[code] OTScanIt2 logfile created on: 2/3/2009 3:12:33 PM - Run 1 OTScanIt2 by OldTimer - Version 1.0.7.1 Folder = C:\Documents and Settings\Owner\Desktop\OTScanIt2 Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.42 Gb Available Physical Memory | 71.05% Memory free 3.34 Gb Paging File | 2.93 Gb Available in Paging File | 87.70% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048; %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 465.76 Gb Total Space | 345.34 Gb Free Space | 74.15% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive M: | 116.44 Gb Total Space | 103.29 Gb Free Space | 88.71% Space Free | Partition Type: NTFS Drive V: | 116.43 Gb Total Space | 19.31 Gb Free Space | 16.59% Space Free | Partition Type: NTFS Drive Z: | 111.76 Gb Total Space | 8.71 Gb Free Space | 7.79% Space Free | Partition Type: FAT Computer Name: WNDY26 Current User Name: Owner Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Whitelist: On File Age = 30 Days [Processes - Safe List] aawservice.exe -> %ProgramFiles%\Lavasoft\Ad-Aware\aawservice.exe -> [2008/08/12 16:42:10 | 00,611,664 | ---- | M] (Lavasoft) adskscsrv.exe -> %CommonProgramFiles%\Autodesk Shared\Service\AdskScSrv.exe -> [2008/03/13 13:55:28 | 00,079,360 | ---- | M] (Autodesk) avgrsx.exe -> %ProgramFiles%\AVG\AVG8\avgrsx.exe -> [2009/01/29 23:26:02 | 00,484,120 | ---- | M] (AVG Technologies CZ, s.r.o.) avgwdsvc.exe -> %ProgramFiles%\AVG\AVG8\avgwdsvc.exe -> [2009/01/29 23:25:57 | 00,298,264 | ---- | M] (AVG Technologies CZ, s.r.o.) cmd.exe -> %SystemRoot%\system32\cmd.exe -> [2008/04/13 18:12:14 | 00,406,528 | ---- | M] (Microsoft Corporation) ioctlsvc.exe -> %SystemRoot%\system32\IoctlSvc.exe -> [2006/12/19 09:30:26 | 00,102,400 | ---- | M] (Prolific Technology Inc.) jqs.exe -> %ProgramFiles%\Java\jre6\bin\jqs.exe -> [2008/12/27 19:39:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) jusched.exe -> %ProgramFiles%\Java\jre6\bin\jusched.exe -> [2008/12/27 19:39:15 | 00,136,600 | ---- | M] (Sun Microsystems, Inc.) lssrvc.exe -> %CommonProgramFiles%\LightScribe\LSSrvc.exe -> [2007/04/19 12:35:46 | 00,075,304 | ---- | M] (Hewlett-Packard Company) mdm.exe -> %CommonProgramFiles%\Microsoft Shared\VS7DEBUG\MDM.EXE -> [2003/06/19 22:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) mdnsresponder.exe -> %ProgramFiles%\Extensis\Extensis Suitcase 11\Bonjour\mDNSResponder.exe -> [2006/02/28 11:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) msmpeng.exe -> %ProgramFiles%\Windows Defender\MsMpEng.exe -> [2006/11/03 17:19:58 | 00,013,592 | ---- | M] (Microsoft Corporation) ntuneservice.exe -> %ProgramFiles%\NVIDIA Corporation\nTune\nTuneService.exe -> [2007/09/04 19:25:44 | 00,131,072 | ---- | M] (NVIDIA) nvsvc32.exe -> %SystemRoot%\system32\nvsvc32.exe -> [2008/10/07 12:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) otscanit2.exe -> %UserProfile%\Desktop\OTScanIt2\OTScanIt2.exe -> [2009/01/26 12:13:22 | 00,485,376 | ---- | M] (OldTimer Tools) raysat_3dsmax2008_32server.exe -> %ProgramFiles%\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe -> [2007/09/24 16:05:26 | 00,065,536 | ---- | M] () realsched.exe -> %CommonProgramFiles%\Real\Update_OB\realsched.exe -> [2008/03/16 02:21:28 | 00,185,896 | ---- | M] (RealNetworks, Inc.) sansadispatch.exe -> %AppData%\SanDisk\Sansa Updater\SansaDispatch.exe -> [2008/11/28 08:02:35 | 00,097,280 | ---- | M] (SanDisk Corporation) services.exe -> %SystemRoot%\services.exe -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () snmp.exe -> %SystemRoot%\system32\snmp.exe -> [2008/04/13 18:12:36 | 00,050,688 | ---- | M] (Microsoft Corporation) viewpointservice.exe -> %ProgramFiles%\Viewpoint\Common\ViewpointService.exe -> [2007/01/04 15:38:08 | 00,045,132 | ---- | M] (Viewpoint Corporation) wmpnetwk.exe -> %ProgramFiles%\Windows Media Player\wmpnetwk.exe -> [2006/10/18 19:05:24 | 00,930,816 | ---- | M] (Microsoft Corporation) wuauclt.exe -> %SystemRoot%\system32\wuauclt.exe -> [2008/10/16 14:09:44 | 00,051,224 | ---- | M] (Microsoft Corporation) [Win32 Services - Safe List] (aawservice) Lavasoft Ad-Aware Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Lavasoft\Ad-Aware\aawservice.exe -> [2008/08/12 16:42:10 | 00,611,664 | ---- | M] (Lavasoft) (aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -> [2007/10/24 01:47:22 | 00,033,800 | ---- | M] (Microsoft Corporation) (Autodesk Licensing Service) Autodesk Licensing Service [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Autodesk Shared\Service\AdskScSrv.exe -> [2008/03/13 13:55:28 | 00,079,360 | ---- | M] (Autodesk) (avg8wd) AVG Free8 WatchDog [Win32_Own | Auto | Running] -> %ProgramFiles%\AVG\AVG8\avgwdsvc.exe -> [2009/01/29 23:25:57 | 00,298,264 | ---- | M] (AVG Technologies CZ, s.r.o.) (Bonjour Service) Bonjour Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Extensis\Extensis Suitcase 11\Bonjour\mDNSResponder.exe -> [2006/02/28 11:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) (clr_optimization_v2.0.50727_32) .NET Runtime Optimization Service v2.0.50727_X86 [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> [2007/10/24 01:47:40 | 00,070,144 | ---- | M] (Microsoft Corporation) (FLEXnet Licensing Service) FLEXnet Licensing Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -> [2008/03/06 04:11:31 | 00,672,256 | ---- | M] (Macrovision Europe Ltd.) (FontCache3.0.0.0) Windows Presentation Foundation Font Cache 3.0.0.0 [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -> [2007/10/09 12:58:12 | 00,057,344 | ---- | M] (Microsoft Corporation) (helpsvc) Help and Support [Win32_Shared | Auto | Running] -> %SystemRoot%\pchealth\helpctr\binaries\pchsvc.dll -> [2008/04/13 18:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) (IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IDriverT.exe -> [2005/04/04 00:41:10 | 00,090,112 | ---- | M] (Macrovision Corporation) (idsvc) Windows CardSpace [Win32_Shared | Unknown | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -> [2007/10/11 09:55:10 | 00,884,736 | ---- | M] (Microsoft Corporation) (iPod Service) iPod Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\iPod\bin\iPodService.exe -> [2007/12/11 12:10:16 | 00,504,104 | ---- | M] (Apple Inc.) (Irmon) Infrared Monitor [Win32_Shared | Auto | Running] -> %SystemRoot%\system32\irmon.dll -> [2008/04/13 18:11:55 | 00,028,160 | ---- | M] (Microsoft Corporation) (JavaQuickStarterService) Java Quick Starter [Win32_Own | Auto | Running] -> %ProgramFiles%\Java\jre6\bin\jqs.exe -> [2008/12/27 19:39:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) (LBTServ) Logitech Bluetooth Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Logishrd\Bluetooth\LBTServ.exe -> [2008/05/02 01:42:06 | 00,121,360 | ---- | M] (Logitech, Inc.) (LightScribeService) LightScribeService Direct Disc Labeling Service [Win32_Own | Auto | Running] -> %CommonProgramFiles%\LightScribe\LSSrvc.exe -> [2007/04/19 12:35:46 | 00,075,304 | ---- | M] (Hewlett-Packard Company) (MDM) Machine Debug Manager [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Microsoft Shared\VS7DEBUG\MDM.EXE -> [2003/06/19 22:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) (mi-raysat_3dsMax2008_32) mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit [Win32_Own | Auto | Running] -> %ProgramFiles%\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe -> [2007/09/24 16:05:26 | 00,065,536 | ---- | M] () (Microsoft Office Groove Audit Service) Microsoft Office Groove Audit Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Microsoft Office\Office12\GrooveAuditService.exe -> [2007/08/24 06:59:20 | 00,068,464 | ---- | M] (Microsoft Corporation) (NBService) NBService [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Nero\Nero 7\Nero BackItUp\NBService.exe -> [2008/04/08 08:56:30 | 00,800,040 | ---- | M] (Nero AG) (NetTcpPortSharing) Net.Tcp Port Sharing Service [Win32_Shared | Disabled | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -> [2007/10/11 09:55:14 | 00,143,360 | ---- | M] (Microsoft Corporation) (NMIndexingService) NMIndexingService [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Ahead\Lib\NMIndexingService.exe -> [2008/01/22 10:13:26 | 00,275,752 | ---- | M] (Nero AG) (nTuneService) nTune Service [Win32_Own | Auto | Running] -> %ProgramFiles%\NVIDIA Corporation\nTune\nTuneService.exe -> [2007/09/04 19:25:44 | 00,131,072 | ---- | M] (NVIDIA) (NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\nvsvc32.exe -> [2008/10/07 12:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) (odserv) Microsoft Office Diagnostics Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Microsoft Shared\OFFICE12\ODSERV.EXE -> [2007/08/24 03:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) (OOD2000) O&O Defrag 2000 [Win32_Own | Auto | Stopped] -> %SystemRoot%\system32\OOD2000.exe -> [2001/04/06 12:57:46 | 00,255,488 | ---- | M] (O&O Software GmbH) (ose) Office Source Engine [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Microsoft Shared\Source Engine\OSE.EXE -> [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) (PLFlash DeviceIoControl Service) PLFlash DeviceIoControl Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\IoctlSvc.exe -> [2006/12/19 09:30:26 | 00,102,400 | ---- | M] (Prolific Technology Inc.) (SNMP) SNMP Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\snmp.exe -> [2008/04/13 18:12:36 | 00,050,688 | ---- | M] (Microsoft Corporation) (SNMPTRAP) SNMP Trap Service [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\system32\snmptrap.exe -> [2008/04/13 18:12:36 | 00,026,112 | ---- | M] (Microsoft Corporation) (usnjsvc) Messenger Sharing Folders USN Journal Reader service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Windows Live\Messenger\usnsvc.exe -> [2007/10/18 11:31:54 | 00,098,328 | ---- | M] (Microsoft Corporation) (Viewpoint Manager Service) Viewpoint Manager Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Viewpoint\Common\ViewpointService.exe -> [2007/01/04 15:38:08 | 00,045,132 | ---- | M] (Viewpoint Corporation) (Visual Studio Analyzer RPC bridge) Visual Studio Analyzer RPC bridge [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Microsoft Visual Studio\COMMON\Tools\VS-Ent98\Vanalyzr\VARPC.EXE -> [1998/06/06 00:00:00 | 00,034,036 | ---- | M] (Microsoft Corporation) (WinDefend) Windows Defender [Win32_Own | Auto | Running] -> %ProgramFiles%\Windows Defender\MsMpEng.exe -> [2006/11/03 17:19:58 | 00,013,592 | ---- | M] (Microsoft Corporation) (WLSetupSvc) Windows Live Setup Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Windows Live\installer\WLSetupSvc.exe -> [2007/10/25 15:27:54 | 00,283,648 | ---- | M] (Microsoft Corporation) (WMPNetworkSvc) Windows Media Player Network Sharing Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Windows Media Player\wmpnetwk.exe -> [2006/10/18 19:05:24 | 00,930,816 | ---- | M] (Microsoft Corporation) (WudfSvc) Windows Driver Foundation - User-mode Driver Framework [Win32_Shared | Auto | Running] -> %SystemRoot%\system32\WudfSvc.dll -> [2006/09/28 17:56:14 | 00,055,808 | ---- | M] (Microsoft Corporation) [Driver Services - Safe List] (AgereSoftModem) Agere Systems Soft Modem [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\AGRSM.sys -> [2006/01/25 15:24:30 | 01,149,888 | ---- | M] (Agere Systems) (Alpham1) Ideazon Merc USB Human Interface Device [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\Alpham1.sys -> [2007/07/23 09:56:58 | 00,042,624 | ---- | M] (Ideazon Corporation) (Alpham2) Ideazon Merc MM USB Human Interface Device [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\Alpham2.sys -> [2007/03/20 11:49:52 | 00,018,432 | ---- | M] (Ideazon Corporation) (AmdK7) AMD K7 Processor Driver [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\amdk7.sys -> [2008/04/13 12:31:33 | 00,037,760 | ---- | M] (Microsoft Corporation) (Aspi32) Aspi32 [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\aspi32.sys -> [1999/09/10 05:06:00 | 00,025,244 | ---- | M] (Adaptec) (ati2mtag) ati2mtag [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\ati2mtag.sys -> [2004/08/03 22:29:28 | 00,701,440 | ---- | M] (ATI Technologies Inc.) (atksgt) atksgt [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\atksgt.sys -> [2008/12/08 16:43:38 | 00,278,984 | ---- | M] () (AvgLdx86) AVG Free AVI Loader Driver x86 [Kernel | System | Running] -> %SystemRoot%\system32\drivers\avgldx86.sys -> [2009/01/29 23:26:02 | 00,325,128 | ---- | M] (AVG Technologies CZ, s.r.o.) (AvgMfx86) AVG Free On-access Scanner Minifilter Driver x86 [File_System | System | Running] -> %SystemRoot%\system32\drivers\avgmfx86.sys -> [2009/01/29 23:26:02 | 00,027,656 | ---- | M] (AVG Technologies CZ, s.r.o.) (EagleNT) EagleNT [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\eaglent.sys -> [2009/02/03 14:24:27 | 00,137,280 | ---- | M] () (ethakwnq) ethakwnq [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethakwnq.sys -> [2009/02/03 14:26:05 | 00,137,280 | ---- | M] () (ethavaao) ethavaao [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethavaao.sys -> [2009/02/03 14:24:29 | 00,137,280 | ---- | M] () (ethctcow) ethctcow [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethctcow.sys -> [2009/02/03 14:25:32 | 00,137,280 | ---- | M] () (ethfjkbp) ethfjkbp [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethfjkbp.sys -> [2009/02/03 14:25:47 | 00,137,280 | ---- | M] () (ethgrwyi) ethgrwyi [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethgrwyi.sys -> [2009/02/03 14:25:44 | 00,137,280 | ---- | M] () (ethhjgek) ethhjgek [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethhjgek.sys -> [2009/02/03 14:24:31 | 00,137,280 | ---- | M] () (ethibmbi) ethibmbi [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethibmbi.sys -> [2009/02/03 14:25:24 | 00,137,280 | ---- | M] () (ethjdsjw) ethjdsjw [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethjdsjw.sys -> [2009/02/03 14:25:22 | 00,137,280 | ---- | M] () (ethkoouo) ethkoouo [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethkoouo.sys -> [2009/02/03 14:24:33 | 00,137,280 | ---- | M] () (ethlcaed) ethlcaed [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethlcaed.sys -> [2009/02/03 14:25:12 | 00,137,280 | ---- | M] () (ethmdqei) ethmdqei [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethmdqei.sys -> [2009/02/03 14:24:35 | 00,137,280 | ---- | M] () (ethnzjae) ethnzjae [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethnzjae.sys -> [2009/02/03 14:24:37 | 00,137,280 | ---- | M] () (ethptbbv) ethptbbv [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethptbbv.sys -> [2009/02/03 14:26:09 | 00,137,280 | ---- | M] () (ethqfvop) ethqfvop [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethqfvop.sys -> [2009/02/03 14:25:17 | 00,137,280 | ---- | M] () (ethtlmip) ethtlmip [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethtlmip.sys -> [2009/02/03 14:24:39 | 00,137,280 | ---- | M] () (ethulfdq) ethulfdq [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethulfdq.sys -> [2009/02/03 14:24:41 | 00,137,280 | ---- | M] () (ethuobhu) ethuobhu [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethuobhu.sys -> [2009/02/03 14:24:43 | 00,137,280 | ---- | M] () (ethuwqki) ethuwqki [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethuwqki.sys -> [2009/02/03 14:24:45 | 00,137,280 | ---- | M] () (ethvowqt) ethvowqt [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethvowqt.sys -> [2009/02/03 14:24:47 | 00,137,280 | ---- | M] () (ethwqzzu) ethwqzzu [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethwqzzu.sys -> [2009/02/03 14:25:50 | 00,137,280 | ---- | M] () (ethxzcoe) ethxzcoe [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethxzcoe.sys -> [2009/02/03 14:24:49 | 00,137,280 | ---- | M] () (ethxzpmy) ethxzpmy [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethxzpmy.sys -> [2009/02/03 14:24:51 | 00,137,280 | ---- | M] () (ethyyoje) ethyyoje [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethyyoje.sys -> [2009/02/03 14:25:35 | 00,137,280 | ---- | M] () (ethztlzs) ethztlzs [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethztlzs.sys -> [2009/02/03 14:25:42 | 00,137,280 | ---- | M] () (gdrv) gdrv [Kernel | On_Demand | Stopped] -> %SystemRoot%\gdrv.sys -> [2008/01/21 18:16:31 | 00,015,600 | ---- | M] (Windows (R) 2000 DDK provider) (GEARAspiWDM) GEARAspiWDM [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\GEARAspiWDM.sys -> [2006/09/19 14:44:04 | 00,015,664 | ---- | M] (GEAR Software Inc.) (giveio) giveio [Kernel | Boot | Running] -> %SystemRoot%\system32\giveio.sys -> [1996/04/03 13:33:26 | 00,005,248 | ---- | M] () (hamachi) Hamachi Network Interface [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\hamachi.sys -> [2008/12/25 21:38:11 | 00,025,280 | ---- | M] (LogMeIn, Inc.) (HDAudBus) Microsoft UAA Bus Driver for High Definition Audio [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\hdaudbus.sys -> [2008/04/13 10:36:05 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) (ialm) ialm [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\ialmnt5.sys -> [2006/03/22 22:47:06 | 01,166,972 | R--- | M] (Intel Corporation) (IntcAzAudAddService) Service for Realtek HD Audio (WDM) [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\RtkHDAud.sys -> [2007/11/01 00:38:56 | 04,620,288 | R--- | M] (Realtek Semiconductor Corp.) (irsir) Microsoft Serial Infrared Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\irsir.sys -> [2001/08/17 07:51:32 | 00,018,688 | ---- | M] (Microsoft Corporation) (kbdhid) Keyboard HID Driver [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\kbdhid.sys -> [2008/04/13 12:39:48 | 00,014,592 | ---- | M] (Microsoft Corporation) (L8042Kbd) Logitech SetPoint Keyboard Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\L8042Kbd.sys -> [2008/02/29 02:12:48 | 00,020,240 | ---- | M] (Logitech, Inc.) (LHidFilt) Logitech SetPoint KMDF HID Filter Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\LHidFilt.Sys -> [2008/02/29 02:13:16 | 00,035,344 | ---- | M] (Logitech, Inc.) (lirsgt) lirsgt [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\lirsgt.sys -> [2008/12/08 16:43:38 | 00,025,416 | ---- | M] () (LMouFilt) Logitech SetPoint KMDF Mouse Filter Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\LMouFilt.Sys -> [2008/02/29 02:13:24 | 00,036,880 | ---- | M] (Logitech, Inc.) (LUsbFilt) Logitech SetPoint KMDF USB Filter [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\LUsbFilt.sys -> [2008/02/29 02:13:46 | 00,028,944 | ---- | M] (Logitech, Inc.) (MCSTRM) MCSTRM [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\mcstrm.sys -> [2008/06/09 19:52:06 | 00,008,413 | ---- | M] (RealNetworks, Inc.) (nv) nv [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\nv4_mini.sys -> [2008/10/07 12:33:00 | 06,133,856 | ---- | M] (NVIDIA Corporation) (NVR0Dev) NVR0Dev [Kernel | On_Demand | Running] -> %SystemRoot%\nvoclock.sys -> [2007/09/04 19:26:32 | 00,029,696 | ---- | M] (NVidia Corp.) (Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\ptilink.sys -> [2004/08/04 06:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) (rspndr) Link-Layer Topology Discovery Responder [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\rspndr.sys -> [2008/05/29 06:04:43 | 00,062,848 | ---- | M] (Microsoft Corporation) (RTL8023xp) Realtek 10/100/1000 PCI NIC Family NDIS XP Driver [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\Rtnicxp.sys -> [2007/11/20 11:09:22 | 00,104,320 | ---- | M] (Realtek Semiconductor Corporation ) (RTLE8023xp) Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\Rtenicxp.sys -> [2008/10/30 13:14:20 | 00,117,888 | ---- | M] (Realtek Semiconductor Corporation ) (SCDEmu) SCDEmu [Kernel | System | Running] -> %SystemRoot%\system32\drivers\scdemu.sys -> [2008/07/07 01:40:49 | 00,056,108 | ---- | M] (PowerISO Computing, Inc.) (Secdrv) Security Driver [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\secdrv.sys -> [2007/11/13 02:47:45 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) (speedfan) speedfan [Kernel | Boot | Running] -> %SystemRoot%\system32\speedfan.sys -> [2006/09/24 07:28:46 | 00,005,248 | ---- | M] (Windows (R) 2000 DDK provider) (sptd) sptd [Kernel | Boot | Running] -> %SystemRoot%\system32\drivers\sptd.sys -> [2008/03/06 03:23:05 | 00,716,272 | ---- | M] () (Wdf01000) Wdf01000 [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\wdf01000.sys -> [2006/11/02 06:22:54 | 00,492,000 | ---- | M] (Microsoft Corporation) (XDva120) XDva120 [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\xdva120.sys -> [2009/02/03 14:24:53 | 00,137,280 | ---- | M] () (XDva189) XDva189 [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\xdva189.sys -> [2009/02/03 14:24:55 | 00,137,280 | ---- | M] () [Registry - Safe List] < Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com -> HKEY_LOCAL_MACHINE\: Main\\"Default_Secondary_Page_URL" -> -> HKEY_LOCAL_MACHINE\: Main\\"Extensions Off Page" -> about:NoAdd-ons -> HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm -> HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com -> HKEY_LOCAL_MACHINE\: Main\\"Security Risk Page" -> about:SecurityRisk -> HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> HKEY_LOCAL_MACHINE\: Search\\"CustomSearch" -> http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html -> HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> < Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> HKEY_CURRENT_USER\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> HKEY_CURRENT_USER\: Main\\"Search Page" -> http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com -> HKEY_CURRENT_USER\: Main\\"Start Page" -> http://www.yahoo.com/ -> HKEY_CURRENT_USER\: SearchURL\\"" -> http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com -> HKEY_CURRENT_USER\: "ProxyEnable" -> 0 -> HKEY_CURRENT_USER\: "ProxyOverride" -> *.local -> < Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> HKEY_USERS\.DEFAULT\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> HKEY_USERS\.DEFAULT\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> HKEY_USERS\.DEFAULT\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> HKEY_USERS\S-1-5-18\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> HKEY_USERS\S-1-5-18\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> HKEY_USERS\S-1-5-18\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> < Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> HKEY_USERS\S-1-5-20\: "ProxyEnable" -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\] > -> -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\: Main\\"Search Page" -> http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\: Main\\"Start Page" -> http://www.yahoo.com/ -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\: SearchURL\\"" -> http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\: "ProxyEnable" -> 0 -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\: "ProxyOverride" -> *.local -> < FireFox Settings [Default Profile] > -> C:\Documents and Settings\Owner\Application Data\Mozilla\FireFox\Profiles\a1rvruhz.default\prefs.js -> browser.search.defaultenginename -> "Yahoo" -> browser.search.selectedEngine -> "Yahoo" -> browser.startup.homepage -> "http://www.yahoo.com/" -> browser.startup.homepage_override.mstone -> "rv:1.9.0.5" -> extensions.enabledItems -> {3f963a5b-e555-4543-90e2-c3908898db71}:8.0 -> extensions.enabledItems -> {1d5287d1-8a92-0001-1f31-1cec198018d8}:2.0.20080710 -> extensions.enabledItems -> {2e768a0b-9ee3-4e60-babc-9ff4bc4aacfb}:1.300.66 -> extensions.enabledItems -> [removed]:[removed] -> extensions.enabledItems -> flashplugin@idm:4.1.0.077 -> extensions.enabledItems -> {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11 -> extensions.enabledItems -> [removed]:1.0 -> extensions.enabledItems -> [removed]:1.0.0.07103010 -> extensions.enabledItems -> {0df7b3bb-9581-44bb-835f-061a29ec8a46}:2.1.20081021 -> extensions.enabledItems -> {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.5 -> < HOSTS File > (290900 bytes and 10079 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts -> First 25 entries... 192.168.1.101 localhost 192.168.1.101 www.rohlfingwedding.com 192.168.1.101 sub1 192.168.1.101 sub2 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.100888290cs.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 127.0.0.1 www.10sek.com 127.0.0.1 10sek.com 127.0.0.1 www.123topsearch.com 127.0.0.1 123topsearch.com 127.0.0.1 www.132.com 127.0.0.1 132.com 127.0.0.1 www.136136.net < Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [Adobe PDF] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) "{A057A204-BACC-4D26-9990-79A187E2698E}" [HKLM] -> %ProgramFiles%\AVG\AVG8\avgtoolbar.dll [AVG Security Toolbar] -> [2009/01/29 23:26:00 | 01,968,920 | ---- | M] ([[[COMPANYNAME]]]----------------------------) < Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ -> WebBrowser\\"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [Adobe PDF] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) WebBrowser\\"{A057A204-BACC-4D26-9990-79A187E2698E}" [HKLM] -> %ProgramFiles%\AVG\AVG8\avgtoolbar.dll [AVG Security Toolbar] -> [2009/01/29 23:26:00 | 01,968,920 | ---- | M] ([[[COMPANYNAME]]]----------------------------) WebBrowser\\"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.] -> File not found < Internet Explorer ToolBars [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\ -> WebBrowser\\"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.] -> File not found WebBrowser\\"{A057A204-BACC-4D26-9990-79A187E2698E}" [HKLM] -> %ProgramFiles%\AVG\AVG8\avgtoolbar.dll [AVG Security Toolbar] -> [2009/01/29 23:26:00 | 01,968,920 | ---- | M] ([[[COMPANYNAME]]]----------------------------) < Internet Explorer ToolBars [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\ -> WebBrowser\\"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.] -> File not found WebBrowser\\"{A057A204-BACC-4D26-9990-79A187E2698E}" [HKLM] -> %ProgramFiles%\AVG\AVG8\avgtoolbar.dll [AVG Security Toolbar] -> [2009/01/29 23:26:00 | 01,968,920 | ---- | M] ([[[COMPANYNAME]]]----------------------------) < Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\Software\Microsoft\Internet Explorer\Toolbar\ -> WebBrowser\\"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [Adobe PDF] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) WebBrowser\\"{A057A204-BACC-4D26-9990-79A187E2698E}" [HKLM] -> %ProgramFiles%\AVG\AVG8\avgtoolbar.dll [AVG Security Toolbar] -> [2009/01/29 23:26:00 | 01,968,920 | ---- | M] ([[[COMPANYNAME]]]----------------------------) WebBrowser\\"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.] -> File not found < Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "AVG8_TRAY" -> %ProgramFiles%\AVG\AVG8\avgtray.exe [C:\PROGRA~1\AVG\AVG8\avgtray.exe] -> [2009/01/29 23:25:53 | 01,601,304 | ---- | M] (AVG Technologies CZ, s.r.o.) "Framework Windows" -> [frmwrk32.exe] -> File not found "NvCplDaemon" -> %SystemRoot%\system32\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> [2008/10/07 12:33:00 | 13,574,144 | ---- | M] (NVIDIA Corporation) "QuickTime Task" -> %ProgramFiles%\QuickTime\QTTask.exe ["C:\Program Files\QuickTime\qttask.exe" -atboottime] -> [2008/03/28 22:37:20 | 00,434,176 | ---- | M] (Apple Inc.) "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () "SunJavaUpdateSched" -> %ProgramFiles%\Java\jre6\bin\jusched.exe ["C:\Program Files\Java\jre6\bin\jusched.exe"] -> [2008/12/27 19:39:15 | 00,136,600 | ---- | M] (Sun Microsystems, Inc.) "TkBellExe" -> %CommonProgramFiles%\Real\Update_OB\realsched.exe ["C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot] -> [2008/03/16 02:21:28 | 00,185,896 | ---- | M] (RealNetworks, Inc.) < Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "igndlm.exe" -> [C:\Program Files\Download Manager\dlm.exe /windowsstart /startifwork] -> File not found "SansaDispatch" -> %AppData%\SanDisk\Sansa Updater\SansaDispatch.exe [C:\Documents and Settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe] -> [2008/11/28 08:02:35 | 00,097,280 | ---- | M] (SanDisk Corporation) "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () < Run [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "DWQueuedReporting" -> %CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE ["C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t] -> [2007/08/24 03:18:18 | 00,437,160 | ---- | M] (Microsoft Corporation) "ehddsvxm.exe" -> %SystemRoot%\ehddsvxm.exe [C:\WINDOWS\ehddsvxm.exe] -> File not found "LightScribe Control Panel" -> %CommonProgramFiles%\LightScribe\LightScribeControlPanel.exe [C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden] -> [2007/04/19 12:26:52 | 00,484,904 | ---- | M] (Hewlett-Packard Company) "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () < Run [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "DWQueuedReporting" -> %CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE ["C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t] -> [2007/08/24 03:18:18 | 00,437,160 | ---- | M] (Microsoft Corporation) "ehddsvxm.exe" -> %SystemRoot%\ehddsvxm.exe [C:\WINDOWS\ehddsvxm.exe] -> File not found "LightScribe Control Panel" -> %CommonProgramFiles%\LightScribe\LightScribeControlPanel.exe [C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden] -> [2007/04/19 12:26:52 | 00,484,904 | ---- | M] (Hewlett-Packard Company) "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () < Run [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "igndlm.exe" -> [C:\Program Files\Download Manager\dlm.exe /windowsstart /startifwork] -> File not found "SansaDispatch" -> %AppData%\SanDisk\Sansa Updater\SansaDispatch.exe [C:\Documents and Settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe] -> [2008/11/28 08:02:35 | 00,097,280 | ---- | M] (SanDisk Corporation) "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () < All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> < Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup -> < Owner Startup Folder > -> C:\Documents and Settings\Owner\Start Menu\Programs\Startup -> %UserProfile%\Start Menu\Programs\Startup\Suitcase 11.0.lnk -> %ProgramFiles%\Extensis\Extensis Suitcase 11\Suitcase.exe -> [2007/02/16 15:32:28 | 05,246,976 | ---- | M] (Extensis) < CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () < CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System \\"dontdisplaylastusername" -> [0] -> File not found \\"legalnoticecaption" -> [] -> File not found \\"legalnoticetext" -> [] -> File not found \\"shutdownwithoutlogon" -> [1] -> File not found \\"undockwithoutlogon" -> [1] -> File not found < CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer \\"NoDriveTypeAutoRun" -> [145] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () < CurrentVersion Policy Settings - System [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System \\"DisableRegistryTools" -> [0] -> File not found < CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer \\"NoDriveTypeAutoRun" -> [145] -> File not found \\"NoFolderOptions" -> [1] -> File not found HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () < CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System \\"DisableRegistryTools" -> [1] -> File not found < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer \\"NoDriveTypeAutoRun" -> [145] -> File not found \\"NoFolderOptions" -> [1] -> File not found HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System \\"DisableRegistryTools" -> [1] -> File not found < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer \\"NoDriveTypeAutoRun" -> [145] -> File not found < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer \\"NoDriveTypeAutoRun" -> [145] -> File not found < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer \\"NoDriveTypeAutoRun" -> [145] -> File not found HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe] -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System \\"DisableRegistryTools" -> [0] -> File not found < Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> Append to existing PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert link target to Adobe PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert link target to existing PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert selected links to Adobe PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert selected links to existing PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert selection to Adobe PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert selection to existing PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert to Adobe PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) E&xport to Microsoft Excel -> %ProgramFiles%\Microsoft Office\Office12\EXCEL.EXE [res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000] -> [2007/12/12 22:45:26 | 17,904,152 | ---- | M] (Microsoft Corporation) < Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\Software\Microsoft\Internet Explorer\MenuExt\ -> Append to existing PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert link target to Adobe PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert link target to existing PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert selected links to Adobe PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert selected links to existing PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert selection to Adobe PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert selection to existing PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) Convert to Adobe PDF -> %ProgramFiles%\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2007/05/10 22:47:03 | 00,321,120 | ---- | M] (Adobe Systems Incorporated) E&xport to Microsoft Excel -> %ProgramFiles%\Microsoft Office\Office12\EXCEL.EXE [res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000] -> [2007/12/12 22:45:26 | 17,904,152 | ---- | M] (Microsoft Corporation) < Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> {2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> %ProgramFiles%\Microsoft Office\Office12\ONBttnIE.dll [Button: Send to OneNote] -> [2007/08/29 00:49:28 | 00,606,120 | ---- | M] (Microsoft Corporation) {2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> %ProgramFiles%\Microsoft Office\Office12\ONBttnIE.dll [Menu: S&end to OneNote] -> [2007/08/29 00:49:28 | 00,606,120 | ---- | M] (Microsoft Corporation) {92780B25-18CC-41C8-B9BE-3C9C571A8263}:{FF059E31-CC5A-4E2E-BF3B-96E929D65503} [HKLM] -> %ProgramFiles%\Microsoft Office\OFFICE11\REFIEBAR.DLL [Button: Research] -> [2003/07/14 21:57:08 | 00,040,512 | ---- | M] (Microsoft Corporation) {d9288080-1baa-4bc4-9cf8-a92d743db949}:Exec [HKLM] -> %UserProfile%\Start Menu\Programs\IMVU\Run IMVU.lnk [Button: Run IMVU] -> File not found {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Menu: Spybot - Search & Destroy Configuration] -> [2008/09/15 14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited) {e2e2dd38-d088-4134-82b7-f2ba38496583}:Exec [HKLM] -> %SystemRoot%\network diagnostic\xpnetdiag.exe [Menu: @xpsp3res.dll,-20001] -> [2008/04/13 12:53:32 | 00,575,488 | ---- | M] (Microsoft Corporation) {FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Button: Messenger] -> [2008/04/13 18:12:28 | 01,712,640 | ---- | M] (Microsoft Corporation) {FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2008/04/13 18:12:28 | 01,712,640 | ---- | M] (Microsoft Corporation) < Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> < Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix "" -> http:// < Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5235 domain(s) found. -> 49 domain(s) and sub-domain(s) not assigned to a zone. < Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. -> < Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5234 domain(s) found. -> 48 domain(s) and sub-domain(s) not assigned to a zone. < Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5234 domain(s) found. -> 48 domain(s) and sub-domain(s) not assigned to a zone. < Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5234 domain(s) found. -> 48 domain(s) and sub-domain(s) not assigned to a zone. < Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5234 domain(s) found. -> 48 domain(s) and sub-domain(s) not assigned to a zone. < Trusted Sites Ranges [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. -> < Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} [HKLM] -> http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab [Office Genuine Advantage Validation Tool] -> {166B1BCA-3F9C-11CF-8075-444553540000} [HKLM] -> http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab [Shockwave ActiveX Control] -> {1E54D648-B804-468d-BC78-4AFFED8E262E} [HKLM] -> http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab [System Requirements Lab Class] -> {233C1507-6A77-46A4-9443-F871F945D258} [HKLM] -> http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab [Shockwave ActiveX Control] -> {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} [HKLM] -> http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab [CDownloadCtrl Object] -> {406B5949-7190-4245-91A9-30A17DE16AD0} [HKLM] -> http://photos.walmart.com/WalmartActivia.cab [Snapfish Activia] -> {48DD0448-9209-4F81-9F6D-D83562940134} [HKLM] -> http://lads.myspace.com/upload/MySpaceUploader1006.cab [MySpace Uploader Control] -> {4F1E5B1A-2A80-42CA-8532-2D05CB959537} [HKLM] -> http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab [MSN Photo Upload Tool] -> {5D6F45B3-9043-443D-A792-115447494D24} [HKLM] -> http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab [UnoCtrl Class] -> {6414512B-B978-451D-A0D8-FCFDF33E833C} [HKLM] -> http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1191516742453 [WUWebControl Class] -> {6E5E167B-1566-4316-B27F-0DDAB3484CF7} [HKLM] -> http://www.familylobby.com/common/ImageUploader/ImageUploader4.cab [Reg Error: Key does not exist or could not be opened.] -> {8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab [Java Plug-in 1.6.0_11] -> {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} [HKLM] -> http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab [Reg Error: Key does not exist or could not be opened.] -> {99FE5072-78AA-4FEE-89BA-69A5FA55343F} [HKLM] -> http://download.microsoft.com/download/B/3/A/B3A2EA73-793D-4ABE-992D-C81140384044/igdtoolx.cab [IGDTester Class] -> {C3F79A2B-B9B4-4A66-B012-3EE46475B072} [HKLM] -> http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab [MessengerStatsClient Class] -> {C4847596-972C-11D0-9567-00A0C9273C2A} [HKLM] -> http://198.209.97.177/viewer/activeXViewer/activexviewer.cab [Crystal Report Smart Viewer 7] -> {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} [HKLM] -> http://office.microsoft.com/officeupdate/content/opuc4.cab [Office Update Installation Engine] -> {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab [Java Plug-in 1.6.0_11] -> {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab [Java Plug-in 1.6.0_11] -> {D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab [Shockwave Flash Object] -> {DE625294-70E6-45ED-B895-CFFA13AEB044} [HKLM] -> http://oakmont.axiscam.net/activex/AMC.cab [AxisMediaControlEmb Class] -> {EDFCB7CB-942C-4822-AF14-F0B687409848} [HKLM] -> http://www.snapgalaxy.com/albums/ImageUploader4.cab [Image Uploader Control] -> {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} [HKLM] -> https://secure.logmein.com/activex/ractrl.cab?lmi=100 [Performance Viewer Activex Control] -> < DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> {5FD5F582-3015-4AAD-8991-1999F9E27759} -> (Realtek RTL8139/810x Family Fast Ethernet NIC) -> {8DBD0DCE-219C-4B82-B2C6-3C911DFC8336} -> (Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC) -> {95D84F34-5BE7-4CDC-98F9-565EB28313E0} -> (1394 Net Adapter) -> {AED1EF20-64EB-446C-AE0C-1BCA928F6B77} -> (Realtek RTL8169/8110 Family Gigabit Ethernet NIC) -> < Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> avgrsstarter -> %SystemRoot%\system32\avgrsstx.dll -> [2009/01/29 23:26:02 | 00,010,520 | ---- | M] (AVG Technologies CZ, s.r.o.) igfxcui -> %SystemRoot%\system32\igfxdev.dll -> [2006/10/05 22:09:04 | 00,155,648 | R--- | M] (Intel Corporation) khfFWpPJ -> -> File not found LBTWlgn -> %CommonProgramFiles%\Logishrd\Bluetooth\LBTWLgn.dll -> [2008/05/02 01:42:30 | 00,072,208 | ---- | M] (Logitech, Inc.) < ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}" [HKLM] -> %ProgramFiles%\Windows Defender\MpShHook.dll [Microsoft AntiMalware ShellExecuteHook] -> [2006/11/03 17:20:00 | 00,083,224 | ---- | M] (Microsoft Corporation) "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" [HKLM] -> %ProgramFiles%\Microsoft Office\Office12\GrooveShellExtensions.dll [Groove GFS Stub Execution Hook] -> [2007/08/24 07:01:22 | 02,212,224 | ---- | M] (Microsoft Corporation) < Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List -> "%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\network diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000] -> [2008/04/13 12:53:32 | 00,575,488 | ---- | M] (Microsoft Corporation) "%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2008/04/13 18:12:34 | 00,158,720 | ---- | M] (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\livecall.exe" -> C:\Program Files\Windows Live\Messenger\livecall.exe [C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)] -> [2007/10/02 17:18:24 | 00,304,488 | ---- | M] (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" -> C:\Program Files\Windows Live\Messenger\msnmsgr.exe [C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger] -> [2007/10/18 11:34:02 | 05,724,184 | ---- | M] (Microsoft Corporation) < Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> "%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\network diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000] -> [2008/04/13 12:53:32 | 00,575,488 | ---- | M] (Microsoft Corporation) "%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2008/04/13 18:12:34 | 00,158,720 | ---- | M] (Microsoft Corporation) "\??\C:\WINDOWS\system32\winlogon.exe" -> C:\WINDOWS\system32\winlogon.exe [\??\C:\WINDOWS\system32\winlogon.exe:*:enabled:@shell32.dll,-1] -> [2008/04/13 18:12:39 | 00,507,904 | ---- | M] (Microsoft Corporation) "C:\Documents and Settings\Owner\Desktop\Catastrophe\Catastrophe.exe" -> C:\Documents and Settings\Owner\Desktop\Catastrophe\Catastrophe.exe [C:\Documents and Settings\Owner\Desktop\Catastrophe\Catastrophe.exe:*:Enabled:Catastrophe] -> File not found "C:\Documents and Settings\Owner\Local Settings\Temp\Nero Web\SetupXu.exe" -> C:\Documents and Settings\Owner\Local Settings\Temp\Nero Web\SetupXu.exe [C:\Documents and Settings\Owner\Local Settings\Temp\Nero Web\SetupXu.exe:*:Enabled:Nero ProductSetup] -> File not found "C:\Helbreath USA\Helbreath.exe" -> C:\Helbreath USA\Helbreath.exe [C:\Helbreath USA\Helbreath.exe:*:Enabled:mfcftp] -> File not found "C:\ijji\ENGLISH\Gunz\Gunz.exe" -> C:\ijji\ENGLISH\Gunz\Gunz.exe [C:\ijji\ENGLISH\Gunz\Gunz.exe:*:Enabled:Gunz] -> File not found "C:\ijji\ENGLISH\u_gunz.exe" -> C:\ijji\ENGLISH\u_gunz.exe [C:\ijji\ENGLISH\u_gunz.exe:*:Enabled:] -> File not found "C:\Program Files\AIM6\aim6.exe" -> C:\Program Files\AIM6\aim6.exe [C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM] -> File not found "C:\Program Files\Autodesk\3ds Max 2008\3dsmax.exe" -> C:\Program Files\Autodesk\3ds Max 2008\3dsmax.exe [C:\Program Files\Autodesk\3ds Max 2008\3dsmax.exe:*:Enabled:Autodesk 3ds Max 2008 32-bit] -> [2007/09/24 17:24:22 | 06,535,680 | ---- | M] (Autodesk, Inc.) "C:\Program Files\Autodesk\Backburner\manager.exe" -> C:\Program Files\Autodesk\Backburner\manager.exe [C:\Program Files\Autodesk\Backburner\manager.exe:*:Enabled:backburner 2.3 manager] -> [2007/07/03 13:21:36 | 00,528,384 | ---- | M] (Autodesk, Inc.) "C:\Program Files\Autodesk\Backburner\monitor.exe" -> C:\Program Files\Autodesk\Backburner\monitor.exe [C:\Program Files\Autodesk\Backburner\monitor.exe:*:Enabled:backburner 2.3 monitor] -> [2007/07/03 13:21:38 | 00,446,464 | ---- | M] (Autodesk, Inc.) "C:\Program Files\Autodesk\Backburner\server.exe" -> C:\Program Files\Autodesk\Backburner\server.exe [C:\Program Files\Autodesk\Backburner\server.exe:*:Enabled:backburner 2.3 server] -> [2007/07/03 13:21:38 | 00,131,072 | ---- | M] (Autodesk, Inc.) "C:\Program Files\AVG\AVG8\avgupd.exe" -> C:\Program Files\AVG\AVG8\avgupd.exe [C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe] -> [2009/01/29 23:24:13 | 01,032,984 | ---- | M] (AVG Technologies CZ, s.r.o.) "C:\Program Files\BitTorrent\bittorrent.exe" -> C:\Program Files\BitTorrent\bittorrent.exe [C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent] -> File not found "C:\Program Files\Bonjour\mDNSResponder.exe" -> C:\Program Files\Bonjour\mDNSResponder.exe [C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour] -> [2006/02/28 12:42:38 | 00,249,856 | ---- | M] (Apple Computer, Inc.) "C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe" -> C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe [C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup] -> [2008/05/28 07:26:58 | 01,856,808 | ---- | M] (Nero AG) "C:\Program Files\Common Files\AOL\Loader\aolload.exe" -> C:\Program Files\Common Files\AOL\Loader\aolload.exe [C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader] -> File not found "C:\Program Files\DNA\btdna.exe" -> C:\Program Files\DNA\btdna.exe [C:\Program Files\DNA\btdna.exe:*:Enabled:DNA] -> [2008/07/31 15:46:24 | 00,289,088 | ---- | M] (BitTorrent, Inc.) "C:\Program Files\DRGunZ\DRGunZ.exe" -> C:\Program Files\DRGunZ\DRGunZ.exe [C:\Program Files\DRGunZ\DRGunZ.exe:*:Enabled:Gunz] -> [2008/01/28 23:17:46 | 02,641,921 | ---- | M] (MAIET entertainment) "C:\Program Files\Electronic Arts\EADM\Core.exe" -> C:\Program Files\Electronic Arts\EADM\Core.exe [C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager] -> [2008/06/13 17:27:34 | 02,772,992 | ---- | M] (Electronic Arts) "C:\Program Files\FlareMu Season 4\Main.exe" -> C:\Program Files\FlareMu Season 4\Main.exe [C:\Program Files\FlareMu Season 4\Main.exe:*:Enabled:Main] -> File not found "C:\Program Files\Grisoft\AVG7\avgamsvr.exe" -> C:\Program Files\Grisoft\AVG7\avgamsvr.exe [C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Disabled:avgamsvr.exe] -> File not found "C:\Program Files\Grisoft\AVG7\avgcc.exe" -> C:\Program Files\Grisoft\AVG7\avgcc.exe [C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Disabled:avgcc.exe] -> File not found "C:\Program Files\Grisoft\AVG7\avgemc.exe" -> C:\Program Files\Grisoft\AVG7\avgemc.exe [C:\Program Files\Grisoft\AVG7\avgemc.exe:*:Disabled:avgemc.exe] -> File not found "C:\Program Files\Grisoft\AVG7\avginet.exe" -> C:\Program Files\Grisoft\AVG7\avginet.exe [C:\Program Files\Grisoft\AVG7\avginet.exe:*:Disabled:avginet.exe] -> File not found "C:\Program Files\Helbreath\Helbreath.exe" -> C:\Program Files\Helbreath\Helbreath.exe [C:\Program Files\Helbreath\Helbreath.exe:*:Enabled:mfcftp] -> File not found "C:\Program Files\Internet Explorer\iexplore.exe" -> C:\Program Files\Internet Explorer\iexplore.exe [C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer] -> [2008/10/15 01:06:26 | 00,633,632 | ---- | M] (Microsoft Corporation) "C:\Program Files\iTunes\iTunes.exe" -> C:\Program Files\iTunes\iTunes.exe [C:\Program Files\iTunes\iTunes.exe:*:Disabled:iTunes] -> [2007/12/11 12:10:18 | 17,152,808 | ---- | M] (Apple Inc.) "C:\Program Files\MAIET\Gunz\Gunz.exe" -> C:\Program Files\MAIET\Gunz\Gunz.exe [C:\Program Files\MAIET\Gunz\Gunz.exe:*:Enabled:Gunz] -> File not found "C:\Program Files\MAIET\Gunz\GunzLauncher.exe" -> C:\Program Files\MAIET\Gunz\GunzLauncher.exe [C:\Program Files\MAIET\Gunz\GunzLauncher.exe:*:Enabled:GunzLauncher] -> File not found "C:\Program Files\Messenger\msmsgs.exe" -> C:\Program Files\Messenger\msmsgs.exe [C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger] -> [2008/04/13 18:12:28 | 01,712,640 | ---- | M] (Microsoft Corporation) "C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age2_x1.exe" -> C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age2_x1.exe [C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age2_x1.exe:*:Enabled:Age of Empires II Expansion] -> File not found "C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\AGE2_X1.ICD" -> C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\AGE2_X1.ICD [C:\Program Files\Microsoft Games\Age of Empires II\age2_x1\AGE2_X1.ICD:*:Enabled:Age of Empires II Expansion] -> File not found "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" -> C:\Program Files\Microsoft Office\Office12\GROOVE.EXE [C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove] -> [2007/08/29 00:23:36 | 00,340,856 | ---- | M] (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" -> C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE [C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote] -> [2007/08/28 23:43:30 | 01,022,840 | ---- | M] (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" -> C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE [C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook] -> [2008/05/21 03:37:24 | 12,844,576 | ---- | M] (Microsoft Corporation) "C:\Program Files\mIRC\mirc.exe" -> C:\Program Files\mIRC\mirc.exe [C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC] -> [2007/11/01 13:57:24 | 02,773,504 | ---- | M] (mIRC Co. Ltd.) "C:\Program Files\MySpace\IM\MySpaceIM.exe" -> C:\Program Files\MySpace\IM\MySpaceIM.exe [C:\Program Files\MySpace\IM\MySpaceIM.exe:*:Enabled:MySpaceIM] -> File not found "C:\Program Files\OpenCase\OpenCASE Media Agent\PandoBinaries\NBCPandoREST.exe" -> C:\Program Files\OpenCase\OpenCASE Media Agent\PandoBinaries\NBCPandoREST.exe [C:\Program Files\OpenCase\OpenCASE Media Agent\PandoBinaries\NBCPandoREST.exe:*:Enabled:PandoRest Application Name] -> File not found "C:\Program Files\Sunshine Mu 0.12\Main.exe" -> C:\Program Files\Sunshine Mu 0.12\Main.exe [C:\Program Files\Sunshine Mu 0.12\Main.exe:*:Enabled:Main] -> File not found "C:\Program Files\TeamViewer3\TeamViewer.exe" -> C:\Program Files\TeamViewer3\TeamViewer.exe [C:\Program Files\TeamViewer3\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application] -> File not found "C:\Program Files\UrbanGamerz GunZ\theduel.exe" -> C:\Program Files\UrbanGamerz GunZ\theduel.exe [C:\Program Files\UrbanGamerz GunZ\theduel.exe:*:Enabled:Xiao's Runnable] -> File not found "C:\Program Files\uTorrent\uTorrent.exe" -> C:\Program Files\uTorrent\uTorrent.exe [C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent] -> File not found "C:\Program Files\Ventrilo\Ventrilo.exe" -> C:\Program Files\Ventrilo\Ventrilo.exe [C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe] -> [2008/11/10 10:23:50 | 01,556,480 | ---- | M] () "C:\Program Files\VentSrv\ventrilo_srv.exe" -> C:\Program Files\VentSrv\ventrilo_srv.exe [C:\Program Files\VentSrv\ventrilo_srv.exe:*:Enabled:ventrilo_srv] -> File not found "C:\Program Files\Windows Live\Messenger\livecall.exe" -> C:\Program Files\Windows Live\Messenger\livecall.exe [C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)] -> [2007/10/02 17:18:24 | 00,304,488 | ---- | M] (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" -> C:\Program Files\Windows Live\Messenger\msnmsgr.exe [C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger] -> [2007/10/18 11:34:02 | 05,724,184 | ---- | M] (Microsoft Corporation) "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger] -> [2007/08/30 17:43:18 | 04,670,704 | ---- | M] (Yahoo! Inc.) "C:\Program Files\Yahoo!\Messenger\YServer.exe" -> C:\Program Files\Yahoo!\Messenger\YServer.exe [C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server] -> [2007/08/30 17:43:18 | 00,091,376 | ---- | M] (Yahoo! Inc.) "C:\wamp\bin\apache\apache2.2.8\bin\httpd.exe" -> C:\wamp\bin\apache\apache2.2.8\bin\httpd.exe [C:\wamp\bin\apache\apache2.2.8\bin\httpd.exe:*:Enabled:Apache HTTP Server] -> File not found "C:\WINDOWS\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\network diagnostic\xpnetdiag.exe [C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000] -> [2008/04/13 12:53:32 | 00,575,488 | ---- | M] (Microsoft Corporation) "C:\WINDOWS\system32\dplaysvr.exe" -> C:\WINDOWS\system32\dplaysvr.exe [C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper] -> [2008/04/13 18:12:17 | 00,047,104 | ---- | M] (Microsoft Corporation) "C:\WINDOWS\system32\dpvsetup.exe" -> C:\WINDOWS\system32\dpvsetup.exe [C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test] -> [2008/04/13 18:12:18 | 00,100,864 | ---- | M] (Microsoft Corporation) "C:\WINDOWS\system32\PnkBstrA.exe" -> C:\WINDOWS\system32\PnkBstrA.exe [C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA] -> File not found "C:\WINDOWS\system32\PnkBstrB.exe" -> C:\WINDOWS\system32\PnkBstrB.exe [C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB] -> File not found "C:\WINDOWS\system32\rundll32.exe" -> C:\WINDOWS\system32\rundll32.exe [C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App] -> [2008/04/13 18:12:33 | 00,050,688 | ---- | M] (Microsoft Corporation) "C:\WINDOWS\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019] -> [2008/04/13 18:12:34 | 00,158,720 | ---- | M] (Microsoft Corporation) < SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> "AlternateShell" -> cmd.exe -> < CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom -> "AutoRun" -> 1 -> "DisplayName" -> CD-ROM Driver -> "ImagePath" -> %SystemRoot%\system32\drivers\cdrom.sys [system32\DRIVERS\cdrom.sys] -> [2008/04/13 12:40:46 | 00,062,976 | ---- | M] (Microsoft Corporation) < Drives with AutoRun files > -> -> C:\AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ] -> [2007/10/04 10:29:05 | 00,000,000 | ---- | M] () < MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> \G HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell \G\Shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell\AutoRun \G\Shell\AutoRun\\"" -> [Auto&Play] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell\AutoRun\command \G\Shell\AutoRun\command\\"" -> G:\autorun.exe [G:\autorun.exe] -> File not found \H HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\Shell \H\Shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\Shell\AutoRun \H\Shell\AutoRun\\"" -> [Auto&Play] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\Shell\AutoRun\command \H\Shell\AutoRun\command\\"" -> H:\autorun.exe [H:\autorun.exe] -> File not found \J HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\Shell \J\Shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\Shell\AutoRun \J\Shell\AutoRun\\"" -> [Auto&Play] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\Shell\AutoRun\command \J\Shell\AutoRun\command\\"" -> J:\autorun.exe [J:\autorun.exe] -> File not found \K HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\Shell \K\Shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\Shell\AutoRun \K\Shell\AutoRun\\"" -> [Auto&Play] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\Shell\AutoRun\command \K\Shell\AutoRun\command\\"" -> K:\autorun.exe [K:\autorun.exe] -> File not found \L HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L\Shell \L\Shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L\Shell\AutoRun \L\Shell\AutoRun\\"" -> [Auto&Play] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L\Shell\AutoRun\command \L\Shell\AutoRun\command\\"" -> L:\autorun.exe [L:\autorun.exe] -> File not found \{f8b076fc-42df-11dd-afb8-001c256bdff3} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f8b076fc-42df-11dd-afb8-001c256bdff3}\Shell \{f8b076fc-42df-11dd-afb8-001c256bdff3}\Shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f8b076fc-42df-11dd-afb8-001c256bdff3}\Shell\AutoRun \{f8b076fc-42df-11dd-afb8-001c256bdff3}\Shell\AutoRun\\"" -> [Auto&Play] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f8b076fc-42df-11dd-afb8-001c256bdff3}\Shell\AutoRun\command \{f8b076fc-42df-11dd-afb8-001c256bdff3}\Shell\AutoRun\command\\"" -> G:\LaunchU3.exe [G:\LaunchU3.exe -a] -> File not found \{f8b076fd-42df-11dd-afb8-001c256bdff3} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f8b076fd-42df-11dd-afb8-001c256bdff3}\Shell\AutoRun\command \{f8b076fd-42df-11dd-afb8-001c256bdff3}\Shell\AutoRun\command\\"" -> H:\setupSNK.exe [H:\setupSNK.exe] -> File not found [Registry - Additional Scans - Safe List] < EventViewer Logs - Last 10 Errors > -> Event Information -> Description Application [ Error ] 2/3/2009 7:05:47 AM Computer Name = WNDY26 | Source = Adobe Version Cue CS3 | ID = 3 -> Description = Application [ Error ] 2/3/2009 7:05:47 AM Computer Name = WNDY26 | Source = Adobe Version Cue CS3 | ID = 3 -> Description = Application [ Error ] 2/3/2009 7:46:16 AM Computer Name = WNDY26 | Source = Application Error | ID = 1000 -> Description = Faulting application OOD2000.exe, version 3.5.562.1616, faulting module OOD2000.exe, version 3.5.562.1616, fault address 0x000319f6. Application [ Error ] 2/3/2009 4:17:04 PM Computer Name = WNDY26 | Source = Application Error | ID = 1000 -> Description = Faulting application OOD2000.exe, version 3.5.562.1616, faulting module OOD2000.exe, version 3.5.562.1616, fault address 0x000319f6. Application [ Error ] 2/3/2009 4:18:10 PM Computer Name = WNDY26 | Source = Application Error | ID = 1004 -> Description = Faulting application OOD2000.exe, version 3.5.562.1616, faulting module OOD2000.exe, version 3.5.562.1616, fault address 0x000319f6. Application [ Error ] 2/3/2009 4:46:22 PM Computer Name = WNDY26 | Source = Application Error | ID = 1000 -> Description = Faulting application prep.com, version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000. Application [ Error ] 2/3/2009 4:46:53 PM Computer Name = WNDY26 | Source = Application Error | ID = 1000 -> Description = Faulting application prep.com, version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000. Application [ Error ] 2/3/2009 4:54:25 PM Computer Name = WNDY26 | Source = Application Error | ID = 1000 -> Description = Faulting application prep.com, version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000. Application [ Error ] 2/3/2009 4:58:31 PM Computer Name = WNDY26 | Source = Application Error | ID = 1000 -> Description = Faulting application prep.com, version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000. Application [ Error ] 2/3/2009 5:08:37 PM Computer Name = WNDY26 | Source = Application Error | ID = 1000 -> Description = Faulting application OOD2000.exe, version 3.5.562.1616, faulting module OOD2000.exe, version 3.5.562.1616, fault address 0x000319f6. OSession [ Error ] 4/25/2008 11:28:51 PM Computer Name = WNDY26 | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6211.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 9601 seconds with 5520 seconds of active time. This session ended with a crash. OSession [ Error ] 5/21/2008 4:17:37 PM Computer Name = WNDY26 | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 84 seconds with 0 seconds of active time. This session ended with a crash. OSession [ Error ] 6/24/2008 3:10:44 AM Computer Name = WNDY26 | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6308.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 172 seconds with 60 seconds of active time. This session ended with a crash. OSession [ Error ] 8/8/2008 4:33:05 AM Computer Name = WNDY26 | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 20309 seconds with 180 seconds of active time. This session ended with a crash. OSession [ Error ] 9/12/2008 9:03:52 PM Computer Name = WNDY26 | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 8964 seconds with 2280 seconds of active time. This session ended with a crash. System [ Error ] 2/3/2009 4:12:14 PM Computer Name = WNDY26 | Source = Service Control Manager | ID = 7000 -> Description = The Windows Installer service failed to start due to the following error: %%14001 System [ Error ] 2/3/2009 4:12:21 PM Computer Name = WNDY26 | Source = SideBySide | ID = 16842811 -> Description = Resolve Partial Assembly failed for Microsoft.Windows.Common-Controls. Reference error message: Insufficient system resources exist to complete the requested service. . System [ Error ] 2/3/2009 4:12:21 PM Computer Name = WNDY26 | Source = SideBySide | ID = 16842811 -> Description = Generate Activation Context failed for C:\WINDOWS\system32\shimgvw.dll. Reference error message: The operation completed successfully. . System [ Error ] 2/3/2009 4:18:10 PM Computer Name = WNDY26 | Source = Service Control Manager | ID = 7000 -> Description = The Parallel port driver service failed to start due to the following error: %%1058 System [ Error ] 2/3/2009 4:18:10 PM Computer Name = WNDY26 | Source = Service Control Manager | ID = 7009 -> Description = Timeout (30000 milliseconds) waiting for the O&O Defrag 2000 service to connect. System [ Error ] 2/3/2009 4:18:10 PM Computer Name = WNDY26 | Source = Service Control Manager | ID = 7000 -> Description = The O&O Defrag 2000 service failed to start due to the following error: %%1053 System [ Error ] 2/3/2009 5:04:57 PM Computer Name = WNDY26 | Source = sr | ID = 1 -> Description = The System Restore filter encountered the unexpected error '0xC0000022' while processing the file 'rveefkde.exe' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. System [ Error ] 2/3/2009 5:09:49 PM Computer Name = WNDY26 | Source = Service Control Manager | ID = 7000 -> Description = The Parallel port driver service failed to start due to the following error: %%1058 System [ Error ] 2/3/2009 5:09:49 PM Computer Name = WNDY26 | Source = Service Control Manager | ID = 7009 -> Description = Timeout (30000 milliseconds) waiting for the O&O Defrag 2000 service to connect. System [ Error ] 2/3/2009 5:09:49 PM Computer Name = WNDY26 | Source = Service Control Manager | ID = 7000 -> Description = The O&O Defrag 2000 service failed to start due to the following error: %%1053 [Files/Folders - Created Within 30 Days] OTScanIt2 -> %UserProfile%\Desktop\OTScanIt2 -> [2009/02/03 15:10:03 | 00,000,000 | ---D | C] DrWeb.csv -> %UserProfile%\Desktop\DrWeb.csv -> [2009/02/03 15:06:11 | 00,000,186 | ---- | C] () DoctorWeb -> %UserProfile%\DoctorWeb -> [2009/02/03 15:01:54 | 00,000,000 | ---D | C] OTScanIt2.exe -> %UserProfile%\Desktop\OTScanIt2.exe -> [2009/02/03 15:00:19 | 00,656,714 | ---- | C] () drweb-cureit.exe -> %UserProfile%\Desktop\drweb-cureit.exe -> [2009/02/03 15:00:12 | 12,356,832 | ---- | C] (Doctor Web, Ltd.) 32788R22FWJFW -> %SystemDrive%\32788R22FWJFW -> [2009/02/03 14:58:20 | 00,000,000 | ---D | C] cmd.execf -> %SystemRoot%\System32\cmd.execf -> [2009/02/03 14:46:21 | 00,406,528 | ---- | C] (Microsoft Corporation) ComboFix.exe -> %UserProfile%\Desktop\ComboFix.exe -> [2009/02/03 14:40:33 | 03,126,530 | ---- | C] () ethptbbv.sys -> %SystemRoot%\System32\drivers\ethptbbv.sys -> [2009/02/03 14:26:09 | 00,137,280 | ---- | C] () ethakwnq.sys -> %SystemRoot%\System32\drivers\ethakwnq.sys -> [2009/02/03 14:26:05 | 00,137,280 | ---- | C] () ethwqzzu.sys -> %SystemRoot%\System32\drivers\ethwqzzu.sys -> [2009/02/03 14:25:50 | 00,137,280 | ---- | C] () ethfjkbp.sys -> %SystemRoot%\System32\drivers\ethfjkbp.sys -> [2009/02/03 14:25:47 | 00,137,280 | ---- | C] () ethgrwyi.sys -> %SystemRoot%\System32\drivers\ethgrwyi.sys -> [2009/02/03 14:25:44 | 00,137,280 | ---- | C] () ethztlzs.sys -> %SystemRoot%\System32\drivers\ethztlzs.sys -> [2009/02/03 14:25:42 | 00,137,280 | ---- | C] () ethyyoje.sys -> %SystemRoot%\System32\drivers\ethyyoje.sys -> [2009/02/03 14:25:35 | 00,137,280 | ---- | C] () ethctcow.sys -> %SystemRoot%\System32\drivers\ethctcow.sys -> [2009/02/03 14:25:32 | 00,137,280 | ---- | C] () ethibmbi.sys -> %SystemRoot%\System32\drivers\ethibmbi.sys -> [2009/02/03 14:25:24 | 00,137,280 | ---- | C] () ethjdsjw.sys -> %SystemRoot%\System32\drivers\ethjdsjw.sys -> [2009/02/03 14:25:22 | 00,137,280 | ---- | C] () ethqfvop.sys -> %SystemRoot%\System32\drivers\ethqfvop.sys -> [2009/02/03 14:25:17 | 00,137,280 | ---- | C] () ethlcaed.sys -> %SystemRoot%\System32\drivers\ethlcaed.sys -> [2009/02/03 14:25:12 | 00,137,280 | ---- | C] () xdva189.sys -> %SystemRoot%\System32\xdva189.sys -> [2009/02/03 14:24:55 | 00,137,280 | ---- | C] () xdva120.sys -> %SystemRoot%\System32\xdva120.sys -> [2009/02/03 14:24:53 | 00,137,280 | ---- | C] () ethxzpmy.sys -> %SystemRoot%\System32\drivers\ethxzpmy.sys -> [2009/02/03 14:24:51 | 00,137,280 | ---- | C] () ethxzcoe.sys -> %SystemRoot%\System32\drivers\ethxzcoe.sys -> [2009/02/03 14:24:49 | 00,137,280 | ---- | C] () ethvowqt.sys -> %SystemRoot%\System32\drivers\ethvowqt.sys -> [2009/02/03 14:24:47 | 00,137,280 | ---- | C] () ethuwqki.sys -> %SystemRoot%\System32\drivers\ethuwqki.sys -> [2009/02/03 14:24:45 | 00,137,280 | ---- | C] () ethuobhu.sys -> %SystemRoot%\System32\drivers\ethuobhu.sys -> [2009/02/03 14:24:43 | 00,137,280 | ---- | C] () ethulfdq.sys -> %SystemRoot%\System32\drivers\ethulfdq.sys -> [2009/02/03 14:24:41 | 00,137,280 | ---- | C] () ethtlmip.sys -> %SystemRoot%\System32\drivers\ethtlmip.sys -> [2009/02/03 14:24:39 | 00,137,280 | ---- | C] () ethnzjae.sys -> %SystemRoot%\System32\drivers\ethnzjae.sys -> [2009/02/03 14:24:37 | 00,137,280 | ---- | C] () ethmdqei.sys -> %SystemRoot%\System32\drivers\ethmdqei.sys -> [2009/02/03 14:24:35 | 00,137,280 | ---- | C] () ethkoouo.sys -> %SystemRoot%\System32\drivers\ethkoouo.sys -> [2009/02/03 14:24:33 | 00,137,280 | ---- | C] () ethhjgek.sys -> %SystemRoot%\System32\drivers\ethhjgek.sys -> [2009/02/03 14:24:31 | 00,137,280 | ---- | C] () ethavaao.sys -> %SystemRoot%\System32\drivers\ethavaao.sys -> [2009/02/03 14:24:29 | 00,137,280 | ---- | C] () eaglent.sys -> %SystemRoot%\System32\drivers\eaglent.sys -> [2009/02/03 14:24:27 | 00,137,280 | ---- | C] () secupdat.dat -> %SystemRoot%\System32\secupdat.dat -> [2009/02/03 14:20:25 | 00,066,560 | -H-- | C] () ndisio.sys -> %SystemRoot%\System32\drivers\ndisio.sys -> [2009/02/03 14:20:25 | 00,053,248 | ---- | C] () _id.dat -> %SystemRoot%\_id.dat -> [2009/02/03 14:18:44 | 00,000,003 | ---- | C] () adobe.bat -> %SystemRoot%\adobe.bat -> [2009/02/03 14:18:38 | 00,000,124 | ---- | C] () services.exe -> %SystemRoot%\services.exe -> [2009/02/03 14:18:34 | 00,233,636 | ---- | C] () Microsoft Visual Studio 8 -> %ProgramFiles%\Microsoft Visual Studio 8 -> [2009/02/03 02:31:09 | 00,000,000 | ---D | C] Recent -> %UserProfile%\Recent -> [2009/02/03 01:49:08 | 00,000,000 | RH-D | C] MegaManager.INI -> %SystemRoot%\MegaManager.INI -> [2009/02/03 01:41:13 | 00,000,050 | ---- | C] () Thumbs.db -> %AllUsersProfile%\Documents\Thumbs.db -> [2009/02/01 23:19:40 | 00,025,600 | -HS- | C] () Blizzard -> %AllUsersProfile%\Application Data\Blizzard -> [2009/02/01 16:40:25 | 00,000,000 | ---D | C] Blizzard Entertainment -> %CommonProgramFiles%\Blizzard Entertainment -> [2009/02/01 16:37:36 | 00,000,000 | ---D | C] Photoshop -> %UserProfile%\Desktop\Photoshop -> [2009/01/31 22:47:20 | 00,000,000 | ---D | C] Thumbs.db -> %UserProfile%\Desktop\Thumbs.db -> [2009/01/31 08:52:12 | 00,007,168 | -HS- | C] () Fonts -> %UserProfile%\Desktop\Fonts -> [2009/01/30 18:37:41 | 00,000,000 | ---D | C] test.gif -> %UserProfile%\Desktop\test.gif -> [2009/01/29 07:14:42 | 00,000,514 | ---- | C] () .gimp-2.6 -> %UserProfile%\.gimp-2.6 -> [2009/01/29 03:35:55 | 00,000,000 | ---D | C] .gegl-0.0 -> %UserProfile%\.gegl-0.0 -> [2009/01/29 03:35:50 | 00,000,000 | ---D | C] GIMP 2.lnk -> %AllUsersProfile%\Desktop\GIMP 2.lnk -> [2009/01/29 03:35:37 | 00,000,790 | ---- | C] () GIMP-2.0 -> %ProgramFiles%\GIMP-2.0 -> [2009/01/29 03:35:18 | 00,000,000 | ---D | C] 22.jpg -> %UserProfile%\Desktop\22.jpg -> [2009/01/29 01:59:06 | 00,024,264 | ---- | C] () Logitech -> %CommonProgramFiles%\Logitech -> [2009/01/28 16:48:56 | 00,000,000 | ---D | C] Megaupload -> %AllUsersProfile%\Application Data\Megaupload -> [2009/01/28 15:34:43 | 00,000,000 | ---D | C] EmailNotifier -> %AppData%\EmailNotifier -> [2009/01/28 15:34:42 | 00,000,000 | ---D | C] EmailNotifier -> %AllUsersProfile%\Application Data\EmailNotifier -> [2009/01/28 15:34:42 | 00,000,000 | ---D | C] gimp-2.6.4-i686-setup.exe -> %UserProfile%\Desktop\gimp-2.6.4-i686-setup.exe -> [2009/01/27 14:18:36 | 15,892,408 | ---- | C] ( ) stdstyles.css -> %UserProfile%\Desktop\stdstyles.css -> [2009/01/25 14:18:21 | 00,006,128 | ---- | C] () bodystyles.css -> %UserProfile%\Desktop\bodystyles.css -> [2009/01/25 14:18:09 | 00,006,483 | ---- | C] () comingsoon.png -> %AllUsersProfile%\Documents\comingsoon.png -> [2009/01/24 21:40:17 | 00,070,812 | ---- | C] () hammer_kirby.gif -> %AllUsersProfile%\Documents\hammer_kirby.gif -> [2009/01/24 21:19:14 | 00,020,846 | ---- | C] () Cherry copy.png -> %AllUsersProfile%\Documents\Cherry copy.png -> [2009/01/24 18:55:57 | 00,120,744 | ---- | C] () Cherry.png -> %AllUsersProfile%\Documents\Cherry.png -> [2009/01/24 18:52:53 | 00,006,146 | ---- | C] () Brushes -> %AllUsersProfile%\Documents\Brushes -> [2009/01/24 16:47:05 | 00,000,000 | ---D | C] ShadowEvil's_Slasher-450002.sql -> %AllUsersProfile%\Documents\ShadowEvil's_Slasher-450002.sql -> [2009/01/24 10:38:56 | 00,002,183 | ---- | C] () ShadowEvil's_Slasher-45000.sql -> %AllUsersProfile%\Documents\ShadowEvil's_Slasher-45000.sql -> [2009/01/24 10:38:47 | 00,002,184 | ---- | C] () Bee'sScreenie.scr -> %UserProfile%\Desktop\Bee'sScreenie.scr -> [2009/01/23 21:31:43 | 00,734,404 | ---- | C] () Screensaver Factory 4 Enterprise.lnk -> %UserProfile%\Desktop\Screensaver Factory 4 Enterprise.lnk -> [2009/01/23 21:13:19 | 00,000,743 | ---- | C] () Screensaver Factory 4 Enterprise -> %ProgramFiles%\Screensaver Factory 4 Enterprise -> [2009/01/23 21:13:16 | 00,000,000 | ---D | C] Blumentals -> %AppData%\Blumentals -> [2009/01/23 21:13:16 | 00,000,000 | ---D | C] uTorrent -> %AppData%\uTorrent -> [2009/01/23 20:54:59 | 00,000,000 | ---D | C] 5 Paragraph Cloning Paper.doc -> %UserProfile%\Desktop\5 Paragraph Cloning Paper.doc -> [2009/01/18 12:06:50 | 00,029,696 | ---- | C] () Seether -> %UserProfile%\Desktop\Seether -> [2009/01/18 11:26:41 | 00,000,000 | ---D | C] 015-b.gif -> %AllUsersProfile%\Documents\015-b.gif -> [2009/01/16 15:16:43 | 02,130,951 | ---- | C] () Attachment.pdf -> %UserProfile%\Desktop\Attachment.pdf -> [2009/01/15 07:37:00 | 00,098,605 | ---- | C] () snow3.fla -> %UserProfile%\Desktop\snow3.fla -> [2009/01/15 06:51:26 | 00,342,528 | ---- | C] () snow3_v2.zip -> %UserProfile%\Desktop\snow3_v2.zip -> [2009/01/15 06:38:40 | 00,031,237 | ---- | C] () snow3.swf -> %UserProfile%\Desktop\snow3.swf -> [2009/01/15 06:14:51 | 00,031,121 | ---- | C] () snow3.zip -> %UserProfile%\Desktop\snow3.zip -> [2009/01/15 06:13:52 | 00,096,012 | ---- | C] () rotatingCircles.swf -> %UserProfile%\Desktop\rotatingCircles.swf -> [2009/01/15 04:14:30 | 00,005,065 | ---- | C] () BlueCircle.as -> %UserProfile%\Desktop\BlueCircle.as -> [2009/01/15 04:13:15 | 00,000,519 | ---- | C] () rotatingCircles.fla -> %UserProfile%\Desktop\rotatingCircles.fla -> [2009/01/15 04:11:47 | 00,023,040 | ---- | C] () Oral Book Report.doc -> %UserProfile%\Desktop\Oral Book Report.doc -> [2009/01/14 18:42:28 | 00,028,160 | ---- | C] () www -> %AllUsersProfile%\Documents\www -> [2009/01/13 23:30:12 | 00,000,000 | ---D | C] Sims 2 -> %UserProfile%\Desktop\Sims 2 -> [2009/01/12 13:03:29 | 00,000,000 | ---D | C] Shit -> %UserProfile%\Desktop\Shit -> [2009/01/12 13:02:03 | 00,000,000 | ---D | C] ALCHUNIN.EXE -> %SystemRoot%\ALCHUNIN.EXE -> [2009/01/09 08:31:22 | 00,233,472 | ---- | C] () My GIF Animations -> %UserProfile%\My Documents\My GIF Animations -> [2009/01/09 08:31:20 | 00,000,000 | ---D | C] Alchemy Mindworks -> %ProgramFiles%\Alchemy Mindworks -> [2009/01/09 08:31:17 | 00,000,000 | ---D | C] Alchemy Mindworks -> %AppData%\Alchemy Mindworks -> [2009/01/09 08:30:40 | 00,000,000 | ---D | C] xrwuphmh.job -> %SystemRoot%\tasks\xrwuphmh.job -> [2009/01/06 03:55:53 | 00,000,310 | ---- | C] () libmysql_c.dll -> %SystemRoot%\System32\libmysql_c.dll -> [2009/01/04 15:36:53 | 01,073,152 | ---- | C] () PremiumSoft -> %ProgramFiles%\PremiumSoft -> [2009/01/04 15:36:51 | 00,000,000 | ---D | C] [Files/Folders - Modified Within 30 Days] 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> 26 C:\Documents and Settings\Owner\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Owner\Local Settings\Temp\*.tmp -> 26 C:\Documents and Settings\Owner\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Owner\Local Settings\Temp\*.tmp -> _start.dat -> %UserProfile%\Local Settings\Temp\RarSFX0\_start.dat -> [2009/02/03 23:30:02 | 00,352,326 | ---- | M] () User_Feed_Synchronization-{83513662-F6F8-4736-BD81-E1ABA64CAAE7}.job -> %SystemRoot%\tasks\User_Feed_Synchronization-{83513662-F6F8-4736-BD81-E1ABA64CAAE7}.job -> [2009/02/03 15:19:06 | 00,000,422 | -H-- | M] () index.dat -> %UserProfile%\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat -> [2009/02/03 15:19:04 | 00,786,432 | -HS- | M] () index.dat -> %UserProfile%\Local Settings\Temp\History\History.IE5\index.dat -> [2009/02/03 15:19:04 | 00,131,072 | -HS- | M] () index.dat -> %UserProfile%\Local Settings\Temp\Cookies\index.dat -> [2009/02/03 15:19:04 | 00,049,152 | -HS- | M] () MP Scheduled Scan.job -> %SystemRoot%\tasks\MP Scheduled Scan.job -> [2009/02/03 15:11:16 | 00,000,330 | -H-- | M] () index.dat -> %UserProfile%\Local Settings\Temp\History\History.IE5\MSHist012009020320090204\index.dat -> [2009/02/03 15:10:28 | 00,065,536 | -HS- | M] () Perflib_Perfdata_1994.dat -> %SystemRoot%\Temp\Perflib_Perfdata_1994.dat -> [2009/02/03 15:09:22 | 00,016,384 | ---- | M] () adobe.bat -> %SystemRoot%\adobe.bat -> [2009/02/03 15:09:14 | 00,000,124 | ---- | M] () nvapps.xml -> %SystemRoot%\System32\nvapps.xml -> [2009/02/03 15:09:07 | 00,196,272 | ---- | M] () Perflib_Perfdata_1d44.dat -> %SystemRoot%\Temp\Perflib_Perfdata_1d44.dat -> [2009/02/03 15:09:02 | 00,016,384 | ---- | M] () Perflib_Perfdata_1798.dat -> %SystemRoot%\Temp\Perflib_Perfdata_1798.dat -> [2009/02/03 15:08:33 | 00,000,000 | ---- | M] () xrwuphmh.job -> %SystemRoot%\tasks\xrwuphmh.job -> [2009/02/03 15:08:19 | 00,000,310 | ---- | M] () SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [2009/02/03 15:08:19 | 00,000,006 | -H-- | M] () bootstat.dat -> %SystemRoot%\bootstat.dat -> [2009/02/03 15:08:12 | 00,002,048 | --S- | M] () hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [2009/02/03 15:08:10 | 21,458,94400 | -HS- | M] () NTUSER.DAT -> %UserProfile%\NTUSER.DAT -> [2009/02/03 15:07:16 | 16,777,216 | -H-- | M] () ntuser.ini -> %UserProfile%\ntuser.ini -> [2009/02/03 15:07:11 | 00,000,178 | -HS- | M] () DrWeb.csv -> %UserProfile%\Desktop\DrWeb.csv -> [2009/02/03 15:06:11 | 00,000,186 | ---- | M] () OTScanIt2.exe -> %UserProfile%\Desktop\OTScanIt2.exe -> [2009/02/03 15:00:26 | 00,656,714 | ---- | M] () drweb-cureit.exe -> %UserProfile%\Desktop\drweb-cureit.exe -> [2009/02/03 15:00:24 | 12,356,832 | ---- | M] (Doctor Web, Ltd.) b2e.dll -> %UserProfile%\Local Settings\Temp\B.tmp\b2e.dll -> [2009/02/03 14:58:31 | 00,032,256 | ---- | M] () cmd.execf -> %SystemRoot%\System32\cmd.execf -> [2009/02/03 14:58:29 | 00,406,528 | ---- | M] (Microsoft Corporation) b2e.dll -> %UserProfile%\Local Settings\Temp\A.tmp\b2e.dll -> [2009/02/03 14:54:25 | 00,032,256 | ---- | M] () b2e.dll -> %UserProfile%\Local Settings\Temp\9.tmp\b2e.dll -> [2009/02/03 14:46:53 | 00,032,256 | ---- | M] () b2e.dll -> %UserProfile%\Local Settings\Temp\8.tmp\b2e.dll -> [2009/02/03 14:46:22 | 00,032,256 | ---- | M] () ComboFix.exe -> %UserProfile%\Desktop\ComboFix.exe -> [2009/02/03 14:40:53 | 03,126,530 | ---- | M] () index.dat -> %SystemRoot%\Temp\Temporary Internet Files\Content.IE5\index.dat -> [2009/02/03 14:30:52 | 00,032,768 | -HS- | M] () index.dat -> %SystemRoot%\Temp\History\History.IE5\index.dat -> [2009/02/03 14:30:52 | 00,016,384 | -HS- | M] () index.dat -> %SystemRoot%\Temp\Cookies\index.dat -> [2009/02/03 14:30:52 | 00,016,384 | -HS- | M] () ethptbbv.sys -> %SystemRoot%\System32\drivers\ethptbbv.sys -> [2009/02/03 14:26:09 | 00,137,280 | ---- | M] () ethakwnq.sys -> %SystemRoot%\System32\drivers\ethakwnq.sys -> [2009/02/03 14:26:05 | 00,137,280 | ---- | M] () ethwqzzu.sys -> %SystemRoot%\System32\drivers\ethwqzzu.sys -> [2009/02/03 14:25:50 | 00,137,280 | ---- | M] () ethfjkbp.sys -> %SystemRoot%\System32\drivers\ethfjkbp.sys -> [2009/02/03 14:25:47 | 00,137,280 | ---- | M] () ethgrwyi.sys -> %SystemRoot%\System32\drivers\ethgrwyi.sys -> [2009/02/03 14:25:44 | 00,137,280 | ---- | M] () ethztlzs.sys -> %SystemRoot%\System32\drivers\ethztlzs.sys -> [2009/02/03 14:25:42 | 00,137,280 | ---- | M] () ethyyoje.sys -> %SystemRoot%\System32\drivers\ethyyoje.sys -> [2009/02/03 14:25:35 | 00,137,280 | ---- | M] () ethctcow.sys -> %SystemRoot%\System32\drivers\ethctcow.sys -> [2009/02/03 14:25:32 | 00,137,280 | ---- | M] () ethibmbi.sys -> %SystemRoot%\System32\drivers\ethibmbi.sys -> [2009/02/03 14:25:24 | 00,137,280 | ---- | M] () ethjdsjw.sys -> %SystemRoot%\System32\drivers\ethjdsjw.sys -> [2009/02/03 14:25:22 | 00,137,280 | ---- | M] () ethqfvop.sys -> %SystemRoot%\System32\drivers\ethqfvop.sys -> [2009/02/03 14:25:17 | 00,137,280 | ---- | M] () ethlcaed.sys -> %SystemRoot%\System32\drivers\ethlcaed.sys -> [2009/02/03 14:25:12 | 00,137,280 | ---- | M] () xdva189.sys -> %SystemRoot%\System32\xdva189.sys -> [2009/02/03 14:24:55 | 00,137,280 | ---- | M] () xdva120.sys -> %SystemRoot%\System32\xdva120.sys -> [2009/02/03 14:24:53 | 00,137,280 | ---- | M] () ethxzpmy.sys -> %SystemRoot%\System32\drivers\ethxzpmy.sys -> [2009/02/03 14:24:51 | 00,137,280 | ---- | M] () ethxzcoe.sys -> %SystemRoot%\System32\drivers\ethxzcoe.sys -> [2009/02/03 14:24:49 | 00,137,280 | ---- | M] () ethvowqt.sys -> %SystemRoot%\System32\drivers\ethvowqt.sys -> [2009/02/03 14:24:47 | 00,137,280 | ---- | M] () ethuwqki.sys -> %SystemRoot%\System32\drivers\ethuwqki.sys -> [2009/02/03 14:24:45 | 00,137,280 | ---- | M] () ethuobhu.sys -> %SystemRoot%\System32\drivers\ethuobhu.sys -> [2009/02/03 14:24:43 | 00,137,280 | ---- | M] () ethulfdq.sys -> %SystemRoot%\System32\drivers\ethulfdq.sys -> [2009/02/03 14:24:41 | 00,137,280 | ---- | M] () ethtlmip.sys -> %SystemRoot%\System32\drivers\ethtlmip.sys -> [2009/02/03 14:24:39 | 00,137,280 | ---- | M] () ethnzjae.sys -> %SystemRoot%\System32\drivers\ethnzjae.sys -> [2009/02/03 14:24:37 | 00,137,280 | ---- | M] () ethmdqei.sys -> %SystemRoot%\System32\drivers\ethmdqei.sys -> [2009/02/03 14:24:35 | 00,137,280 | ---- | M] () ethkoouo.sys -> %SystemRoot%\System32\drivers\ethkoouo.sys -> [2009/02/03 14:24:33 | 00,137,280 | ---- | M] () ethhjgek.sys -> %SystemRoot%\System32\drivers\ethhjgek.sys -> [2009/02/03 14:24:31 | 00,137,280 | ---- | M] () ethavaao.sys -> %SystemRoot%\System32\drivers\ethavaao.sys -> [2009/02/03 14:24:29 | 00,137,280 | ---- | M] () eaglent.sys -> %SystemRoot%\System32\drivers\eaglent.sys -> [2009/02/03 14:24:27 | 00,137,280 | ---- | M] () _id.dat -> %SystemRoot%\_id.dat -> [2009/02/03 14:21:12 | 00,000,003 | ---- | M] () secupdat.dat -> %SystemRoot%\System32\secupdat.dat -> [2009/02/03 14:20:25 | 00,066,560 | -H-- | M] () ndisio.sys -> %SystemRoot%\System32\drivers\ndisio.sys -> [2009/02/03 14:20:25 | 00,053,248 | ---- | M] () incavi.avm -> %SystemRoot%\System32\drivers\Avg\incavi.avm -> [2009/02/03 14:18:42 | 32,749,615 | ---- | M] () services.exe -> %SystemRoot%\services.exe -> [2009/02/03 14:18:34 | 00,233,636 | ---- | M] () Perflib_Perfdata_834.dat -> %SystemRoot%\Temp\Perflib_Perfdata_834.dat -> [2009/02/03 14:17:13 | 00,016,384 | ---- | M] () Perflib_Perfdata_9a0.dat -> %SystemRoot%\Temp\Perflib_Perfdata_9a0.dat -> [2009/02/03 05:46:41 | 00,016,384 | ---- | M] () Perflib_Perfdata_690.dat -> %SystemRoot%\Temp\Perflib_Perfdata_690.dat -> [2009/02/03 05:46:13 | 00,016,384 | ---- | M] () wpa.dbl -> %SystemRoot%\System32\wpa.dbl -> [2009/02/03 05:46:10 | 00,013,730 | ---- | M] () FNTCACHE.DAT -> %SystemRoot%\System32\FNTCACHE.DAT -> [2009/02/03 05:45:48 | 00,288,496 | ---- | M] () GDIPFONTCACHEV1.DAT -> %UserProfile%\Local Settings\Application Data\GDIPFONTCACHEV1.DAT -> [2009/02/03 04:46:32 | 00,074,208 | ---- | M] () My Sharing Folders.lnk -> %UserProfile%\My Documents\My Sharing Folders.lnk -> [2009/02/03 02:33:07 | 00,000,565 | ---- | M] () mbam.check[1].database -> %UserProfile%\Local Settings\Temp\Temporary Internet Files\Content.IE5\ZA3YOZSD\mbam.check[1].database -> [2009/02/03 01:54:48 | 00,000,004 | ---- | M] () MegaManager.INI -> %SystemRoot%\MegaManager.INI -> [2009/02/03 01:41:13 | 00,000,050 | ---- | M] () Perflib_Perfdata_880.dat -> %SystemRoot%\Temp\Perflib_Perfdata_880.dat -> [2009/02/03 01:25:43 | 00,016,384 | ---- | M] () Perflib_Perfdata_7fc.dat -> %SystemRoot%\Temp\Perflib_Perfdata_7fc.dat -> [2009/02/03 01:25:07 | 00,016,384 | ---- | M] () qmgr1.dat -> %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [2009/02/03 01:11:57 | 00,005,491 | ---- | M] () qmgr0.dat -> %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [2009/02/03 01:11:57 | 00,004,232 | ---- | M] () desktop.ini -> %UserProfile%\My Documents\desktop.ini -> [2009/02/03 01:11:33 | 00,000,077 | -HS- | M] () microavi.avg -> %SystemRoot%\System32\drivers\Avg\microavi.avg -> [2009/02/02 22:41:18 | 00,085,942 | ---- | M] () Thumbs.db -> %AllUsersProfile%\Documents\Thumbs.db -> [2009/02/01 23:19:43 | 00,025,600 | -HS- | M] () Thumbs.db -> %UserProfile%\Desktop\Thumbs.db -> [2009/01/31 08:52:20 | 00,007,168 | -HS- | M] () avgldx86.sys -> %SystemRoot%\System32\drivers\avgldx86.sys -> [2009/01/29 23:26:02 | 00,325,128 | ---- | M] (AVG Technologies CZ, s.r.o.) avgmfx86.sys -> %SystemRoot%\System32\drivers\avgmfx86.sys -> [2009/01/29 23:26:02 | 00,027,656 | ---- | M] (AVG Technologies CZ, s.r.o.) avgrsstx.dll -> %SystemRoot%\System32\avgrsstx.dll -> [2009/01/29 23:26:02 | 00,010,520 | ---- | M] (AVG Technologies CZ, s.r.o.) test.gif -> %UserProfile%\Desktop\test.gif -> [2009/01/29 07:14:42 | 00,000,514 | ---- | M] () GIMP 2.lnk -> %AllUsersProfile%\Desktop\GIMP 2.lnk -> [2009/01/29 03:35:37 | 00,000,790 | ---- | M] () 22.jpg -> %UserProfile%\Desktop\22.jpg -> [2009/01/29 01:58:22 | 00,024,264 | ---- | M] () sp_setpoint.exe -> %UserProfile%\Local Settings\Temp\sp_setpoint.exe -> [2009/01/28 16:48:44 | 01,869,888 | ---- | M] (Logitech, Inc.) system.ini -> %SystemRoot%\system.ini -> [2009/01/27 14:21:49 | 00,000,227 | ---- | M] () gimp-2.6.4-i686-setup.exe -> %UserProfile%\Desktop\gimp-2.6.4-i686-setup.exe -> [2009/01/27 14:18:37 | 15,892,408 | ---- | M] ( ) vbaddin.ini -> %SystemRoot%\vbaddin.ini -> [2009/01/26 15:55:09 | 00,000,117 | ---- | M] () 5 Paragraph Cloning Paper.doc -> %UserProfile%\Desktop\5 Paragraph Cloning Paper.doc -> [2009/01/26 15:34:49 | 00,029,696 | ---- | M] () stdstyles.css -> %UserProfile%\Desktop\stdstyles.css -> [2009/01/25 14:18:22 | 00,006,128 | ---- | M] () bodystyles.css -> %UserProfile%\Desktop\bodystyles.css -> [2009/01/25 14:18:11 | 00,006,483 | ---- | M] () comingsoon.png -> %AllUsersProfile%\Documents\comingsoon.png -> [2009/01/24 21:40:19 | 00,070,812 | ---- | M] () hammer_kirby.gif -> %AllUsersProfile%\Documents\hammer_kirby.gif -> [2009/01/24 21:18:58 | 00,020,846 | ---- | M] () Cherry copy.png -> %AllUsersProfile%\Documents\Cherry copy.png -> [2009/01/24 18:55:59 | 00,120,744 | ---- | M] () ShadowEvil's_Slasher-450002.sql -> %AllUsersProfile%\Documents\ShadowEvil's_Slasher-450002.sql -> [2009/01/24 10:38:56 | 00,002,183 | ---- | M] () ShadowEvil's_Slasher-45000.sql -> %AllUsersProfile%\Documents\ShadowEvil's_Slasher-45000.sql -> [2009/01/24 10:38:47 | 00,002,184 | ---- | M] () Bee'sScreenie.scr -> %UserProfile%\Desktop\Bee'sScreenie.scr -> [2009/01/23 21:31:43 | 00,734,404 | ---- | M] () Screensaver Factory 4 Enterprise.lnk -> %UserProfile%\Desktop\Screensaver Factory 4 Enterprise.lnk -> [2009/01/23 21:13:19 | 00,000,743 | ---- | M] () Cherry.png -> %AllUsersProfile%\Documents\Cherry.png -> [2009/01/22 03:29:40 | 00,006,146 | ---- | M] () HsInfo.dat -> %SystemRoot%\System32\HsInfo.dat -> [2009/01/21 17:02:51 | 00,000,096 | -H-- | M] () IconCache.db -> %UserProfile%\Local Settings\Application Data\IconCache.db -> [2009/01/19 16:16:23 | 03,708,432 | -H-- | M] () DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> %UserProfile%\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2009/01/19 15:04:21 | 00,100,352 | ---- | M] () NeroDigital.ini -> %SystemRoot%\NeroDigital.ini -> [2009/01/19 15:04:21 | 00,000,182 | ---- | M] () default.pls -> %UserProfile%\default.pls -> [2009/01/18 13:51:42 | 00,000,135 | ---- | M] () 015-b.gif -> %AllUsersProfile%\Documents\015-b.gif -> [2009/01/16 15:16:51 | 02,130,951 | ---- | M] () snow3.fla -> %UserProfile%\Desktop\snow3.fla -> [2009/01/15 18:04:34 | 00,342,528 | ---- | M] () Attachment.pdf -> %UserProfile%\Desktop\Attachment.pdf -> [2009/01/15 07:37:00 | 00,098,605 | ---- | M] () snow3.swf -> %UserProfile%\Desktop\snow3.swf -> [2009/01/15 06:53:46 | 00,031,121 | ---- | M] () snow3.zip -> %UserProfile%\Desktop\snow3.zip -> [2009/01/15 06:51:14 | 00,096,012 | ---- | M] () snow3_v2.zip -> %UserProfile%\Desktop\snow3_v2.zip -> [2009/01/15 06:38:40 | 00,031,237 | ---- | M] () rotatingCircles.swf -> %UserProfile%\Desktop\rotatingCircles.swf -> [2009/01/15 04:28:32 | 00,005,065 | ---- | M] () BlueCircle.as -> %UserProfile%\Desktop\BlueCircle.as -> [2009/01/15 04:13:56 | 00,000,519 | ---- | M] () rotatingCircles.fla -> %UserProfile%\Desktop\rotatingCircles.fla -> [2009/01/15 04:11:47 | 00,023,040 | ---- | M] () Oral Book Report.doc -> %UserProfile%\Desktop\Oral Book Report.doc -> [2009/01/14 18:42:29 | 00,028,160 | ---- | M] () mbamswissarmy.sys -> %SystemRoot%\System32\drivers\mbamswissarmy.sys -> [2009/01/14 16:11:32 | 00,038,496 | ---- | M] (Malwarebytes Corporation) mbam.sys -> %SystemRoot%\System32\drivers\mbam.sys -> [2009/01/14 16:11:28 | 00,015,504 | ---- | M] (Malwarebytes Corporation) MRT.exe -> %SystemRoot%\System32\MRT.exe -> [2009/01/09 19:35:28 | 20,853,704 | ---- | M] (Microsoft Corporation) win.ini -> %SystemRoot%\win.ini -> [2009/01/07 02:00:08 | 00,000,654 | ---- | M] () english.dll -> %UserProfile%\Local Settings\Temp\SansaUpdater\english.dll -> [2008/12/20 21:17:23 | 00,009,216 | ---- | M] () setup.dll -> %UserProfile%\Local Settings\Temp\RarSFX0\setup.dll -> [2008/12/18 22:55:28 | 03,694,080 | ---- | M] (Doctor Web, Ltd.) setup.exe -> %UserProfile%\Local Settings\Temp\RarSFX0\setup.exe -> [2008/12/18 11:45:00 | 01,709,296 | ---- | M] () 6ce05c75687db6c3d50180f39100f016.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\6ce05c75687db6c3d50180f39100f016.dll -> [2008/11/09 16:41:46 | 00,028,672 | R--- | M] () 1ade6a75a979eec2d1defa6eb379f4c0.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\1ade6a75a979eec2d1defa6eb379f4c0.dll -> [2008/11/09 16:41:45 | 00,032,768 | R--- | M] () ac3b561b5714be75d2bb12a8bd64f98b.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\ac3b561b5714be75d2bb12a8bd64f98b.dll -> [2008/11/09 16:40:08 | 00,032,768 | R--- | M] () c5a9777725b8ff346c50659b7760ca9b.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\c5a9777725b8ff346c50659b7760ca9b.dll -> [2008/11/09 16:40:00 | 00,487,424 | R--- | M] () 533c3946ba3f7bcd90f0a06813186a5b.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\533c3946ba3f7bcd90f0a06813186a5b.dll -> [2008/11/09 16:40:00 | 00,155,648 | R--- | M] () 0e70205b23f4c095c6914fe4101a50bd.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\0e70205b23f4c095c6914fe4101a50bd.dll -> [2008/11/09 16:40:00 | 00,077,824 | R--- | M] () 5e207dd79c18780b5fce6f413eec12c0.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\5e207dd79c18780b5fce6f413eec12c0.dll -> [2008/11/09 16:40:00 | 00,061,440 | R--- | M] () 6c8cbf58f07b6d40d406d0befd1a9831.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\6c8cbf58f07b6d40d406d0befd1a9831.dll -> [2008/11/09 16:40:00 | 00,049,152 | R--- | M] () be7e353d1efdb66c7fe86595feba2206.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\be7e353d1efdb66c7fe86595feba2206.dll -> [2008/11/09 16:40:00 | 00,045,056 | R--- | M] () d0e338b83c6968dc8db6d254756ae7db.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\d0e338b83c6968dc8db6d254756ae7db.dll -> [2008/11/09 16:40:00 | 00,032,768 | R--- | M] () eb9a324484575899cf1bec33b43a56c2.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\eb9a324484575899cf1bec33b43a56c2.dll -> [2008/11/09 16:40:00 | 00,028,672 | R--- | M] () c19933b0daf80774a8c11c6ec1caa7bf.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\c19933b0daf80774a8c11c6ec1caa7bf.dll -> [2008/11/09 16:40:00 | 00,028,672 | R--- | M] () 3f85f0530d6aef9985639aafadac2fc1.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\3f85f0530d6aef9985639aafadac2fc1.dll -> [2008/11/09 16:40:00 | 00,024,576 | R--- | M] () 3ddfcd6051c844e591ebfed4835b0035.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\3ddfcd6051c844e591ebfed4835b0035.dll -> [2008/11/09 16:40:00 | 00,024,576 | R--- | M] () da448330e0b0cf948b2e0da6204129ed.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\da448330e0b0cf948b2e0da6204129ed.dll -> [2008/11/09 16:39:59 | 00,032,879 | R--- | M] () fe78322a8994bfeb4ede9420d8595321.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\fe78322a8994bfeb4ede9420d8595321.dll -> [2008/11/09 16:39:59 | 00,024,576 | R--- | M] () 5aae87e6620ab1cf1ec4dbd00266a2c1.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\5aae87e6620ab1cf1ec4dbd00266a2c1.dll -> [2008/11/09 16:39:59 | 00,024,576 | R--- | M] () c8ceb6e8f4968634b8643eb32b388c2c.dll -> %UserProfile%\Local Settings\Temp\pdk-Owner\c8ceb6e8f4968634b8643eb32b388c2c.dll -> [2008/11/09 16:39:59 | 00,020,480 | R--- | M] () progupd.dll -> %UserProfile%\Local Settings\Temp\progupd.dll -> [2008/10/21 11:16:01 | 00,083,808 | ---- | M] (AOL LLC.) _start.exe -> %UserProfile%\Local Settings\Temp\RarSFX0\_start.exe -> [2008/09/15 13:31:56 | 00,116,024 | ---- | M] (Doctor Web, Ltd.) opa11.dat -> %AllUsersProfile%\Application Data\Microsoft\OFFICE\DATA\opa11.dat -> [2008/08/08 03:18:16 | 00,008,206 | ---- | M] () hhcolreg.dat -> %AllUsersProfile%\Application Data\Microsoft\HTML Help\hhcolreg.dat -> [2008/04/26 03:48:14 | 00,001,312 | ---- | M] () opa12.dat -> %AllUsersProfile%\Application Data\Microsoft\OFFICE\DATA\opa12.dat -> [2008/03/06 03:43:47 | 00,008,206 | ---- | M] () dwebio16.dll -> %UserProfile%\Local Settings\Temp\RarSFX0\dwebio16.dll -> [2004/08/19 03:33:00 | 00,025,664 | ---- | M] (Doctor Web Ltd. ) dwebio32.dll -> %UserProfile%\Local Settings\Temp\RarSFX0\dwebio32.dll -> [2004/08/19 03:33:00 | 00,024,576 | ---- | M] (Doctor Web Ltd.) [Alternate Data Streams] @Alternate Data Stream - 0 bytes -> %AllUsersProfile%\Documents\Thumbs.db:encryptable @Alternate Data Stream - 0 bytes -> %SystemRoot%\Thumbs.db:encryptable @Alternate Data Stream - 0 bytes -> %UserProfile%\Desktop\Thumbs.db:encryptable @Alternate Data Stream - 124 bytes -> %SystemRoot%\System32\apqymrfa.exe:changelist @Alternate Data Stream - 263333 bytes -> %SystemRoot%\Temp:temp @Alternate Data Stream - 3638 bytes -> %UserProfile%\Desktop\blogger Dashboard.url:favicon [File - Lop Check] Application Data -> C:\Documents and Settings\All Users\Application Data -> [2009/02/02 23:23:29 | 00,000,000 | RH-D | M] Age of Empires 3 -> C:\Documents and Settings\All Users\Application Data\Age of Empires 3 -> [2008/07/17 05:42:02 | 00,000,000 | ---D | M] Ahead -> C:\Documents and Settings\All Users\Application Data\Ahead -> [2008/09/03 11:57:34 | 00,000,000 | ---D | M] ALM -> C:\Documents and Settings\All Users\Application Data\ALM -> [2008/03/06 04:23:48 | 00,000,000 | ---D | M] Autodesk -> C:\Documents and Settings\All Users\Application Data\Autodesk -> [2008/03/21 18:58:18 | 00,000,000 | ---D | M] Blizzard -> C:\Documents and Settings\All Users\Application Data\Blizzard -> [2009/02/01 16:40:25 | 00,000,000 | ---D | M] Broderbund -> C:\Documents and Settings\All Users\Application Data\Broderbund -> [2008/08/09 13:47:26 | 00,000,000 | ---D | M] DAEMON Tools Pro -> C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro -> [2008/12/08 16:22:49 | 00,000,000 | ---D | M] Digital Film Tools -> C:\Documents and Settings\All Users\Application Data\Digital Film Tools -> [2008/05/09 00:14:04 | 00,000,000 | ---D | M] EmailNotifier -> C:\Documents and Settings\All Users\Application Data\EmailNotifier -> [2009/01/28 15:34:42 | 00,000,000 | ---D | M] Extensis -> C:\Documents and Settings\All Users\Application Data\Extensis -> [2008/11/09 23:45:14 | 00,000,000 | ---D | M] FLEXnet -> C:\Documents and Settings\All Users\Application Data\FLEXnet -> [2008/11/09 00:34:23 | 00,000,000 | ---D | M] Indentix -> C:\Documents and Settings\All Users\Application Data\Indentix -> [2008/09/22 12:59:27 | 00,000,000 | ---D | M] LightScribe -> C:\Documents and Settings\All Users\Application Data\LightScribe -> [2008/03/08 19:34:46 | 00,000,000 | ---D | M] LogiShrd -> C:\Documents and Settings\All Users\Application Data\LogiShrd -> [2008/07/21 12:34:11 | 00,000,000 | ---D | M] Megaupload -> C:\Documents and Settings\All Users\Application Data\Megaupload -> [2009/01/28 15:34:43 | 00,000,000 | ---D | M] TEMP -> C:\Documents and Settings\All Users\Application Data\TEMP -> [2008/12/17 15:29:33 | 00,000,000 | ---D | M] Viewpoint -> C:\Documents and Settings\All Users\Application Data\Viewpoint -> [2008/12/22 21:38:24 | 00,000,000 | ---D | M] WinZip -> C:\Documents and Settings\All Users\Application Data\WinZip -> [2008/06/21 14:15:36 | 00,000,000 | ---D | M] WinZipSE -> C:\Documents and Settings\All Users\Application Data\WinZipSE -> [2008/06/21 14:11:53 | 00,000,000 | ---D | M] Application Data -> C:\Documents and Settings\Default User\Application Data -> [2007/10/04 05:22:13 | 00,000,000 | RH-D | M] Application Data -> C:\Documents and Settings\LocalService\Application Data -> [2008/05/19 02:55:44 | 00,000,000 | ---D | M] Application Data -> C:\Documents and Settings\NetworkService\Application Data -> [2007/10/04 10:31:32 | 00,000,000 | ---D | M] Application Data -> C:\Documents and Settings\Owner\Application Data -> [2009/02/03 01:41:14 | 00,000,000 | RH-D | M] Ahead -> C:\Documents and Settings\Owner\Application Data\Ahead -> [2008/04/25 14:43:03 | 00,000,000 | ---D | M] Alchemy Mindworks -> C:\Documents and Settings\Owner\Application Data\Alchemy Mindworks -> [2009/01/09 08:31:22 | 00,000,000 | ---D | M] Alien Skin -> C:\Documents and Settings\Owner\Application Data\Alien Skin -> [2008/05/08 23:53:50 | 00,000,000 | ---D | M] Archivarius 3000 -> C:\Documents and Settings\Owner\Application Data\Archivarius 3000 -> [2008/06/21 14:10:15 | 00,000,000 | ---D | M] Autodesk -> C:\Documents and Settings\Owner\Application Data\Autodesk -> [2008/03/13 14:02:22 | 00,000,000 | ---D | M] AVGTOOLBAR -> C:\Documents and Settings\Owner\Application Data\AVGTOOLBAR -> [2008/08/17 03:08:16 | 00,000,000 | ---D | M] BitTorrent -> C:\Documents and Settings\Owner\Application Data\BitTorrent -> [2008/03/10 23:55:45 | 00,000,000 | ---D | M] Blender Foundation -> C:\Documents and Settings\Owner\Application Data\Blender Foundation -> [2008/12/27 02:14:14 | 00,000,000 | ---D | M] Blumentals -> C:\Documents and Settings\Owner\Application Data\Blumentals -> [2009/01/23 21:13:16 | 00,000,000 | ---D | M] Broderbund -> C:\Documents and Settings\Owner\Application Data\Broderbund -> [2008/08/09 13:47:26 | 00,000,000 | ---D | M] CoreFTP -> C:\Documents and Settings\Owner\Application Data\CoreFTP -> [2008/06/07 08:19:58 | 00,000,000 | ---D | M] DAEMON Tools -> C:\Documents and Settings\Owner\Application Data\DAEMON Tools -> [2008/03/06 03:23:05 | 00,000,000 | ---D | M] DAEMON Tools Pro -> C:\Documents and Settings\Owner\Application Data\DAEMON Tools Pro -> [2008/12/08 16:23:54 | 00,000,000 | ---D | M] Digital Film Tools -> C:\Documents and Settings\Owner\Application Data\Digital Film Tools -> [2008/05/09 00:14:38 | 00,000,000 | ---D | M] dvdcss -> C:\Documents and Settings\Owner\Application Data\dvdcss -> [2009/01/17 17:40:37 | 00,000,000 | ---D | M] EmailNotifier -> C:\Documents and Settings\Owner\Application Data\EmailNotifier -> [2009/01/28 15:34:44 | 00,000,000 | ---D | M] Extensis -> C:\Documents and Settings\Owner\Application Data\Extensis -> [2008/11/09 23:45:14 | 00,000,000 | ---D | M] Hamachi -> C:\Documents and Settings\Owner\Application Data\Hamachi -> [2008/12/25 22:36:42 | 00,000,000 | ---D | M] Ideazon -> C:\Documents and Settings\Owner\Application Data\Ideazon -> [2008/09/21 16:42:04 | 00,000,000 | ---D | M] IGN_DLM -> C:\Documents and Settings\Owner\Application Data\IGN_DLM -> [2008/04/12 04:51:35 | 00,000,000 | ---D | M] ijjigame -> C:\Documents and Settings\Owner\Application Data\ijjigame -> [2008/08/15 15:59:26 | 00,000,000 | -H-D | M] Indentix -> C:\Documents and Settings\Owner\Application Data\Indentix -> [2008/09/22 13:00:49 | 00,000,000 | ---D | M] JAlbum -> C:\Documents and Settings\Owner\Application Data\JAlbum -> [2008/09/04 02:02:11 | 00,000,000 | ---D | M] Mask Pro 4.0 -> C:\Documents and Settings\Owner\Application Data\Mask Pro 4.0 -> [2008/05/09 01:49:43 | 00,000,000 | ---D | M] MechCAD -> C:\Documents and Settings\Owner\Application Data\MechCAD -> [2009/01/08 22:53:12 | 00,000,000 | ---D | M] MilkShape 3D 1.x.x -> C:\Documents and Settings\Owner\Application Data\MilkShape 3D 1.x.x -> [2008/12/17 02:06:34 | 00,000,000 | ---D | M] mIRC -> C:\Documents and Settings\Owner\Application Data\mIRC -> [2008/12/02 05:11:33 | 00,000,000 | ---D | M] Move Networks -> C:\Documents and Settings\Owner\Application Data\Move Networks -> [2009/01/26 20:42:27 | 00,000,000 | ---D | M] OfficeUpdate12 -> C:\Documents and Settings\Owner\Application Data\OfficeUpdate12 -> [2008/03/06 13:18:39 | 00,000,000 | ---D | M] onOne Software -> C:\Documents and Settings\Owner\Application Data\onOne Software -> [2008/05/09 01:14:48 | 00,000,000 | ---D | M] PE Explorer -> C:\Documents and Settings\Owner\Application Data\PE Explorer -> [2008/12/20 18:09:28 | 00,000,000 | ---D | M] SanDisk -> C:\Documents and Settings\Owner\Application Data\SanDisk -> [2008/11/28 08:02:24 | 00,000,000 | ---D | M] Snapfish -> C:\Documents and Settings\Owner\Application Data\Snapfish -> [2008/09/07 09:01:42 | 00,000,000 | ---D | M] TeamViewer -> C:\Documents and Settings\Owner\Application Data\TeamViewer -> [2008/12/23 19:15:38 | 00,000,000 | ---D | M] TypingMaster7 -> C:\Documents and Settings\Owner\Application Data\TypingMaster7 -> [2008/08/09 13:59:17 | 00,000,000 | ---D | M] U3 -> C:\Documents and Settings\Owner\Application Data\U3 -> [2008/09/11 20:29:38 | 00,000,000 | ---D | M] uTorrent -> C:\Documents and Settings\Owner\Application Data\uTorrent -> [2009/01/23 21:12:13 | 00,000,000 | ---D | M] Ventrilo -> C:\Documents and Settings\Owner\Application Data\Ventrilo -> [2008/12/25 21:41:39 | 00,000,000 | ---D | M] Windows Search -> C:\Documents and Settings\Owner\Application Data\Windows Search -> [2008/08/18 08:22:06 | 00,000,000 | ---D | M] C:\WINDOWS\Tasks\ -> C:\WINDOWS\Tasks -> [2009/02/03 15:11:16 | 00,000,000 | --SD | M] desktop.ini -> C:\WINDOWS\Tasks\desktop.ini -> [2004/08/04 06:00:00 | 00,000,065 | RH-- | M] () Microsoft_Hardware_Launch_IType_exe.job -> C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job -> [2008/08/17 02:52:46 | 00,000,300 | -H-- | M] () MP Scheduled Scan.job -> C:\WINDOWS\Tasks\MP Scheduled Scan.job -> [2009/02/03 15:11:16 | 00,000,330 | -H-- | M] () SA.DAT -> C:\WINDOWS\Tasks\SA.DAT -> [2009/02/03 15:08:19 | 00,000,006 | -H-- | M] () User_Feed_Synchronization-{83513662-F6F8-4736-BD81-E1ABA64CAAE7}.job -> C:\WINDOWS\Tasks\User_Feed_Synchronization-{83513662-F6F8-4736-BD81-E1ABA64CAAE7}.job -> [2009/02/03 15:19:06 | 00,000,422 | -H-- | M] () xrwuphmh.job -> C:\WINDOWS\Tasks\xrwuphmh.job -> [2009/02/03 15:08:19 | 00,000,310 | ---- | M] () [File - Purity Scan] [CatchMe Rootkit Scan by GMER] < Windows folder & sub-folders > detected NTDLL code modification: ZwOpenFile scanning hidden processes ... IPC error: 2 The system cannot find the file specified. scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="C:\Program Files\DAEMON Tools Pro\" "h0"=dword:00000001 "hdf12"=hex:00,cd,94,7b,7d,80,0f,43,ee,ba,68,d3,de,60,6d,94,c1,3e,7c,18,c3,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,80,d5,93,0e,2b,52,18,c5,b8,ca,98,ca,14,2b,7f,a7,d6,.. "hdf12"=hex:d2,52,42,a2,2d,41,81,1c,e9,50,d9,2b,09,9a,d5,06,14,3c,62,e4,79,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:8e,99,2e,59,8c,be,87,f7,51,24,59,62,d4,a6,3a,35,a7,fc,c3,94,0d,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002] "a0"=hex:20,01,00,00,68,ef,90,0e,09,8c,c6,70,e0,fb,88,e4,0d,74,08,76,6d,.. "hdf12"=hex:bc,0c,09,73,ee,29,22,8e,6d,29,69,55,8e,95,38,f6,23,10,c2,a3,96,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0] "hdf12"=hex:f8,ca,c6,7a,7c,4f,5e,31,fa,bd,bc,0c,35,03,bb,bd,34,23,d5,8b,c5,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:b6,17,c7,9b,f4,62,56,09,bd,cb,6c,4f,fa,fc,8b,f6,23,10,1e,b0,dc,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,65,19,a3,9d,52,61,c0,90,ad,b7,25,c3,23,a4,1f,cf,1b,.. "khjeh"=hex:4f,f8,17,d9,31,96,87,2f,94,b4,4f,c8,fd,de,e6,83,52,c1,cf,fb,f8,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:6b,40,32,a0,f9,29,b8,e9,77,69,24,9b,0b,41,80,d7,83,ff,f1,4c,be,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:b6,17,c7,9b,f4,62,56,09,bd,cb,6c,4f,fa,fc,8b,f6,23,10,1e,b0,dc,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,65,19,a3,9d,52,61,c0,90,ad,b7,25,c3,23,a4,1f,cf,1b,.. "khjeh"=hex:4f,f8,17,d9,31,96,87,2f,94,b4,4f,c8,fd,de,e6,83,52,c1,cf,fb,f8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:bf,65,bc,fa,7f,34,f0,46,83,72,48,39,8d,50,4c,af,93,3b,e6,85,9e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="C:\Program Files\DAEMON Tools Pro\" "h0"=dword:00000001 "hdf12"=hex:00,cd,94,7b,7d,80,0f,43,ee,ba,68,d3,de,60,6d,94,c1,3e,7c,18,c3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,80,d5,93,0e,2b,52,18,c5,b8,ca,98,ca,14,2b,7f,a7,d6,.. "hdf12"=hex:d2,52,42,a2,2d,41,81,1c,e9,50,d9,2b,09,9a,d5,06,14,3c,62,e4,79,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:8e,99,2e,59,8c,be,87,f7,51,24,59,62,d4,a6,3a,35,a7,fc,c3,94,0d,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002] "a0"=hex:20,01,00,00,68,ef,90,0e,09,8c,c6,70,e0,fb,88,e4,0d,74,08,76,6d,.. "hdf12"=hex:bc,0c,09,73,ee,29,22,8e,6d,29,69,55,8e,95,38,f6,23,10,c2,a3,96,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0] "hdf12"=hex:f8,ca,c6,7a,7c,4f,5e,31,fa,bd,bc,0c,35,03,bb,bd,34,23,d5,8b,c5,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:b6,17,c7,9b,f4,62,56,09,bd,cb,6c,4f,fa,fc,8b,f6,23,10,1e,b0,dc,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,65,19,a3,9d,52,61,c0,90,ad,b7,25,c3,23,a4,1f,cf,1b,.. "khjeh"=hex:4f,f8,17,d9,31,96,87,2f,94,b4,4f,c8,fd,de,e6,83,52,c1,cf,fb,f8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:6b,40,32,a0,f9,29,b8,e9,77,69,24,9b,0b,41,80,d7,83,ff,f1,4c,be,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000029 "TracesSuccessful"=dword:00000026 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 "LoadAppInit_DLLs"=dword:00000001 scanning hidden files ... C:\WINDOWS\system32\apqymrfa.exe:changelist 124 bytes C:\WINDOWS\Temp:temp 263333 bytes C:\WINDOWS\Web\Wallpaper\1024x768-P4-Die.jpg:Q30lsldxJoudresxAaaqpcawXc 3936 bytes C:\WINDOWS\Web\Wallpaper\1024x768-P4-Die.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\1280x1024-P4-Die.jpg:Q30lsldxJoudresxAaaqpcawXc 4168 bytes C:\WINDOWS\Web\Wallpaper\1280x1024-P4-Die.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\1600x1200-P4-Die.jpg:Q30lsldxJoudresxAaaqpcawXc 4040 bytes C:\WINDOWS\Web\Wallpaper\1600x1200-P4-Die.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Aero Bliss.jpg:Q30lsldxJoudresxAaaqpcawXc 4804 bytes C:\WINDOWS\Web\Wallpaper\Aero Bliss.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Aero Grass.jpg:Q30lsldxJoudresxAaaqpcawXc 8128 bytes C:\WINDOWS\Web\Wallpaper\Aero Grass.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\amdxtreme.jpg:Q30lsldxJoudresxAaaqpcawXc 3360 bytes C:\WINDOWS\Web\Wallpaper\amdxtreme.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\apple5g_titanium1.jpg:Q30lsldxJoudresxAaaqpcawXc 2600 bytes C:\WINDOWS\Web\Wallpaper\apple5g_titanium1.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\apple5g_titanium2.jpg:Q30lsldxJoudresxAaaqpcawXc 2616 bytes C:\WINDOWS\Web\Wallpaper\apple5g_titanium2.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\apple5g_titanium3.jpg:Q30lsldxJoudresxAaaqpcawXc 4052 bytes C:\WINDOWS\Web\Wallpaper\apple5g_titanium3.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\apple5g_titanium4.jpg:Q30lsldxJoudresxAaaqpcawXc 3100 bytes C:\WINDOWS\Web\Wallpaper\apple5g_titanium4.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Nvidia Powerd.jpg:Q30lsldxJoudresxAaaqpcawXc 5556 bytes C:\WINDOWS\Web\Wallpaper\Nvidia Powerd.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\peace xp copy.jpg:Q30lsldxJoudresxAaaqpcawXc 3184 bytes C:\WINDOWS\Web\Wallpaper\peace xp copy.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Peace.jpg:Q30lsldxJoudresxAaaqpcawXc 2188 bytes C:\WINDOWS\Web\Wallpaper\Peace.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\PlainGloss1 Blue.jpg:Q30lsldxJoudresxAaaqpcawXc 2236 bytes C:\WINDOWS\Web\Wallpaper\PlainGloss1 Blue.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\PlainGloss1 Green.jpg:Q30lsldxJoudresxAaaqpcawXc 2232 bytes C:\WINDOWS\Web\Wallpaper\PlainGloss1 Green.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\PlainGloss1 Orange.jpg:Q30lsldxJoudresxAaaqpcawXc 2224 bytes C:\WINDOWS\Web\Wallpaper\PlainGloss1 Orange.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\aqua_c10-7_02.jpg:Q30lsldxJoudresxAaaqpcawXc 4512 bytes C:\WINDOWS\Web\Wallpaper\aqua_c10-7_02.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Ascent.jpg:Q30lsldxJoudresxAaaqpcawXc 3168 bytes C:\WINDOWS\Web\Wallpaper\Ascent.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Autumn.jpg:Q30lsldxJoudresxAaaqpcawXc 8564 bytes C:\WINDOWS\Web\Wallpaper\Autumn.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Azul.jpg:Q30lsldxJoudresxAaaqpcawXc 5976 bytes C:\WINDOWS\Web\Wallpaper\Azul.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\big logo.bmp:Q30lsldxJoudresxAaaqpcawXc 3196 bytes C:\WINDOWS\Web\Wallpaper\big logo.bmp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Bliss.bmp:Q30lsldxJoudresxAaaqpcawXc 4928 bytes C:\WINDOWS\Web\Wallpaper\Bliss.bmp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\box_and_balls.jpg:Q30lsldxJoudresxAaaqpcawXc 6716 bytes C:\WINDOWS\Web\Wallpaper\box_and_balls.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\ccc logo 1 copy.jpg:Q30lsldxJoudresxAaaqpcawXc 4348 bytes C:\WINDOWS\Web\Wallpaper\ccc logo 1 copy.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\CCC.bmp:Q30lsldxJoudresxAaaqpcawXc 5276 bytes C:\WINDOWS\Web\Wallpaper\CCC.bmp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\CCC2.bmp:Q30lsldxJoudresxAaaqpcawXc 6220 bytes C:\WINDOWS\Web\Wallpaper\CCC2.bmp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\CCC3.bmp:Q30lsldxJoudresxAaaqpcawXc 11732 bytes C:\WINDOWS\Web\Wallpaper\CCC3.bmp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\CCC4.bmp:Q30lsldxJoudresxAaaqpcawXc 8324 bytes C:\WINDOWS\Web\Wallpaper\CCC4.bmp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img1.jpg:Q30lsldxJoudresxAaaqpcawXc 5444 bytes C:\WINDOWS\Web\Wallpaper\Copy of img1.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img10.jpg:Q30lsldxJoudresxAaaqpcawXc 5448 bytes C:\WINDOWS\Web\Wallpaper\Copy of img10.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img11.jpg:Q30lsldxJoudresxAaaqpcawXc 10036 bytes C:\WINDOWS\Web\Wallpaper\Copy of img11.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img12.jpg:Q30lsldxJoudresxAaaqpcawXc 8608 bytes C:\WINDOWS\Web\Wallpaper\Copy of img12.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img13.jpg:Q30lsldxJoudresxAaaqpcawXc 5344 bytes C:\WINDOWS\Web\Wallpaper\Copy of img13.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img14.jpg:Q30lsldxJoudresxAaaqpcawXc 10428 bytes C:\WINDOWS\Web\Wallpaper\Copy of img14.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img15.jpg:Q30lsldxJoudresxAaaqpcawXc 7800 bytes C:\WINDOWS\Web\Wallpaper\Copy of img15.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img16.jpg:Q30lsldxJoudresxAaaqpcawXc 5700 bytes C:\WINDOWS\Web\Wallpaper\Copy of img16.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img17.jpg:Q30lsldxJoudresxAaaqpcawXc 5444 bytes C:\WINDOWS\Web\Wallpaper\Copy of img17.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img18.jpg:Q30lsldxJoudresxAaaqpcawXc 5876 bytes C:\WINDOWS\Web\Wallpaper\Copy of img18.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Crystal.jpg:Q30lsldxJoudresxAaaqpcawXc 3396 bytes C:\WINDOWS\Web\Wallpaper\Crystal.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Cubus.jpg:Q30lsldxJoudresxAaaqpcawXc 2876 bytes C:\WINDOWS\Web\Wallpaper\Cubus.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\darkbliss_1024x768.jpg:Q30lsldxJoudresxAaaqpcawXc 5108 bytes C:\WINDOWS\Web\Wallpaper\darkbliss_1024x768.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\divideby0.jpg:Q30lsldxJoudresxAaaqpcawXc 8068 bytes C:\WINDOWS\Web\Wallpaper\divideby0.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\flare logo.bmp:Q30lsldxJoudresxAaaqpcawXc 3452 bytes C:\WINDOWS\Web\Wallpaper\flare logo.bmp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Follow.jpg:Q30lsldxJoudresxAaaqpcawXc 5048 bytes C:\WINDOWS\Web\Wallpaper\Follow.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Friend.jpg:Q30lsldxJoudresxAaaqpcawXc 7296 bytes C:\WINDOWS\Web\Wallpaper\Friend.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\g5_titanium_xp_1_01.jpg:Q30lsldxJoudresxAaaqpcawXc 3184 bytes C:\WINDOWS\Web\Wallpaper\g5_titanium_xp_1_01.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\g5_titanium_xp_1_02.jpg:Q30lsldxJoudresxAaaqpcawXc 2784 bytes C:\WINDOWS\Web\Wallpaper\g5_titanium_xp_1_02.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\g5_titanium_xp_1_03.jpg:Q30lsldxJoudresxAaaqpcawXc 2780 bytes C:\WINDOWS\Web\Wallpaper\g5_titanium_xp_1_03.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Copy of img19.jpg:Q30lsldxJoudresxAaaqpcawXc 7820 bytes C:\WINDOWS\Web\Wallpaper\Copy of img19.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img24.jpg:Q30lsldxJoudresxAaaqpcawXc 3920 bytes C:\WINDOWS\Web\Wallpaper\img24.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\INTEL.jpg:Q30lsldxJoudresxAaaqpcawXc 7448 bytes C:\WINDOWS\Web\Wallpaper\INTEL.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Moon flower.jpg:Q30lsldxJoudresxAaaqpcawXc 4112 bytes C:\WINDOWS\Web\Wallpaper\Moon flower.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Home.jpg:Q30lsldxJoudresxAaaqpcawXc 5220 bytes C:\WINDOWS\Web\Wallpaper\Home.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img1.jpg:Q30lsldxJoudresxAaaqpcawXc 5444 bytes C:\WINDOWS\Web\Wallpaper\img1.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img10.jpg:Q30lsldxJoudresxAaaqpcawXc 5448 bytes C:\WINDOWS\Web\Wallpaper\img10.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img11.jpg:Q30lsldxJoudresxAaaqpcawXc 10036 bytes C:\WINDOWS\Web\Wallpaper\img11.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img12.jpg:Q30lsldxJoudresxAaaqpcawXc 8608 bytes C:\WINDOWS\Web\Wallpaper\img12.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img13.jpg:Q30lsldxJoudresxAaaqpcawXc 5344 bytes C:\WINDOWS\Web\Wallpaper\img13.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img14.jpg:Q30lsldxJoudresxAaaqpcawXc 10428 bytes C:\WINDOWS\Web\Wallpaper\img14.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img15.jpg:Q30lsldxJoudresxAaaqpcawXc 7800 bytes C:\WINDOWS\Web\Wallpaper\img15.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img16.jpg:Q30lsldxJoudresxAaaqpcawXc 5700 bytes C:\WINDOWS\Web\Wallpaper\img16.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img17.jpg:Q30lsldxJoudresxAaaqpcawXc 5444 bytes C:\WINDOWS\Web\Wallpaper\img17.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img18.jpg:Q30lsldxJoudresxAaaqpcawXc 5876 bytes C:\WINDOWS\Web\Wallpaper\img18.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img19.jpg:Q30lsldxJoudresxAaaqpcawXc 7820 bytes C:\WINDOWS\Web\Wallpaper\img19.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img2.jpg:Q30lsldxJoudresxAaaqpcawXc 5640 bytes C:\WINDOWS\Web\Wallpaper\img2.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img20.jpg:Q30lsldxJoudresxAaaqpcawXc 5628 bytes C:\WINDOWS\Web\Wallpaper\img20.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img21.jpg:Q30lsldxJoudresxAaaqpcawXc 6104 bytes C:\WINDOWS\Web\Wallpaper\img21.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img22.jpg:Q30lsldxJoudresxAaaqpcawXc 7244 bytes C:\WINDOWS\Web\Wallpaper\img22.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img23.jpg:Q30lsldxJoudresxAaaqpcawXc 4468 bytes C:\WINDOWS\Web\Wallpaper\img23.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img25.jpg:Q30lsldxJoudresxAaaqpcawXc 2604 bytes C:\WINDOWS\Web\Wallpaper\img25.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img26.jpg:Q30lsldxJoudresxAaaqpcawXc 2568 bytes C:\WINDOWS\Web\Wallpaper\img26.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img27.jpg:Q30lsldxJoudresxAaaqpcawXc 2652 bytes C:\WINDOWS\Web\Wallpaper\img27.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\img28.jpg:Q30lsldxJoudresxAaaqpcawXc 2776 bytes C:\WINDOWS\Web\Wallpaper\img28.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\kde1.JPG:Q30lsldxJoudresxAaaqpcawXc 3472 bytes C:\WINDOWS\Web\Wallpaper\kde1.JPG:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\KOICE - Eye of the Future.jpg:Q30lsldxJoudresxAaaqpcawXc 4532 bytes C:\WINDOWS\Web\Wallpaper\KOICE - Eye of the Future.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\liquidplastic2.jpg:Q30lsldxJoudresxAaaqpcawXc 5060 bytes C:\WINDOWS\Web\Wallpaper\liquidplastic2.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M3 Bliss.jpg:Q30lsldxJoudresxAaaqpcawXc 3516 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M3 Bliss.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M4 Bliss 2.jpg:Q30lsldxJoudresxAaaqpcawXc 2364 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M4 Bliss 2.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M4 Bliss.jpg:Q30lsldxJoudresxAaaqpcawXc 3340 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M4 Bliss.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5 Bliss 2.jpg:Q30lsldxJoudresxAaaqpcawXc 3680 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5 Bliss 2.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5 Bliss 3.jpg:Q30lsldxJoudresxAaaqpcawXc 3888 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5 Bliss 3.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5 Bliss 4.jpg:Q30lsldxJoudresxAaaqpcawXc 3460 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5 Bliss 4.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5 Bliss.jpg:Q30lsldxJoudresxAaaqpcawXc 3716 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5 Bliss.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5.jpg:Q30lsldxJoudresxAaaqpcawXc 3492 bytes C:\WINDOWS\Web\Wallpaper\Longhorn M5.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Longhorn PDC Bliss.jpg:Q30lsldxJoudresxAaaqpcawXc 6500 bytes C:\WINDOWS\Web\Wallpaper\Longhorn PDC Bliss.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes C:\WINDOWS\Web\Wallpaper\Matrix-XP.jpg:Q30lsldxJoudresxAaaqpcawXc 8428 bytes C:\WINDOWS\Web\Wallpaper\Matrix-XP.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 176 < Document and Settings folder & sub folders > detected NTDLL code modification: ZwOpenFile scanning hidden files ... IPC error: 2 The system cannot find the file specified. C:\Documents and Settings\All Users\Application Data\TEMP:05EE1EEF 498 bytes C:\Documents and Settings\All Users\Start Menu\Programs\EA GAMES\The Sims 2\Check For Update.url:favicon 1150 bytes C:\Documents and Settings\Owner\Desktop\Shit\LogMeIn.com.url:favicon 2550 bytes C:\Documents and Settings\Owner\Desktop\blogger Dashboard.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\Auto Repair\How to Change Rear Brake Shoes, Brake Drum, Wheel Cylinder.url:favicon 1150 bytes C:\Documents and Settings\Owner\Favorites\Excel Help\Link Online Excel Tutorial Videos.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Excel Help\Microsoft Excel Spreadsheet Power-User Tips.url:favicon 766 bytes C:\Documents and Settings\Owner\Favorites\flowers2mail.com - mail a bunch of flowers!.url:favicon 2550 bytes C:\Documents and Settings\Owner\Favorites\Fonts\.. fontz.ch ...url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Fonts\S Fonts - 1001 Free Fonts.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\NEW CAREERS.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\Photoshop\Nav Bar\How To Create a Stunning Vista Inspired Menu - PSDTUTS.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\Torrent sites\mininova the ultimate bittorrent source!.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Wanda's Favorites\Bills & Checking\Grocery\Schnucks Weekly Ad.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Wanda's Favorites\Bills & Checking\Mediacom - Pay Bill.url:favicon 0 bytes C:\Documents and Settings\Owner\Favorites\Wanda's Favorites\Free Online Courses\TRAININGTOOLS Online Training.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Wanda's Favorites\Free Online Courses\Westciv Self-paced Courses.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Wanda's Favorites\Schools\Columbia Public Schools.url:favicon 894 bytes C:\Documents and Settings\Owner\Favorites\Wanda's Favorites\Web Design\CSS in Emails\A Guide to CSS Support in Email 2007 Edition - Campaign Monitor Blog.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Cooking Sites\How to cook papadums Gather tools and supplies. - Instructables - DIY, How To, food.url:favicon 894 bytes C:\Documents and Settings\Owner\Favorites\Links\InSIMenator.net.url:favicon 10134 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\4ESF.url:favicon 1150 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\Blanket Mesh - ADDED FLOOR HEIGHT SLAVE BLANKET & NEW RECOLOURS - Reflexsims Forum.url:favicon 10134 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\Create Seamless Tiles In Photoshop PhotoshopSupport.com.url:favicon 894 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\HousePlans\Apartment for Contest.url:favicon 894 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\HousePlans\House Plans Online, House Floor Plans, House Design Plans.url:favicon 1334 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\HousePlans\Inland Cottage 2 House Plan.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\Marina's Sims 2 - Objects.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\Metal Texturing\Reflective materials & Metal Overview, at 'FARP', Tutorials.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\SimPE - The Sims 2 Package Editor.url:favicon 33438 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\Sims Fashion Barn.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\Tile & Stone Ceramic & Porcelain Tile Glass Mosaic Tile Quarry Tile FastFloors.com.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\Sims Stuff\Wallpaper Borders, Discount Wallpaper, Sports Wallpaper, Child Wallpaper, Kitchen Wallpaper.url:favicon 2238 bytes C:\Documents and Settings\Owner\Favorites\Links\All Recipes.url:favicon 1078 bytes C:\Documents and Settings\Owner\Favorites\Links\Bank.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\Blog.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\Links\blogger Dashboard.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\Links\CDT.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\Links\ChildSupport.url:favicon 11502 bytes C:\Documents and Settings\Owner\Favorites\Links\Control Panel - GetResponse.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\Cooking Tips\Pounds to Cups.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\JJHS.url:favicon 894 bytes C:\Documents and Settings\Owner\Favorites\Links\KoepkeFamily.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\Lynda.com.url:favicon 894 bytes C:\Documents and Settings\Owner\Favorites\Links\MTS2.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\Links\MySpace.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\PCT.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\Links\Photoshop\A List Apart A List Apart.url:favicon 5430 bytes C:\Documents and Settings\Owner\Favorites\Links\Prepress Links\Prepressure.com.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Links\S2CForum.url:favicon 5430 bytes C:\Documents and Settings\Owner\Favorites\Links\simlogical.url:favicon 2238 bytes C:\Documents and Settings\Owner\Favorites\Links\Snooty Sims.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Links\Steves Work Stuff\Register for ADP Services.url:favicon 3574 bytes C:\Documents and Settings\Owner\Favorites\Links\Text'em.url:favicon 1822 bytes C:\Documents and Settings\Owner\Favorites\Links\TS2R.url:favicon 3638 bytes C:\Documents and Settings\Owner\Favorites\Links\Turbo Squid.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\TV Full Episode Stations\ABC.com Full Episode Player.url:favicon 2550 bytes C:\Documents and Settings\Owner\Favorites\Links\TV Full Episode Stations\CBS.com – Official site of CBS.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\TV Full Episode Stations\FOX ON DEMAND.url:favicon 3262 bytes C:\Documents and Settings\Owner\Favorites\Links\TV Full Episode Stations\hulu Double Down Journeyman.url:favicon 1150 bytes C:\Documents and Settings\Owner\Favorites\Links\TV Full Episode Stations\Life.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Links\TV Full Episode Stations\TV Network for Primetime, Daytime and Late Night Television Shows - NBC Official Site.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Links\Wedding Planner - My Wedding Weather, Wedding Day Weather.url:favicon 1406 bytes C:\Documents and Settings\Owner\Favorites\Links\Zazzle.url:favicon 1150 bytes C:\Documents and Settings\Owner\Favorites\Links\cS.url:favicon 894 bytes C:\Documents and Settings\Owner\Favorites\Links\Dictionary.com.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Links\FamilyLobby.url:favicon 318 bytes C:\Documents and Settings\Owner\Favorites\Links\Flickr!.url:favicon 1150 bytes C:\Documents and Settings\Owner\Favorites\Links\Google.url:favicon 1150 bytes C:\Documents and Settings\Owner\Favorites\Links\Image hosting, free photo sharing & video sharing at Photobucket.url:favicon 1150 bytes C:\Documents and Settings\Owner\Favorites\Wellcome To SunRise Mu!.url:favicon 2238 bytes C:\Documents and Settings\Owner\Favorites\Windows Vista Tips\How to Turn Windows Vista Automatic Updates On and Off eHow.com.url:favicon 1150 bytes C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{B25896A6-9248-3931-6C5E-50C727194C48}\01\10-{B25896A6-9248-3931-6C5E-50C727194C48}-v1-{E3444F46-C9E9-4BE9-A8F5-88D4E7AFC73A}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API scan completed successfully hidden files: 2617 < End of report > [/code]