- (Speed Disk service)
SRV - [2008/09/25 17:53:16 | 000,095,600 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE -- (NProtectService)
SRV - [2008/08/01 11:31:11 | 000,238,968 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2008/08/01 11:31:01 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
SRV - [2008/01/29 19:09:02 | 000,394,704 | ---- | M] (Symantec, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe -- (Symantec RemoteAssist)
SRV - [2007/01/31 15:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
========== Driver Services (SafeList) ==========
DRV - [2011/07/02 02:18:59 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOW2\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/02 02:18:59 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOW2\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/11/23 19:41:00 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOW2\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/11/23 19:40:06 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/12/13 23:57:18 | 000,003,584 | ---- | M] (Systems Internals) [Kernel | System | Running] -- C:\WINDOW2\iprot\d8a4fef9-85c1-448f-a6f9-2570fb195020\PhysMem.sys -- (d8a4fef9-85c1-448f-a6f9-2570fb195020)
DRV - [2009/08/18 22:36:30 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOW2\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2009/02/13 12:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOW2\system32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2008/09/25 17:53:36 | 000,095,760 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOW2\system32\drivers\SdDriver.SYS -- (SDdriver)
DRV - [2008/09/25 17:53:14 | 000,087,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOW2\system32\drivers\NPDRIVER.SYS -- (NPDriver)
DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOW2\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004/08/03 18:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOW2\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2002/11/18 11:51:40 | 000,377,358 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\WINDOW2\system32\drivers\cmaudio.sys -- (cmpci) C-Media PCI Audio Driver (WDM)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D3 0F B1 07 4F 69 43 4B 86 6D 7F EF 0E 39 65 25 [binary data]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D3 0F B1 07 4F 69 43 4B 86 6D 7F EF 0E 39 65 25 [binary data]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D3 0F B1 07 4F 69 43 4B 86 6D 7F EF 0E 39 65 25 [binary data]
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D3 0F B1 07 4F 69 43 4B 86 6D 7F EF 0E 39 65 25 [binary data]
IE - HKU\S-1-5-21-299502267-115176313-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOW2\system32\blank.htm
IE - HKU\S-1-5-21-299502267-115176313-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
IE - HKU\S-1-5-21-299502267-115176313-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
IE - HKU\S-1-5-21-299502267-115176313-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D3 0F B1 07 4F 69 43 4B 86 6D 7F EF 0E 39 65 25 [binary data]
IE - HKU\S-1-5-21-299502267-115176313-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-299502267-115176313-839522115-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOW2\system32\blank.htm
IE - HKU\S-1-5-21-299502267-115176313-839522115-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
IE - HKU\S-1-5-21-299502267-115176313-839522115-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
IE - HKU\S-1-5-21-299502267-115176313-839522115-1005\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D3 0F B1 07 4F 69 43 4B 86 6D 7F EF 0E 39 65 25 [binary data]
IE - HKU\S-1-5-21-299502267-115176313-839522115-1005\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =
IE - HKU\S-1-5-21-299502267-115176313-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://www.msn.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOW2\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOW2\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Baba\Application Data\Move Networks\plugins\npqmp071502000008.dll (Move Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/07 01:15:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/14 23:34:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/08/17 23:34:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape 6 6.2.3\Extensions\\Components: C:\Netscape 6\Components [2009/07/13 23:38:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape 6 6.2.3\Extensions\\Plugins: C:\Netscape 6\Plugins [2011/09/14 23:34:24 | 000,000,000 | ---D | M]
[2010/09/03 19:16:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Luli\Application Data\Mozilla\Extensions
[2010/09/03 19:16:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Luli\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/09/29 11:48:06 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Luli\Application Data\Mozilla\Firefox\Profiles\jb86guyn.default\extensions
[2011/10/01 11:21:40 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Documents and Settings\Luli\Application Data\Mozilla\Firefox\Profiles\jb86guyn.default\extensions\{09ee7db3-134a-43b1-9977-7293a87f569c}
[2010/01/13 23:47:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Luli\Application Data\Mozilla\Firefox\Profiles\jb86guyn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/09/28 12:29:25 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Documents and Settings\Luli\Application Data\Mozilla\Firefox\Profiles\jb86guyn.default\extensions\{9d5b705c-2c3a-47dc-b3a3-fba8cab6431e}
[2011/03/23 21:03:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/06/24 12:47:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/06/24 12:46:17 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/09/07 01:15:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2004/11/12 19:36:22 | 000,005,120 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\mozilla firefox\plugins\NPAdbESD.dll
[2008/06/17 22:43:04 | 000,086,016 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2010/06/24 12:46:13 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2005/05/28 07:15:00 | 000,110,592 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npmozax.dll
[2007/09/05 09:56:00 | 000,352,256 | ---- | M] ( ) -- C:\Program Files\mozilla firefox\plugins\npsabffx.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
O1 HOSTS File: ([2006/02/28 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOW2\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Reg Error: Value error.) - {07B10FD3-694F-4B43-866D-7FEF0E396525} - C:\Documents and Settings\Baba\Local Settings\Application Data\ExplorerCodec.dll (Microsoft Corporation)
O2 - BHO: (Reg Error: Value error.) - {0E33B7F1-B674-4F8D-8E83-6E56B158A840} - C:\Documents and Settings\Baba\Local Settings\Application Data\ExplorerCodec.dll (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [C-Media Mixer] C:\WINDOW2\mixer.exe (C-Media Electronic Inc. (www.cmedia.com.tw))
O4 - HKLM..\Run: [NSWosCheck] C:\Program Files\Norton SystemWorks\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [NswUiTray] C:\Program Files\Norton SystemWorks\NswUiTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOW2\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOW2\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOW2\System32\nwiz.exe ()
O4 - HKLM..\Run: [OpwareSE2] C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\.DEFAULT..\Run: [Western Digital Update] C:\Documents and Settings\Baba\Local Settings\Application Data\Western Digital\WesternUpdate\Westernupdt32.exe (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [Western Digital Update] C:\Documents and Settings\Baba\Local Settings\Application Data\Western Digital\WesternUpdate\Westernupdt32.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [Western Digital Update] C:\Documents and Settings\Baba\Local Settings\Application Data\Western Digital\WesternUpdate\Westernupdt32.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Western Digital Update] C:\Documents and Settings\Baba\Local Settings\Application Data\Western Digital\WesternUpdate\Westernupdt32.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-299502267-115176313-839522115-1004..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe File not found
O4 - HKU\S-1-5-21-299502267-115176313-839522115-1004..\Run: [MicrosoftBackupPolicy] C:\Documents and Settings\All Users.WINDOW2\Application Data\MicrosoftBackupPolicy.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-299502267-115176313-839522115-1004..\Run: [Western Digital Update] C:\Documents and Settings\Baba\Local Settings\Application Data\Western Digital\WesternUpdate\Westernupdt32.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ US DOT VPN Client.lnk = File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOW2\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOW2\Start Menu\Programs\Startup\WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (Western Digital Technologies, Inc.)
O4 - Startup: C:\Documents and Settings\Danae Saklas\Start Menu\Programs\Startup\LimeWire On Startup.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-299502267-115176313-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-299502267-115176313-839522115-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk ()
O9 - Extra 'Tools' menuitem : Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O15 - HKU\S-1-5-21-299502267-115176313-839522115-1004\..Trusted Domains: aol.com ([free] http in Trusted sites)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.micr...veX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.m...ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://sra.dot.gov/...SetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.242.0.12
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{17B7A976-DB18-48C7-AD20-F583F7824731}: DhcpNameServer = 192.168.1.1 71.242.0.12
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOW2\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOW2\system32\userinit.exe) -C:\WINDOW2\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOW2\moo-sou1.bmp
O24 - Desktop BackupWallPaper: C:\WINDOW2\moo-sou1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/30 17:16:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007/08/02 07:48:02 | 000,001,688 | ---- | M] () - C:\AUTOEXEC.NT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-299502267-115176313-839522115-1004..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-299502267-115176313-839522115-1004\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/09/28 11:29:31 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\All Users.WINDOW2\Application Data\MicrosoftBackupPolicy.dll
[2011/09/14 22:21:41 | 000,000,000 | ---D | C] -- C:\Car Stuff
[2011/09/08 23:39:55 | 000,000,000 | ---D | C] -- C:\WINDOW2\Out of the Park Baseball
[4 C:\WINDOW2\*.tmp files -> C:\WINDOW2\*.tmp -> ]
[1 C:\Documents and Settings\All Users.WINDOW2\Application Data\*.tmp files -> C:\Documents and Settings\All Users.WINDOW2\Application Data\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/10/01 10:27:05 | 000,186,097 | ---- | M] () -- C:\WINDOW2\System32\nvapps.xml
[2011/10/01 10:25:52 | 000,013,646 | ---- | M] () -- C:\WINDOW2\System32\wpa.dbl
[2011/10/01 09:00:55 | 000,000,290 | ---- | M] () -- C:\WINDOW2\tasks\Norton SystemWorks One Button Checkup.job
[2011/10/01 04:00:02 | 000,000,388 | ---- | M] () -- C:\WINDOW2\tasks\Norton AntiVirus - Baba - Full System Scan.job
[2011/09/30 14:56:20 | 000,002,048 | --S- | M] () -- C:\WINDOW2\bootstat.dat
[2011/09/30 14:56:17 | 1610,145,792 | -HS- | M] () -- C:\hiberfil.sys
[2011/09/26 13:59:05 | 000,000,213 | ---- | M] () -- C:\WINDOW2\Prestopm.INI
[2011/09/26 13:56:33 | 000,000,051 | ---- | M] () -- C:\NsScanforTest.ini
[2011/09/25 23:47:41 | 001,045,386 | ---- | M] () -- C:\WINDOW2\dickinson3.bmp
[2011/09/25 23:45:50 | 001,045,558 | ---- | M] () -- C:\WINDOW2\dickinson2.bmp
[2011/09/25 23:40:59 | 001,045,546 | ---- | M] () -- C:\WINDOW2\dickinson1.bmp
[2011/09/25 23:36:24 | 001,045,558 | ---- | M] () -- C:\WINDOW2\deschanel2.bmp
[2011/09/25 23:35:40 | 001,045,558 | ---- | M] () -- C:\WINDOW2\deschanel1.bmp
[4 C:\WINDOW2\*.tmp files -> C:\WINDOW2\*.tmp -> ]
[1 C:\Documents and Settings\All Users.WINDOW2\Application Data\*.tmp files -> C:\Documents and Settings\All Users.WINDOW2\Application Data\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/09/25 23:47:39 | 001,045,386 | ---- | C] () -- C:\WINDOW2\dickinson3.bmp
[2011/09/25 23:45:48 | 001,045,558 | ---- | C] () -- C:\WINDOW2\dickinson2.bmp
[2011/09/14 23:34:24 | 000,002,347 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOW2\Start Menu\Programs\Adobe Reader X.lnk
[2011/08/18 07:25:23 | 000,008,844 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOW2\Application Data\erxh46ohp5s40vd23yxlj11wrf
[2011/08/17 19:26:02 | 000,001,296 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOW2\Application Data\2wllyxxvw23613v58lce
[2011/07/31 01:15:52 | 000,001,180 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOW2\Application Data\otj0o7dc0gsxuv5406qh58
[2011/07/24 15:28:19 | 000,001,384 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOW2\Application Data\3ynp0gaphb6
[2011/07/11 14:14:55 | 000,007,232 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOW2\Application Data\078ygf0i0303
[2011/07/04 16:49:45 | 000,001,324 | ---- | C] () -- C:\WINDOW2\System32\d3d9caps.dat
[2011/07/04 01:28:41 | 000,013,216 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOW2\Application Data\8kum22k6t217qt6t0fs10d51118ydm
[2009/12/13 19:01:29 | 000,000,066 | ---- | C] () -- C:\WINDOW2\GDINST.INI
[2009/10/01 23:33:34 | 000,000,213 | ---- | C] () -- C:\WINDOW2\Prestopm.INI
[2009/10/01 23:32:22 | 000,036,291 | ---- | C] () -- C:\WINDOW2\CSTBox.INI
[2009/08/19 23:45:06 | 000,176,235 | ---- | C] () -- C:\WINDOW2\System32\Primomonnt.dll
[2009/08/13 18:23:41 | 000,075,776 | ---- | C] () -- C:\WINDOW2\cadkasdeinst01e.exe
[2009/07/14 03:17:34 | 000,000,235 | ---- | C] () -- C:\WINDOW2\EXCEL4.INI
[2009/07/11 15:13:24 | 000,022,480 | ---- | C] () -- C:\WINDOW2\System32\PFMAPI16.DLL
[2009/07/11 15:13:24 | 000,020,992 | ---- | C] () -- C:\WINDOW2\System32\PFMAPI32.DLL
[2009/07/10 20:38:52 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Luli\Application Data\PFP120JPR.{PB
[2009/07/10 20:38:52 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Luli\Application Data\PFP120JCM.{PB
[2009/07/09 21:54:40 | 000,000,532 | ---- | C] () -- C:\WINDOW2\MAXLINK.INI
[2009/07/09 21:52:13 | 000,000,105 | ---- | C] () -- C:\WINDOW2\UMXADDIN.INI
[2009/07/09 21:52:12 | 000,040,960 | ---- | C] () -- C:\WINDOW2\System32\IPPCPUID.DLL
[2009/07/09 21:51:55 | 000,011,776 | ---- | C] () -- C:\WINDOW2\System32\pmsbfn32.dll
[2009/07/09 21:50:49 | 000,000,074 | ---- | C] () -- C:\WINDOW2\PMINI.ini
[2009/07/09 11:50:10 | 000,046,784 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOW2\Application Data\LuUninstall.LiveUpdate
[2009/07/08 01:40:18 | 000,089,312 | ---- | C] () -- C:\WINDOW2\N6Uninst.exe
[2009/07/08 01:14:23 | 000,024,501 | ---- | C] () -- C:\WINDOW2\mozver.dat
[2009/07/07 01:54:29 | 000,006,144 | ---- | C] () -- C:\Documents and Settings\Luli\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/06 21:13:13 | 000,000,376 | ---- | C] () -- C:\WINDOW2\ODBC.INI
[2009/07/06 19:05:29 | 000,000,335 | ---- | C] () -- C:\WINDOW2\nsreg.dat
[2009/07/06 19:03:10 | 000,000,025 | ---- | C] () -- C:\WINDOW2\mixerdef.ini
[2009/07/06 18:56:15 | 000,002,048 | --S- | C] () -- C:\WINDOW2\bootstat.dat
[2009/07/06 18:43:58 | 000,021,640 | ---- | C] () -- C:\WINDOW2\System32\emptyregdb.dat
[2009/07/06 11:30:20 | 000,004,161 | ---- | C] () -- C:\WINDOW2\ODBCINST.INI
[2009/07/06 11:27:26 | 000,929,280 | ---- | C] () -- C:\WINDOW2\System32\FNTCACHE.DAT
[2009/07/06 10:34:13 | 000,039,104 | ---- | C] () -- C:\WINDOW2\cmijack.dat
[2009/07/06 10:34:13 | 000,022,178 | ---- | C] () -- C:\WINDOW2\cmaudio.dat
[2009/04/27 00:13:36 | 000,000,314 | ---- | C] () -- C:\WINDOW2\primopdf.ini
[2008/05/16 17:01:00 | 001,703,936 | ---- | C] () -- C:\WINDOW2\System32\nvwdmcpl.dll
[2008/05/16 17:01:00 | 001,630,208 | ---- | C] () -- C:\WINDOW2\System32\nwiz.exe
[2008/05/16 17:01:00 | 001,486,848 | ---- | C] () -- C:\WINDOW2\System32\nview.dll
[2008/05/16 17:01:00 | 001,339,392 | ---- | C] () -- C:\WINDOW2\System32\nvdspsch.exe
[2008/05/16 17:01:00 | 001,019,904 | ---- | C] () -- C:\WINDOW2\System32\nvwimg.dll
[2008/05/16 17:01:00 | 000,466,944 | ---- | C] () -- C:\WINDOW2\System32\nvshell.dll
[2008/05/16 17:01:00 | 000,442,368 | ---- | C] () -- C:\WINDOW2\System32\nvappbar.exe
[2008/05/16 17:01:00 | 000,425,984 | ---- | C] () -- C:\WINDOW2\System32\keystone.exe
[2008/05/16 17:01:00 | 000,286,720 | ---- | C] () -- C:\WINDOW2\System32\nvnt4cpl.dll
[2006/11/01 08:54:30 | 000,180,224 | ---- | C] () -- C:\WINDOW2\System32\xvidvfw.dll
[2006/11/01 08:52:38 | 000,765,952 | ---- | C] () -- C:\WINDOW2\System32\xvidcore.dll
[2006/02/28 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOW2\System32\oembios.bin
[2006/02/28 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOW2\System32\mlang.dat
[2006/02/28 08:00:00 | 000,432,622 | ---- | C] () -- C:\WINDOW2\System32\perfh009.dat
[2006/02/28 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOW2\System32\perfi009.dat
[2006/02/28 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOW2\System32\dssec.dat
[2006/02/28 08:00:00 | 000,067,578 | ---- | C] () -- C:\WINDOW2\System32\perfc009.dat
[2006/02/28 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOW2\System32\mib.bin
[2006/02/28 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOW2\System32\perfd009.dat
[2006/02/28 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOW2\System32\secupd.dat
[2006/02/28 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOW2\System32\oembios.dat
[2006/02/28 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOW2\System32\dcache.bin
[2006/02/28 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOW2\System32\noise.dat
[2004/10/26 18:39:04 | 003,375,104 | ---- | C] () -- C:\WINDOW2\System32\qt-mt331.dll
========== LOP Check ==========
[2009/12/13 13:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avery
[2006/03/29 20:08:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Borland
[2007/08/12 13:47:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2008/12/10 20:47:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FreeRIP
[2007/06/18 15:01:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2007/06/03 06:51:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IMSI
[2008/04/23 17:38:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Juniper Networks
[2008/04/10 13:42:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nuance
[2006/02/04 19:29:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2005/10/29 12:45:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2005/10/29 12:45:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanWizard
[2006/12/19 08:05:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2005/11/22 12:16:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/09/17 21:03:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ypmtgrih
[2009/01/30 14:16:18 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2009/12/13 13:40:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\Avery
[2009/09/01 23:16:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\FileOpen
[2009/09/20 13:31:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\IMSI
[2009/12/14 00:58:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\IProt
[2009/07/08 02:45:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\Juniper Networks
[2009/07/09 00:39:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\PCSettings
[2009/08/18 23:17:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\ScanSoft
[2009/08/18 23:17:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\SSScanAppDataDir
[2009/08/18 23:18:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\SSScanWizard
[2009/12/27 03:05:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\WD_SmartWareCommon
[2011/03/02 01:14:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOW2\Application Data\Western Digital
[2005/11/24 22:16:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ariadne Saklas\Application Data\acccore
[2006/02/08 11:48:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ariadne Saklas\Application Data\Canon
[2006/09/12 11:44:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ariadne Saklas\Application Data\FileOpen
[2005/11/25 07:31:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ariadne Saklas\Application Data\Thunderbird
[2011/09/26 13:56:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\Canon
[2009/07/09 22:52:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\DeepBurner
[2009/09/01 23:16:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\FileOpen
[2009/09/20 13:54:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\IMSI
[2010/12/14 10:51:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\Juniper Networks
[2009/07/06 20:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\Netscape
[2009/07/09 21:50:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\NewSoft
[2011/03/24 22:00:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\NSBackup
[2010/06/24 13:42:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\OpenOffice.org
[2011/09/08 23:39:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\Out of the Park Developments
[2009/07/09 21:54:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\ScanSoft
[2009/12/31 20:16:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\TechWizard
[2010/09/03 18:15:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\Thunderbird
[2009/08/25 00:41:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\Uniblue
[2009/12/27 01:36:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Baba\Application Data\Western Digital
[2005/11/22 12:18:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Danae Saklas\Application Data\acccore
[2006/05/09 11:31:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Danae Saklas\Application Data\Canon
[2006/05/10 16:59:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Danae Saklas\Application Data\FileOpen
[2006/05/14 07:17:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Danae Saklas\Application Data\Thunderbird
[2005/11/24 16:20:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\acccore
[2008/01/01 12:39:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\BitTorrent
[2005/11/30 19:50:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\Canon
[2006/09/27 20:17:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\Configuration
[2008/01/01 12:34:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\DNA
[2006/02/13 12:08:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\FileOpen
[2008/03/05 02:41:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\IMSI
[2008/04/23 17:34:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\Juniper Networks
[2005/11/04 15:26:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\Netscape
[2008/09/29 09:55:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\Nuance
[2005/10/29 12:45:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\ScanSoft
[2006/07/08 09:06:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\Seven Zip
[2005/12/01 19:14:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\Simple Star
[2005/12/01 19:28:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\Snapfish
[2005/10/19 18:01:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\Thunderbird
[2006/02/13 12:08:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\WebPublisherDemo
[2006/07/08 09:07:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James Saklas\Application Data\{4588FC3C-C040-44E3-BB19-D9D014557FE1}
[2011/07/26 21:09:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Luli\Application Data\Canon
[2009/09/04 16:48:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Luli\Application Data\FileOpen
[2010/08/09 20:35:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Luli\Application Data\NewSoft
[2009/08/18 23:17:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Luli\Application Data\ScanSoft
[2010/09/03 19:16:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Luli\Application Data\Thunderbird
[2009/07/03 07:29:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\DeepBurner
[2008/08/16 08:31:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosalia Saklas\Application Data\Canon
[2006/02/20 15:53:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosalia Saklas\Application Data\FileOpen
[2008/04/10 13:51:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosalia Saklas\Application Data\Nuance
[2007/08/02 15:27:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosalia Saklas\Application Data\ScanSoft
[2006/02/23 02:26:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosalia Saklas\Application Data\Thunderbird
[2006/04/05 06:29:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosalia Saklas\Application Data\WebPublisherDemo
========== Purity Check ==========
< End of report >
Also, I get an icon on my desktop named: fpfkbfxlzm.tmp