Spyware / Malware / Virus Removal

[Closed] Is there anything else to worry about?

3 min read

Looking for the outcome? Ask AI

xamtoro Topic Starter

Post #1January 30, 2010, 11:28 PM UTC

i had just removed win netsky 32 virus thanks to hijack this
i wanted to know that if there was anything else that shouldnt be on my computer in my hijack this log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:22:24 PM, on 1/30/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\smss32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe
C:\PROGRA~1\COMMON~1\AOL\126429~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\COMMON~1\AOL\126429~1\EE\AOLServiceHost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon32.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [_AntiSpyware] C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1264290931\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim] "C:\Program Files\AIM\aim.exe" /d locale=en-US
O4 - HKCU\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.buy-internet-security10.com
O15 - Trusted Zone: http://*.is-soft-download.com
O15 - Trusted Zone: http://*.is-software-download.com
O15 - Trusted Zone: http://*.is-software-download25.com
O15 - Trusted Zone: http://*.buy-internet-security10.com (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: McAfee AntiSpyware Real-Time Scanner (McAfeeAntiSpyware) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 12046 bytes

CatByte

Post #2January 31, 2010, 2:04 PM UTC

Hi,

Yes you are still infected:

Please do the following:

Download OTL from one of these locations to your Desktop
OTL
OTL

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scans/Fixes box at the bottom, paste in the following

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="explorer.exe"
"Userinit"="C:\\WINDOWS\\system32\\Userinit.exe,"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSetActiveDesktop"=-
"NoActiveDesktopChanges"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSetActiveDesktop"=-
"NoActiveDesktopChanges"=-

:Files
helper32.dll /lsp
winhelper86.dll /lsp
%HOMEDRIVE%\Internet Security 2010.lnk /s
%systemroot%\System32\winlogon32.exe
%systemroot%\System32\smss32.exe
%systemroot%\System32\AVR10.exe
%systemroot%\System32\helper32.dll
%systemroot%\System32\winlogon32.exe
%systemroot%\System32\smss32.exe
%systemroot%\System32\warning.html
%systemroot%\system32\IS15.exe
%systemroot%\System32\winhelper86.dll
%HOMEDRIVE%\trhh.exe
%HOMEDRIVE%\sdigdvmg.exe
%HOMEDRIVE%\wgqi.exe
%HOMEDRIVE%\byyk.exe
%systemroot%\lsass.exe 
%systemroot%\odbn0.exe
%systemroot%\System32\sdra64.exe
%systemroot%\System32\41.exe
%systemroot%\System32\153.exe
%systemroot%\System32\292.exe
%systemroot%\System32\491.exe
%systemroot%\System32\1869.exe
%systemroot%\system32\2876.exe
%systemroot%\System32\2995.exe
%systemroot%\System32\3902.exe
%systemroot%\System32\4827.exe
%systemroot%\System32\5436.exe
%systemroot%\System32\5447.exe
%systemroot%\System32\5705.exe
%systemroot%\System32\6334.exe
%systemroot%\System32\7376.exe
%systemroot%\System32\9961.exe
%systemroot%\System32\11478.exe
%systemroot%\System32\11538.exe
%systemroot%\System32\11942.exe
%systemroot%\System32\12382.exe
%systemroot%\system32\12662.exe
%systemroot%\System32\13931.exe
%systemroot%\system32\14070.exe
%systemroot%\System32\14604.exe
%systemroot%\System32\14771.exe
%systemroot%\System32\15724.exe
%systemroot%\System32\16827.exe
%systemroot%\System32\16944.exe
%systemroot%\system32\17125.exe
%systemroot%\System32\17421.exe
%systemroot%\System32\18467.exe
%systemroot%\System32\18716.exe
%systemroot%\System32\19169.exe
%systemroot%\System32\19718.exe
%systemroot%\System32\19895.exe
%systemroot%\system32\19905.exe
%systemroot%\System32\19912.exe
%systemroot%\system32\21386.exe
%systemroot%\System32\21726.exe
%systemroot%\system32\22934.exe
%systemroot%\System32\23281.exe
%systemroot%\system32\24242.exe
%systemroot%\System32\24464.exe
%systemroot%\system32\24478.exe
%systemroot%\System32\26308.exe
%systemroot%\System32\26500.exe
%systemroot%\System32\26962.exe
%systemroot%\system32\27213.exe
%systemroot%\System32\28145.exe
%systemroot%\system32\28466.exe
%systemroot%\System32\29358.exe
%systemroot%\System32\32391.exe
%systemroot%\System32\32439.exe
%systemroot%\system32\ndisdrv.sys
%HOMEDRIVE%\s
%systemroot%\system32\kbdsock.dll
%systemroot%\system32\mshlps.dll 
%systemroot%\system32\drivers\kdrhkukb.sys 
%PROGRAMFILES%\InternetSecurity2010
%systemroot%\System32\lowsec

:Services
lmuytnv
ndisdrv
qvazdxe

:Commands
[purity]
[emptytemp]
[CREATERESTOREPOINT] 
[resethosts]

Then click the Run Fix button at the top
Let the program run unhindered, it wont take long.

Now, please rerun a normal scan with OTL and post the resulting log.

NEXT

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Please post the resulting log

xamtoro

Post #3January 31, 2010, 9:53 PM UTC

here is the OTL normal scan log after i ran the custom scan

OTL logfile created on: 1/31/2010 3:49:05 PM - Run 1
OTL by OldTimer - Version 3.1.27.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 436.00 Mb Available Physical Memory | 43.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 182.14 Gb Total Space | 163.58 Gb Free Space | 89.81% Space Free | Partition Type: NTFS
Drive D: | 4.15 Gb Total Space | 1.48 Gb Free Space | 35.71% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-277319736F
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/01/31 15:39:39 | 000,548,864 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2010/01/23 17:56:37 | 000,098,304 | —- | M] (Apple Computer, Inc.) – C:\Program Files\QuickTime\qttask.exe
PRC - [2010/01/13 16:44:52 | 000,037,888 | —- | M] (Nullsoft, Inc.) – C:\Program Files\Winamp\winampa.exe
PRC - [2009/11/10 15:39:26 | 005,244,216 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
PRC - [2009/09/29 20:08:50 | 000,602,112 | —- | M] (ATI Technologies Inc.) – C:\WINDOWS\system32\ati2evxx.exe
PRC - [2009/05/06 08:22:24 | 000,140,584 | —- | M] (AOL LLC.) – c:\Program Files\Winamp Toolbar\winampTbServer.exe
PRC - [2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) – C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2008/12/18 14:32:52 | 000,049,152 | —- | M] (Advanced Micro Devices Inc.) – C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
PRC - [2008/12/18 13:19:44 | 000,049,152 | —- | M] (ATI Technologies Inc.) – C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
PRC - [2008/11/09 14:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/05/26 22:19:14 | 000,123,904 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Desktop Search\WindowsSearch.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/01/17 11:42:04 | 000,181,608 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
PRC - [2008/01/17 11:42:02 | 000,197,992 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
PRC - [2008/01/17 11:42:02 | 000,058,728 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\CCAPP.EXE
PRC - [2007/03/28 18:41:56 | 000,206,552 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
PRC - [2006/07/25 18:03:42 | 000,100,032 | —- | M] (Symantec Corporation) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2006/06/14 13:48:42 | 000,235,168 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE
PRC - [2005/10/19 12:54:14 | 000,177,264 | —- | M] (Symantec Corporation) – C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE
PRC - [2005/05/03 16:02:00 | 000,543,232 | —- | M] () – C:\WINDOWS\zHotkey.exe
PRC - [2005/04/15 13:01:46 | 000,077,824 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005/02/02 04:00:00 | 000,098,304 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIADA.EXE
PRC - [2004/11/15 17:04:32 | 000,135,168 | —- | M] (Alcor Micro, Corp.) – C:\Program Files\Digital Media Reader\shwiconEM.exe
PRC - [2004/11/03 15:03:00 | 000,125,528 | —- | M] (America Online, Inc.) – C:\Program Files\Common Files\AOL\1264290931\EE\AOLHostManager.exe
PRC - [2004/11/03 15:03:00 | 000,110,680 | —- | M] (America Online, Inc.) – C:\Program Files\Common Files\AOL\1264290931\EE\AOLServiceHost.exe
PRC - [2004/11/02 16:59:50 | 000,316,544 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\Security Center\symwsc.exe
PRC - [2004/10/20 08:40:04 | 000,010,328 | —- | M] (America Online) – C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
PRC - [2004/10/19 03:00:00 | 000,114,688 | —- | M] (Network Associates, Inc.) – C:\Program Files\McAfee\McAfee AntiSpyware\Msscli.exe
PRC - [2004/10/19 03:00:00 | 000,090,112 | —- | M] (Network Associates, Inc.) – C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
PRC - [2004/10/18 19:42:18 | 000,079,448 | —- | M] () – C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler.exe
PRC - [2004/10/15 14:54:14 | 000,100,016 | —- | M] (America Online, Inc) – C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
PRC - [2004/10/15 14:54:12 | 000,046,768 | —- | M] (America Online Inc) – C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
PRC - [2004/08/30 21:29:46 | 000,078,992 | —- | M] (Symantec Corporation) – C:\Program Files\Norton Internet Security\ISSVC.exe
PRC - [2004/08/17 20:26:38 | 000,245,760 | —- | M] (McAfee, Inc) – C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2004/07/21 11:24:04 | 000,173,160 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

========== Modules (SafeList) ==========

MOD - [2010/01/31 15:39:39 | 000,548,864 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
MOD - [2004/08/24 17:05:02 | 000,197,744 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\AntiSpam\asOEHook.dll
MOD - [2003/08/12 19:17:04 | 000,348,160 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msvcr71.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/01/23 18:38:45 | 000,172,032 | —- | M] (New Boundary Technologies, Inc.) [Disabled | Stopped] – C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS – (PrismXL)
SRV - [2009/09/29 21:15:00 | 000,593,920 | —- | M] () [Auto | Stopped] – C:\WINDOWS\system32\ati2sgag.exe – (ATI Smart)
SRV - [2009/09/29 20:08:50 | 000,602,112 | —- | M] (ATI Technologies Inc.) [Auto | Running] – C:\WINDOWS\system32\ati2evxx.exe – (Ati HotKey Poller)
SRV - [2008/11/09 14:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2008/11/04 01:06:28 | 000,441,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE – (odserv)
SRV - [2008/01/17 11:42:04 | 000,181,608 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe – (ccSetMgr)
SRV - [2008/01/17 11:42:04 | 000,079,208 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe – (ccPwdSvc)
SRV - [2008/01/17 11:42:02 | 000,197,992 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe – (ccEvtMgr)
SRV - [2007/03/28 18:41:56 | 000,206,552 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe – (SNDSrvc)
SRV - [2006/10/26 14:03:08 | 000,145,184 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE – (ose)
SRV - [2006/07/25 18:03:42 | 002,119,360 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE – (LiveUpdate)
SRV - [2006/07/25 18:03:42 | 000,100,032 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe – (Automatic LiveUpdate Scheduler)
SRV - [2006/06/14 13:48:42 | 000,235,168 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\ccProxy.exe – (ccProxy)
SRV - [2005/10/19 12:55:00 | 000,067,184 | —- | M] (Symantec Corporation) [Auto | Stopped] – C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBSERV.EXE – (SBService)
SRV - [2005/10/19 12:54:14 | 000,177,264 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe – (navapsvc)
SRV - [2005/03/07 14:59:36 | 000,198,368 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe – (SAVScan)
SRV - [2004/11/02 16:59:50 | 000,316,544 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe – (SymWSC)
SRV - [2004/10/20 08:40:04 | 000,010,328 | —- | M] (America Online) [Auto | Running] – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe – (AOL ACS)
SRV - [2004/10/19 03:00:00 | 000,090,112 | —- | M] (Network Associates, Inc.) [Auto | Running] – C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe – (McAfeeAntiSpyware)
SRV - [2004/10/15 14:54:14 | 000,100,016 | —- | M] (America Online, Inc) [Auto | Running] – C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe – (AOL TopSpeedMonitor)
SRV - [2004/08/30 21:29:46 | 000,078,992 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton Internet Security\ISSVC.exe – (ISSVC)
SRV - [2004/08/16 17:32:20 | 000,249,856 | —- | M] (McAfee, Inc) [On_Demand | Stopped] – C:\Program Files\McAfee.com\Agent\mcupdmgr.exe – (mcupdmgr.exe)
SRV - [2004/07/21 11:24:04 | 000,173,160 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe – (SPBBCSvc)

========== Driver Services (SafeList) ==========

DRV - [2010/01/23 17:56:24 | 000,008,552 | —- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\asctrm.sys – (ASCTRM)
DRV - [2010/01/18 18:39:04 | 001,323,568 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100127.005\navex15.sys – (NAVEX15)
DRV - [2010/01/18 18:39:04 | 000,084,912 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100127.005\naveng.sys – (NAVENG)
DRV - [2009/12/30 22:32:06 | 000,268,664 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20100128.002\SymIDSCo.sys – (SYMIDSCO)
DRV - [2009/09/29 22:18:22 | 003,565,056 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2009/04/28 14:20:06 | 000,044,944 | —- | M] (Sonic Solutions) [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\PxHelp20.sys – (PxHelp20)
DRV - [2009/04/28 14:20:06 | 000,009,200 | —- | M] (Sonic Solutions) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\cdralw2k.sys – (Cdralw2k)
DRV - [2009/04/28 14:20:06 | 000,009,072 | —- | M] (Sonic Solutions) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\cdr4_xp.sys – (Cdr4_xp)
DRV - [2008/04/13 12:36:39 | 000,043,008 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\amdagp.sys – (amdagp)
DRV - [2008/04/13 12:36:39 | 000,040,960 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sisagp.sys – (sisagp)
DRV - [2007/11/13 04:25:53 | 000,020,480 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\secdrv.sys – (Secdrv)
DRV - [2007/03/28 18:41:26 | 000,266,552 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\SYMTDI.SYS – (SYMTDI)
DRV - [2007/03/28 18:41:24 | 000,018,904 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS – (SYMREDRV)
DRV - [2007/03/28 18:41:20 | 000,037,016 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMIDS.SYS – (SYMIDS)
DRV - [2007/03/28 18:41:18 | 000,047,192 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS – (SYMNDIS)
DRV - [2007/03/28 18:41:14 | 000,171,928 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMFW.SYS – (SYMFW)
DRV - [2007/03/28 18:41:12 | 000,011,480 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMDNS.SYS – (SYMDNS)
DRV - [2006/09/15 22:52:12 | 000,124,016 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Symantec\SYMEVENT.SYS – (SymEvent)
DRV - [2005/04/19 12:40:52 | 002,317,504 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ALCXWDM.SYS – (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2005/03/07 14:59:50 | 000,050,312 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRTPEL.SYS – (SAVRTPEL)
DRV - [2005/03/07 14:59:44 | 000,338,056 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS – (SAVRT)
DRV - [2004/11/15 19:41:54 | 000,036,804 | —- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Sunkfilt.sys – (SunkFilt)
DRV - [2004/08/10 13:00:00 | 000,179,584 | —- | M] (Mylex Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys – (dac2w2k)
DRV - [2004/08/10 13:00:00 | 000,049,024 | —- | M] (QLogic Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ql1280.sys – (ql1280)
DRV - [2004/08/10 13:00:00 | 000,045,312 | —- | M] (QLogic Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ql12160.sys – (ql12160)
DRV - [2004/08/10 13:00:00 | 000,040,320 | —- | M] (QLogic Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ql1080.sys – (ql1080)
DRV - [2004/08/10 13:00:00 | 000,036,736 | —- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\ultra.sys – (ultra)
DRV - [2004/08/10 13:00:00 | 000,032,640 | —- | M] (LSI Logic) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\symc8xx.sys – (symc8xx)
DRV - [2004/08/10 13:00:00 | 000,030,688 | —- | M] (LSI Logic) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sym_u3.sys – (sym_u3)
DRV - [2004/08/10 13:00:00 | 000,028,384 | —- | M] (LSI Logic) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sym_hi.sys – (sym_hi)
DRV - [2004/08/10 13:00:00 | 000,026,496 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\asc.sys – (asc)
DRV - [2004/08/10 13:00:00 | 000,019,072 | —- | M] (Adaptec, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\sparrow.sys – (Sparrow)
DRV - [2004/08/10 13:00:00 | 000,017,792 | —- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ptilink.sys – (Ptilink)
DRV - [2004/08/10 13:00:00 | 000,017,280 | —- | M] (American Megatrends Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\mraid35x.sys – (mraid35x)
DRV - [2004/08/10 13:00:00 | 000,016,256 | —- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\symc810.sys – (symc810)
DRV - [2004/08/10 13:00:00 | 000,014,848 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\asc3550.sys – (asc3550)
DRV - [2004/08/10 13:00:00 | 000,006,656 | —- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\cmdide.sys – (CmdIde)
DRV - [2004/08/10 13:00:00 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde)
DRV - [2004/08/03 16:29:56 | 001,897,408 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2004/07/30 09:55:48 | 000,091,830 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\P0630Vid.sys – (P0630VID)
DRV - [2004/07/21 11:24:02 | 000,341,096 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys – (SPBBCDrv)
DRV - [2004/06/17 16:56:22 | 000,220,032 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2004/06/17 16:55:38 | 000,685,056 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2004/06/17 16:55:04 | 001,041,536 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2004/04/14 00:14:12 | 000,070,144 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtlnicxp.sys – (RTL8023xp)
DRV - [2004/03/17 13:04:14 | 000,013,059 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\mdmxsdk.sys – (mdmxsdk)
DRV - [2003/01/10 15:13:04 | 000,033,588 | —- | M] (America Online, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\wanatw4.sys – (wanatw) WAN Miniport (ATW)
DRV - [2001/08/17 13:56:16 | 000,007,552 | —- | M] (Sony Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SONYPVU1.SYS – (SONYPVU1) Sony USB Filter Driver (SONYPVU1)
DRV - [2001/08/17 07:49:32 | 000,019,968 | —- | M] (Macronix International Co., Ltd. ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mxnic.sys – (mxnic)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
IE - HKCU\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2010/01/31 15:41:23 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (CNisExtBho Class) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O2 - BHO: (CNavExtBho Class) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL (Symantec Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Norton Internet Security) - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Norton AntiVirus) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL (Symantec Corporation)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (IE Toolbar)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Internet Security) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton AntiVirus) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (IE Toolbar)
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [_AntiSpyware] C:\Program Files\McAfee\McAfee AntiSpyware\Msscli.exe (Network Associates, Inc.)
O4 - HKLM..\Run: [AOL Spyware Protection] C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler.exe ()
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\zHotkey.exe ()
O4 - HKLM..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1264290931\EE\AOLHostManager.exe (America Online, Inc.)
O4 - HKLM..\Run: [MCAgentExe] c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc)
O4 - HKLM..\Run: [MCUpdateExe] C:\Program Files\McAfee.com\Agent\mcupdate.exe (McAfee, Inc)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\WINDOWS\creator\remind_xp.exe (SoftThinks)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconEM.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [Symantec NetDriver Monitor] C:\Program Files\SymNetDrv\SNDMon.exe (Symantec Corporation)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk = C:\Program Files\BigFix\BigFix.exe (BigFix Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &AOL Toolbar search - C:\Program Files\AOL Toolbar\toolbar.dll (IE Toolbar)
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (IE Toolbar)
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (IE Toolbar)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 192.168.0.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {F2A0229A-C4CA-4789-B606-973D24DCDD1C} - C:\Program Files\McAfee\McAfee AntiSpyware\MssShell.dll (Network Associates, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/10/27 19:20:25 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{25d5cc6c-0932-11df-8660-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{25d5cc6c-0932-11df-8660-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{25d5cc6c-0932-11df-8660-00038a000015}\Shell\AutoRun\command - "" = M:\HPLauncher.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/31 15:40:04 | 000,000,000 | —D | C] – C:\_OTL
[2010/01/31 15:39:38 | 000,548,864 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/31 08:12:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\Family Sabau
[2010/01/30 17:06:59 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/01/30 16:43:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\Documents 1=30=10
[2010/01/30 07:25:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Identities
[2010/01/30 07:25:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Windows Desktop Search
[2010/01/30 07:16:27 | 000,000,000 | —D | C] – C:\Program Files\Windows Desktop Search
[2010/01/30 07:16:27 | 000,000,000 | —D | C] – C:\WINDOWS\System32\GroupPolicy
[2010/01/30 07:15:36 | 000,192,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\offfilt.dll
[2010/01/30 07:15:36 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nlhtml.dll
[2010/01/30 07:15:36 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mimefilt.dll
[2010/01/30 07:05:54 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Motive
[2010/01/30 07:05:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Motive
[2010/01/29 11:06:35 | 000,005,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstee.sys
[2010/01/29 11:06:21 | 000,010,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndisip.sys
[2010/01/29 11:06:20 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipsink.ax
[2010/01/29 11:06:20 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipsink.ax
[2010/01/29 11:06:20 | 000,015,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\streamip.sys
[2010/01/29 11:06:18 | 000,011,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\slip.sys
[2010/01/29 11:06:16 | 000,019,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wstcodec.sys
[2010/01/29 11:06:14 | 000,085,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nabtsfec.sys
[2010/01/29 11:06:13 | 000,017,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ccdecode.sys
[2010/01/29 11:06:04 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kswdmcap.ax
[2010/01/29 11:06:04 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kswdmcap.ax
[2010/01/29 11:06:04 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kstvtune.ax
[2010/01/29 11:06:04 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kstvtune.ax
[2010/01/29 11:06:04 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vfwwdm32.dll
[2010/01/29 11:06:04 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vfwwdm32.dll
[2010/01/29 11:06:04 | 000,043,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ksxbar.ax
[2010/01/29 11:06:04 | 000,043,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ksxbar.ax
[2010/01/29 11:05:43 | 001,125,376 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\drivers\P0630Evx.sys
[2010/01/29 11:05:43 | 000,126,976 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\P0630Vfw.dll
[2010/01/29 11:05:43 | 000,091,830 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\drivers\P0630Vid.sys
[2010/01/29 11:05:43 | 000,081,920 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\CtDrvIns.exe
[2010/01/29 11:05:43 | 000,073,728 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\P0630Ext.ax
[2010/01/29 11:05:43 | 000,069,632 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\P0630Sti.dll
[2010/01/29 11:05:43 | 000,065,536 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\CtCamMgr.dll
[2010/01/29 11:05:43 | 000,049,152 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\P0630Hwx.dll
[2010/01/29 11:05:43 | 000,032,768 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\P0630Pin.dll
[2010/01/29 11:05:43 | 000,028,672 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\P0630Ext.crl
[2010/01/29 11:05:43 | 000,020,480 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\P0630Srv.exe
[2010/01/29 11:05:43 | 000,020,480 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\P0630Pin.crl
[2010/01/29 11:05:43 | 000,020,480 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\P0630Cfg.exe
[2010/01/29 11:05:39 | 000,000,000 | —D | C] – C:\Webcam Live!
[2010/01/29 11:00:25 | 000,000,000 | —D | C] – C:\WINDOWS\CtDrvInstall
[2010/01/29 11:00:19 | 000,000,000 | —D | C] – C:\WebCam
[2010/01/29 07:15:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2010/01/29 07:15:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Yahoo!
[2010/01/27 07:08:33 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/01/27 07:05:31 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2010/01/27 06:44:49 | 000,000,000 | —D | C] – C:\WINDOWS\System32\scripting
[2010/01/27 06:44:48 | 000,000,000 | —D | C] – C:\WINDOWS\l2schemas
[2010/01/27 06:44:48 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en
[2010/01/27 06:44:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\bits
[2010/01/27 06:37:54 | 000,000,000 | —D | C] – C:\WINDOWS\network diagnostic
[2010/01/27 06:31:55 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstall$
[2010/01/26 08:17:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\EPSON
[2010/01/26 07:05:39 | 000,501,912 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\PICSDK2.dll
[2010/01/26 07:05:39 | 000,108,704 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\PICEntry.dll
[2010/01/26 07:05:39 | 000,080,024 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\PICSDK.dll
[2010/01/26 07:05:38 | 000,051,360 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\EpPicPrt.dll
[2010/01/26 07:05:38 | 000,051,360 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\EpPicMgr.dll
[2010/01/26 07:05:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\InstallShield
[2010/01/26 07:05:05 | 000,079,679 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\E_FLMADA.DLL
[2010/01/26 07:05:05 | 000,064,000 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\E_FBCBADA.DLL
[2010/01/26 07:05:05 | 000,034,304 | —- | C] (SEIKO EPSON CORPORATION) – C:\WINDOWS\System32\E_FBCHADA.DLL
[2010/01/26 07:03:43 | 000,000,000 | —D | C] – C:\Program Files\epson
[2010/01/26 07:03:41 | 000,046,080 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\escimgd.dll
[2010/01/26 07:03:41 | 000,029,696 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\escwiad.dll
[2010/01/26 07:03:41 | 000,022,016 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\esccmd.dll
[2010/01/26 06:22:55 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2010/01/26 06:22:46 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2010/01/26 06:22:28 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2010/01/26 06:22:28 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2010/01/26 06:22:27 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2010/01/26 06:22:27 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2010/01/26 06:22:27 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2010/01/26 06:22:27 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2010/01/26 06:22:27 | 000,000,000 | —D | C] – C:\1081a625887970ab67
[2010/01/26 06:19:50 | 000,000,000 | —D | C] – C:\Program Files\MSXML 6.0
[2010/01/26 06:16:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\AOL
[2010/01/26 06:15:06 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\AOL
[2010/01/25 21:17:21 | 000,000,000 | —D | C] – C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2010/01/25 19:32:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\AIM Toolbar
[2010/01/25 19:31:57 | 000,000,000 | —D | C] – C:\Program Files\AIM Toolbar
[2010/01/25 19:31:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/01/25 19:31:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Software Update Utility
[2010/01/25 19:31:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\acccore
[2010/01/25 19:31:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\AIM
[2010/01/25 19:31:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AIM
[2010/01/25 19:31:27 | 000,000,000 | —D | C] – C:\Program Files\AIM
[2010/01/25 09:14:41 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2010/01/25 09:14:41 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2010/01/25 07:39:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Yahoo!
[2010/01/24 16:46:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Yahoo
[2010/01/24 16:44:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Yahoo!
[2010/01/24 16:44:47 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2010/01/24 16:31:40 | 000,007,552 | —- | C] (Sony Corporation) – C:\WINDOWS\System32\drivers\SONYPVU1.SYS
[2010/01/24 16:31:40 | 000,007,552 | —- | C] (Sony Corporation) – C:\WINDOWS\System32\dllcache\sonypvu1.sys
[2010/01/24 16:24:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Tracing
[2010/01/24 16:20:51 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2010/01/24 16:20:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\microsoft
[2010/01/24 16:20:35 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2010/01/24 16:20:14 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2010/01/24 16:15:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2010/01/24 16:14:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\WinRAR
[2010/01/24 16:14:40 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2010/01/24 16:06:16 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wlanapi.dll
[2010/01/24 16:06:13 | 000,025,471 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv10nt.sys
[2010/01/24 16:06:13 | 000,022,271 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv06nt.sys
[2010/01/24 16:06:13 | 000,011,935 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv11nt.sys
[2010/01/24 16:06:13 | 000,011,871 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv09nt.sys
[2010/01/24 16:06:13 | 000,011,807 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv07nt.sys
[2010/01/24 16:06:13 | 000,011,295 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv08nt.sys
[2010/01/24 16:06:12 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vidcap.ax
[2010/01/24 16:06:11 | 000,011,325 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\vchnt5.dll
[2010/01/24 16:06:10 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usb8023x.sys
[2010/01/24 16:06:06 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tsgqec.dll
[2010/01/24 16:05:59 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spupdwxp.exe
[2010/01/24 16:05:57 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spdwnwxp.exe
[2010/01/24 16:05:56 | 000,404,990 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slntamr.sys
[2010/01/24 16:05:56 | 000,286,792 | —- | C] (Smart Link) – C:\WINDOWS\System32\slextspk.dll
[2010/01/24 16:05:56 | 000,188,508 | —- | C] (Smart Link) – C:\WINDOWS\System32\slgen.dll
[2010/01/24 16:05:56 | 000,129,535 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slnt7554.sys
[2010/01/24 16:05:56 | 000,095,424 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slnthal.sys
[2010/01/24 16:05:56 | 000,073,832 | —- | C] (Smart Link) – C:\WINDOWS\System32\slcoinst.dll
[2010/01/24 16:05:56 | 000,073,796 | —- | C] (Smart Link) – C:\WINDOWS\System32\slserv.exe
[2010/01/24 16:05:56 | 000,032,866 | —- | C] (Smart Link) – C:\WINDOWS\System32\slrundll.exe
[2010/01/24 16:05:56 | 000,032,866 | —- | C] (Smart Link) – C:\WINDOWS\slrundll.exe
[2010/01/24 16:05:56 | 000,013,240 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slwdmsup.sys
[2010/01/24 16:05:56 | 000,005,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\smbali.sys
[2010/01/24 16:05:55 | 000,003,901 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\siint5.dll
[2010/01/24 16:05:52 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\setupn.exe
[2010/01/24 16:05:50 | 000,397,056 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\s3gnb.dll
[2010/01/24 16:05:50 | 000,166,912 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\drivers\s3gnbm.sys
[2010/01/24 16:05:49 | 000,030,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\rndismpx.sys
[2010/01/24 16:05:48 | 000,290,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rhttpaa.dll
[2010/01/24 16:05:48 | 000,013,776 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\recagent.sys
[2010/01/24 16:05:47 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasqec.dll
[2010/01/24 16:05:46 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qutil.dll
[2010/01/24 16:05:45 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qagent.dll
[2010/01/24 16:05:45 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qcliprov.dll
[2010/01/24 16:05:40 | 000,144,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\onex.dll
[2010/01/24 16:05:37 | 000,180,360 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\ntmtlfax.sys
[2010/01/24 16:05:31 | 001,737,856 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\mtxparhd.dll
[2010/01/24 16:05:31 | 000,452,736 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\drivers\mtxparhm.sys
[2010/01/24 16:05:31 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\napmontr.dll
[2010/01/24 16:05:31 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\napstat.exe
[2010/01/24 16:05:31 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\napipsec.dll
[2010/01/24 16:05:31 | 000,012,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\mutohpen.sys
[2010/01/24 16:05:30 | 001,372,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxml6.dll
[2010/01/24 16:05:30 | 001,309,184 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\mtlstrm.sys
[2010/01/24 16:05:30 | 000,126,686 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\mtlmnt5.sys
[2010/01/24 16:05:30 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxml6r.dll
[2010/01/24 16:05:27 | 000,155,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mssha.dll
[2010/01/24 16:05:27 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msshavmsg.dll
[2010/01/24 16:05:13 | 000,397,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmcex.dll
[2010/01/24 16:05:13 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\microsoft.managementconsole.dll
[2010/01/24 16:05:13 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmcfxcommon.dll
[2010/01/24 16:05:13 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmcperf.exe
[2010/01/24 16:05:00 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\l2gpstore.dll
[2010/01/24 16:04:59 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdpash.dll
[2010/01/24 16:04:59 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdnepr.dll
[2010/01/24 16:04:59 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdiultn.dll
[2010/01/24 16:04:58 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdbhc.dll
[2010/01/24 16:04:47 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\smtpapi.dll
[2010/01/24 16:04:46 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rwnh.dll
[2010/01/24 16:04:44 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\irbus.sys
[2010/01/24 16:04:43 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comsdupd.exe
[2010/01/24 16:04:42 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ieencode.dll
[2010/01/24 16:04:40 | 001,041,536 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\drivers\hsfdpsp2.sys
[2010/01/24 16:04:40 | 000,685,056 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\drivers\hsfcxts2.sys
[2010/01/24 16:04:40 | 000,220,032 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\drivers\hsfbs2s2.sys
[2010/01/24 16:04:40 | 000,032,285 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\hsfcisp2.dll
[2010/01/24 16:04:39 | 000,144,384 | —- | C] (Windows ® Server 2003 DDK provider) – C:\WINDOWS\System32\drivers\hdaudbus.sys
[2010/01/24 16:04:35 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\faxpatch.exe
[2010/01/24 16:04:33 | 000,184,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eapp3hst.dll
[2010/01/24 16:04:33 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eapphost.dll
[2010/01/24 16:04:33 | 000,126,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eappcfg.dll
[2010/01/24 16:04:33 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eappgnui.dll
[2010/01/24 16:04:33 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eapqec.dll
[2010/01/24 16:04:33 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eappprxy.dll
[2010/01/24 16:04:33 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eapolqec.dll
[2010/01/24 16:04:30 | 000,650,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3ui.dll
[2010/01/24 16:04:30 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3msm.dll
[2010/01/24 16:04:30 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3gpclnt.dll
[2010/01/24 16:04:30 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3dlg.dll
[2010/01/24 16:04:29 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3cfg.dll
[2010/01/24 16:04:29 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3api.dll
[2010/01/24 16:04:28 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dhcpqec.dll
[2010/01/24 16:04:28 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dimsroam.dll
[2010/01/24 16:04:20 | 000,015,423 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\ch7xxnt5.dll
[2010/01/24 16:04:19 | 000,233,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\azroles.dll
[2010/01/24 16:04:19 | 000,036,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\bthprint.sys
[2010/01/24 16:04:19 | 000,025,471 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv04nt5.dll
[2010/01/24 16:04:19 | 000,021,183 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv01nt5.dll
[2010/01/24 16:04:19 | 000,017,279 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv10nt5.dll
[2010/01/24 16:04:19 | 000,014,143 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv06nt5.dll
[2010/01/24 16:04:19 | 000,011,359 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv02nt5.dll
[2010/01/24 16:04:19 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bitsprx4.dll
[2010/01/24 16:04:18 | 000,870,784 | —- | C] (ATI Technologies Inc. ) – C:\WINDOWS\System32\ati3d1ag.dll
[2010/01/24 16:04:18 | 000,377,984 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ati2dvaa.dll
[2010/01/24 16:04:18 | 000,327,040 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati2mtaa.sys
[2010/01/24 16:04:18 | 000,104,960 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinrvxx.sys
[2010/01/24 16:04:18 | 000,073,216 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atintuxx.sys
[2010/01/24 16:04:18 | 000,063,488 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinxsxx.sys
[2010/01/24 16:04:18 | 000,057,856 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinbtxx.sys
[2010/01/24 16:04:18 | 000,052,224 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinraxx.sys
[2010/01/24 16:04:18 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2010/01/24 16:04:18 | 000,032,768 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ativtmxx.dll
[2010/01/24 16:04:18 | 000,031,744 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinxbxx.sys
[2010/01/24 16:04:18 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2010/01/24 16:04:18 | 000,028,672 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinsnxx.sys
[2010/01/24 16:04:18 | 000,023,040 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ativmvxx.ax
[2010/01/24 16:04:18 | 000,014,336 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinpdxx.sys
[2010/01/24 16:04:18 | 000,013,824 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinttxx.sys
[2010/01/24 16:04:18 | 000,013,824 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinmdxx.sys
[2010/01/24 16:04:18 | 000,009,728 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ativdaxx.ax
[2010/01/24 16:04:17 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2010/01/24 16:04:17 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1btxx.sys
[2010/01/24 16:04:17 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2010/01/24 16:04:17 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1raxx.sys
[2010/01/24 16:04:17 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1snxx.sys
[2010/01/24 16:04:17 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2010/01/24 16:04:17 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2010/01/24 16:04:17 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2010/01/24 16:04:14 | 000,136,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\aaclient.dll
[2010/01/24 16:04:14 | 000,004,255 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv01nt5.dll
[2010/01/24 16:04:14 | 000,003,967 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv02nt5.dll
[2010/01/24 16:04:14 | 000,003,775 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv11nt5.dll
[2010/01/24 16:04:14 | 000,003,711 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv09nt5.dll
[2010/01/24 16:04:14 | 000,003,647 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv07nt5.dll
[2010/01/24 16:04:14 | 000,003,615 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv05nt5.dll
[2010/01/24 16:04:14 | 000,003,135 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv08nt5.dll
[2010/01/24 15:48:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\ArcSoft
[2010/01/24 15:48:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\HP SimpleSave Application
[2010/01/24 15:16:54 | 000,000,000 | —D | C] – C:\WINDOWS\pss
[2010/01/24 10:41:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\ATI
[2010/01/24 10:41:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\ATI
[2010/01/24 10:41:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\ATI
[2010/01/24 07:43:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Winamp Toolbar
[2010/01/24 07:42:42 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_42.dll
[2010/01/24 07:42:41 | 002,414,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_31.dll
[2010/01/24 07:42:35 | 000,000,000 | —D | C] – C:\WINDOWS\Logs
[2010/01/24 07:42:15 | 000,000,000 | —D | C] – C:\Program Files\Winamp Detect
[2010/01/24 07:42:07 | 000,000,000 | —D | C] – C:\Program Files\Winamp Toolbar
[2010/01/24 07:42:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Winamp Toolbar
[2010/01/24 07:41:12 | 000,072,176 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxhpinst.exe
[2010/01/24 07:41:12 | 000,066,544 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxcpya64.exe
[2010/01/24 07:41:12 | 000,066,032 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxinsa64.exe
[2010/01/24 07:41:11 | 001,858,032 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxsfs.dll
[2010/01/24 07:41:11 | 000,670,192 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\px.dll
[2010/01/24 07:41:11 | 000,551,408 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxdrv.dll
[2010/01/24 07:41:11 | 000,436,720 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxwave.dll
[2010/01/24 07:41:11 | 000,219,632 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxmas.dll
[2010/01/24 07:41:11 | 000,129,520 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxafs.dll
[2010/01/24 07:41:11 | 000,096,752 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\vxblock.dll
[2010/01/24 07:41:09 | 000,000,000 | —D | C] – C:\Program Files\Winamp
[2010/01/24 07:41:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Winamp
[2010/01/24 07:14:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AdobeUM
[2010/01/24 07:10:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Adobe
[2010/01/24 07:10:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Adobe
[2010/01/24 07:07:49 | 000,000,000 | —D | C] – C:\Program Files\SymNetDrv
[2010/01/24 07:05:45 | 000,000,000 | —D | C] – C:\WINDOWS\ServicePackFiles
[2010/01/24 07:03:21 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Owner\PrivacIE
[2010/01/24 06:59:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Symantec
[2010/01/24 06:58:06 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Owner\IETldCache
[2010/01/23 20:29:52 | 000,203,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rmcast.sys
[2010/01/23 20:29:32 | 000,691,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcomm.dll
[2010/01/23 20:29:01 | 000,455,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2010/01/23 20:16:17 | 000,689,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsp3res.dll
[2010/01/23 20:14:41 | 000,272,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bthport.sys
[2010/01/23 20:13:54 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2010/01/23 20:13:32 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2010/01/23 20:12:45 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/01/23 20:12:45 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en-US
[2010/01/23 20:10:35 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aclayers.dll
[2010/01/23 20:07:24 | 000,594,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010/01/23 20:07:24 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010/01/23 20:07:22 | 001,985,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2010/01/23 20:07:16 | 011,070,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/01/23 20:05:37 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\t2embed.dll
[2010/01/23 20:05:37 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fontsub.dll
[2010/01/23 20:04:59 | 002,145,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2010/01/23 20:04:59 | 000,730,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lsasrv.dll
[2010/01/23 20:04:58 | 002,189,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2010/01/23 20:04:57 | 002,023,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2010/01/23 19:51:46 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2010/01/23 19:51:14 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2010/01/23 19:50:34 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2010/01/23 19:50:33 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2010/01/23 19:49:49 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2010/01/23 19:49:11 | 000,333,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srv.sys
[2010/01/23 19:48:51 | 000,331,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadce.dll
[2010/01/23 19:46:26 | 002,066,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstscax.dll
[2010/01/23 19:46:17 | 000,000,000 | —D | C] – C:\WINDOWS\SHELLNEW
[2010/01/23 19:45:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft Help
[2010/01/23 19:45:11 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2010/01/23 19:45:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2010/01/23 19:44:19 | 000,000,000 | RH-D | C] – C:\MSOCache
[2010/01/23 19:43:28 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netapi32.dll
[2010/01/23 19:43:16 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxml3.dll
[2010/01/23 19:37:28 | 000,000,000 | -H-D | C] – C:\WINDOWS\$MSI31Uninstall_KB893803v2$
[2010/01/23 19:36:45 | 000,000,000 | —D | C] – C:\WINDOWS\System32\PreInstall
[2010/01/23 19:34:24 | 000,000,000 | —D | C] – C:\ATI
[2010/01/23 19:24:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Macromedia
[2010/01/23 19:22:45 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2010/01/23 18:50:29 | 000,024,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mdimon.dll
[2010/01/23 18:49:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ReinstallBackups
[2010/01/23 18:49:04 | 000,000,000 | —D | C] – C:\Program Files\ATI Technologies
[2010/01/23 18:44:42 | 000,000,000 | —D | C] – C:\Program Files\Norton Internet Security
[2010/01/23 18:43:35 | 000,124,016 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/01/23 18:43:35 | 000,091,904 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/01/23 18:43:34 | 000,466,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\capicom.dll
[2010/01/23 18:43:20 | 000,000,000 | —D | C] – C:\Program Files\Google
[2010/01/23 18:43:17 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2010/01/23 18:43:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Symantec
[2010/01/23 18:43:09 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2010/01/23 18:42:53 | 000,018,000 | —- | C] (BigFix, Inc.) – C:\WINDOWS\BigFixClientOverride.dll
[2010/01/23 18:42:52 | 000,000,000 | —D | C] – C:\Program Files\BigFix
[2010/01/23 18:42:39 | 000,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2010/01/23 18:41:54 | 000,000,000 | —D | C] – C:\Program Files\Digital Media Reader
[2010/01/23 18:41:51 | 000,000,000 | —D | C] – C:\WINDOWS\Downloaded Installations
[2010/01/23 18:41:50 | 000,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2010/01/23 18:41:43 | 000,487,424 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvcp70.dll
[2010/01/23 18:41:43 | 000,344,064 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvcr70.dll
[2010/01/23 18:41:43 | 000,212,480 | R— | C] (Eastman Kodak) – C:\WINDOWS\System32\PCDLIB32.DLL
[2010/01/23 18:41:43 | 000,037,888 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\ochlp30e.dll
[2010/01/23 18:41:42 | 000,716,288 | R— | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\Ltwvc11n.dll
[2010/01/23 18:41:42 | 000,392,192 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LTKRN11N.DLL
[2010/01/23 18:41:42 | 000,285,184 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFCMP11n.DLL
[2010/01/23 18:41:42 | 000,262,656 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LTDIS11n.dll
[2010/01/23 18:41:42 | 000,172,032 | R— | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\Lfpng11n.dll
[2010/01/23 18:41:42 | 000,152,064 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFTIF11N.DLL
[2010/01/23 18:41:42 | 000,127,488 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LTIMG11N.DLL
[2010/01/23 18:41:42 | 000,118,784 | R— | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\ltfil11n.DLL
[2010/01/23 18:41:42 | 000,091,136 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\msls2.dll
[2010/01/23 18:41:42 | 000,081,408 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFFAX11N.DLL
[2010/01/23 18:41:42 | 000,059,392 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFWMF11N.DLL
[2010/01/23 18:41:42 | 000,056,320 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFPSD11N.DLL
[2010/01/23 18:41:42 | 000,054,784 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvci70.dll
[2010/01/23 18:41:42 | 000,041,472 | R— | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\lfgif11n.dll
[2010/01/23 18:41:42 | 000,036,864 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFBMP11N.DLL
[2010/01/23 18:41:42 | 000,033,280 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFPCX11N.DLL
[2010/01/23 18:41:42 | 000,031,744 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\hlp95en.dll
[2010/01/23 18:41:42 | 000,031,232 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFEPS11N.DLL
[2010/01/23 18:41:42 | 000,027,648 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFTGA11N.DLL
[2010/01/23 18:41:42 | 000,026,112 | —- | C] (LEAD Technologies, Inc.) – C:\WINDOWS\System32\LFPCD11N.DLL
[2010/01/23 18:39:12 | 002,658,304 | —- | C] (Nero AG) – C:\WINDOWS\UNNeroBurnRights.exe
[2010/01/23 18:39:12 | 000,090,184 | —- | C] (Ahead Software AG
im Stoeckmaedle 18
76307 Karlsbad, Germany
Fax: ++49-7248-911-888
e-mail: [removed]) – C:\WINDOWS\System32\NeroCo.dll
[2010/01/23 18:39:12 | 000,057,344 | —- | C] (Ahead Software AG) – C:\WINDOWS\System32\NeroBurnRights.cpl
[2010/01/23 18:38:49 | 000,106,496 | —- | C] (Pegasus Software) – C:\WINDOWS\System32\TwnLib20.dll
[2010/01/23 18:38:48 | 000,471,040 | —- | C] (Pegasus Imaging Corp.) – C:\WINDOWS\System32\ImagXRA7.dll
[2010/01/23 18:38:47 | 001,568,768 | —- | C] (Pegasus Imaging Corp.) – C:\WINDOWS\System32\ImagX7.dll
[2010/01/23 18:38:47 | 000,476,320 | —- | C] (Pegasus Imaging Corp.) – C:\WINDOWS\System32\ImagXpr7.dll
[2010/01/23 18:38:47 | 000,262,144 | —- | C] (Pegasus Imaging Corp.) – C:\WINDOWS\System32\ImagXR7.dll
[2010/01/23 18:38:47 | 000,155,648 | —- | C] (Ahead Software Gmbh) – C:\WINDOWS\System32\NeroCheck.exe
[2010/01/23 18:38:47 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Ahead
[2010/01/23 18:38:46 | 000,000,000 | —D | C] – C:\Program Files\Ahead
[2010/01/23 18:34:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Prism Deploy
[2010/01/23 18:34:39 | 000,000,000 | —D | C] – C:\Program Files\Common Files\New Boundary
[2010/01/23 18:32:02 | 000,000,000 | —D | C] – C:\WINDOWS\System32\URTTemp
[2010/01/23 18:30:03 | 000,000,000 | —D | C] – C:\Program Files\CONEXANT
[2010/01/23 18:30:01 | 000,006,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\enum1394.sys
[2010/01/23 18:30:00 | 000,053,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\1394bus.sys
[2010/01/23 18:29:36 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hccoin.dll
[2010/01/23 18:27:42 | 000,000,000 | -HSD | C] – C:\System Volume Information
[2010/01/23 18:24:35 | 000,000,000 | —D | C] – C:\WINDOWS\creator
[2010/01/23 18:23:20 | 001,041,536 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\drivers\HSF_DP.sys
[2010/01/23 18:23:20 | 000,685,056 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\drivers\HSF_CNXT.sys
[2010/01/23 18:23:20 | 000,220,032 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\drivers\HSFHWBS2.sys
[2010/01/23 18:23:20 | 000,086,016 | —- | C] (Conexant) – C:\WINDOWS\System32\mdmxsdk.dll
[2010/01/23 18:23:20 | 000,070,144 | —- | C] (Realtek Semiconductor Corporation ) – C:\WINDOWS\System32\drivers\Rtlnicxp.sys
[2010/01/23 18:23:20 | 000,039,018 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\HSFCI011.dll
[2010/01/23 18:23:20 | 000,013,059 | —- | C] (Conexant) – C:\WINDOWS\System32\drivers\mdmxsdk.sys
[2010/01/23 18:23:19 | 000,000,000 | —D | C] – C:\WINDOWS\SMINST
[2010/01/23 18:23:14 | 000,000,000 | —D | C] – C:\WINDOWS\I386
[2010/01/23 18:23:02 | 000,052,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wzcsapi.dll
[2010/01/23 18:22:58 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wowfaxui.dll
[2010/01/23 18:22:55 | 000,003,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wowfax.dll
[2010/01/23 18:22:42 | 000,049,211 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrvpa.dll
[2010/01/23 18:22:39 | 000,045,116 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrvoica.dll
[2010/01/23 18:22:36 | 000,049,209 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrv80a.dll
[2010/01/23 18:22:33 | 000,102,457 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrv42a.dll
[2010/01/23 18:22:30 | 000,041,019 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrsvpia.dll
[2010/01/23 18:22:27 | 000,069,700 | —- | C] ( U.S. Robotics Corporation) – C:\WINDOWS\System32\usrshuta.exe
[2010/01/23 18:22:24 | 000,049,211 | —- | C] ( U.S. Robotics Corporation) – C:\WINDOWS\System32\usrsdpia.dll
[2010/01/23 18:22:21 | 000,077,883 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrrtosa.dll
[2010/01/23 18:22:18 | 000,061,508 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrprbda.exe
[2010/01/23 18:22:15 | 000,077,891 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrmlnka.exe
[2010/01/23 18:22:12 | 000,053,305 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrlbva.dll
[2010/01/23 18:22:09 | 000,086,073 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrfaxa.dll
[2010/01/23 18:22:06 | 000,323,641 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrdtea.dll
[2010/01/23 18:22:03 | 000,077,890 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrdpa.dll
[2010/01/23 18:22:00 | 000,069,699 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrcoina.dll
[2010/01/23 18:21:57 | 000,061,500 | —- | C] (U.S. Robotics Corporation) – C:\WINDOWS\System32\usrcntra.dll
[2010/01/23 18:21:56 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\usbui.dll
[2010/01/23 18:21:50 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\storprop.dll
[2010/01/23 18:21:50 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\streamci.dll
[2010/01/23 18:21:47 | 000,072,192 | —- | C] (S3/Diamond Multimedia) – C:\WINDOWS\System32\sprio800.dll
[2010/01/23 18:21:44 | 000,070,656 | —- | C] (S3/Diamond Multimedia) – C:\WINDOWS\System32\sprio600.dll
[2010/01/23 18:21:39 | 000,069,632 | —- | C] (S3/Diamond Multimedia) – C:\WINDOWS\System32\spnike.dll
[2010/01/23 18:21:36 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pjlmon.dll
[2010/01/23 18:21:35 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pid.dll
[2010/01/23 18:21:27 | 004,274,816 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nv4_disp.dll
[2010/01/23 18:21:26 | 002,066,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntkrnlpa.exe
[2010/01/23 18:21:12 | 000,147,968 | —- | C] (RioPort) – C:\WINDOWS\System32\mdwmdmsp.dll
[2010/01/23 18:21:07 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hid.dll
[2010/01/23 18:21:01 | 000,058,112 | —- | C] (RAVISENT Technologies Inc.) – C:\WINDOWS\System32\drivers\vdmindvd.sys
[2010/01/23 18:21:01 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usbintel.sys
[2010/01/23 18:20:58 | 000,025,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usbcamd2.sys
[2010/01/23 18:20:55 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usbcamd.sys
[2010/01/23 18:20:51 | 000,021,376 | —- | C] (Toshiba Corporation) – C:\WINDOWS\System32\drivers\tsbvcap.sys
[2010/01/23 18:20:48 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\tosdvd.sys
[2010/01/23 18:20:46 | 000,049,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\stream.sys
[2010/01/23 18:20:45 | 000,025,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\sonydcam.sys
[2010/01/23 18:20:42 | 000,012,032 | —- | C] (S3/Diamond Multimedia Systems) – C:\WINDOWS\System32\drivers\riodrv.sys
[2010/01/23 18:20:40 | 000,012,032 | —- | C] (S3/Diamond Multimedia Systems) – C:\WINDOWS\System32\drivers\rio8drv.sys
[2010/01/23 18:20:36 | 001,897,408 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\drivers\nv4_mini.sys
[2010/01/23 18:20:33 | 000,012,032 | —- | C] (S3/Diamond Multimedia Systems) – C:\WINDOWS\System32\drivers\nikedrv.sys
[2010/01/23 18:20:30 | 000,019,968 | —- | C] (Macronix International Co., Ltd. ) – C:\WINDOWS\System32\drivers\mxnic.sys
[2010/01/23 18:20:27 | 000,141,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\ks.sys
[2010/01/23 18:20:27 | 000,063,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\mf.sys
[2010/01/23 18:20:25 | 000,012,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\fsvga.sys
[2010/01/23 18:20:24 | 000,011,776 | —- | C] (Compaq Computer Corporation) – C:\WINDOWS\System32\drivers\cpqdap01.sys
[2010/01/23 18:20:23 | 000,262,528 | —- | C] (RAVISENT Technologies Inc.) – C:\WINDOWS\System32\drivers\cinemst2.sys
[2010/01/23 18:20:21 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\amdk6.sys
[2010/01/23 18:20:20 | 000,043,008 | —- | C] (Advanced Micro Devices, Inc.) – C:\WINDOWS\System32\drivers\amdagp.sys
[2010/01/23 18:20:20 | 000,040,960 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\drivers\sisagp.sys
[2010/01/23 18:20:17 | 000,052,224 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dmutil.dll
[2010/01/23 18:20:14 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cnbjmon.dll
[2010/01/23 18:19:19 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/01/23 18:19:19 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/23 18:19:19 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/23 18:17:23 | 000,000,000 | –SD | C] – C:\Documents and Settings\Owner\Application Data\Microsoft
[2010/01/23 18:17:23 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner\SendTo
[2010/01/23 18:17:23 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner\Recent
[2010/01/23 18:17:23 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner\Application Data
[2010/01/23 18:17:23 | 000,000,000 | R–D | C] – C:\Documents and Settings\Owner\Start Menu
[2010/01/23 18:17:23 | 000,000,000 | R–D | C] – C:\Documents and Settings\Owner\My Documents
[2010/01/23 18:17:23 | 000,000,000 | R–D | C] – C:\Documents and Settings\Owner\Favorites
[2010/01/23 18:17:23 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Owner\Cookies
[2010/01/23 18:17:23 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner\Templates
[2010/01/23 18:17:23 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner\PrintHood
[2010/01/23 18:17:23 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner\NetHood
[2010/01/23 18:17:23 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner\Local Settings
[2010/01/23 18:17:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\You've Got Pictures Screensaver
[2010/01/23 18:17:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\WINDOWS
[2010/01/23 18:17:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\SampleView
[2010/01/23 18:17:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft
[2010/01/23 18:17:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\McAfee
[2010/01/23 18:17:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Identities
[2010/01/23 18:17:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Google
[2010/01/23 18:17:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop
[2010/01/23 18:17:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150020}
[2010/01/23 18:14:39 | 000,000,000 | —D | C] – C:\WINDOWS\System32\SoftwareDistribution
[2010/01/23 18:07:45 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/01/23 18:01:09 | 000,016,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2010/01/23 18:00:59 | 000,000,000 | -H-D | C] – C:\WINDOWS\$hf_mig$
[2010/01/23 17:59:17 | 000,026,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spupdsvc.exe
[2010/01/23 17:58:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/01/23 17:58:57 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2010/01/23 17:58:57 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2010/01/23 17:58:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee.com
[2010/01/23 17:58:44 | 000,341,064 | —- | C] (McAfee, Inc) – C:\WINDOWS\System32\mcinsctl.dll
[2010/01/23 17:58:44 | 000,279,624 | —- | C] (McAfee, Inc) – C:\WINDOWS\System32\mcgdmgr.dll
[2010/01/23 17:58:44 | 000,000,000 | —D | C] – C:\Program Files\McAfee.com
[2010/01/23 17:58:37 | 000,000,000 | —D | C] – C:\WINDOWS\RegisteredPackages
[2010/01/23 17:58:31 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\POWERCFG.EXE
[2010/01/23 17:58:20 | 000,000,000 | —D | C] – C:\Program Files\CyberLink
[2010/01/23 17:58:04 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2010/01/23 17:58:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Adobe
[2010/01/23 17:57:53 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2010/01/23 17:57:40 | 000,000,000 | —D | C] – C:\Program Files\MSN Encarta Plus
[2010/01/23 17:56:51 | 000,173,184 | —- | C] (America Online Inc) – C:\WINDOWS\System32\ygpss.scr
[2010/01/23 17:56:49 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nullsoft
[2010/01/23 17:56:36 | 000,086,016 | —- | C] (MindVision) – C:\WINDOWS\unvise32qt.exe
[2010/01/23 17:56:31 | 000,000,000 | —D | C] – C:\WINDOWS\System32\QuickTime
[2010/01/23 17:56:31 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/01/23 17:56:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\QuickTime
[2010/01/23 17:56:24 | 000,008,552 | —- | C] (Windows ® 2000 DDK provider) – C:\WINDOWS\System32\drivers\asctrm.sys
[2010/01/23 17:56:24 | 000,000,000 | —D | C] – C:\My Music
[2010/01/23 17:56:21 | 000,157,696 | —- | C] (RealNetworks) – C:\WINDOWS\System32\rmoc3260.dll
[2010/01/23 17:56:20 | 000,278,528 | —- | C] (Real Networks, Inc) – C:\WINDOWS\System32\pncrt.dll
[2010/01/23 17:56:20 | 000,024,576 | —- | C] (RealNetworks, Inc.) – C:\WINDOWS\System32\prefscpl.cpl
[2010/01/23 17:56:20 | 000,006,656 | —- | C] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5016.dll
[2010/01/23 17:56:20 | 000,005,632 | —- | C] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5032.dll
[2010/01/23 17:56:20 | 000,000,000 | —D | C] – C:\Program Files\Real
[2010/01/23 17:56:20 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Real
[2010/01/23 17:56:13 | 000,647,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSComCt2.ocx
[2010/01/23 17:56:13 | 000,203,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\RichTx32.ocx
[2010/01/23 17:56:13 | 000,115,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSInet.ocx
[2010/01/23 17:56:13 | 000,102,400 | —- | C] (4Developers LLC) – C:\WINDOWS\System32\SimpleRegistry.dll
[2010/01/23 17:56:13 | 000,010,752 | —- | C] (Almeida & Andrade Ltda) – C:\WINDOWS\System32\aamd532.dll
[2010/01/23 17:56:12 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\COMDLG32.OCX
[2010/01/23 17:56:09 | 000,000,000 | —D | C] – C:\Program Files\Viewpoint
[2010/01/23 17:56:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/01/23 17:56:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Pure Networks
[2010/01/23 17:56:05 | 000,000,000 | —D | C] – C:\Program Files\Pure Networks
[2010/01/23 17:55:57 | 000,000,000 | —D | C] – C:\Program Files\AOL Toolbar
[2010/01/23 17:55:48 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AolCoach
[2010/01/23 17:55:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\AOL Downloads
[2010/01/23 17:55:30 | 000,000,000 | —D | C] – C:\Program Files\Common Files\aolshare
[2010/01/23 17:55:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AOL
[2010/01/23 17:55:30 | 000,000,000 | —D | C] – C:\Program Files\America Online 9.0
[2010/01/23 17:55:23 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AOL
[2010/01/23 17:54:51 | 000,146,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\portcls.sys
[2010/01/23 17:54:50 | 000,060,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\drmk.sys
[2010/01/23 17:54:49 | 000,129,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ksproxy.ax
[2010/01/23 17:54:49 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ksuser.dll
[2010/01/23 17:54:41 | 002,317,504 | —- | C] (Realtek Semiconductor Corp.) – C:\WINDOWS\System32\drivers\ALCXWDM.SYS
[2010/01/23 17:54:41 | 000,077,824 | —- | C] (Realtek Semiconductor Corp.) – C:\WINDOWS\SOUNDMAN.EXE
[2010/01/23 17:54:40 | 009,324,032 | —- | C] (Realtek Semiconductor Corp.) – C:\WINDOWS\System32\RTLCPL.EXE
[2010/01/23 17:54:39 | 018,706,432 | —- | C] (Realtek Semiconductor Corp.) – C:\WINDOWS\System32\ALSNDMGR.CPL
[2010/01/23 17:54:39 | 000,294,912 | —- | C] (Realtek Semiconductor Corp.) – C:\WINDOWS\alcupd.exe
[2010/01/23 17:54:39 | 000,200,704 | —- | C] (Realtek Semiconductor Corp.) – C:\WINDOWS\alcrmv.exe
[2010/01/23 17:54:36 | 000,192,512 | —- | C] (Realtek Semiconductor Corp.) – C:\WINDOWS\RtlExUpd.dll
[2010/01/23 17:54:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Roxio Shared
[2010/01/23 17:54:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Napster
[2010/01/23 17:54:16 | 000,000,000 | —D | C] – C:\Program Files\Napster
[2010/01/23 17:54:11 | 000,020,480 | —- | C] (Gateway) – C:\WINDOWS\System32\Marker32.exe
[2010/01/23 17:53:34 | 000,127,078 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/23 17:53:34 | 000,049,265 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\jpicpl32.cpl
[2010/01/23 17:53:34 | 000,049,250 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/23 17:53:34 | 000,049,248 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/23 17:53:06 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/01/23 17:53:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/01/05 07:53:35 | 000,000,000 | —D | C] – C:\My Backup – 10-01-05 0653AM

========== Files - Modified Within 30 Days ==========

[2010/01/31 15:50:00 | 000,000,492 | —- | M] () – C:\WINDOWS\tasks\McAfee.com Update Check (YOUR-277319736F-Administrator).job
[2010/01/31 15:50:00 | 000,000,366 | —- | M] () – C:\WINDOWS\tasks\Symantec NetDetect.job
[2010/01/31 15:46:28 | 000,000,693 | —- | M] () – C:\WINDOWS\win.ini
[2010/01/31 15:46:04 | 002,097,152 | -H– | M] () – C:\Documents and Settings\Owner\NTUSER.DAT
[2010/01/31 15:42:56 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/31 15:42:47 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/31 15:42:41 | 1072,222,208 | -HS- | M] () – C:\hiberfil.sys
[2010/01/31 15:41:33 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Owner\ntuser.ini
[2010/01/31 15:41:23 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2010/01/31 15:39:39 | 000,548,864 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/31 13:48:06 | 000,000,476 | —- | M] () – C:\WINDOWS\tasks\McAfee.com Update Check (YOUR-277319736F-Owner).job
[2010/01/31 08:00:16 | 036,248,520 | —- | M] () – C:\Documents and Settings\Owner\Desktop\poze.part10.rar
[2010/01/31 07:07:14 | 000,000,738 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Outlook Express (2).lnk
[2010/01/30 18:56:14 | 005,885,054 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/01/30 17:45:19 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/30 17:45:19 | 000,000,195 | RHS- | M] () – C:\boot.ini
[2010/01/30 17:07:03 | 000,001,734 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2010/01/30 07:16:40 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/30 07:16:38 | 000,001,787 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
[2010/01/30 07:16:34 | 000,547,668 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/01/30 07:16:34 | 000,465,402 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/01/30 07:16:34 | 000,079,162 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/01/29 21:48:40 | 000,000,548 | —- | M] () – C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Owner.job
[2010/01/29 21:00:00 | 000,000,360 | —- | M] () – C:\WINDOWS\tasks\McAfee AntiSpyware.job
[2010/01/29 07:15:00 | 000,001,692 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AT&T Yahoo! Messenger.lnk
[2010/01/27 19:30:53 | 000,278,152 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/01/27 07:17:39 | 000,072,000 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/01/27 07:08:38 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2010/01/27 07:05:23 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/27 06:37:30 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/01/26 07:03:43 | 000,000,665 | —- | M] () – C:\Documents and Settings\All Users\Desktop\EPSON Scan.lnk
[2010/01/25 19:31:41 | 000,001,633 | -H– | M] () – C:\IPH.PH
[2010/01/25 19:31:30 | 000,001,574 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/01/24 07:42:44 | 000,000,654 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Winamp.lnk
[2010/01/23 19:39:36 | 000,000,000 | —- | M] () – C:\WINDOWS\ativpsrm.bin
[2010/01/23 18:50:34 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2010/01/23 18:32:36 | 000,000,867 | —- | M] () – C:\WINDOWS\System32\VGASwitcher.lnk
[2010/01/23 18:31:55 | 000,000,002 | RHS- | M] () – C:\USER
[2010/01/23 18:24:43 | 000,000,060 | —- | M] () – C:\WINDOWS\System32\SYSDRV.DAT
[2010/01/23 18:17:04 | 000,000,038 | —- | M] () – C:\WINDOWS\System32\$winnt$.inf
[2010/01/23 18:17:01 | 000,262,144 | —- | M] () – C:\Documents and Settings\All Users\NTUSER.DAT
[2010/01/23 18:16:58 | 000,000,258 | —- | M] () – C:\WINDOWS\tasks\ISP signup reminder 3.job
[2010/01/23 18:16:58 | 000,000,258 | —- | M] () – C:\WINDOWS\tasks\ISP signup reminder 2.job
[2010/01/23 18:10:13 | 000,008,192 | —- | M] () – C:\WINDOWS\REGLOCS.OLD
[2010/01/23 18:07:47 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\Gateway_T6524__.MRK
[2010/01/23 18:07:40 | 000,000,333 | —- | M] () – C:\WINDOWS\System32\$ncsp$.inf
[2010/01/23 18:05:15 | 000,001,386 | —- | M] () – C:\WINDOWS\System32\oeminfo.ini
[2010/01/23 18:05:15 | 000,000,464 | —- | M] () – C:\WINDOWS\System32\emver.ini
[2010/01/23 17:58:04 | 000,001,757 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
[2010/01/23 17:56:25 | 000,157,696 | —- | M] (RealNetworks) – C:\WINDOWS\System32\rmoc3260.dll
[2010/01/23 17:56:24 | 000,008,552 | —- | M] (Windows ® 2000 DDK provider) – C:\WINDOWS\System32\drivers\asctrm.sys
[2010/01/23 17:56:20 | 000,278,528 | —- | M] (Real Networks, Inc) – C:\WINDOWS\System32\pncrt.dll
[2010/01/23 17:56:20 | 000,024,576 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\prefscpl.cpl
[2010/01/23 17:56:20 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5016.dll
[2010/01/23 17:56:20 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5032.dll
[2010/01/23 17:55:23 | 000,000,335 | —- | M] () – C:\WINDOWS\nsreg.dat

========== Files Created - No Company Name ==========

[2010/01/31 07:59:13 | 036,248,520 | —- | C] () – C:\Documents and Settings\Owner\Desktop\poze.part10.rar
[2010/01/31 07:07:14 | 000,000,738 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Outlook Express (2).lnk
[2010/01/30 17:14:45 | 000,001,787 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
[2010/01/30 17:14:45 | 000,001,757 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
[2010/01/30 17:14:45 | 000,001,540 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
[2010/01/30 17:07:00 | 000,001,734 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2010/01/29 11:05:43 | 000,003,877 | —- | C] () – C:\WINDOWS\PD0630.uns
[2010/01/29 07:15:00 | 000,001,692 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AT&T Yahoo! Messenger.lnk
[2010/01/26 07:05:39 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2010/01/26 07:05:38 | 000,073,220 | —- | C] () – C:\WINDOWS\System32\EPPICPrinterDB.dat
[2010/01/26 07:05:38 | 000,031,053 | —- | C] () – C:\WINDOWS\System32\EPPICPattern131.dat
[2010/01/26 07:05:38 | 000,029,114 | —- | C] () – C:\WINDOWS\System32\EPPICPattern1.dat
[2010/01/26 07:05:38 | 000,027,417 | —- | C] () – C:\WINDOWS\System32\EPPICPattern121.dat
[2010/01/26 07:05:38 | 000,021,021 | —- | C] () – C:\WINDOWS\System32\EPPICPattern3.dat
[2010/01/26 07:05:38 | 000,015,670 | —- | C] () – C:\WINDOWS\System32\EPPICPattern5.dat
[2010/01/26 07:05:38 | 000,013,280 | —- | C] () – C:\WINDOWS\System32\EPPICPattern2.dat
[2010/01/26 07:05:38 | 000,012,669 | —- | C] () – C:\WINDOWS\System32\EPPICLocal_EN.cfg
[2010/01/26 07:05:38 | 000,010,673 | —- | C] () – C:\WINDOWS\System32\EPPICPattern4.dat
[2010/01/26 07:05:38 | 000,006,478 | —- | C] () – C:\WINDOWS\System32\EPPICLocal_PT.cfg
[2010/01/26 07:05:38 | 000,006,478 | —- | C] () – C:\WINDOWS\System32\EPPICLocal_BP.cfg
[2010/01/26 07:05:38 | 000,006,366 | —- | C] () – C:\WINDOWS\System32\EPPICLocal_FR.cfg
[2010/01/26 07:05:38 | 000,006,366 | —- | C] () – C:\WINDOWS\System32\EPPICLocal_CF.cfg
[2010/01/26 07:05:38 | 000,006,226 | —- | C] () – C:\WINDOWS\System32\EPPICLocal_ES.cfg
[2010/01/26 07:05:38 | 000,004,943 | —- | C] () – C:\WINDOWS\System32\EPPICPattern6.dat
[2010/01/26 07:05:38 | 000,001,140 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2010/01/26 07:05:38 | 000,001,140 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2010/01/26 07:05:38 | 000,001,137 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2010/01/26 07:05:38 | 000,001,130 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2010/01/26 07:05:38 | 000,001,130 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2010/01/26 07:05:38 | 000,001,104 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2010/01/26 07:03:43 | 000,000,665 | —- | C] () – C:\Documents and Settings\All Users\Desktop\EPSON Scan.lnk
[2010/01/25 19:31:30 | 000,001,574 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/01/24 16:05:33 | 000,067,866 | —- | C] () – C:\WINDOWS\System32\drivers\netwlan5.img
[2010/01/24 16:04:46 | 000,000,974 | —- | C] () – C:\WINDOWS\System32\pid.inf
[2010/01/24 16:04:27 | 000,129,045 | —- | C] () – C:\WINDOWS\System32\drivers\cxthsfs2.cty
[2010/01/24 16:04:18 | 000,064,352 | —- | C] () – C:\WINDOWS\System32\drivers\ativmc20.cod
[2010/01/24 07:42:44 | 000,000,654 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Winamp.lnk
[2010/01/24 07:00:34 | 000,000,548 | —- | C] () – C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Owner.job
[2010/01/23 19:39:36 | 000,000,000 | —- | C] () – C:\WINDOWS\ativpsrm.bin
[2010/01/23 19:39:34 | 1072,222,208 | -HS- | C] () – C:\hiberfil.sys
[2010/01/23 19:35:46 | 000,593,920 | —- | C] () – C:\WINDOWS\System32\ati2sgag.exe
[2010/01/23 18:50:36 | 000,262,144 | —- | C] () – C:\Documents and Settings\All Users\NTUSER.DAT
[2010/01/23 18:50:34 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/01/23 18:45:12 | 000,000,366 | —- | C] () – C:\WINDOWS\tasks\Symantec NetDetect.job
[2010/01/23 18:43:07 | 000,003,126 | —- | C] () – C:\WINDOWS\emachines_32.bmp
[2010/01/23 18:39:13 | 000,024,001 | —- | C] () – C:\WINDOWS\UNNeroBurnRights.cfg
[2010/01/23 18:31:55 | 000,000,002 | RHS- | C] () – C:\USER
[2010/01/23 18:24:43 | 000,000,060 | —- | C] () – C:\WINDOWS\System32\SYSDRV.DAT
[2010/01/23 18:23:20 | 000,129,045 | —- | C] () – C:\WINDOWS\System32\drivers\HSFProf.cty
[2010/01/23 18:21:04 | 000,055,296 | —- | C] () – C:\WINDOWS\System32\dvdplay.exe
[2010/01/23 18:18:08 | 000,000,476 | —- | C] () – C:\WINDOWS\tasks\McAfee.com Update Check (YOUR-277319736F-Owner).job
[2010/01/23 18:17:22 | 002,097,152 | -H– | C] () – C:\Documents and Settings\Owner\NTUSER.DAT
[2010/01/23 18:17:22 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\Owner\ntuser.ini
[2010/01/23 18:16:58 | 000,000,258 | —- | C] () – C:\WINDOWS\tasks\ISP signup reminder 3.job
[2010/01/23 18:16:58 | 000,000,258 | —- | C] () – C:\WINDOWS\tasks\ISP signup reminder 2.job
[2010/01/23 18:10:13 | 000,008,192 | —- | C] () – C:\WINDOWS\REGLOCS.OLD
[2010/01/23 18:07:47 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\Gateway_T6524__.MRK
[2010/01/23 18:07:40 | 000,000,333 | —- | C] () – C:\WINDOWS\System32\$ncsp$.inf
[2010/01/23 17:58:59 | 000,000,360 | —- | C] () – C:\WINDOWS\tasks\McAfee AntiSpyware.job
[2010/01/23 17:58:56 | 000,000,492 | —- | C] () – C:\WINDOWS\tasks\McAfee.com Update Check (YOUR-277319736F-Administrator).job
[2010/01/23 17:55:23 | 000,001,633 | -H– | C] () – C:\IPH.PH
[2010/01/23 17:55:23 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/01/23 17:54:41 | 000,156,672 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2010/01/23 17:54:41 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\ChCfg.exe
[2010/01/23 17:54:39 | 000,141,016 | —- | C] () – C:\WINDOWS\System32\ALSNDMGR.WAV
[2010/01/23 17:54:01 | 000,543,232 | —- | C] () – C:\WINDOWS\zHotkey.exe
[2010/01/23 17:54:01 | 000,532,544 | —- | C] () – C:\WINDOWS\PIC.dll
[2010/01/23 17:54:01 | 000,042,040 | —- | C] () – C:\WINDOWS\PatchWnd.exe
[2010/01/23 17:54:01 | 000,024,576 | —- | C] () – C:\WINDOWS\HKNTDLL.dll
[2010/01/23 17:54:01 | 000,005,280 | —- | C] () – C:\WINDOWS\hotbtnv.vxd
[2010/01/23 17:54:01 | 000,003,927 | —- | C] () – C:\WINDOWS\mHotkey.reg
[2010/01/23 17:52:47 | 000,002,238 | —- | C] () – C:\WINDOWS\System32\32-aol.ico
[2010/01/23 17:52:47 | 000,001,406 | —- | C] () – C:\WINDOWS\System32\16-aol.ico
[2010/01/23 17:52:42 | 000,471,300 | —- | C] () – C:\WINDOWS\wallpe.exe
[2010/01/23 17:52:42 | 000,030,056 | —- | C] () – C:\WINDOWS\System32\oemlogo.bmp
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2004/10/28 11:47:17 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/10/27 18:53:07 | 000,001,386 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/10/27 18:53:07 | 000,000,464 | —- | C] () – C:\WINDOWS\System32\emver.ini
< End of report >

CatByte

Post #4January 31, 2010, 10:04 PM UTC

Were you able to run malwarebytes, please post the log Please advise how your computer is running now and if there are any outstanding issues.

xamtoro

Post #5January 31, 2010, 10:14 PM UTC

Malwarebytes' Anti-Malware 1.44 Database version: 3669 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 1/31/2010 4:04:49 PM mbam-log-2010-01-31 (16-04-49).txt Scan type: Quick Scan Objects scanned: 122272 Time elapsed: 5 minute(s), 55 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 1 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) now my computer is back to normal and so far no signs of the virus anymore here is the mbam log Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

CatByte

Post #6January 31, 2010, 10:33 PM UTC

Please do the following:

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan.

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

CatByte

Post #7February 6, 2010, 4:46 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Is there anything else to worry about?

✨ Ask AI

Ask AI