Spyware / Malware / Virus Removal

[Resolved] Google Chrome Not Working

40 min read

Looking for the outcome? Ask AI

Shiftlemac

Post #31April 23, 2010, 10:06 AM UTC

Ah yes, apologies, this one should be correct:

ComboFix 10-04-21.01 - GB090455 22/04/2010 17:00:31.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.1992.1442 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Client Firewall *disabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}

FILE ::
"c:\windows\system32\msln.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\documents and settings\Administrator\Application Data\Ziwytu
c:\windows\system32\msln.exe

.
((((((((((((((((((((((((( Files Created from 2010-03-22 to 2010-04-22 )))))))))))))))))))))))))))))))
.

2010-04-22 11:39 . 2010-04-22 11:39 ——– d—–w- c:\program files\Recuva
2010-04-22 10:16 . 2010-04-22 11:39 ——– d—–w- c:\program files\NTFS Undelete
2010-04-18 20:10 . 2010-04-21 09:48 ——– d—–w- c:\program files\JDownloader
2010-04-18 16:56 . 2010-04-18 16:56 ——– d-sh–w- c:\documents and settings\NetworkService.NT AUTHORITY\IETldCache
2010-04-18 16:52 . 2010-04-18 16:52 ——– d—–w- c:\documents and settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Google
2010-04-18 16:51 . 2010-04-18 17:02 ——– d—–w- c:\documents and settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft
2010-04-18 16:51 . 2005-04-04 17:56 ——– d-s—w- c:\documents and settings\NetworkService.NT AUTHORITY\UserData
2010-04-18 16:51 . 2010-04-18 16:56 ——– d-sh–w- c:\documents and settings\NetworkService.NT AUTHORITY
2010-04-16 11:49 . 2010-04-16 11:49 ——– d—–w- c:\documents and settings\Administrator\Application Data\No Company Name
2010-04-16 10:20 . 2010-04-16 10:21 ——– d—–w- c:\documents and settings\All Users\Application Data\SmartSound Software Inc
2010-04-16 10:20 . 2010-04-16 10:20 ——– d—–w- c:\program files\SmartSound Software
2010-04-15 21:04 . 2010-04-15 21:04 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\HandBrake
2010-04-15 21:04 . 2010-04-15 23:09 ——– d—–w- c:\documents and settings\Administrator\Application Data\HandBrake
2010-04-13 15:38 . 2010-04-13 15:38 ——– d—–w- c:\program files\TagRename
2010-04-13 10:06 . 2010-04-13 10:06 ——– d—–w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-13 10:05 . 2010-04-13 10:10 ——– d—–w- c:\program files\SpywareBlaster
2010-04-13 01:46 . 2010-04-20 02:34 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-04-13 00:19 . 2010-04-13 00:19 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Flickr
2010-04-13 00:19 . 2010-04-13 00:19 ——– d—–w- c:\documents and settings\Administrator\Application Data\Flickr
2010-04-12 23:37 . 2010-04-12 23:37 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Geckofx
2010-04-12 23:37 . 2010-04-12 23:37 ——– d—–w- c:\documents and settings\Administrator\Application Data\Red Kawa
2010-04-12 22:52 . 2010-04-12 22:52 ——– d—–w- c:\program files\mp4UI
2010-04-12 22:45 . 2010-04-12 22:45 ——– d—–w- c:\program files\lame
2010-04-12 22:20 . 2010-04-12 22:24 ——– d—–w- c:\program files\Yamb
2010-04-12 22:06 . 2010-04-13 17:47 ——– d—–w- c:\documents and settings\Administrator\Application Data\avidemux
2010-04-12 22:06 . 2010-04-15 20:29 ——– d—–w- c:\program files\Avidemux 2.5
2010-04-12 22:00 . 2010-04-12 22:05 ——– d—–w- c:\program files\VirtualDub-1.9.9
2010-04-12 21:16 . 2010-04-12 22:04 ——– d—–w- c:\program files\GSpot270a
2010-04-12 17:40 . 2010-04-12 17:40 ——– d-sh–w- c:\documents and settings\LocalService\PrivacIE
2010-04-12 17:40 . 2010-04-12 17:40 ——– d-sh–w- c:\documents and settings\LocalService\IECompatCache
2010-04-12 11:35 . 2009-06-26 00:22 319000 —-a-w- c:\windows\system32\drivers\iastor.sys
2010-04-12 11:35 . 2009-06-26 00:22 319000 —-a-w- C:\iastor.sys
2010-04-07 09:30 . 2010-04-07 09:30 ——– d—–w- c:\program files\Trend Micro
2010-04-07 08:32 . 2010-04-07 08:33 3908515 —-a-r- c:\program files\ComboFix.exe
2010-04-07 07:20 . 2010-04-07 07:20 ——– d—–w- C:\RegBackup
2010-04-06 21:13 . 2010-04-06 21:13 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-04-06 19:52 . 2010-04-06 19:52 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-04-06 19:52 . 2010-03-29 23:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-06 19:52 . 2010-04-06 19:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-06 19:52 . 2010-03-29 23:45 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-06 19:52 . 2010-04-06 19:52 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-05 18:52 . 2010-04-05 18:52 ——– d—–w- c:\program files\BBC iPlayer Desktop
2010-04-01 22:42 . 2010-04-01 22:43 ——– d—–w- c:\program files\MagicDisc
2010-04-01 22:42 . 2009-02-24 16:42 116736 —-a-w- c:\windows\system32\drivers\mcdbus.sys
2010-04-01 21:56 . 2010-04-01 21:56 ——– d—–w- c:\windows\system32\syncdb
2010-04-01 21:27 . 2010-04-01 21:27 ——– d—–w- c:\program files\Windows Installer Clean Up
2010-03-31 13:31 . 2009-05-18 11:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-03-31 13:31 . 2008-04-17 10:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2010-03-31 13:30 . 2010-03-31 13:30 ——– d—–w- c:\program files\iPod
2010-03-31 13:30 . 2010-03-31 13:31 ——– d—–w- c:\program files\iTunes
2010-03-31 13:30 . 2010-03-31 13:31 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-03-31 13:29 . 2010-03-31 13:29 ——– d—–w- c:\program files\QuickTime
2010-03-31 13:29 . 2010-04-15 02:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-03-31 13:27 . 2010-03-31 13:27 ——– d—–w- c:\program files\Apple Software Update
2010-03-31 13:27 . 2009-10-16 00:33 41472 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2010-03-31 13:27 . 2009-10-16 00:33 3003680 —-a-w- c:\windows\system32\usbaaplrc.dll
2010-03-31 13:27 . 2010-03-31 13:27 ——– d—–w- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-22 15:59 . 2005-04-05 17:21 ——– d—–w- c:\program files\C4ebreg
2010-04-22 15:56 . 2007-03-05 22:09 40 —-a-w- c:\windows\system32\profile.dat
2010-04-22 13:00 . 2010-02-19 00:23 ——– d—–w- c:\documents and settings\Administrator\Application Data\vlc
2010-04-22 11:40 . 2006-01-24 00:45 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-04-22 11:14 . 2009-06-26 00:54 ——– d—–w- c:\program files\AT&T Network Client
2010-04-21 11:34 . 2009-08-22 15:57 ——– d—–w- c:\documents and settings\Administrator\Application Data\dvdcss
2010-04-19 19:03 . 2009-12-27 15:32 ——– d—–w- c:\documents and settings\Administrator\Application Data\Giqay
2010-04-19 12:30 . 2006-03-27 21:50 ——– d—–w- c:\program files\WST
2010-04-19 05:07 . 2009-02-11 21:17 23552 —-a-w- c:\windows\system32\drivers\abp480n5.sys
2010-04-18 23:10 . 2009-06-30 15:07 ——– d—–w- c:\program files\Foxit Reader
2010-04-17 14:44 . 2006-04-12 02:08 ——– d—–w- c:\program files\Common Files\Adobe
2010-04-16 10:26 . 2005-04-04 18:17 47168 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-15 21:04 . 2009-08-14 17:22 ——– d—–w- c:\program files\HandBrake
2010-04-15 17:30 . 2009-07-24 21:16 ——– d—–w- c:\program files\Google
2010-04-13 00:19 . 2009-11-22 19:11 ——– d—–w- c:\program files\Flickr Uploadr
2010-04-12 22:46 . 2009-10-16 20:37 ——– d—–w- c:\documents and settings\Administrator\Application Data\foobar2000
2010-04-12 17:37 . 2009-10-31 19:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-11 18:57 . 2010-01-30 12:28 ——– d—–w- c:\documents and settings\Administrator\Application Data\Apple Computer
2010-04-07 08:41 . 2009-08-14 17:43 ——– d—–w- c:\program files\T-Mobile Internet Manager
2010-04-07 06:42 . 2010-04-06 19:51 319000 —-a-w- c:\windows\system32\drivers\tsk29.tmp
2010-04-06 21:16 . 2009-10-31 20:35 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-04-06 21:16 . 2009-10-31 20:54 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-04-06 21:13 . 2009-10-31 19:49 ——– d—–w- c:\program files\Lavasoft
2010-04-05 18:50 . 2009-06-26 20:01 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-04-01 21:27 . 2007-10-10 15:20 ——– d—–w- c:\program files\MSECache
2010-03-31 13:30 . 2010-01-17 03:54 ——– d—–w- c:\program files\Common Files\Apple
2010-02-26 16:34 . 2009-10-07 10:07 6400 —-a-w- c:\windows\system32\drivers\isamfilter.sys
2010-02-26 13:11 . 2010-02-26 13:11 ——– d—–w- c:\documents and settings\Administrator\Application Data\Facebook
2010-02-25 18:11 . 2005-07-29 18:05 64792 —-a-w- c:\windows\isamunin.exe
2010-02-12 09:46 . 2010-02-12 09:46 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-02-12 09:46 . 2010-02-12 09:46 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-02-04 15:53 . 2009-10-31 20:35 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
.

((((((((((((((((((((((((((((( SnapShot_2010-04-19_11.20.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-04-22 15:59 . 2010-04-22 15:59 16384 c:\windows\Temp\Perflib_Perfdata_b0c.dat
+ 2004-08-04 05:00 . 2004-08-04 05:00 37888 c:\windows\system32\url.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 39424 c:\windows\system32\pngfilt.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 96256 c:\windows\system32\occache.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 56832 c:\windows\system32\mshtmler.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 29184 c:\windows\system32\mshta.exe
+ 2004-08-04 05:00 . 2004-08-04 05:00 22016 c:\windows\system32\licmgr10.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 16384 c:\windows\system32\jsproxy.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 96256 c:\windows\system32\inseng.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 35840 c:\windows\system32\imgutil.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 62976 c:\windows\system32\iesetup.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 48640 c:\windows\system32\iernonce.dll
+ 2009-06-29 15:09 . 2009-04-29 04:52 81920 c:\windows\system32\ieencode.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 34304 c:\windows\system32\ie4uinit.exe
+ 2004-08-04 05:00 . 2004-08-04 05:00 37888 c:\windows\system32\dllcache\url.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 39424 c:\windows\system32\dllcache\pngfilt.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 96256 c:\windows\system32\dllcache\occache.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 56832 c:\windows\system32\dllcache\mshtmler.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 29184 c:\windows\system32\dllcache\mshta.exe
+ 2004-08-04 05:00 . 2004-08-04 05:00 22016 c:\windows\system32\dllcache\licmgr10.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 16384 c:\windows\system32\dllcache\jsproxy.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 96256 c:\windows\system32\dllcache\inseng.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 35840 c:\windows\system32\dllcache\imgutil.dll
+ 2005-04-04 17:41 . 2004-08-04 05:00 93184 c:\windows\system32\dllcache\iexplore.exe
+ 2004-08-04 05:00 . 2004-08-04 05:00 62976 c:\windows\system32\dllcache\iesetup.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 48640 c:\windows\system32\dllcache\iernonce.dll
+ 2009-06-29 15:09 . 2009-04-29 04:52 81920 c:\windows\system32\dllcache\ieencode.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 34304 c:\windows\system32\dllcache\ie4uinit.exe
+ 2005-04-04 17:41 . 2004-08-04 05:00 38912 c:\windows\system32\dllcache\hmmapi.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 35328 c:\windows\system32\dllcache\corpol.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 99840 c:\windows\system32\dllcache\advpack.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 61440 c:\windows\system32\dllcache\admparse.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 35328 c:\windows\system32\corpol.dll
+ 2005-04-04 17:46 . 2010-04-22 15:51 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2005-04-04 17:46 . 2010-04-19 11:10 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2010-04-11 21:09 . 2010-04-19 11:10 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-04-19 11:30 . 2010-04-22 15:51 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-04 05:00 . 2004-08-04 05:00 99840 c:\windows\system32\advpack.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 61440 c:\windows\system32\admparse.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 659456 c:\windows\system32\wininet.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 276480 c:\windows\system32\webcheck.dll
+ 2004-08-04 05:00 . 2007-12-18 14:40 417792 c:\windows\system32\vbscript.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 616448 c:\windows\system32\urlmon.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 532480 c:\windows\system32\mstime.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 146432 c:\windows\system32\msrating.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 146432 c:\windows\system32\msls31.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 449024 c:\windows\system32\mshtmled.dll
+ 2004-08-04 05:00 . 2007-12-18 14:40 450560 c:\windows\system32\jscript.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 251392 c:\windows\system32\iepeers.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 323584 c:\windows\system32\iedkcs32.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 221184 c:\windows\system32\ieakui.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 216576 c:\windows\system32\ieaksie.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 139264 c:\windows\system32\ieakeng.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 205312 c:\windows\system32\dxtrans.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 357888 c:\windows\system32\dxtmsft.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 659456 c:\windows\system32\dllcache\wininet.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 276480 c:\windows\system32\dllcache\webcheck.dll
+ 2005-04-04 17:42 . 2007-06-26 15:13 851968 c:\windows\system32\dllcache\vgx.dll
+ 2004-08-04 05:00 . 2007-12-18 14:40 417792 c:\windows\system32\dllcache\vbscript.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 616448 c:\windows\system32\dllcache\urlmon.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 532480 c:\windows\system32\dllcache\mstime.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 146432 c:\windows\system32\dllcache\msrating.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 146432 c:\windows\system32\dllcache\msls31.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 449024 c:\windows\system32\dllcache\mshtmled.dll
+ 2004-08-04 05:00 . 2007-12-18 14:40 450560 c:\windows\system32\dllcache\jscript.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 251392 c:\windows\system32\dllcache\iepeers.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 323584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 221184 c:\windows\system32\dllcache\ieakui.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 216576 c:\windows\system32\dllcache\ieaksie.dll
+ 2004-08-04 05:00 . 2004-08-04 05:00 139264 c:\windows\system32\dllcache\ieakeng.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 205312 c:\windows\system32\dllcache\dxtrans.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 357888 c:\windows\system32\dllcache\dxtmsft.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 3060736 c:\windows\system32\mshtml.dll
+ 2004-08-04 05:00 . 2009-04-29 04:52 3060736 c:\windows\system32\dllcache\mshtml.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetSP - restore settings on power failure"="c:\program files\AT&T Network Client\NetSP.exe" [2007-01-13 24576]
"SkinClock"="c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2008-05-21 1134592]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768]
"Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-11-03 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pmonmh"="c:\program files\IBM\My Help\plugins\\com.ibm.myhelp.common_1.4.19" [X]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"stgclean"="c:\sdwork\w32maing.exe" [2010-04-07 267776]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"vptray"="c:\progra~1\SYMANT~2\SYMANT~2\VPTray.exe" [2006-09-27 125168]
"Tpam.exe"="c:\program files\IBM\Personal Communications\tpam.exe" [2007-11-02 28672]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-26 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-26 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-26 141848]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 110592]
"TpShocks"="TpShocks.exe" [2008-06-06 181536]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2009-06-26 331776]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2009-06-26 208896]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-06-26 820520]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2009-06-26 60192]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-03-24 68464]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2007-01-09 868352]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2008-08-15 143360]
"ipmcmu"="c:\program files\IBM\IPM Client Migration Utility\ipmcmu.exe" [2009-06-29 204800]
"ISSI Service"="c:\sdwork\issimsvc.exe" [2010-02-11 241392]
"C4EBReg"="c:\program files\c4ebreg\c4ebreg.exe" [2010-02-25 482584]
"Isamtray"="c:\program files\c4ebreg\isamtray.exe" [2010-02-25 285976]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-29 148888]
"UIExec"="c:\program files\T-Mobile Internet Manager\UIExec.exe" [2009-06-12 132608]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Check for TWS Updates.lnk - c:\jts\WiseUpdt.exe [2010-2-24 194775]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2009-10-02 128360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pcsinst]
2007-11-02 10:45 49152 —-a-w- c:\windows\system32\pcsinst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-06 16:37 34344 —-a-w- c:\program files\Lenovo\HOTKEY\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2008-03-17 16:02 34080 —-a-w- c:\program files\Lenovo\HOTKEY\tphklock.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\assistant2]
2006-10-20 09:01 2107392 —-a-w- c:\program files\VoiceRite\Client\Viewer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 16:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"IBMconfig"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AT&T Network Client\\NetClient.exe"=
"c:\\Program Files\\IBM\\Lotus\\Sametime Connect\\rcp\\eclipse\\plugins\\com.ibm.rcp.jcl.desktop.win32.x86_6.2.0.200810071032\\jre\\bin\\sametime80w.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [31/10/2009 21:35 64288]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [14/05/2008 17:21 19496]
R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [09/10/2009 04:45 169312]
R2 pdlndldl6;IBM Enterprise Extender (HPR/IPv6);c:\windows\system32\drivers\pdlndldl6.sys [02/11/2007 05:09 70656]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [26/06/2009 01:22 243856]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [04/09/2009 20:31 102448]
R3 IsamFilter;IsamFilter;c:\windows\system32\drivers\isamfilter.sys [07/10/2009 11:07 6400]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24/07/2009 22:16 133104]
S3 csrcmds;csrcmds;c:\program files\IBM\Personal Communications\csrcmds.exe [02/11/2007 05:09 49152]
S3 cstrcser;IBM Command Line Trace;c:\windows\system32\drivers\cstrcser.exe [02/11/2007 05:09 36864]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [14/08/2009 18:43 9728]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [16/10/2009 22:12 721904]

— Other Services/Drivers In Memory —

*Deregistered* - BMLoad

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-04-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 21:15]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-24 21:16]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-24 21:16]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2869554992-1010074173-1580797646-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-03 08:21]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2869554992-1010074173-1580797646-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-03 08:21]

2010-04-22 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2009-06-26 00:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://w3.ibm.com/
uInternet Connection Wizard,ShellNext = hxxp://w3.ibm.com/
uInternet Settings,ProxyServer = proxy.emea.ibm.com:8080
uInternet Settings,ProxyOverride = localhost;127.0.0.1;*.local;
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1ACECAFE-0015-0000-0000-ABCDEFFEDCBA} - hxxp://
DPF: {9519B2A2-6592-4E41-8290-D0298459270C} - hxxp://w3.ibm.com/bluepages/scripts/lnwebassist.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff36\gears.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-22 17:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ipmcmu = c:\program files\IBM\IPM Client Migration Utility\ipmcmu.exe "c:\program files\IBM\IPM Client Migration Utility"?run key ipmcmu was set successfully?run key ipmcmu was not set successfully?Error, Windows run key not found?The service "Task Scheduler" is not ru

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: >>UNKNOWN [0x804D7000]<< >>UNKNOWN [0xF77EF000]<< >>UNKNOWN [0xF76B7000]<< >>UNKNOWN [0xF76A7000]<< >>UNKNOWN [0xF75A8000]<< >>UNKNOWN [0x806FF000]<< >>UNKNOWN [0xF7B0F000]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0xf76bbfc3
\Driver\ACPI -> 0xf75aecb8
\Driver\atapi -> 0xf746a814
\Driver\iaStor -> 0xf7b4b992
IoDeviceObjectType -> DeleteProcedure -> 0x805e4d69
ParseProcedure -> 0x8057950b
\Device\Harddisk0\DR0 -> DeleteProcedure -> 0x805e4d69
ParseProcedure -> 0x8057950b
NDIS: Intel® WiFi Link 5100 AGN -> SendCompleteHandler -> 0xba62dbb0
PacketIndicateHandler -> 0xba61ca0d
SendHandler -> 0xba630b40
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iastor]
"ImagePath"="system32\drivers\tsk29.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2869554992-1010074173-1580797646-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6e,02,39,19,25,c4,84,41,8d,4f,c0,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,fe,38,df,56,87,6c,4c,b5,1c,3e,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•A~*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1052)
c:\program files\Lenovo\HOTKEY\tphklock.dll
c:\windows\system32\pcsinst.dll
.
Completion time: 2010-04-22 17:16:02
ComboFix-quarantined-files.txt 2010-04-22 16:16
ComboFix2.txt 2010-04-19 11:26
ComboFix3.txt 2010-04-07 09:28

Pre-Run: 2,719,248,384 bytes free
Post-Run: 2,677,514,240 bytes free

- - End Of File - - 5673D7875BE4C83874A39B6661F6A48B

inzanity

Post #32April 23, 2010, 10:28 AM UTC

Hi,

Your log is looking good.

Please do the following:

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs
——————————————————————–

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

DEQUARANTINE::
C:\Qoobox\Quarantine\C\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk.vir

QUIT::

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at DeQuarantine_log.txt which I will require in your next reply.

–Next–

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post back the log.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.

–Next–

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

To post in your next reply:
1. DeQuarantine_log.txt
2. Malwarebytes' log.
3. Kaspersky log.
4. How is your computer? Any outstanding issues?

Shiftlemac

Post #33April 24, 2010, 8:12 AM UTC

Ok, first up, the DeQuarantine log: C:\Qoobox\Quarantine\C\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk.vir -> C:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk ( 643 bytes ) Then the Malwarebytes log: Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 4024 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 23/04/2010 13:46:21 mbam-log-2010-04-23 (13-46-21).txt Scan type: Quick scan Objects scanned: 118097 Time elapsed: 5 minute(s), 18 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) And finally the Kaspersky log: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Saturday, April 24, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, April 23, 2010 22:02:14 Records in database: 3975762 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ E:\ Scan statistics: Objects scanned: 431385 Threats found: 5 Infected objects found: 7 Suspicious objects found: 0 Scan duration: 07:40:25 File name / Threat / Threats count C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\0\7eb3e3c0-3b7edeab Infected: Exploit.Java.CVE-2009-3867.gen 1 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\0\7eb3e3c0-3b7edeab Infected: Trojan-Downloader.Java.OpenStream.al 1 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7259e802-1a38660c Infected: Exploit.Java.CVE-2009-3867.gen 1 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7259e802-1a38660c Infected: Trojan-Downloader.Java.OpenStream.al 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40000\5FEF8279.VBN Infected: Trojan-Spy.Win32.Zbot.ahzc 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16080000\5FCA3AB8.VBN Infected: Trojan-Spy.Win32.Zbot.ahvx 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1FFC0000\5FFF8A60.VBN Infected: Virus.Win32.Virut.ce 1 Selected area has been scanned. I haven't noticed any more issues - so far the computer's behaving itself! How am I doing? Thanks, Mark T

inzanity

Post #34April 24, 2010, 8:23 AM UTC

Hi,

So far so good.

The infections found by Kaspersky are quarantined files and the java cache. We'll be cleaning it at the same time another round of OTL to be sure.

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Files
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\0\7eb3e3c0-3b7edeab
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\0\7eb3e3c0-3b7edeab
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7259e802-1a38660c
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7259e802-1a38660c

:Commands
[purity]
[emptytemp]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
Then post the result and a new OTL log in your next reply. ( don't check the boxes beside LOP Check or Purity this time )

–Next–

Open OTL.exe.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
There will only be a single log produced. OTL.Txt.
Note:This log can be located in the OTL. folder on you C:\ drive if it fails to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

To post in your next reply:
1. OTL fix log.
2. Fresh OTL log.

Shiftlemac

Post #35April 24, 2010, 3:28 PM UTC last edited April 24, 2010, 5:02 PM UTC

Aargh, help! That seemed to go ok (the first 'fix' step, this is), until it said it would reboot the computer, and now the computer won't start! It gets stuck at a blue screen. I ran chkdsk but no luck - is there something else I can do? Thanks, Mark

Shiftlemac

Post #36April 24, 2010, 4:43 PM UTC

I should add that I've tried booting into Safe Mode and "Last Known Good Configuration", but they didn't work either… Thanks, Mark

inzanity

Post #37April 25, 2010, 3:44 AM UTC

Hi,

Can you post the BSOD error?

We will need to make a BOOT CD

Print these instruction out so that you know what you are doing.

Two programs to download:

First

Please downloadISOBurner and save it to your desktop. This program will allow you to burn OTLPE.ISO to make a bootable CD.

Double click the ISOBurner set up icon to install the program, from there on in it is fairly automatic.
There are Instructions for the iso burner here if you need them.

Second

Download OTLPE.iso save it to your desktop. Now burn OTLPE.iso to a CD using ISO Burner. {NOTE: This file is 292Mb in size so it may take some time to download.)
When downloaded double click OTLPE.iso > this will then open ISOBurner to burn the file to CD
Reboot the infected system using the boot CD you just created.
Note : If you do not know how to set your computer to boot from CD follow the steps here
Your system should now display a REATOGO-X-PE desktop.
you will find an icon on the desktop called OTLPE > Double-click on the OTLPE icon.
When asked "Do you wish to load the remote registry", select Yes
When asked "Do you wish to load remote user profile(s) for scanning", select Yes
Ensure the box "Automatically Load All Remaining Users" is checked and press OK
OTL should now start. Change the following settings
- Change Drivers to SafeList
Press Run Scan to start the scan.
When finished, the file will be saved in drive C:\OTL.txt
Copy this file to your USB drive if you do not have internet connection on this system
Please post the contents of the C:\OTL.txt file in your reply.

Shiftlemac

Post #38April 25, 2010, 2:12 PM UTC

Hi, the error message says:

"A problem has been detected and windows has been shut down to prevent damage to your computer.

If this is the first time you've seen this stop error screen … etc etc…. Run CHKDSK /F to check for hard drive corruption…. etc etc …. Technical information:

*** STOP: 0x0000007B … etc etc"

I loaded the boot disk and followed your instructions, but note that it jumped straight to the "Do you wish to load remote user profiles" step - there was no "remote registry" step.

OTL.txt is attached:

OTL logfile created on: 4/25/2010 2:35:12 PM - Run
OTLPE by OldTimer - Version 3.1.38.0 Folder = X:\Programs\OTLPE
(Version = .) - Type =
Internet Explorer (Version = )
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 89.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): Reg Error: Key error.

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 6.80 Gb Free Space | 4.56% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 276.80 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO
Current User Name: SYSTEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
Unable to determine ControlSet!

========== Win32 Services (SafeList) ==========

========== Driver Services (SafeList) ==========

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

[2010/04/24 04:18:49 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/06/30 11:06:45 | 000,072,960 | —- | M] (Foxit Software Company) – C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
[2010/04/08 14:09:38 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/04/08 14:09:39 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/04/08 14:09:39 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/04/08 14:09:39 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/04/02 06:45:51 | 000,349,331 | R— | M]) - C:\Windows\System32\Drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 11977 more lines…
O13 - ftp Prefix: missing
O13 - gopher Prefix: missing
O13 - home Prefix: missing
O13 - mosaic Prefix: missing
O13 - www Prefix: missing
O20 - HKLM Winlogon: Shell - ( ) - (Registry key not found)
O20 - HKLM Winlogon: UserInit - ( ) - (Registry key not found)
O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - Unable to open key or key not present!
O32 - AutoRun File - [2005/04/04 13:44:20 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R— | M] () - X:\AUTORUN.INF – [ CDFS ]
O37 - HKLM\…com [@ = Reg Error: Key error.] – Reg Error: Key error. File not found
O37 - HKLM\…exe [@ = Reg Error: Key error.] – Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/04/24 06:31:44 | 000,000,000 | —D | C] – C:\_OTL
[2010/04/23 08:14:46 | 000,000,000 | –SD | C] – C:\ComboFix
[2010/04/22 13:45:18 | 000,000,000 | —D | C] – C:\Windows\Prefetch
[2010/04/22 13:15:17 | 001,307,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dllcache\msxml6.dll
[2010/04/22 13:15:17 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dllcache\msxml6r.dll
[2010/04/22 13:15:11 | 000,086,016 | —- | C] (Sipro Lab Telecom Inc.) – C:\Windows\System32\dllcache\sl_anet.acm
[2010/04/22 13:15:10 | 000,294,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dllcache\msaud32.acm
[2010/04/22 13:15:10 | 000,290,816 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\System32\dllcache\l3codeca.acm
[2010/04/22 13:15:06 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dllcache\dpcdll.dll
[2010/04/22 13:14:54 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\irbus.sys
[2010/04/22 13:14:54 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\smtpapi.dll
[2010/04/22 13:14:54 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rwnh.dll
[2010/04/22 13:14:54 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\System32\comsdupd.exe
[2010/04/22 13:14:49 | 001,888,992 | —- | C] (ATI Technologies Inc. ) – C:\Windows\System32\ati3duag.dll
[2010/04/22 13:14:49 | 000,870,784 | —- | C] (ATI Technologies Inc. ) – C:\Windows\System32\ati3d1ag.dll
[2010/04/22 13:14:49 | 000,650,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3ui.dll
[2010/04/22 13:14:49 | 000,516,768 | —- | C] (ATI Technologies Inc. ) – C:\Windows\System32\ativvaxx.dll
[2010/04/22 13:14:49 | 000,377,984 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\ati2dvaa.dll
[2010/04/22 13:14:49 | 000,233,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\azroles.dll
[2010/04/22 13:14:49 | 000,229,376 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\ati2cqag.dll
[2010/04/22 13:14:49 | 000,201,728 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\ati2dvag.dll
[2010/04/22 13:14:49 | 000,184,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eapp3hst.dll
[2010/04/22 13:14:49 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eapphost.dll
[2010/04/22 13:14:49 | 000,126,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eappcfg.dll
[2010/04/22 13:14:49 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eappgnui.dll
[2010/04/22 13:14:49 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eapqec.dll
[2010/04/22 13:14:49 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3cfg.dll
[2010/04/22 13:14:49 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3msm.dll
[2010/04/22 13:14:49 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dhcpqec.dll
[2010/04/22 13:14:49 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eappprxy.dll
[2010/04/22 13:14:49 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3gpclnt.dll
[2010/04/22 13:14:49 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dimsroam.dll
[2010/04/22 13:14:49 | 000,032,768 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\ativtmxx.dll
[2010/04/22 13:14:49 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eapolqec.dll
[2010/04/22 13:14:49 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3api.dll
[2010/04/22 13:14:49 | 000,023,040 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\ativmvxx.ax
[2010/04/22 13:14:49 | 000,009,728 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\ativdaxx.ax
[2010/04/22 13:14:49 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3dlg.dll
[2010/04/22 13:14:49 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bitsprx4.dll
[2010/04/22 13:14:48 | 001,737,856 | —- | C] (Matrox Graphics Inc.) – C:\Windows\System32\mtxparhd.dll
[2010/04/22 13:14:48 | 000,397,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mmcex.dll
[2010/04/22 13:14:48 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\napmontr.dll
[2010/04/22 13:14:48 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\microsoft.managementconsole.dll
[2010/04/22 13:14:48 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\napstat.exe
[2010/04/22 13:14:48 | 000,155,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssha.dll
[2010/04/22 13:14:48 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mmcfxcommon.dll
[2010/04/22 13:14:48 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieencode.dll
[2010/04/22 13:14:48 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msshavmsg.dll
[2010/04/22 13:14:48 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\l2gpstore.dll
[2010/04/22 13:14:48 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mmcperf.exe
[2010/04/22 13:14:48 | 000,032,285 | —- | C] (Conexant Systems, Inc.) – C:\Windows\System32\hsfcisp2.dll
[2010/04/22 13:14:48 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\napipsec.dll
[2010/04/22 13:14:48 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kbdpash.dll
[2010/04/22 13:14:48 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kbdnepr.dll
[2010/04/22 13:14:48 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kbdiultn.dll
[2010/04/22 13:14:48 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kbdbhc.dll
[2010/04/22 13:14:47 | 004,274,816 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\nv4_disp.dll
[2010/04/22 13:14:47 | 000,397,056 | —- | C] (S3 Graphics, Inc.) – C:\Windows\System32\s3gnb.dll
[2010/04/22 13:14:47 | 000,286,792 | —- | C] (Smart Link) – C:\Windows\System32\slextspk.dll
[2010/04/22 13:14:47 | 000,188,508 | —- | C] (Smart Link) – C:\Windows\System32\slgen.dll
[2010/04/22 13:14:47 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qagent.dll
[2010/04/22 13:14:47 | 000,144,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\onex.dll
[2010/04/22 13:14:47 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qutil.dll
[2010/04/22 13:14:47 | 000,073,832 | —- | C] (Smart Link) – C:\Windows\System32\slcoinst.dll
[2010/04/22 13:14:47 | 000,073,796 | —- | C] (Smart Link) – C:\Windows\System32\slserv.exe
[2010/04/22 13:14:47 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanapi.dll
[2010/04/22 13:14:47 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qcliprov.dll
[2010/04/22 13:14:47 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rasqec.dll
[2010/04/22 13:14:47 | 000,032,866 | —- | C] (Smart Link) – C:\Windows\System32\slrundll.exe
[2010/04/22 13:14:47 | 000,032,866 | —- | C] (Smart Link) – C:\Windows\slrundll.exe
[2010/04/22 13:14:47 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setupn.exe
[2010/04/22 13:14:47 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vidcap.ax
[2010/04/22 13:14:47 | 000,000,000 | —D | C] – C:\Windows\System32\scripting
[2010/04/22 13:14:46 | 000,000,000 | —D | C] – C:\Windows\l2schemas
[2010/04/22 13:14:46 | 000,000,000 | —D | C] – C:\Windows\System32\en
[2010/04/22 13:14:46 | 000,000,000 | —D | C] – C:\Windows\System32\bits
[2010/04/22 13:12:28 | 000,294,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dllcache\dlimport.exe
[2010/04/22 13:11:50 | 000,004,255 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\adv01nt5.dll
[2010/04/22 13:11:50 | 000,003,967 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\adv02nt5.dll
[2010/04/22 13:11:50 | 000,003,775 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\adv11nt5.dll
[2010/04/22 13:11:50 | 000,003,711 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\adv09nt5.dll
[2010/04/22 13:11:50 | 000,003,647 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\adv07nt5.dll
[2010/04/22 13:11:50 | 000,003,615 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\adv05nt5.dll
[2010/04/22 13:11:50 | 000,003,135 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\adv08nt5.dll
[2010/04/22 13:11:50 | 000,000,000 | —D | C] – C:\Windows\network diagnostic
[2010/04/22 13:11:49 | 000,701,440 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati2mtag.sys
[2010/04/22 13:11:49 | 000,327,040 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati2mtaa.sys
[2010/04/22 13:11:49 | 000,104,960 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atinrvxx.sys
[2010/04/22 13:11:49 | 000,073,216 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atintuxx.sys
[2010/04/22 13:11:49 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1rvxx.sys
[2010/04/22 13:11:49 | 000,057,856 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atinbtxx.sys
[2010/04/22 13:11:49 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1btxx.sys
[2010/04/22 13:11:49 | 000,052,224 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atinraxx.sys
[2010/04/22 13:11:49 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1tuxx.sys
[2010/04/22 13:11:49 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1xsxx.sys
[2010/04/22 13:11:49 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1raxx.sys
[2010/04/22 13:11:49 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1xbxx.sys
[2010/04/22 13:11:49 | 000,028,672 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atinsnxx.sys
[2010/04/22 13:11:49 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1snxx.sys
[2010/04/22 13:11:49 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1ttxx.sys
[2010/04/22 13:11:49 | 000,014,336 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atinpdxx.sys
[2010/04/22 13:11:49 | 000,013,824 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atinttxx.sys
[2010/04/22 13:11:49 | 000,013,824 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atinmdxx.sys
[2010/04/22 13:11:49 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1pdxx.sys
[2010/04/22 13:11:49 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\ati1mdxx.sys
[2010/04/22 13:11:48 | 000,063,488 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atinxsxx.sys
[2010/04/22 13:11:48 | 000,036,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\bthprint.sys
[2010/04/22 13:11:48 | 000,031,744 | —- | C] (ATI Technologies Inc.) – C:\Windows\System32\drivers\atinxbxx.sys
[2010/04/22 13:11:48 | 000,025,471 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\atv04nt5.dll
[2010/04/22 13:11:48 | 000,021,183 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\atv01nt5.dll
[2010/04/22 13:11:48 | 000,017,279 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\atv10nt5.dll
[2010/04/22 13:11:48 | 000,015,423 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\ch7xxnt5.dll
[2010/04/22 13:11:48 | 000,014,143 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\atv06nt5.dll
[2010/04/22 13:11:48 | 000,011,359 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\atv02nt5.dll
[2010/04/22 13:11:47 | 001,897,408 | —- | C] (NVIDIA Corporation) – C:\Windows\System32\drivers\nv4_mini.sys
[2010/04/22 13:11:47 | 001,309,184 | —- | C] (Smart Link) – C:\Windows\System32\drivers\mtlstrm.sys
[2010/04/22 13:11:47 | 000,452,736 | —- | C] (Matrox Graphics Inc.) – C:\Windows\System32\drivers\mtxparhm.sys
[2010/04/22 13:11:47 | 000,404,990 | —- | C] (Smart Link) – C:\Windows\System32\drivers\slntamr.sys
[2010/04/22 13:11:47 | 000,180,360 | —- | C] (Smart Link) – C:\Windows\System32\drivers\ntmtlfax.sys
[2010/04/22 13:11:47 | 000,166,912 | —- | C] (S3 Graphics, Inc.) – C:\Windows\System32\drivers\s3gnbm.sys
[2010/04/22 13:11:47 | 000,129,535 | —- | C] (Smart Link) – C:\Windows\System32\drivers\slnt7554.sys
[2010/04/22 13:11:47 | 000,126,686 | —- | C] (Smart Link) – C:\Windows\System32\drivers\mtlmnt5.sys
[2010/04/22 13:11:47 | 000,095,424 | —- | C] (Smart Link) – C:\Windows\System32\drivers\slnthal.sys
[2010/04/22 13:11:47 | 000,030,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\rndismpx.sys
[2010/04/22 13:11:47 | 000,013,776 | —- | C] (Smart Link) – C:\Windows\System32\drivers\recagent.sys
[2010/04/22 13:11:47 | 000,013,240 | —- | C] (Smart Link) – C:\Windows\System32\drivers\slwdmsup.sys
[2010/04/22 13:11:47 | 000,012,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\mutohpen.sys
[2010/04/22 13:11:47 | 000,005,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\smbali.sys
[2010/04/22 13:11:47 | 000,003,901 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\siint5.dll
[2010/04/22 13:11:46 | 000,025,471 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\watv10nt.sys
[2010/04/22 13:11:46 | 000,022,271 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\watv06nt.sys
[2010/04/22 13:11:46 | 000,011,935 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\wadv11nt.sys
[2010/04/22 13:11:46 | 000,011,871 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\wadv09nt.sys
[2010/04/22 13:11:46 | 000,011,807 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\wadv07nt.sys
[2010/04/22 13:11:46 | 000,011,325 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\vchnt5.dll
[2010/04/22 13:11:46 | 000,011,295 | —- | C] (Intel® Corporation) – C:\Windows\System32\drivers\wadv08nt.sys
[2010/04/22 12:51:06 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/04/22 12:43:20 | 000,000,000 | -H-D | C] – C:\Windows\ie8
[2010/04/22 12:40:36 | 000,594,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dllcache\msfeeds.dll
[2010/04/22 12:40:35 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dllcache\msfeedsbs.dll
[2010/04/22 07:39:40 | 000,000,000 | —D | C] – C:\Program Files\Recuva
[2010/04/22 06:16:30 | 000,000,000 | —D | C] – C:\Program Files\NTFS Undelete
[2010/04/18 16:10:06 | 000,000,000 | —D | C] – C:\Program Files\JDownloader
[2010/04/18 12:50:40 | 000,000,000 | —D | C] – C:\Avenger
[2010/04/16 06:20:56 | 000,000,000 | —D | C] – C:\Program Files\SmartSound Software
[2010/04/13 11:38:00 | 000,000,000 | —D | C] – C:\Program Files\TagRename
[2010/04/13 06:05:54 | 000,000,000 | —D | C] – C:\Program Files\SpywareBlaster
[2010/04/12 18:52:49 | 000,000,000 | —D | C] – C:\Program Files\mp4UI
[2010/04/12 18:45:19 | 000,000,000 | —D | C] – C:\Program Files\lame
[2010/04/12 18:20:46 | 000,000,000 | —D | C] – C:\Program Files\Yamb
[2010/04/12 18:06:43 | 000,000,000 | —D | C] – C:\Program Files\Avidemux 2.5
[2010/04/12 18:00:35 | 000,000,000 | —D | C] – C:\Program Files\VirtualDub-1.9.9
[2010/04/12 17:16:49 | 000,000,000 | —D | C] – C:\Program Files\GSpot270a
[2010/04/12 07:35:54 | 000,319,000 | —- | C] (Intel Corporation) – C:\Windows\System32\drivers\iastor.sys
[2010/04/12 07:35:54 | 000,319,000 | —- | C] (Intel Corporation) – C:\iastor.sys
[2010/04/07 05:30:16 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/04/07 04:46:25 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/04/07 04:46:24 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/04/07 04:46:24 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/04/07 04:45:32 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/04/07 04:41:40 | 000,000,000 | —D | C] – C:\Qoobox
[2010/04/07 03:20:15 | 000,000,000 | —D | C] – C:\RegBackup
[2010/04/06 15:52:29 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/04/06 15:52:26 | 000,020,824 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/04/06 15:52:25 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/05 14:52:30 | 000,000,000 | —D | C] – C:\Program Files\BBC iPlayer Desktop
[2010/04/01 18:42:56 | 000,116,736 | —- | C] (MagicISO, Inc.) – C:\Windows\System32\drivers\mcdbus.sys
[2010/04/01 18:42:56 | 000,000,000 | —D | C] – C:\Program Files\MagicDisc
[2010/04/01 17:56:46 | 000,000,000 | —D | C] – C:\Windows\System32\syncdb
[2010/04/01 17:27:43 | 000,000,000 | —D | C] – C:\Program Files\Windows Installer Clean Up
[2010/03/31 09:31:26 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\System32\GEARAspi.dll
[2010/03/31 09:30:13 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/03/31 09:30:05 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/03/31 09:29:14 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/03/31 09:27:56 | 000,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2010/03/31 09:27:40 | 000,000,000 | —D | C] – C:\Windows\pss
[2010/03/31 09:27:34 | 003,003,680 | —- | C] (Apple, Inc.) – C:\Windows\System32\usbaaplrc.dll
[2010/03/31 09:27:17 | 000,000,000 | —D | C] – C:\Program Files\Bonjour

========== Files - Modified Within 30 Days ==========

[2010/04/24 06:33:19 | 000,002,048 | –S- | M] () – C:\Windows\bootstat.dat
[2010/04/24 06:33:16 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/04/24 06:33:00 | 000,000,998 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2869554992-1010074173-1580797646-500UA.job
[2010/04/24 06:31:46 | 000,000,040 | —- | M] () – C:\Windows\System32\profile.dat
[2010/04/24 05:38:00 | 000,000,888 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/04/24 04:38:04 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/04/24 04:33:00 | 000,000,946 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2869554992-1010074173-1580797646-500Core.job
[2010/04/23 19:35:12 | 000,000,316 | —- | M] () – C:\Windows\tasks\PMTask.job
[2010/04/23 16:51:08 | 000,512,914 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/04/23 16:51:08 | 000,436,048 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/04/23 16:51:08 | 000,069,680 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/04/23 16:47:28 | 000,002,206 | —- | M] () – C:\Windows\System32\wpa.dbl
[2010/04/23 16:45:34 | 2088,787,968 | -HS- | M] () – C:\hiberfil.sys
[2010/04/23 07:58:17 | 000,001,374 | —- | M] () – C:\Windows\imsins.BAK
[2010/04/22 13:47:55 | 000,316,640 | —- | M] () – C:\Windows\WMSysPr9.prx
[2010/04/22 13:44:34 | 000,223,712 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/04/22 13:11:39 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/04/22 12:09:47 | 000,000,227 | —- | M] () – C:\Windows\system.ini
[2010/04/19 22:34:06 | 000,000,664 | —- | M] () – C:\Windows\System32\d3d9caps.dat
[2010/04/19 01:07:02 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dllcache\abp480n5.sys
[2010/04/13 10:48:54 | 000,000,472 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010/04/07 04:33:02 | 003,908,515 | R— | M] () – C:\Program Files\ComboFix.exe
[2010/04/06 17:16:56 | 000,095,024 | —- | M] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2010/04/06 17:16:48 | 000,015,880 | —- | M] () – C:\Windows\System32\lsdelete.exe
[2010/04/02 06:45:51 | 000,349,331 | R— | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/03/31 09:28:50 | 000,000,498 | —- | M] () – C:\Windows\win.ini
[2010/03/31 09:28:50 | 000,000,294 | RHS- | M] () – C:\boot.ini
[2010/03/29 19:46:30 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/03/29 19:45:52 | 000,020,824 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2010/04/22 13:15:14 | 000,613,334 | —- | C] () – C:\Windows\System32\dllcache\wmplayer.chm
[2010/04/22 13:15:14 | 000,343,204 | —- | C] () – C:\Windows\System32\dllcache\wmpaud7.wav
[2010/04/22 13:15:14 | 000,343,204 | —- | C] () – C:\Windows\System32\dllcache\wmpaud6.wav
[2010/04/22 13:15:14 | 000,172,196 | —- | C] () – C:\Windows\System32\dllcache\wmpaud9.wav
[2010/04/22 13:15:14 | 000,172,196 | —- | C] () – C:\Windows\System32\dllcache\wmpaud8.wav
[2010/04/22 13:15:14 | 000,086,196 | —- | C] () – C:\Windows\System32\dllcache\wmpaud5.wav
[2010/04/22 13:15:14 | 000,067,374 | —- | C] () – C:\Windows\System32\dllcache\wmplayer.adm
[2010/04/22 13:15:14 | 000,023,195 | —- | C] () – C:\Windows\System32\dllcache\wmplay.chm
[2010/04/22 13:15:14 | 000,010,457 | —- | C] () – C:\Windows\System32\dllcache\wmptour.hta
[2010/04/22 13:15:14 | 000,001,771 | —- | C] () – C:\Windows\System32\dllcache\wmptour.css
[2010/04/22 13:15:14 | 000,000,855 | —- | C] () – C:\Windows\System32\dllcache\wmpocm.inf
[2010/04/22 13:15:14 | 000,000,420 | —- | C] () – C:\Windows\System32\dllcache\wmploc.js
[2010/04/22 13:15:13 | 000,354,468 | —- | C] () – C:\Windows\System32\dllcache\wmpaud1.wav
[2010/04/22 13:15:13 | 000,172,196 | —- | C] () – C:\Windows\System32\dllcache\wmpaud3.wav
[2010/04/22 13:15:13 | 000,086,180 | —- | C] () – C:\Windows\System32\dllcache\wmpaud4.wav
[2010/04/22 13:15:13 | 000,086,180 | —- | C] () – C:\Windows\System32\dllcache\wmpaud2.wav
[2010/04/22 13:15:13 | 000,029,070 | —- | C] () – C:\Windows\System32\dllcache\wmp.inf
[2010/04/22 13:15:13 | 000,017,272 | —- | C] () – C:\Windows\System32\dllcache\wmdm.inf
[2010/04/22 13:15:13 | 000,008,677 | —- | C] () – C:\Windows\System32\dllcache\wm7.gif
[2010/04/22 13:15:13 | 000,007,892 | —- | C] () – C:\Windows\System32\dllcache\wm9.gif
[2010/04/22 13:15:13 | 000,007,636 | —- | C] () – C:\Windows\System32\dllcache\wm2.gif
[2010/04/22 13:15:13 | 000,007,369 | —- | C] () – C:\Windows\System32\dllcache\wm4.gif
[2010/04/22 13:15:13 | 000,006,769 | —- | C] () – C:\Windows\System32\dllcache\wmfsdk.inf
[2010/04/22 13:15:13 | 000,006,241 | —- | C] () – C:\Windows\System32\dllcache\wm3.gif
[2010/04/22 13:15:13 | 000,006,060 | —- | C] () – C:\Windows\System32\dllcache\wm6.gif
[2010/04/22 13:15:13 | 000,005,789 | —- | C] () – C:\Windows\System32\dllcache\wm1.gif
[2010/04/22 13:15:13 | 000,004,193 | —- | C] () – C:\Windows\System32\dllcache\wm8.gif
[2010/04/22 13:15:13 | 000,002,477 | —- | C] () – C:\Windows\System32\dllcache\wm5.gif
[2010/04/22 13:15:12 | 000,300,969 | —- | C] () – C:\Windows\System32\dllcache\viz.wmv
[2010/04/22 13:15:12 | 000,017,489 | —- | C] () – C:\Windows\System32\dllcache\videobg.gif
[2010/04/22 13:15:12 | 000,005,290 | —- | C] () – C:\Windows\System32\dllcache\vidsamp.gif
[2010/04/22 13:15:12 | 000,002,469 | —- | C] () – C:\Windows\System32\dllcache\tplay.gif
[2010/04/22 13:15:12 | 000,002,375 | —- | C] () – C:\Windows\System32\dllcache\tplayh.gif
[2010/04/22 13:15:11 | 000,572,557 | —- | C] () – C:\Windows\System32\dllcache\rtuner.wmv
[2010/04/22 13:15:11 | 000,066,725 | —- | C] () – C:\Windows\System32\dllcache\revert.wmz
[2010/04/22 13:15:11 | 000,023,829 | —- | C] () – C:\Windows\System32\dllcache\tourbg.gif
[2010/04/22 13:15:11 | 000,003,187 | —- | C] () – C:\Windows\System32\dllcache\tour.js
[2010/04/22 13:15:11 | 000,002,450 | —- | C] () – C:\Windows\System32\dllcache\tpause.gif
[2010/04/22 13:15:11 | 000,002,371 | —- | C] () – C:\Windows\System32\dllcache\tpauseh.gif
[2010/04/22 13:15:11 | 000,001,398 | —- | C] () – C:\Windows\System32\dllcache\taon.gif
[2010/04/22 13:15:11 | 000,001,380 | —- | C] () – C:\Windows\System32\dllcache\taonh.gif
[2010/04/22 13:15:11 | 000,001,380 | —- | C] () – C:\Windows\System32\dllcache\taoff.gif
[2010/04/22 13:15:11 | 000,001,367 | —- | C] () – C:\Windows\System32\dllcache\taoffh.gif
[2010/04/22 13:15:11 | 000,001,148 | —- | C] () – C:\Windows\System32\dllcache\snd.htm
[2010/04/22 13:15:11 | 000,000,908 | —- | C] () – C:\Windows\System32\dllcache\skins.inf
[2010/04/22 13:15:10 | 000,457,607 | —- | C] () – C:\Windows\System32\dllcache\mdlib.wmv
[2010/04/22 13:15:10 | 000,381,425 | —- | C] () – C:\Windows\System32\dllcache\copycd.wmv
[2010/04/22 13:15:10 | 000,375,519 | —- | C] () – C:\Windows\System32\dllcache\nuskin.wmv
[2010/04/22 13:15:10 | 000,097,117 | —- | C] () – C:\Windows\System32\dllcache\mplayer2.hlp
[2010/04/22 13:15:10 | 000,077,307 | —- | C] () – C:\Windows\System32\dllcache\plyr_err.chm
[2010/04/22 13:15:10 | 000,022,060 | —- | C] () – C:\Windows\System32\dllcache\npds.zip
[2010/04/22 13:15:10 | 000,018,286 | —- | C] () – C:\Windows\System32\dllcache\mplayer2.inf
[2010/04/22 13:15:10 | 000,005,971 | —- | C] () – C:\Windows\System32\dllcache\events.js
[2010/04/22 13:15:10 | 000,002,778 | —- | C] () – C:\Windows\System32\dllcache\mplogoh.gif
[2010/04/22 13:15:10 | 000,002,545 | —- | C] () – C:\Windows\System32\dllcache\mplogo.gif
[2010/04/22 13:15:10 | 000,001,885 | —- | C] () – C:\Windows\System32\dllcache\mplayer2.cnt
[2010/04/22 13:15:10 | 000,001,477 | —- | C] () – C:\Windows\System32\dllcache\plylst6.wpl
[2010/04/22 13:15:10 | 000,001,477 | —- | C] () – C:\Windows\System32\dllcache\plylst5.wpl
[2010/04/22 13:15:10 | 000,001,474 | —- | C] () – C:\Windows\System32\dllcache\plylst3.wpl
[2010/04/22 13:15:10 | 000,001,451 | —- | C] () – C:\Windows\System32\dllcache\plylst12.wpl
[2010/04/22 13:15:10 | 000,001,448 | —- | C] () – C:\Windows\System32\dllcache\plylst4.wpl
[2010/04/22 13:15:10 | 000,001,250 | —- | C] () – C:\Windows\System32\dllcache\plylst1.wpl
[2010/04/22 13:15:10 | 000,001,049 | —- | C] () – C:\Windows\System32\dllcache\plylst2.wpl
[2010/04/22 13:15:10 | 000,001,046 | —- | C] () – C:\Windows\System32\dllcache\plylst7.wpl
[2010/04/22 13:15:10 | 000,001,036 | —- | C] () – C:\Windows\System32\dllcache\plylst8.wpl
[2010/04/22 13:15:10 | 000,000,789 | —- | C] () – C:\Windows\System32\dllcache\plylst11.wpl
[2010/04/22 13:15:10 | 000,000,787 | —- | C] () – C:\Windows\System32\dllcache\plylst10.wpl
[2010/04/22 13:15:10 | 000,000,784 | —- | C] () – C:\Windows\System32\dllcache\plylst9.wpl
[2010/04/22 13:15:10 | 000,000,783 | —- | C] () – C:\Windows\System32\dllcache\plylst13.wpl
[2010/04/22 13:15:10 | 000,000,775 | —- | C] () – C:\Windows\System32\dllcache\plylst14.wpl
[2010/04/22 13:15:10 | 000,000,733 | —- | C] () – C:\Windows\System32\dllcache\plylst15.wpl
[2010/04/22 13:15:10 | 000,000,403 | —- | C] () – C:\Windows\System32\dllcache\npdrmv2.zip
[2010/04/22 13:15:09 | 000,184,959 | —- | C] () – C:\Windows\System32\dllcache\compact.wmz
[2010/04/22 13:15:09 | 000,009,585 | —- | C] () – C:\Windows\System32\dllcache\controls.css
[2010/04/22 13:15:09 | 000,008,298 | —- | C] () – C:\Windows\System32\dllcache\contents.htm
[2010/04/22 13:15:09 | 000,006,878 | —- | C] () – C:\Windows\System32\dllcache\controls.js
[2010/04/22 13:15:09 | 000,000,999 | —- | C] () – C:\Windows\System32\dllcache\bktrh.gif
[2010/04/22 13:15:09 | 000,000,773 | —- | C] () – C:\Windows\System32\dllcache\cnth.gif
[2010/04/22 13:15:09 | 000,000,773 | —- | C] () – C:\Windows\System32\dllcache\cnt.gif
[2010/04/22 13:15:09 | 000,000,772 | —- | C] () – C:\Windows\System32\dllcache\cntd.gif
[2010/04/22 13:15:09 | 000,000,760 | —- | C] () – C:\Windows\System32\dllcache\cloapph.gif
[2010/04/22 13:15:09 | 000,000,717 | —- | C] () – C:\Windows\System32\dllcache\cloapp.gif
[2010/04/22 13:11:48 | 000,129,045 | —- | C] () – C:\Windows\System32\drivers\cxthsfs2.cty
[2010/04/22 13:11:48 | 000,064,352 | —- | C] () – C:\Windows\System32\drivers\ativmc20.cod
[2010/04/22 13:11:47 | 000,067,866 | —- | C] () – C:\Windows\System32\drivers\netwlan5.img
[2010/04/22 11:47:49 | 2088,787,968 | -HS- | C] () – C:\hiberfil.sys
[2010/04/12 21:46:09 | 000,000,664 | —- | C] () – C:\Windows\System32\d3d9caps.dat
[2010/04/12 11:07:42 | 000,001,374 | —- | C] () – C:\Windows\imsins.BAK
[2010/04/07 04:46:26 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/04/07 04:46:25 | 000,261,632 | —- | C] () – C:\Windows\PEV.exe
[2010/04/07 04:46:25 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/04/07 04:46:24 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/04/07 04:46:24 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/04/07 04:32:33 | 003,908,515 | R— | C] () – C:\Program Files\ComboFix.exe
[2010/02/24 13:27:28 | 000,000,043 | —- | C] () – C:\Windows\ib.ini
[2010/02/24 13:27:27 | 000,026,624 | —- | C] () – C:\Windows\GetIe.dll
[2009/11/18 17:03:38 | 000,040,960 | —- | C] () – C:\Windows\System32\TunnelThruDll.dll
[2009/11/18 17:03:38 | 000,030,720 | —- | C] () – C:\Windows\System32\tdsExSvr.dll
[2009/09/27 18:51:48 | 000,003,840 | —- | C] () – C:\Windows\System32\drivers\BANTExt.sys
[2009/08/19 13:01:06 | 000,000,102 | —- | C] () – C:\Windows\SW_Win2000X9.DLL
[2009/08/19 12:51:29 | 000,000,024 | —- | C] () – C:\Windows\System32\XLSCX.INI
[2009/08/19 12:51:29 | 000,000,024 | —- | C] () – C:\Windows\System32\WordCX.INI
[2009/08/19 12:51:28 | 000,000,050 | —- | C] () – C:\Windows\SW_Win2000X16.DLL
[2009/08/11 18:50:29 | 000,000,038 | —- | C] () – C:\Windows\AviSplitter.INI
[2009/07/01 16:09:50 | 000,176,235 | —- | C] () – C:\Windows\System32\Primomonnt.dll
[2009/06/29 11:18:17 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/06/25 20:53:40 | 000,004,224 | —- | C] () – C:\Windows\System32\drivers\IBMBLDID.sys
[2009/06/25 20:49:23 | 000,004,608 | —- | C] () – C:\Windows\System32\drivers\TSMAPIP.SYS
[2009/06/25 20:48:11 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2009/06/25 20:47:57 | 000,004,442 | —- | C] () – C:\Windows\System32\drivers\TPPWRIF.SYS
[2009/06/25 20:22:49 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v4957.dll
[2009/04/27 00:13:36 | 000,000,314 | —- | C] () – C:\Windows\primopdf.ini
[2009/02/11 17:21:22 | 000,000,061 | —- | C] () – C:\Windows\smscfg.ini
[2008/11/14 17:24:06 | 000,036,864 | —- | C] () – C:\Windows\System32\pdresrc.dll
[2008/11/14 17:24:04 | 000,552,960 | —- | C] () – C:\Windows\System32\pdclntif.dll
[2008/11/14 17:24:04 | 000,151,552 | —- | C] () – C:\Windows\System32\pdprDlg.dll
[2008/11/14 17:24:04 | 000,122,880 | —- | C] () – C:\Windows\System32\selnt.dll
[2008/11/14 17:24:04 | 000,053,248 | —- | C] () – C:\Windows\System32\IBMMenu.dll
[2008/08/18 14:44:34 | 002,854,912 | —- | C] () – C:\Windows\System32\btwicons.dll
[2006/07/17 16:30:20 | 000,012,288 | —- | C] () – C:\Windows\impborl.dll
[2006/01/23 20:55:44 | 000,000,000 | —- | C] () – C:\Windows\VPC32.INI
[2005/04/27 05:53:10 | 000,045,056 | —- | C] () – C:\Windows\System32\pwdmon.dll
[2005/04/05 15:59:19 | 000,000,000 | —- | C] () – C:\Windows\pcsmig.INI
[2005/04/04 15:42:47 | 000,000,299 | RH– | C] () – C:\Windows\System32\OEMINFO.INI
[2005/02/17 08:41:32 | 000,000,603 | —- | C] () – C:\Windows\System32\BTNeighborhood.dll.manifest
[2005/02/17 08:41:30 | 000,000,593 | —- | C] () – C:\Windows\System32\btcss.dll.manifest
[2003/04/07 20:00:00 | 000,222,928 | —- | C] () – C:\Windows\System32\lobas09.dll
[2003/04/07 20:00:00 | 000,047,104 | —- | C] () – C:\Windows\System32\lotrn13.dll
[2003/04/07 20:00:00 | 000,031,008 | —- | C] () – C:\Windows\System32\ivtrn09.dll
[2003/04/07 20:00:00 | 000,014,928 | —- | C] () – C:\Windows\System32\wingen.drv
[2002/10/15 18:54:04 | 000,153,088 | —- | C] () – C:\Windows\System32\unrar.dll
[2002/04/01 13:45:50 | 000,047,616 | —- | C] () – C:\Windows\System32\ODBCMON.DLL
[2001/11/14 09:56:00 | 001,802,240 | —- | C] () – C:\Windows\System32\lcppn21.dll
[1998/09/30 20:00:00 | 001,708,032 | —- | C] () – C:\Windows\System32\MSO97V.DLL
[1997/06/17 20:00:00 | 000,022,016 | —- | C] () – C:\Windows\System32\DOCOBJ.DLL
[1997/06/17 20:00:00 | 000,012,288 | —- | C] () – C:\Windows\System32\HLINKPRX.DLL

========== LOP Check ==========

[2010/04/13 10:48:54 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/04/23 19:35:12 | 000,000,316 | —- | M] () – C:\WINDOWS\Tasks\PMTask.job

========== Purity Check ==========

< End of report >

Thanks,
Mark

inzanity

Post #39April 26, 2010, 9:01 AM UTC last edited April 26, 2010, 11:20 AM UTC

Hi,

I missed something that Kaspersky quarantined as a Virut.

I you are able to connect to the internet using OTLPE then do the following:

Please go to VirSCAN

Click on Browse.
On the File Upload window, copy/paste the text below into the File name box:
c:\windows\explorer.exe
Click Submit. Allow the file to be scanned. If it says already scanned – click Reanalyze Now

Repeat the procedure with the following file:
c:\windows\system32\userinit.exe
c:\windows\system32\ctfmon.exe
c:\windows\system32\svchost.exe

Please post the results in your next reply.

Shiftlemac

Post #40April 26, 2010, 1:46 PM UTC

Hi, none of those files came up with any infection (I can't connect to the internet on that laptop, but I could copy those files to a usb drive and check them elsewhere). I really need this back for work now, so is there an obvious next step for recovering it? If not, I'll need to send it off and they'll just put on a new version of Windows, which would be quite a hassle. So… as usual, all advice much appreciated

Thanks, Mark

inzanity

Post #41April 27, 2010, 1:38 AM UTC

Hi,

I should've advised you not to copy those files as it may have been infected with virut. Good thing it's not.

Let's try to restore your computer to an earlier date by using OTLPE.

Please navigate to this folder:
C:\WINDOWS\ERDNT\AutoBackup

Then list the contents of that folder.

–Next–

Then here:
C:\WINDOWS\ERDNT

Then list the contents of that folder.

To post in your next reply:
1. Contents of ERUNT folders, specify which list came from C:\WINDOWS\ERDNT\AutoBackup and C:\WINDOWS\ERDNT.

inzanity

Post #42April 27, 2010, 4:58 AM UTC last edited April 27, 2010, 7:59 AM UTC

Hi,

Additional instruction:

Let's run another OTLPE scan.

Double-click on the OTLPE icon.
Select the Windows folder of the infected drive if it asks for a location
When asked "Do you wish to load the remote registry", select Yes
When asked "Do you wish to load remote user profile(s) for scanning", select Yes
Ensure the box "Automatically Load All Remaining Users" is checked and press OK
OTL should now start. Change the following settings
- Change Drivers to Safe List
- Under the Custom Scan box paste this in:
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  userinit.exe
  rundll32.exe
  winlogon.exe
  /md5stop
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
Press Run Scan to start the scan.
When finished, the file will be saved in drive C:\OTL.txt
Copy this file to your USB drive if you do not have internet connection on this system.
Right click the file and select send to : select the USB drive.
Confirm that it has copied to the USB drive by selecting it
You can backup any files that you wish from this OS
Please post the contents of the C:\OTL.txt file in your reply.

–Next–

NOTE: If you cannot save this batch file while using OTLPE then save it to a USB flash drive then copy it to the infected pc then run it by double clicking.

Open a new Notepad session

Click the Start button, click Run.
In the run box type notepad.
click OK.
In the notepad, Click "Format" and be certain that Word Wrap is not checked.

Copy and paste all of the text in the code box below into Notepad, Do not copy the word code.

@echo off
reg query "HKLM\system\currentcontrolset\services\iastor" /v imagepath > result.txt
start result.txt
del %0

Click File, Save as…, and set the Save in to your Desktop
In the File name box, type fix.bat
In the Save as type: box, choose All Files
Choose a location to save. Preferably on your desktop.
Click Save

It should look like this: [external image: Posted Image]

Double click on fix.bat & allow it to run. A small black box should open and close - this is normal.

Post the contents of result.txt.

To post in your next reply:
1. OTL log.
2. result.txt log.

EDIT: Added instructions. TY OM.

Shiftlemac

Post #43April 27, 2010, 10:32 AM UTC

Hey, ok, got your PM and presume your instructions below had been updated already?

C:\Windows\ERDNT\Autobackup doesn't exist.

C:\Windows\ERDNT\ contains the following:
cache (contains 62 files)
Hiv-backup (contains a "Users" folder and 10 files. The "Users" folder itself contains 6 folders, each of which contains either an NTUSER.DAT or a UsrClass.dat)
subs (appears to contain exactly the same as Hiv-backup)
CFrecovery.bat

The registry batch file gave the following error (could this be to do with the fact that I don't get the "Do you wish to load the remote registry" prompt when I run OTLPE?):
Error: The system was unable to find the specified registry key or value
Insert the diskette that contains the batch file and press any key when ready.

And finally, the OTL log file gave the following:
OTL logfile created on: 4/27/2010 5:29:16 PM - Run
OTLPE by OldTimer - Version 3.1.38.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 86.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 6.80 Gb Free Space | 4.56% Space Free | Partition Type: NTFS
Drive D: | 111.79 Gb Total Space | 0.54 Gb Free Space | 0.48% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 276.80 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO
Current User Name: SYSTEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] – – (ISAMsmt)
SRV - File not found [Auto] – – (AdobeActiveFileMonitor6.0)
SRV - [2010/04/06 17:15:37 | 001,265,264 | —- | M] (Lavasoft) [On_Demand] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2010/03/19 04:49:20 | 000,144,672 | —- | M] (Apple Inc.) [Auto] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/02/25 14:10:40 | 000,482,584 | —- | M] (IBM Corp.) [Auto] – C:\Program Files\c4ebreg\c4ebreg.exe – (ISAMSvc)
SRV - [2010/02/11 09:29:00 | 000,241,392 | —- | M] (IBM Corp.) [Auto] – c:\sdwork\issimsvc.exe – (ISSIMon)
SRV - [2009/11/01 14:16:06 | 000,867,080 | —- | M] (Acresso Software Inc.) [On_Demand] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2009/10/08 23:45:56 | 000,169,312 | —- | M] (Adobe Systems Incorporated) [Auto] – C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe – (AdobeActiveFileMonitor8.0)
SRV - [2009/06/25 20:24:58 | 000,094,208 | —- | M] () [Auto] – C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe – (Power Manager DBC Service)
SRV - [2009/06/25 20:22:43 | 000,036,640 | —- | M] (Lenovo) [Auto] – C:\WINDOWS\system32\ibmpmsvc.exe – (IBMPMSVC)
SRV - [2009/06/12 04:34:48 | 000,241,664 | —- | M] () [Auto] – C:\Program Files\T-Mobile Internet Manager\AssistantServices.exe – (UI Assistant Service)
SRV - [2008/08/18 14:45:42 | 000,346,720 | —- | M] (Broadcom Corporation.) [Auto] – C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe – (btwdins)
SRV - [2008/08/15 17:43:58 | 000,090,112 | —- | M] (Lenovo ) [Auto] – C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe – (AcPrfMgrSvc)
SRV - [2008/08/15 17:42:34 | 000,212,992 | —- | M] (Lenovo ) [Auto] – C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe – (AcSvc)
SRV - [2008/07/10 16:42:14 | 000,819,200 | —- | M] (Intel® Corporation) [Auto] – C:\Program Files\Intel\WiFi\bin\EvtEng.exe – (EvtEng)
SRV - [2008/07/10 16:23:22 | 000,901,120 | —- | M] (Intel® Corporation) [Auto] – C:\Program Files\Intel\WiFi\bin\S24EvMon.exe – (S24EventMonitor)
SRV - [2008/07/10 16:12:40 | 000,466,944 | —- | M] (Intel® Corporation) [Auto] – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe – (RegSrvc)
SRV - [2008/05/14 12:21:16 | 000,037,416 | —- | M] (Lenovo.) [Auto] – C:\WINDOWS\system32\TPHDEXLG.exe – (TPHDEXLGSVC)
SRV - [2007/11/02 00:09:34 | 000,049,152 | —- | M] (IBM Corporation) [On_Demand] – C:\Program Files\IBM\Personal Communications\csrcmds.exe – (csrcmds)
SRV - [2007/11/02 00:09:34 | 000,040,960 | —- | M] (IBM Corporation) [Auto] – C:\WINDOWS\system32\drivers\ldlcserv6.exe – (ldlcserv6) IBM Enterprise Extender (IPv6)
SRV - [2007/11/02 00:09:34 | 000,036,864 | —- | M] (IBM Corporation) [On_Demand] – C:\WINDOWS\system32\drivers\cstrcser.exe – (cstrcser)
SRV - [2007/11/02 00:09:34 | 000,032,768 | —- | M] (IBM Corporation) [Auto] – C:\WINDOWS\system32\drivers\trcboot.exe – (TrcBoot)
SRV - [2007/11/02 00:09:34 | 000,032,768 | —- | M] (IBM Corporation) [On_Demand] – C:\WINDOWS\system32\drivers\appnnode.exe – (AppnNode)
SRV - [2007/11/02 00:09:34 | 000,028,672 | —- | M] (IBM Corporation) [Auto] – C:\WINDOWS\system32\drivers\ldlcserv.exe – (ldlcserv) IBM Enterprise Extender (IPv4)
SRV - [2007/01/13 04:00:00 | 000,323,584 | —- | M] (AT&T;) [Auto] – C:\Program Files\AT&T; Network Client\NetCfgSv.EXE – (NetCfgSvr)
SRV - [2006/09/27 16:33:38 | 000,116,464 | —- | M] (symantec) [Auto] – c:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe – (SavRoam)
SRV - [2006/09/27 16:33:32 | 001,813,232 | —- | M] (Symantec Corporation) [Auto] – C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe – (Symantec AntiVirus)
SRV - [2006/09/27 16:33:22 | 000,031,472 | —- | M] (Symantec Corporation) [Auto] – C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe – (DefWatch)
SRV - [2006/09/27 10:15:56 | 000,173,744 | —- | M] (Symantec Corporation) [Auto] – C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe – (SymSecurePort)
SRV - [2006/09/27 10:14:44 | 000,087,728 | —- | M] (Symantec Corporation) [Auto] – C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe – (ISSVC)
SRV - [2006/08/25 08:00:38 | 002,528,960 | —- | M] (Symantec Corporation) [On_Demand] – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE – (LiveUpdate)
SRV - [2006/08/07 12:03:02 | 000,214,720 | —- | M] (Symantec Corporation) [Auto] – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe – (SNDSrvc)
SRV - [2006/07/19 15:26:12 | 000,169,632 | —- | M] (Symantec Corporation) [Auto] – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe – (ccSetMgr)
SRV - [2006/07/19 15:26:10 | 000,202,400 | —- | M] (Symantec Corporation) [Auto] – C:\Program Files\Common Files\Symantec Shared\ccProxy.exe – (ccProxy)
SRV - [2006/07/19 15:26:06 | 000,192,160 | —- | M] (Symantec Corporation) [Auto] – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe – (ccEvtMgr)
SRV - [2006/06/29 17:57:50 | 000,032,768 | —- | M] () [Auto] – C:\WINDOWS\system32\TpKmpSvc.exe – (TpKmpSVC)
SRV - [2006/04/11 13:13:38 | 001,160,848 | —- | M] (Symantec Corporation) [Auto] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe – (SPBBCSvc)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] – – (WDICA)
DRV - File not found [Kernel | On_Demand] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand] – – (PDRELI)
DRV - File not found [Kernel | On_Demand] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand] – – (PDCOMP)
DRV - File not found [Kernel | System] – – (PCIDump)
DRV - File not found [Kernel | System] – – (lbrtfdc)
DRV - File not found [Kernel | System] – – (Changer)
DRV - File not found [Kernel | On_Demand] – – (catchme)
DRV - [2010/03/29 04:00:00 | 001,324,720 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100423.002\NAVEX15.SYS – (NAVEX15)
DRV - [2010/03/29 04:00:00 | 000,084,912 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100423.002\NAVENG.SYS – (NAVENG)
DRV - [2010/02/26 12:34:05 | 000,006,400 | —- | M] (IBM Corp.) [File_System | On_Demand] – C:\WINDOWS\system32\drivers\isamfilter.sys – (IsamFilter)
DRV - [2010/02/04 11:53:02 | 000,064,288 | —- | M] (Lavasoft AB) [File_System | Boot] – C:\WINDOWS\system32\drivers\Lbd.sys – (Lbd)
DRV - [2009/11/19 22:03:00 | 000,268,664 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\Program Files\Common Files\Symantec Shared\SymcData\scfidsdefs\20100421.001\SymIDSCo.sys – (SYMIDSCO)
DRV - [2009/10/16 17:12:08 | 000,721,904 | —- | M] (Duplex Secure Ltd.) [Kernel | Disabled] – C:\WINDOWS\System32\Drivers\sptd.sys – (sptd)
DRV - [2009/08/27 04:00:00 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2009/08/27 04:00:00 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2009/07/26 22:43:18 | 000,058,908 | —- | M] (PowerISO Computing, Inc.) [Kernel | System] – C:\WINDOWS\system32\drivers\scdemu.sys – (SCDEmu)
DRV - [2009/06/25 20:25:09 | 000,004,608 | —- | M] () [Kernel | System] – C:\WINDOWS\system32\drivers\TSMAPIP.SYS – (TSMAPIP)
DRV - [2009/06/25 20:25:00 | 000,004,442 | —- | M] () [Kernel | System] – C:\WINDOWS\system32\drivers\TPPWRIF.SYS – (TPPWRIF)
DRV - [2009/06/25 20:23:34 | 000,991,656 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\btkrnl.sys – (BTKRNL)
DRV - [2009/06/25 20:23:34 | 000,534,568 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\btaudio.sys – (btaudio)
DRV - [2009/06/25 20:23:34 | 000,156,816 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\btwdndis.sys – (BTWDNDIS)
DRV - [2009/06/25 20:23:34 | 000,047,272 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\btwusb.sys – (BTWUSB)
DRV - [2009/06/25 20:23:34 | 000,037,160 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\btport.sys – (BTDriver)
DRV - [2009/06/25 20:23:34 | 000,037,032 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\btwmodem.sys – (btwmodem)
DRV - [2009/06/25 20:23:05 | 000,181,168 | —- | M] (Synaptics, Inc.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\SynTP.sys – (SynTP)
DRV - [2009/06/25 20:22:55 | 000,319,000 | —- | M] (Intel Corporation) [Kernel | Boot] – C:\WINDOWS\system32\drivers\iastor.old – (iastor)
DRV - [2009/06/25 20:22:54 | 000,013,824 | —- | M] (Intel Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\tpm.sys – (tpm)
DRV - [2009/06/25 20:22:53 | 000,040,832 | —- | M] (Intel Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\HECI.sys – (HECI) Intel®
DRV - [2009/06/25 20:22:50 | 006,021,184 | —- | M] (Intel Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\igxpmp32.sys – (ialm)
DRV - [2009/06/25 20:22:43 | 000,023,720 | —- | M] (Lenovo.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ibmpmdrv.sys – (IBMPMDRV)
DRV - [2009/06/25 20:22:32 | 000,243,856 | —- | M] (Intel Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\e1y5132.sys – (e1yexpress) Intel®
DRV - [2009/06/25 20:22:31 | 000,985,472 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\HSF_DPV.sys – (HSF_DPV)
DRV - [2009/06/25 20:22:31 | 000,210,560 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\HSFHWAZL.sys – (HSFHWAZL)
DRV - [2009/06/25 20:22:30 | 000,731,264 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2009/05/21 15:34:00 | 000,814,592 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\CHDAU32.sys – (CnxtHdAudService)
DRV - [2009/05/07 11:53:40 | 000,022,528 | —- | M] (Bytemobile, Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\BMLoad.sys – (BMLoad)
DRV - [2009/05/07 11:53:40 | 000,018,816 | —- | M] (Bytemobile, Inc.) [Kernel | System] – C:\WINDOWS\system32\drivers\tcpipBM.sys – (tcpipBM)
DRV - [2009/05/07 11:47:14 | 000,105,344 | —- | M] (ZTE Incorporated) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ZTEusbnmea.sys – (ZTEusbnmea)
DRV - [2009/05/07 11:47:14 | 000,104,960 | —- | M] (ZTE Incorporated) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ZTEusbser6k.sys – (ZTEusbser6k)
DRV - [2009/05/07 11:47:14 | 000,104,960 | —- | M] (ZTE Incorporated) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys – (ZTEusbmdm6k)
DRV - [2009/05/07 11:47:14 | 000,009,728 | —- | M] (ZTE Incorporated) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\massfilter.sys – (massfilter)
DRV - [2009/02/24 12:42:14 | 000,116,736 | —- | M] (MagicISO, Inc.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\mcdbus.sys – (mcdbus)
DRV - [2008/08/15 16:12:44 | 000,004,224 | —- | M] () [Kernel | System] – C:\WINDOWS\system32\drivers\IBMBLDID.sys – (IBMTPCHK)
DRV - [2008/08/15 16:12:42 | 000,011,520 | —- | M] (IBM Corp.) [Kernel | System] – C:\WINDOWS\system32\drivers\ANC.sys – (ANC)
DRV - [2008/06/26 02:15:34 | 003,630,080 | —- | M] (Intel Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\NETw5x32.sys – (NETw5x32) Intel®
DRV - [2008/05/14 12:21:16 | 000,114,728 | —- | M] (Lenovo.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\ApsX86.sys – (Shockprf)
DRV - [2008/05/14 12:21:16 | 000,019,496 | —- | M] (Lenovo.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\ApsHM86.sys – (TPDIGIMN)
DRV - [2008/05/12 18:14:16 | 000,017,844 | —- | M] (Lenovo Group Limited) [Kernel | System] – C:\WINDOWS\system32\drivers\TPHKDRV.sys – (TPHKDRV)
DRV - [2008/04/18 11:48:50 | 000,011,904 | —- | M] (Intel Corporation) [Kernel | Auto] – C:\WINDOWS\system32\drivers\s24trans.sys – (s24trans)
DRV - [2008/04/13 19:06:40 | 000,043,008 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\amdagp.sys – (amdagp)
DRV - [2008/04/13 19:06:40 | 000,040,960 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot] – C:\WINDOWS\system32\drivers\sisagp.sys – (sisagp)
DRV - [2008/04/13 17:06:06 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2008/03/06 06:51:14 | 000,003,840 | —- | M] () [Kernel | System] – C:\WINDOWS\System32\Drivers\BANTExt.sys – (BANTExt)
DRV - [2007/11/02 00:09:34 | 001,315,392 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\appn.sys – (Appn)
DRV - [2007/11/02 00:09:34 | 000,208,896 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\AppnBase.sys – (AppnBase)
DRV - [2007/11/02 00:09:34 | 000,160,288 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlncfwk.sys – (pdlncfwk)
DRV - [2007/11/02 00:09:34 | 000,120,256 | —- | M] (IBM Corporation) [Kernel | Auto] – C:\WINDOWS\System32\drivers\appnapi.sys – (AppnApi)
DRV - [2007/11/02 00:09:34 | 000,101,696 | —- | M] (IBM Corporation) [Kernel | Auto] – C:\WINDOWS\system32\drivers\llc2.sys – (IBM_LLC2)
DRV - [2007/11/02 00:09:34 | 000,075,200 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnacom.sys – (pdlnacom)
DRV - [2007/11/02 00:09:34 | 000,070,656 | —- | M] (IBM Corporation) [Kernel | Auto] – C:\WINDOWS\System32\drivers\pdlndldl6.sys – (pdlndldl6) IBM Enterprise Extender (HPR/IPv6)
DRV - [2007/11/02 00:09:34 | 000,070,144 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlndlpb.sys – (pdlndlpb)
DRV - [2007/11/02 00:09:34 | 000,067,184 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnemap.sys – (pdlnemap)
DRV - [2007/11/02 00:09:34 | 000,067,072 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlndsdl.sys – (pdlndsdl)
DRV - [2007/11/02 00:09:34 | 000,064,512 | —- | M] (IBM Corporation) [Kernel | Auto] – C:\WINDOWS\System32\drivers\pdlndldl.sys – (pdlndldl) IBM Enterprise Extender (HPR/IPv4)
DRV - [2007/11/02 00:09:34 | 000,059,504 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnshay.sys – (pdlnshay)
DRV - [2007/11/02 00:09:34 | 000,058,432 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnsx25.sys – (pdlnsx25)
DRV - [2007/11/02 00:09:34 | 000,054,416 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnsv25.sys – (pdlnsv25)
DRV - [2007/11/02 00:09:34 | 000,053,248 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlndqll.sys – (pdlndqll)
DRV - [2007/11/02 00:09:34 | 000,051,712 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlndtdl.sys – (pdlndtdl)
DRV - [2007/11/02 00:09:34 | 000,050,336 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnecfg.sys – (pdlnecfg)
DRV - [2007/11/02 00:09:34 | 000,038,280 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\anydlc.sys – (Anydlc)
DRV - [2007/11/02 00:09:34 | 000,036,048 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnafac.sys – (pdlnafac)
DRV - [2007/11/02 00:09:34 | 000,024,588 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\klognt.sys – (KLOGNT)
DRV - [2007/11/02 00:09:34 | 000,022,384 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnslea.sys – (pdlnslea)
DRV - [2007/11/02 00:09:34 | 000,020,480 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnatcm.sys – (pdlnatcm)
DRV - [2007/11/02 00:09:34 | 000,019,984 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnepkt.sys – (pdlnepkt)
DRV - [2007/11/02 00:09:34 | 000,018,944 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlndoem.sys – (pdlndoem)
DRV - [2007/11/02 00:09:34 | 000,018,432 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnatdl.sys – (pdlnatdl)
DRV - [2007/11/02 00:09:34 | 000,012,800 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlndint.sys – (pdlndint)
DRV - [2007/11/02 00:09:34 | 000,012,768 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnemsg.sys – (pdlnemsg)
DRV - [2007/11/02 00:09:34 | 000,012,288 | —- | M] (IBM Corporation) [Kernel | Auto] – C:\WINDOWS\System32\drivers\pdlnctdl.sys – (pdlnctdl)
DRV - [2007/11/02 00:09:34 | 000,012,028 | —- | M] (IBM Corporation) [Kernel | Auto] – C:\WINDOWS\System32\drivers\nstrcnt.sys – (NsTrcNT)
DRV - [2007/11/02 00:09:34 | 000,008,608 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlnebas.sys – (pdlnebas)
DRV - [2007/11/02 00:09:34 | 000,006,784 | —- | M] (IBM Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\pdlncbas.sys – (pdlncbas)
DRV - [2006/09/18 13:55:28 | 000,109,744 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\Program Files\Symantec\SYMEVENT.SYS – (SymEvent)
DRV - [2006/09/06 10:41:20 | 000,337,592 | —- | M] (Symantec Corporation) [Kernel | System] – C:\Program Files\Symantec Client Security\Symantec AntiVirus\savrt.sys – (SAVRT)
DRV - [2006/09/06 10:41:20 | 000,054,968 | —- | M] (Symantec Corporation) [Kernel | System] – C:\Program Files\Symantec Client Security\Symantec AntiVirus\Savrtpel.sys – (SAVRTPEL)
DRV - [2006/08/07 12:02:26 | 000,195,776 | —- | M] (Symantec Corporation) [Kernel | System] – C:\WINDOWS\System32\Drivers\SYMTDI.SYS – (SYMTDI)
DRV - [2006/08/07 12:02:22 | 000,024,768 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS – (SYMREDRV)
DRV - [2006/08/07 12:02:18 | 000,031,936 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\Drivers\SYMIDS.SYS – (SYMIDS)
DRV - [2006/08/07 12:02:14 | 000,028,352 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS – (SYMNDIS)
DRV - [2006/08/07 12:02:02 | 000,110,784 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\Drivers\SYMFW.SYS – (SYMFW)
DRV - [2006/08/07 12:01:56 | 000,012,992 | —- | M] (Symantec Corporation) [Kernel | On_Demand] – C:\WINDOWS\System32\Drivers\SYMDNS.SYS – (SYMDNS)
DRV - [2006/05/19 05:46:14 | 000,180,864 | —- | M] (AT&T;) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\agnfilt.sys – (agnfilt)
DRV - [2006/04/11 13:13:34 | 000,389,776 | —- | M] (Symantec Corporation) [Kernel | System] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys – (SPBBCDrv)
DRV - [2005/04/27 05:16:46 | 000,005,427 | —- | M] (IBM Corporation) [Kernel | Auto] – C:\WINDOWS\system32\egathdrv.sys – (EGATHDRV)
DRV - [2004/05/06 12:12:10 | 000,114,688 | R— | M] (Broadcom Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\b57xp32.sys – (b57w2k)
DRV - [2004/04/29 13:19:18 | 000,019,328 | —- | M] (AT&T;) [Kernel | Disabled] – C:\WINDOWS\system32\drivers\agnwifi.sys – (agnwifi)
DRV - [2003/04/04 08:48:06 | 000,013,952 | —- | M] (AT&T;) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\avpnnic.sys – (avpnnic)
DRV - [2002/07/17 22:00:00 | 000,007,012 | —- | M] (Microsoft Corporation) [Kernel | Auto] – C:\WINDOWS\system32\drivers\PMEMNT.SYS – (PMEM)
DRV - [2001/08/17 10:07:44 | 000,019,072 | —- | M] (Adaptec, Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\sparrow.sys – (Sparrow)
DRV - [2001/08/17 10:07:42 | 000,030,688 | —- | M] (LSI Logic) [Kernel | Boot] – C:\WINDOWS\system32\drivers\sym_u3.sys – (sym_u3)
DRV - [2001/08/17 10:07:40 | 000,028,384 | —- | M] (LSI Logic) [Kernel | Boot] – C:\WINDOWS\system32\drivers\sym_hi.sys – (sym_hi)
DRV - [2001/08/17 10:07:36 | 000,032,640 | —- | M] (LSI Logic) [Kernel | Boot] – C:\WINDOWS\system32\drivers\symc8xx.sys – (symc8xx)
DRV - [2001/08/17 10:07:34 | 000,016,256 | —- | M] (Symbios Logic Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\symc810.sys – (symc810)
DRV - [2001/08/17 09:52:22 | 000,036,736 | —- | M] (Promise Technology, Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\ultra.sys – (ultra)
DRV - [2001/08/17 09:52:20 | 000,045,312 | —- | M] (QLogic Corporation) [Kernel | Boot] – C:\WINDOWS\system32\drivers\ql12160.sys – (ql12160)
DRV - [2001/08/17 09:52:20 | 000,040,320 | —- | M] (QLogic Corporation) [Kernel | Boot] – C:\WINDOWS\system32\drivers\ql1080.sys – (ql1080)
DRV - [2001/08/17 09:52:18 | 000,049,024 | —- | M] (QLogic Corporation) [Kernel | Boot] – C:\WINDOWS\system32\drivers\ql1280.sys – (ql1280)
DRV - [2001/08/17 09:52:16 | 000,179,584 | —- | M] (Mylex Corporation) [Kernel | Boot] – C:\WINDOWS\system32\drivers\dac2w2k.sys – (dac2w2k)
DRV - [2001/08/17 09:52:12 | 000,017,280 | —- | M] (American Megatrends Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\mraid35x.sys – (mraid35x)
DRV - [2001/08/17 09:52:00 | 000,026,496 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\asc.sys – (asc)
DRV - [2001/08/17 09:51:58 | 000,014,848 | —- | M] (Advanced System Products, Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\asc3550.sys – (asc3550)
DRV - [2001/08/17 09:51:56 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\aliide.sys – (AliIde)
DRV - [2001/08/17 09:51:54 | 000,006,656 | —- | M] (CMD Technology, Inc.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\cmdide.sys – (CmdIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://w3.ibm.com/
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;127.0.0.1;*.local;
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.emea.ibm.com:8080

IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://w3.ibm.com
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\NetworkService.NT_AUTHORITY_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://w3.ibm.com/
IE - HKU\NetworkService.NT_AUTHORITY_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\NetworkService.NT_AUTHORITY_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.9
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {d5ea4520-61a1-11da-8cd6-0800200c9a66}:2009.07.19
FF - prefs.js..extensions.enabledItems: [removed]:3.6.7
FF - prefs.js..network.proxy.backup.ftp: "proxy.emea.ibm.com"
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.gopher: "proxy.emea.ibm.com"
FF - prefs.js..network.proxy.backup.gopher_port: 8080
FF - prefs.js..network.proxy.backup.socks: "proxy.emea.ibm.com"
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "proxy.emea.ibm.com"
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "proxy.emea.ibm.com"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.gopher: "proxy.emea.ibm.com"
FF - prefs.js..network.proxy.gopher_port: 8080
FF - prefs.js..network.proxy.http: "proxy.emea.ibm.com"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxy.emea.ibm.com"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "proxy.emea.ibm.com"
FF - prefs.js..network.proxy.ssl_port: 8080

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\T-Mobile Internet Manager\addon [2009/08/14 13:43:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2010/03/06 00:35:03 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/08 14:09:43 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/16 06:25:28 | 000,000,000 | —D | M]

[2010/04/12 20:19:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/04/12 20:19:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\[removed]
[2009/06/29 11:55:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\eclipse\extensions
[2008/12/11 12:46:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\eclipse1\extensions
[2010/04/24 04:18:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\extensions
[2010/01/10 00:56:31 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009/08/20 15:06:01 | 000,000,000 | —D | M] (QuickProxy) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\extensions\{d5ea4520-61a1-11da-8cd6-0800200c9a66}
[2010/04/07 11:33:22 | 000,000,000 | —D | M] (DownThemAll!) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009/06/29 11:59:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\extensions\[removed]
[2010/04/14 22:23:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\extensions\[removed]
[2009/06/29 11:59:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\extensions\[removed]\plugins
[2009/10/13 10:12:15 | 000,000,939 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\searchplugins\dictionary.xml
[2009/08/27 16:08:26 | 000,001,907 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\searchplugins\flickr-tags.xml
[2009/07/06 12:06:07 | 000,001,504 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\searchplugins\imdb.xml
[2009/10/13 10:12:30 | 000,002,256 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\searchplugins\snappy-words.xml
[2009/07/17 19:19:19 | 000,004,140 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\io5qivq1.default\searchplugins\youtube.xml
[2010/04/24 04:18:49 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/06/30 11:06:45 | 000,072,960 | —- | M] (Foxit Software Company) – C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
[2010/04/08 14:09:38 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/04/08 14:09:39 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/04/08 14:09:39 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/04/08 14:09:39 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/04/02 06:45:51 | 000,349,331 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 11977 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O4 - HKLM..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo )
O4 - HKLM..\Run: [BLOG] C:\Program Files\ThinkPad\Utilities\BATLOGEX.DLL ()
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [C4EBReg] C:\Program Files\c4ebreg\c4ebreg.exe (IBM Corp.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ipmcmu] c:\Program Files\IBM\IPM Client Migration Utility\ipmcmu.exe (IBM)
O4 - HKLM..\Run: [Isamtray] C:\Program Files\c4ebreg\isamtray.exe (IBM Corp.)
O4 - HKLM..\Run: [ISSI Service] c:\sdwork\issimsvc.exe (IBM Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [pmonmh] C:\Program Files\IBM\My Help\plugins\\com.ibm.myhelp.common_1.4.19/pmonmh.exe ()
O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [stgclean] c:\sdwork\w32maing.exe (IBM Global Services)
O4 - HKLM..\Run: [Tpam.exe] C:\Program Files\IBM\Personal Communications\tpam.exe ()
O4 - HKLM..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe (Lenovo)
O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [UIExec] C:\Program Files\T-Mobile Internet Manager\UIExec.exe ()
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec Client Security\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKU\Administrator_ON_C..\Run: [NetSP - restore settings on power failure] C:\Program Files\AT&T; Network Client\NetSP.exe (AT&T;)
O4 - HKU\Administrator_ON_C..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe ()
O4 - HKU\Administrator_ON_C..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\Administrator_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 1
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\LocalService_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService.NT_AUTHORITY_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\NetworkService.NT_AUTHORITY_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService.NT_AUTHORITY_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 1
O7 - HKU\systemprofile_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send to &Bluetooth; Device… - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : &Gears; Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {1ACECAFE-0015-0000-0000-ABCDEFFEDCBA} http:// (Java Plug-in 1.5.0)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdat…b?1228972592890 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1228972560421 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9519B2A2-6592-4E41-8290-D0298459270C} http://w3.ibm.com/bluepages/scripts/lnwebassist.cab (LNWebAssist Class)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http:// (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O20 - Winlogon\Notify\pcsinst: DllName - pcsinst.dll - C:\WINDOWS\System32\pcsinst.dll (IBM Corporation)
O20 - Winlogon\Notify\tpfnf2: DllName - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll ()
O20 - Winlogon\Notify\tphotkey: DllName - C:\Program Files\Lenovo\HOTKEY\tphklock.dll - C:\Program Files\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited)
O22 - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files\Stardock\Fences\FencesMenu.dll (Stardock)
O24 - Desktop BackupWallPaper: C:\WINDOWS\BlueBack.BMP
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/04/04 13:44:20 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R— | M] () - X:\AUTORUN.INF – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2005/04/04 13:43:48 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/04/24 06:31:44 | 000,000,000 | —D | C] – C:\_OTL
[2010/04/23 08:14:46 | 000,000,000 | –SD | C] – C:\ComboFix
[2010/04/22 13:45:18 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2010/04/22 13:15:17 | 001,307,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxml6.dll
[2010/04/22 13:15:17 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxml6r.dll
[2010/04/22 13:15:11 | 000,086,016 | —- | C] (Sipro Lab Telecom Inc.) – C:\WINDOWS\System32\dllcache\sl_anet.acm
[2010/04/22 13:15:10 | 000,294,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msaud32.acm
[2010/04/22 13:15:10 | 000,290,816 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\WINDOWS\System32\dllcache\l3codeca.acm
[2010/04/22 13:15:06 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dpcdll.dll
[2010/04/22 13:14:54 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\irbus.sys
[2010/04/22 13:14:54 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\smtpapi.dll
[2010/04/22 13:14:54 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rwnh.dll
[2010/04/22 13:14:54 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comsdupd.exe
[2010/04/22 13:14:49 | 001,888,992 | —- | C] (ATI Technologies Inc. ) – C:\WINDOWS\System32\ati3duag.dll
[2010/04/22 13:14:49 | 000,870,784 | —- | C] (ATI Technologies Inc. ) – C:\WINDOWS\System32\ati3d1ag.dll
[2010/04/22 13:14:49 | 000,650,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3ui.dll
[2010/04/22 13:14:49 | 000,516,768 | —- | C] (ATI Technologies Inc. ) – C:\WINDOWS\System32\ativvaxx.dll
[2010/04/22 13:14:49 | 000,377,984 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ati2dvaa.dll
[2010/04/22 13:14:49 | 000,233,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\azroles.dll
[2010/04/22 13:14:49 | 000,229,376 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ati2cqag.dll
[2010/04/22 13:14:49 | 000,201,728 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ati2dvag.dll
[2010/04/22 13:14:49 | 000,184,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eapp3hst.dll
[2010/04/22 13:14:49 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eapphost.dll
[2010/04/22 13:14:49 | 000,126,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eappcfg.dll
[2010/04/22 13:14:49 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eappgnui.dll
[2010/04/22 13:14:49 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eapqec.dll
[2010/04/22 13:14:49 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3cfg.dll
[2010/04/22 13:14:49 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3msm.dll
[2010/04/22 13:14:49 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dhcpqec.dll
[2010/04/22 13:14:49 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eappprxy.dll
[2010/04/22 13:14:49 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3gpclnt.dll
[2010/04/22 13:14:49 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dimsroam.dll
[2010/04/22 13:14:49 | 000,032,768 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ativtmxx.dll
[2010/04/22 13:14:49 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eapolqec.dll
[2010/04/22 13:14:49 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3api.dll
[2010/04/22 13:14:49 | 000,023,040 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ativmvxx.ax
[2010/04/22 13:14:49 | 000,009,728 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\ativdaxx.ax
[2010/04/22 13:14:49 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dot3dlg.dll
[2010/04/22 13:14:49 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bitsprx4.dll
[2010/04/22 13:14:48 | 001,737,856 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\mtxparhd.dll
[2010/04/22 13:14:48 | 000,397,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmcex.dll
[2010/04/22 13:14:48 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\napmontr.dll
[2010/04/22 13:14:48 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\microsoft.managementconsole.dll
[2010/04/22 13:14:48 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\napstat.exe
[2010/04/22 13:14:48 | 000,155,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mssha.dll
[2010/04/22 13:14:48 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmcfxcommon.dll
[2010/04/22 13:14:48 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ieencode.dll
[2010/04/22 13:14:48 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msshavmsg.dll
[2010/04/22 13:14:48 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\l2gpstore.dll
[2010/04/22 13:14:48 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmcperf.exe
[2010/04/22 13:14:48 | 000,032,285 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\hsfcisp2.dll
[2010/04/22 13:14:48 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\napipsec.dll
[2010/04/22 13:14:48 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdpash.dll
[2010/04/22 13:14:48 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdnepr.dll
[2010/04/22 13:14:48 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdiultn.dll
[2010/04/22 13:14:48 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdbhc.dll
[2010/04/22 13:14:47 | 004,274,816 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nv4_disp.dll
[2010/04/22 13:14:47 | 000,397,056 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\s3gnb.dll
[2010/04/22 13:14:47 | 000,286,792 | —- | C] (Smart Link) – C:\WINDOWS\System32\slextspk.dll
[2010/04/22 13:14:47 | 000,188,508 | —- | C] (Smart Link) – C:\WINDOWS\System32\slgen.dll
[2010/04/22 13:14:47 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qagent.dll
[2010/04/22 13:14:47 | 000,144,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\onex.dll
[2010/04/22 13:14:47 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qutil.dll
[2010/04/22 13:14:47 | 000,073,832 | —- | C] (Smart Link) – C:\WINDOWS\System32\slcoinst.dll
[2010/04/22 13:14:47 | 000,073,796 | —- | C] (Smart Link) – C:\WINDOWS\System32\slserv.exe
[2010/04/22 13:14:47 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wlanapi.dll
[2010/04/22 13:14:47 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qcliprov.dll
[2010/04/22 13:14:47 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasqec.dll
[2010/04/22 13:14:47 | 000,032,866 | —- | C] (Smart Link) – C:\WINDOWS\System32\slrundll.exe
[2010/04/22 13:14:47 | 000,032,866 | —- | C] (Smart Link) – C:\WINDOWS\slrundll.exe
[2010/04/22 13:14:47 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\setupn.exe
[2010/04/22 13:14:47 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vidcap.ax
[2010/04/22 13:14:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\scripting
[2010/04/22 13:14:46 | 000,000,000 | —D | C] – C:\WINDOWS\l2schemas
[2010/04/22 13:14:46 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en
[2010/04/22 13:14:46 | 000,000,000 | —D | C] – C:\WINDOWS\System32\bits
[2010/04/22 13:12:28 | 000,294,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dlimport.exe
[2010/04/22 13:11:50 | 000,004,255 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv01nt5.dll
[2010/04/22 13:11:50 | 000,003,967 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv02nt5.dll
[2010/04/22 13:11:50 | 000,003,775 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv11nt5.dll
[2010/04/22 13:11:50 | 000,003,711 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv09nt5.dll
[2010/04/22 13:11:50 | 000,003,647 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv07nt5.dll
[2010/04/22 13:11:50 | 000,003,615 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv05nt5.dll
[2010/04/22 13:11:50 | 000,003,135 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\adv08nt5.dll
[2010/04/22 13:11:50 | 000,000,000 | —D | C] – C:\WINDOWS\network diagnostic
[2010/04/22 13:11:49 | 000,701,440 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati2mtag.sys
[2010/04/22 13:11:49 | 000,327,040 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati2mtaa.sys
[2010/04/22 13:11:49 | 000,104,960 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinrvxx.sys
[2010/04/22 13:11:49 | 000,073,216 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atintuxx.sys
[2010/04/22 13:11:49 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2010/04/22 13:11:49 | 000,057,856 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinbtxx.sys
[2010/04/22 13:11:49 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1btxx.sys
[2010/04/22 13:11:49 | 000,052,224 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinraxx.sys
[2010/04/22 13:11:49 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2010/04/22 13:11:49 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2010/04/22 13:11:49 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1raxx.sys
[2010/04/22 13:11:49 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2010/04/22 13:11:49 | 000,028,672 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinsnxx.sys
[2010/04/22 13:11:49 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1snxx.sys
[2010/04/22 13:11:49 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2010/04/22 13:11:49 | 000,014,336 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinpdxx.sys
[2010/04/22 13:11:49 | 000,013,824 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinttxx.sys
[2010/04/22 13:11:49 | 000,013,824 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinmdxx.sys
[2010/04/22 13:11:49 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2010/04/22 13:11:49 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2010/04/22 13:11:48 | 000,063,488 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinxsxx.sys
[2010/04/22 13:11:48 | 000,036,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\bthprint.sys
[2010/04/22 13:11:48 | 000,031,744 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinxbxx.sys
[2010/04/22 13:11:48 | 000,025,471 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv04nt5.dll
[2010/04/22 13:11:48 | 000,021,183 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv01nt5.dll
[2010/04/22 13:11:48 | 000,017,279 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv10nt5.dll
[2010/04/22 13:11:48 | 000,015,423 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\ch7xxnt5.dll
[2010/04/22 13:11:48 | 000,014,143 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv06nt5.dll
[2010/04/22 13:11:48 | 000,011,359 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\atv02nt5.dll
[2010/04/22 13:11:47 | 001,897,408 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\drivers\nv4_mini.sys
[2010/04/22 13:11:47 | 001,309,184 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\mtlstrm.sys
[2010/04/22 13:11:47 | 000,452,736 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\drivers\mtxparhm.sys
[2010/04/22 13:11:47 | 000,404,990 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slntamr.sys
[2010/04/22 13:11:47 | 000,180,360 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\ntmtlfax.sys
[2010/04/22 13:11:47 | 000,166,912 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\drivers\s3gnbm.sys
[2010/04/22 13:11:47 | 000,129,535 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slnt7554.sys
[2010/04/22 13:11:47 | 000,126,686 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\mtlmnt5.sys
[2010/04/22 13:11:47 | 000,095,424 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slnthal.sys
[2010/04/22 13:11:47 | 000,030,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\rndismpx.sys
[2010/04/22 13:11:47 | 000,013,776 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\recagent.sys
[2010/04/22 13:11:47 | 000,013,240 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slwdmsup.sys
[2010/04/22 13:11:47 | 000,012,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\mutohpen.sys
[2010/04/22 13:11:47 | 000,005,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\smbali.sys
[2010/04/22 13:11:47 | 000,003,901 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\siint5.dll
[2010/04/22 13:11:46 | 000,025,471 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv10nt.sys
[2010/04/22 13:11:46 | 000,022,271 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv06nt.sys
[2010/04/22 13:11:46 | 000,011,935 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv11nt.sys
[2010/04/22 13:11:46 | 000,011,871 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv09nt.sys
[2010/04/22 13:11:46 | 000,011,807 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv07nt.sys
[2010/04/22 13:11:46 | 000,011,325 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\vchnt5.dll
[2010/04/22 13:11:46 | 000,011,295 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv08nt.sys
[2010/04/22 12:51:06 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/04/22 12:43:20 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/04/22 12:40:36 | 000,594,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010/04/22 12:40:35 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010/04/22 07:39:40 | 000,000,000 | —D | C] – C:\Program Files\Recuva
[2010/04/22 06:16:30 | 000,000,000 | —D | C] – C:\Program Files\NTFS Undelete
[2010/04/21 19:29:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Access Connections
[2010/04/18 21:07:28 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\Application Data\Sun
[2010/04/18 16:10:06 | 000,000,000 | —D | C] – C:\Program Files\JDownloader
[2010/04/18 13:55:09 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\Application Data\Macromedia
[2010/04/18 13:55:08 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\Application Data\Adobe
[2010/04/18 12:56:44 | 000,000,000 | -HSD | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\IETldCache
[2010/04/18 12:56:43 | 000,000,000 | -HSD | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\Cookies
[2010/04/18 12:52:12 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Google
[2010/04/18 12:51:37 | 000,000,000 | –SD | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\UserData
[2010/04/18 12:51:37 | 000,000,000 | –SD | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\Application Data\Microsoft
[2010/04/18 12:51:37 | 000,000,000 | -H-D | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings
[2010/04/18 12:51:37 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft
[2010/04/18 12:51:37 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService.NT AUTHORITY\Application Data
[2010/04/18 12:50:40 | 000,000,000 | —D | C] – C:\Avenger
[2010/04/18 12:48:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\avenger
[2010/04/16 07:49:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\No Company Name
[2010/04/16 06:20:56 | 000,000,000 | —D | C] – C:\Program Files\SmartSound Software
[2010/04/15 17:04:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\HandBrake
[2010/04/15 17:04:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\HandBrake
[2010/04/13 11:38:00 | 000,000,000 | —D | C] – C:\Program Files\TagRename
[2010/04/13 06:05:54 | 000,000,000 | —D | C] – C:\Program Files\SpywareBlaster
[2010/04/12 20:19:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Flickr
[2010/04/12 20:19:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Flickr
[2010/04/12 19:37:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Geckofx
[2010/04/12 19:37:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Red Kawa
[2010/04/12 18:52:49 | 000,000,000 | —D | C] – C:\Program Files\mp4UI
[2010/04/12 18:45:19 | 000,000,000 | —D | C] – C:\Program Files\lame
[2010/04/12 18:20:46 | 000,000,000 | —D | C] – C:\Program Files\Yamb
[2010/04/12 18:06:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\avidemux
[2010/04/12 18:06:43 | 000,000,000 | —D | C] – C:\Program Files\Avidemux 2.5
[2010/04/12 18:00:35 | 000,000,000 | —D | C] – C:\Program Files\VirtualDub-1.9.9
[2010/04/12 17:36:01 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/04/12 17:36:00 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/04/12 17:16:49 | 000,000,000 | —D | C] – C:\Program Files\GSpot270a
[2010/04/12 13:40:56 | 000,000,000 | -HSD | C] – C:\Documents and Settings\LocalService\PrivacIE
[2010/04/12 13:40:44 | 000,000,000 | -HSD | C] – C:\Documents and Settings\LocalService\IECompatCache
[2010/04/12 13:40:40 | 000,000,000 | R–D | C] – C:\Documents and Settings\LocalService\Favorites
[2010/04/12 07:35:54 | 000,319,000 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\iastor.sys
[2010/04/12 07:35:54 | 000,319,000 | —- | C] (Intel Corporation) – C:\iastor.sys
[2010/04/12 05:56:55 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2010/04/07 05:30:16 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/04/07 04:46:25 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/04/07 04:46:24 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/04/07 04:46:24 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/04/07 04:45:32 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/04/07 04:41:40 | 000,000,000 | —D | C] – C:\Qoobox
[2010/04/07 03:20:15 | 000,000,000 | —D | C] – C:\RegBackup
[2010/04/06 15:52:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2010/04/06 15:52:29 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/06 15:52:26 | 000,020,824 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/06 15:52:25 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/05 14:52:30 | 000,000,000 | —D | C] – C:\Program Files\BBC iPlayer Desktop
[2010/04/01 18:42:56 | 000,116,736 | —- | C] (MagicISO, Inc.) – C:\WINDOWS\System32\drivers\mcdbus.sys
[2010/04/01 18:42:56 | 000,000,000 | —D | C] – C:\Program Files\MagicDisc
[2010/04/01 17:56:46 | 000,000,000 | —D | C] – C:\WINDOWS\System32\syncdb
[2010/04/01 17:27:43 | 000,000,000 | —D | C] – C:\Program Files\Windows Installer Clean Up
[2010/03/31 09:31:26 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\WINDOWS\System32\GEARAspi.dll
[2010/03/31 09:30:13 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/03/31 09:30:05 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/03/31 09:29:14 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/03/31 09:27:56 | 000,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2010/03/31 09:27:40 | 000,000,000 | —D | C] – C:\WINDOWS\pss
[2010/03/31 09:27:34 | 003,003,680 | —- | C] (Apple, Inc.) – C:\WINDOWS\System32\usbaaplrc.dll
[2010/03/31 09:27:17 | 000,000,000 | —D | C] – C:\Program Files\Bonjour

========== Files - Modified Within 30 Days ==========

[2010/04/25 17:10:44 | 011,796,480 | —- | M] () – C:\Documents and Settings\Administrator\ntuser.dat
[2010/04/24 06:33:21 | 002,621,440 | -H– | M] () – C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT
[2010/04/24 06:33:21 | 000,237,568 | —- | M] () – C:\Documents and Settings\LocalService\NTUSER.DAT
[2010/04/24 06:33:19 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/04/24 06:33:16 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/04/24 06:33:00 | 000,000,998 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2869554992-1010074173-1580797646-500UA.job
[2010/04/24 06:32:57 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/04/24 06:31:46 | 000,000,040 | —- | M] () – C:\WINDOWS\System32\profile.dat
[2010/04/24 05:38:00 | 000,000,888 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/04/24 04:38:04 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/04/24 04:33:00 | 000,000,946 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2869554992-1010074173-1580797646-500Core.job
[2010/04/23 19:35:12 | 000,000,316 | —- | M] () – C:\WINDOWS\tasks\PMTask.job
[2010/04/23 16:51:08 | 000,512,914 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/04/23 16:51:08 | 000,436,048 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/04/23 16:51:08 | 000,069,680 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/04/23 16:47:28 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/04/23 16:47:15 | 000,000,818 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\AtomicAlarmClock.ini
[2010/04/23 16:45:34 | 2088,787,968 | -HS- | M] () – C:\hiberfil.sys
[2010/04/23 15:09:29 | 000,002,310 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Lock Computer.lnk
[2010/04/23 07:58:17 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/04/22 13:47:55 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2010/04/22 13:44:34 | 000,223,712 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/04/22 13:11:39 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/04/22 12:09:47 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/04/22 11:40:38 | 006,909,928 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/04/22 09:02:30 | 003,923,062 | R— | M] () – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2010/04/22 08:29:34 | 000,108,544 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/21 06:33:41 | 000,002,344 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Google Chrome.lnk
[2010/04/20 12:19:42 | 000,047,168 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
[2010/04/20 03:40:03 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Barcelona y Madrid to Hard Drive
[2010/04/19 22:34:06 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/04/19 20:18:55 | 000,000,708 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HDR In Photoshop Elements 8 Tutorial.mht.lnk
[2010/04/19 16:28:24 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\UNDELETE HORIZON FROM WD DRIVE then give back to Suzanne
[2010/04/19 16:23:53 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Install Windows 7 on netbook and see if works
[2010/04/19 16:17:01 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\TV Shows + Downloads to old hard drive; Rest of documents to New; Wipe WD Drive
[2010/04/19 01:07:02 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\abp480n5.sys
[2010/04/16 13:02:43 | 000,025,088 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\TODO - Fix Rootkit.doc
[2010/04/16 08:20:09 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\BESTIVAL
[2010/04/16 06:32:52 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Premiere content + Javier + Wakeboarding Vids
[2010/04/16 06:26:17 | 000,047,168 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/04/15 20:55:48 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\CameraWorld - W1T 3PB - 14 Wells Street
[2010/04/15 10:36:10 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Twin Town
[2010/04/14 16:37:14 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Day bag for england (just camera + flash)
[2010/04/13 18:48:37 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Carry-On dimensions are 55x40x20
[2010/04/13 10:48:54 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/04/12 20:17:04 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Books to library
[2010/04/12 18:21:33 | 000,000,646 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ACCEPT LBS.doc.lnk
[2010/04/12 06:16:13 | 002,671,314 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\HDR In Photoshop Elements 8 Tutorial.mht
[2010/04/11 15:11:03 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Convert Horizon and Films
[2010/04/11 09:42:42 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\CAMERA + JABS
[2010/04/10 19:39:01 | 000,000,020 | —- | M] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/04/10 12:49:33 | 000,001,303 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\SELL THURS FRI. BUY MAY PUTS on strength. SELL MARCH PUTS on weakness. CASH OUT ODL. COVER some @1070 then some@1050-1030 (watch McLellan).lnk
[2010/04/10 12:49:32 | 000,000,748 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\OptionsXPressAccountOpen.pdf.lnk
[2010/04/10 12:49:32 | 000,000,718 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ETFvsE-MiniFutures.pdf.lnk
[2010/04/10 12:49:32 | 000,000,698 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\DeflationGuide.pdf.lnk
[2010/04/10 12:49:32 | 000,000,673 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Scenarios.xls.lnk
[2010/04/10 12:49:32 | 000,000,656 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\JulyEW.pdf.lnk
[2010/04/10 12:49:32 | 000,000,644 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\JGQ3.pdf.lnk
[2010/04/10 12:49:32 | 000,000,542 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\OPEN ACCOUNT.lnk
[2010/04/10 10:32:39 | 000,002,468 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\TODO.lnk
[2010/04/10 10:29:58 | 000,000,909 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Corporate games entry form 2010.xls.lnk
[2010/04/10 10:29:58 | 000,000,819 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\DragonPayment.JPG.lnk
[2010/04/10 10:27:24 | 000,000,569 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\30 DAY to 441.lnk
[2010/04/07 06:16:03 | 000,000,513 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Shortcut to MBA Finance.lnk
[2010/04/07 04:33:02 | 003,908,515 | R— | M] () – C:\Program Files\ComboFix.exe
[2010/04/06 17:16:56 | 000,095,024 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/04/06 17:16:48 | 000,015,880 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2010/04/06 06:20:47 | 000,000,701 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Mark Utilisation 2010.xls.lnk
[2010/04/02 06:45:51 | 000,349,331 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/31 09:28:50 | 000,000,498 | —- | M] () – C:\WINDOWS\win.ini
[2010/03/31 09:28:50 | 000,000,294 | RHS- | M] () – C:\boot.ini
[2010/03/31 08:08:53 | 000,001,643 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\alarms.ini
[2010/03/29 19:46:30 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/29 19:45:52 | 000,020,824 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2010/04/22 13:15:14 | 000,613,334 | —- | C] () – C:\WINDOWS\System32\dllcache\wmplayer.chm
[2010/04/22 13:15:14 | 000,343,204 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpaud7.wav
[2010/04/22 13:15:14 | 000,343,204 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpaud6.wav
[2010/04/22 13:15:14 | 000,172,196 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpaud9.wav
[2010/04/22 13:15:14 | 000,172,196 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpaud8.wav
[2010/04/22 13:15:14 | 000,086,196 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpaud5.wav
[2010/04/22 13:15:14 | 000,067,374 | —- | C] () – C:\WINDOWS\System32\dllcache\wmplayer.adm
[2010/04/22 13:15:14 | 000,023,195 | —- | C] () – C:\WINDOWS\System32\dllcache\wmplay.chm
[2010/04/22 13:15:14 | 000,010,457 | —- | C] () – C:\WINDOWS\System32\dllcache\wmptour.hta
[2010/04/22 13:15:14 | 000,001,771 | —- | C] () – C:\WINDOWS\System32\dllcache\wmptour.css
[2010/04/22 13:15:14 | 000,000,855 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpocm.inf
[2010/04/22 13:15:14 | 000,000,420 | —- | C] () – C:\WINDOWS\System32\dllcache\wmploc.js
[2010/04/22 13:15:13 | 000,354,468 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpaud1.wav
[2010/04/22 13:15:13 | 000,172,196 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpaud3.wav
[2010/04/22 13:15:13 | 000,086,180 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpaud4.wav
[2010/04/22 13:15:13 | 000,086,180 | —- | C] () – C:\WINDOWS\System32\dllcache\wmpaud2.wav
[2010/04/22 13:15:13 | 000,029,070 | —- | C] () – C:\WINDOWS\System32\dllcache\wmp.inf
[2010/04/22 13:15:13 | 000,017,272 | —- | C] () – C:\WINDOWS\System32\dllcache\wmdm.inf
[2010/04/22 13:15:13 | 000,008,677 | —- | C] () – C:\WINDOWS\System32\dllcache\wm7.gif
[2010/04/22 13:15:13 | 000,007,892 | —- | C] () – C:\WINDOWS\System32\dllcache\wm9.gif
[2010/04/22 13:15:13 | 000,007,636 | —- | C] () – C:\WINDOWS\System32\dllcache\wm2.gif
[2010/04/22 13:15:13 | 000,007,369 | —- | C] () – C:\WINDOWS\System32\dllcache\wm4.gif
[2010/04/22 13:15:13 | 000,006,769 | —- | C] () – C:\WINDOWS\System32\dllcache\wmfsdk.inf
[2010/04/22 13:15:13 | 000,006,241 | —- | C] () – C:\WINDOWS\System32\dllcache\wm3.gif
[2010/04/22 13:15:13 | 000,006,060 | —- | C] () – C:\WINDOWS\System32\dllcache\wm6.gif
[2010/04/22 13:15:13 | 000,005,789 | —- | C] () – C:\WINDOWS\System32\dllcache\wm1.gif
[2010/04/22 13:15:13 | 000,004,193 | —- | C] () – C:\WINDOWS\System32\dllcache\wm8.gif
[2010/04/22 13:15:13 | 000,002,477 | —- | C] () – C:\WINDOWS\System32\dllcache\wm5.gif
[2010/04/22 13:15:12 | 000,300,969 | —- | C] () – C:\WINDOWS\System32\dllcache\viz.wmv
[2010/04/22 13:15:12 | 000,017,489 | —- | C] () – C:\WINDOWS\System32\dllcache\videobg.gif
[2010/04/22 13:15:12 | 000,005,290 | —- | C] () – C:\WINDOWS\System32\dllcache\vidsamp.gif
[2010/04/22 13:15:12 | 000,002,469 | —- | C] () – C:\WINDOWS\System32\dllcache\tplay.gif
[2010/04/22 13:15:12 | 000,002,375 | —- | C] () – C:\WINDOWS\System32\dllcache\tplayh.gif
[2010/04/22 13:15:11 | 000,572,557 | —- | C] () – C:\WINDOWS\System32\dllcache\rtuner.wmv
[2010/04/22 13:15:11 | 000,066,725 | —- | C] () – C:\WINDOWS\System32\dllcache\revert.wmz
[2010/04/22 13:15:11 | 000,023,829 | —- | C] () – C:\WINDOWS\System32\dllcache\tourbg.gif
[2010/04/22 13:15:11 | 000,003,187 | —- | C] () – C:\WINDOWS\System32\dllcache\tour.js
[2010/04/22 13:15:11 | 000,002,450 | —- | C] () – C:\WINDOWS\System32\dllcache\tpause.gif
[2010/04/22 13:15:11 | 000,002,371 | —- | C] () – C:\WINDOWS\System32\dllcache\tpauseh.gif
[2010/04/22 13:15:11 | 000,001,398 | —- | C] () – C:\WINDOWS\System32\dllcache\taon.gif
[2010/04/22 13:15:11 | 000,001,380 | —- | C] () – C:\WINDOWS\System32\dllcache\taonh.gif
[2010/04/22 13:15:11 | 000,001,380 | —- | C] () – C:\WINDOWS\System32\dllcache\taoff.gif
[2010/04/22 13:15:11 | 000,001,367 | —- | C] () – C:\WINDOWS\System32\dllcache\taoffh.gif
[2010/04/22 13:15:11 | 000,001,148 | —- | C] () – C:\WINDOWS\System32\dllcache\snd.htm
[2010/04/22 13:15:11 | 000,000,908 | —- | C] () – C:\WINDOWS\System32\dllcache\skins.inf
[2010/04/22 13:15:10 | 000,457,607 | —- | C] () – C:\WINDOWS\System32\dllcache\mdlib.wmv
[2010/04/22 13:15:10 | 000,381,425 | —- | C] () – C:\WINDOWS\System32\dllcache\copycd.wmv
[2010/04/22 13:15:10 | 000,375,519 | —- | C] () – C:\WINDOWS\System32\dllcache\nuskin.wmv
[2010/04/22 13:15:10 | 000,097,117 | —- | C] () – C:\WINDOWS\System32\dllcache\mplayer2.hlp
[2010/04/22 13:15:10 | 000,077,307 | —- | C] () – C:\WINDOWS\System32\dllcache\plyr_err.chm
[2010/04/22 13:15:10 | 000,022,060 | —- | C] () – C:\WINDOWS\System32\dllcache\npds.zip
[2010/04/22 13:15:10 | 000,018,286 | —- | C] () – C:\WINDOWS\System32\dllcache\mplayer2.inf
[2010/04/22 13:15:10 | 000,005,971 | —- | C] () – C:\WINDOWS\System32\dllcache\events.js
[2010/04/22 13:15:10 | 000,002,778 | —- | C] () – C:\WINDOWS\System32\dllcache\mplogoh.gif
[2010/04/22 13:15:10 | 000,002,545 | —- | C] () – C:\WINDOWS\System32\dllcache\mplogo.gif
[2010/04/22 13:15:10 | 000,001,885 | —- | C] () – C:\WINDOWS\System32\dllcache\mplayer2.cnt
[2010/04/22 13:15:10 | 000,001,477 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst6.wpl
[2010/04/22 13:15:10 | 000,001,477 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst5.wpl
[2010/04/22 13:15:10 | 000,001,474 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst3.wpl
[2010/04/22 13:15:10 | 000,001,451 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst12.wpl
[2010/04/22 13:15:10 | 000,001,448 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst4.wpl
[2010/04/22 13:15:10 | 000,001,250 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst1.wpl
[2010/04/22 13:15:10 | 000,001,049 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst2.wpl
[2010/04/22 13:15:10 | 000,001,046 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst7.wpl
[2010/04/22 13:15:10 | 000,001,036 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst8.wpl
[2010/04/22 13:15:10 | 000,000,789 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst11.wpl
[2010/04/22 13:15:10 | 000,000,787 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst10.wpl
[2010/04/22 13:15:10 | 000,000,784 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst9.wpl
[2010/04/22 13:15:10 | 000,000,783 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst13.wpl
[2010/04/22 13:15:10 | 000,000,775 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst14.wpl
[2010/04/22 13:15:10 | 000,000,733 | —- | C] () – C:\WINDOWS\System32\dllcache\plylst15.wpl
[2010/04/22 13:15:10 | 000,000,403 | —- | C] () – C:\WINDOWS\System32\dllcache\npdrmv2.zip
[2010/04/22 13:15:09 | 000,184,959 | —- | C] () – C:\WINDOWS\System32\dllcache\compact.wmz
[2010/04/22 13:15:09 | 000,009,585 | —- | C] () – C:\WINDOWS\System32\dllcache\controls.css
[2010/04/22 13:15:09 | 000,008,298 | —- | C] () – C:\WINDOWS\System32\dllcache\contents.htm
[2010/04/22 13:15:09 | 000,006,878 | —- | C] () – C:\WINDOWS\System32\dllcache\controls.js
[2010/04/22 13:15:09 | 000,000,999 | —- | C] () – C:\WINDOWS\System32\dllcache\bktrh.gif
[2010/04/22 13:15:09 | 000,000,773 | —- | C] () – C:\WINDOWS\System32\dllcache\cnth.gif
[2010/04/22 13:15:09 | 000,000,773 | —- | C] () – C:\WINDOWS\System32\dllcache\cnt.gif
[2010/04/22 13:15:09 | 000,000,772 | —- | C] () – C:\WINDOWS\System32\dllcache\cntd.gif
[2010/04/22 13:15:09 | 000,000,760 | —- | C] () – C:\WINDOWS\System32\dllcache\cloapph.gif
[2010/04/22 13:15:09 | 000,000,717 | —- | C] () – C:\WINDOWS\System32\dllcache\cloapp.gif
[2010/04/22 13:11:48 | 000,129,045 | —- | C] () – C:\WINDOWS\System32\drivers\cxthsfs2.cty
[2010/04/22 13:11:48 | 000,064,352 | —- | C] () – C:\WINDOWS\System32\drivers\ativmc20.cod
[2010/04/22 13:11:47 | 000,067,866 | —- | C] () – C:\WINDOWS\System32\drivers\netwlan5.img
[2010/04/22 11:47:49 | 2088,787,968 | -HS- | C] () – C:\hiberfil.sys
[2010/04/20 03:40:03 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Barcelona y Madrid to Hard Drive
[2010/04/19 20:18:55 | 000,000,708 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HDR In Photoshop Elements 8 Tutorial.mht.lnk
[2010/04/19 20:15:58 | 000,610,807 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\Find The Perfect Image.pdf
[2010/04/19 20:15:40 | 000,965,734 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\mayer_atkinson_five_ways_to_reduce_powerpoint_overload.pdf
[2010/04/19 16:28:24 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\UNDELETE HORIZON FROM WD DRIVE then give back to Suzanne
[2010/04/19 16:23:53 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Install Windows 7 on netbook and see if works
[2010/04/19 16:17:01 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\TV Shows + Downloads to old hard drive; Rest of documents to New; Wipe WD Drive
[2010/04/19 06:53:03 | 003,923,062 | R— | C] () – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2010/04/18 18:06:19 | 000,012,018 | —- | C] () – C:\Documents and Settings\Administrator\hs_err_pid1996.log
[2010/04/18 12:51:37 | 000,008,192 | -H– | C] () – C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG
[2010/04/18 12:51:37 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.ini
[2010/04/18 12:51:36 | 002,621,440 | -H– | C] () – C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT
[2010/04/16 13:02:43 | 000,025,088 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\TODO - Fix Rootkit.doc
[2010/04/16 08:20:09 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\BESTIVAL
[2010/04/16 06:32:52 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Premiere content + Javier + Wakeboarding Vids
[2010/04/15 20:55:48 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\CameraWorld - W1T 3PB - 14 Wells Street
[2010/04/15 10:36:10 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Twin Town
[2010/04/14 16:37:14 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Day bag for england (just camera + flash)
[2010/04/13 18:48:37 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Carry-On dimensions are 55x40x20
[2010/04/12 21:46:09 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/04/12 20:17:04 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Books to library
[2010/04/12 18:21:33 | 000,000,646 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ACCEPT LBS.doc.lnk
[2010/04/12 11:07:42 | 000,001,374 | —- | C] () – C:\WINDOWS\imsins.BAK
[2010/04/12 06:16:13 | 002,671,314 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\HDR In Photoshop Elements 8 Tutorial.mht
[2010/04/11 15:11:03 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Convert Horizon and Films
[2010/04/11 09:42:42 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\CAMERA + JABS
[2010/04/10 19:38:45 | 000,000,020 | —- | C] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/04/10 12:49:32 | 000,001,303 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\SELL THURS FRI. BUY MAY PUTS on strength. SELL MARCH PUTS on weakness. CASH OUT ODL. COVER some @1070 then some@1050-1030 (watch McLellan).lnk
[2010/04/10 12:49:32 | 000,000,748 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\OptionsXPressAccountOpen.pdf.lnk
[2010/04/10 12:49:32 | 000,000,698 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\DeflationGuide.pdf.lnk
[2010/04/10 12:49:32 | 000,000,673 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Scenarios.xls.lnk
[2010/04/10 12:49:32 | 000,000,656 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\JulyEW.pdf.lnk
[2010/04/10 12:49:32 | 000,000,644 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\JGQ3.pdf.lnk
[2010/04/10 12:49:32 | 000,000,542 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\OPEN ACCOUNT.lnk
[2010/04/10 12:49:31 | 000,000,718 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ETFvsE-MiniFutures.pdf.lnk
[2010/04/10 10:32:14 | 000,002,468 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\TODO.lnk
[2010/04/10 10:29:58 | 000,000,909 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Corporate games entry form 2010.xls.lnk
[2010/04/10 10:29:58 | 000,000,819 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\DragonPayment.JPG.lnk
[2010/04/10 10:27:24 | 000,000,569 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\30 DAY to 441.lnk
[2010/04/07 06:16:44 | 000,002,344 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Google Chrome.lnk
[2010/04/07 06:16:02 | 000,000,513 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Shortcut to MBA Finance.lnk
[2010/04/07 04:46:26 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/04/07 04:46:25 | 000,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/04/07 04:46:25 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/04/07 04:46:24 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/04/07 04:46:24 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/04/07 04:32:33 | 003,908,515 | R— | C] () – C:\Program Files\ComboFix.exe
[2010/04/06 06:20:47 | 000,000,701 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Mark Utilisation 2010.xls.lnk
[2010/03/07 16:43:54 | 000,000,280 | —- | C] () – C:\Documents and Settings\Administrator\VideoTrace_1.txt
[2010/03/07 16:43:54 | 000,000,183 | —- | C] () – C:\Documents and Settings\Administrator\VideoTrace_0.txt
[2010/03/07 16:43:26 | 000,001,294 | —- | C] () – C:\Documents and Settings\Administrator\FFDC.1267994606168.txt
[2010/03/07 16:43:21 | 000,001,294 | —- | C] () – C:\Documents and Settings\Administrator\FFDC.1267994601246.txt
[2010/03/07 16:43:16 | 000,001,294 | —- | C] () – C:\Documents and Settings\Administrator\FFDC.1267994596449.txt
[2010/02/24 13:27:28 | 000,000,043 | —- | C] () – C:\WINDOWS\ib.ini
[2010/02/24 13:27:27 | 000,026,624 | —- | C] () – C:\WINDOWS\GetIe.dll
[2010/02/03 17:38:29 | 000,000,008 | RH– | C] () – C:\Documents and Settings\Administrator\hwid
[2010/01/11 17:19:50 | 000,000,881 | —- | C] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2009/11/18 17:03:38 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\TunnelThruDll.dll
[2009/11/18 17:03:38 | 000,030,720 | —- | C] () – C:\WINDOWS\System32\tdsExSvr.dll
[2009/11/01 16:30:31 | 011,796,480 | —- | C] () – C:\Documents and Settings\Administrator\ntuser.dat
[2009/09/27 18:51:48 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2009/08/26 19:10:17 | 000,001,643 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\alarms.ini
[2009/08/26 19:10:17 | 000,000,818 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\AtomicAlarmClock.ini
[2009/08/19 13:01:06 | 000,000,102 | —- | C] () – C:\WINDOWS\SW_Win2000X9.DLL
[2009/08/19 12:51:29 | 000,000,024 | —- | C] () – C:\WINDOWS\System32\XLSCX.INI
[2009/08/19 12:51:29 | 000,000,024 | —- | C] () – C:\WINDOWS\System32\WordCX.INI
[2009/08/19 12:51:28 | 000,000,050 | —- | C] () – C:\WINDOWS\SW_Win2000X16.DLL
[2009/08/11 19:17:46 | 000,000,605 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\AutoGK.ini
[2009/08/11 18:50:29 | 000,000,038 | —- | C] () – C:\WINDOWS\AviSplitter.INI
[2009/07/21 09:31:13 | 000,000,136 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2009/07/01 16:13:50 | 000,006,160 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\PrimoPDFSet.xml
[2009/07/01 16:13:48 | 000,000,324 | —- | C] () – C:\Documents and Settings\LocalService\Application Data\PrimoPDFSet.xml
[2009/07/01 16:09:50 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2009/07/01 09:59:16 | 000,108,544 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/30 07:04:35 | 000,000,000 | -H– | C] () – C:\Documents and Settings\Administrator\nation.hiv.LOG
[2009/06/30 07:04:35 | 000,000,000 | -H– | C] () – C:\Documents and Settings\Administrator\ctf.hiv.LOG
[2009/06/30 07:04:34 | 000,008,192 | —- | C] () – C:\Documents and Settings\Administrator\nation.hiv
[2009/06/30 07:04:34 | 000,008,192 | —- | C] () – C:\Documents and Settings\Administrator\layout.hiv
[2009/06/30 07:04:34 | 000,008,192 | —- | C] () – C:\Documents and Settings\Administrator\ctf.hiv
[2009/06/30 07:04:34 | 000,000,000 | -H– | C] () – C:\Documents and Settings\Administrator\layout.hiv.LOG
[2009/06/29 11:18:17 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/06/25 20:53:40 | 000,004,224 | —- | C] () – C:\WINDOWS\System32\drivers\IBMBLDID.sys
[2009/06/25 20:49:23 | 000,004,608 | —- | C] () – C:\WINDOWS\System32\drivers\TSMAPIP.SYS
[2009/06/25 20:48:11 | 001,060,424 | —- | C] () – C:\WINDOWS\System32\WdfCoInstaller01000.dll
[2009/06/25 20:47:57 | 000,004,442 | —- | C] () – C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2009/06/25 20:22:49 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4957.dll
[2009/04/27 00:13:36 | 000,000,314 | —- | C] () – C:\WINDOWS\primopdf.ini
[2009/02/11 17:21:22 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2008/11/14 17:24:06 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\pdresrc.dll
[2008/11/14 17:24:04 | 000,552,960 | —- | C] () – C:\WINDOWS\System32\pdclntif.dll
[2008/11/14 17:24:04 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\pdprDlg.dll
[2008/11/14 17:24:04 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\selnt.dll
[2008/11/14 17:24:04 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\IBMMenu.dll
[2008/08/18 14:44:34 | 002,854,912 | —- | C] () – C:\WINDOWS\System32\btwicons.dll
[2007/03/05 18:09:37 | 000,262,144 | —- | C] () – C:\WINDOWS\system32\config\systemprofile\ntuser.dat
[2007/03/05 18:09:37 | 000,008,192 | -H– | C] () – C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
[2006/07/17 16:30:20 | 000,012,288 | —- | C] () – C:\WINDOWS\impborl.dll
[2006/01/23 20:55:44 | 000,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2005/04/27 05:53:10 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\pwdmon.dll
[2005/04/05 15:59:19 | 000,000,000 | —- | C] () – C:\WINDOWS\pcsmig.INI
[2005/04/04 15:42:47 | 000,000,299 | RH– | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/04/04 13:48:45 | 000,086,016 | -H– | C] () – C:\Documents and Settings\Administrator\ntuser.dat.LOG
[2005/04/04 13:48:45 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\Administrator\ntuser.ini
[2005/04/04 13:47:13 | 000,000,020 | -HS- | C] () – C:\Documents and Settings\LocalService\ntuser.ini
[2005/04/04 13:47:11 | 000,008,192 | -H– | C] () – C:\Documents and Settings\LocalService\ntuser.dat.LOG
[2005/04/04 13:47:10 | 000,237,568 | —- | C] () – C:\Documents and Settings\LocalService\NTUSER.DAT
[2005/02/17 08:41:32 | 000,000,603 | —- | C] () – C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 08:41:30 | 000,000,593 | —- | C] () – C:\WINDOWS\System32\btcss.dll.manifest
[2003/04/07 20:00:00 | 000,222,928 | —- | C] () – C:\WINDOWS\System32\lobas09.dll
[2003/04/07 20:00:00 | 000,047,104 | —- | C] () – C:\WINDOWS\System32\lotrn13.dll
[2003/04/07 20:00:00 | 000,031,008 | —- | C] () – C:\WINDOWS\System32\ivtrn09.dll
[2003/04/07 20:00:00 | 000,014,928 | —- | C] () – C:\WINDOWS\System32\wingen.drv
[2002/10/15 18:54:04 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2002/04/01 13:45:50 | 000,047,616 | —- | C] () – C:\WINDOWS\System32\ODBCMON.DLL
[2001/11/14 09:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll
[1998/09/30 20:00:00 | 001,708,032 | —- | C] () – C:\WINDOWS\System32\MSO97V.DLL
[1997/06/17 20:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1997/06/17 20:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2009/06/30 05:22:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Avaya
[2010/04/13 13:47:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\avidemux
[2009/10/19 01:19:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2009/07/13 09:01:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Centra
[2008/11/14 21:48:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/10/16 18:20:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Lite
[2009/09/10 09:29:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ETRADEUK
[2010/02/26 09:11:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Facebook
[2010/04/12 20:19:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Flickr
[2010/04/12 18:46:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\foobar2000
[2009/06/30 11:07:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Foxit
[2010/04/19 15:03:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Giqay
[2009/11/11 05:59:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\gtk-2.0
[2010/04/15 19:09:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\HandBrake
[2009/07/26 19:28:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Helios
[2008/11/14 17:14:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\IBM
[2009/07/14 21:02:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\iPodder
[2009/06/29 11:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Lotus
[2010/04/16 07:49:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\No Company Name
[2009/08/14 13:43:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Program Files
[2009/06/30 05:22:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\QcWizard
[2010/04/12 19:37:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Red Kawa
[2009/07/13 09:01:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Saba
[2009/07/21 09:30:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Saba Software
[2009/08/27 19:55:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SharePod
[2010/02/20 16:24:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Spotify
[2009/12/23 18:54:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Stardock
[2009/06/29 07:58:36 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Avaya
[2008/08/22 11:46:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\IBM
[2010/04/13 10:48:54 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/04/23 19:35:12 | 000,000,316 | —- | M] () – C:\WINDOWS\Tasks\PMTask.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2002/09/17 19:30:03 | 000,000,037 | —- | M] () – C:\cebWXP.exe

< MD5 for: AGP440.SYS >
[2004/08/04 01:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/14 00:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/04 01:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008/04/14 00:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 19:06:40 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 19:06:40 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 19:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\ERDNT\cache\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2004/08/04 01:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/14 00:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/04 01:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008/04/14 00:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2007/04/03 06:39:42 | 000,096,384 | —- | M] (Microsoft Corporation) MD5=2218E3FD674DC284CE98C807086CAB14 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 19:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 19:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 01:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtUninstallKB934205$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 00:41:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/14 00:41:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 01:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\ERDNT\cache\eventlog.dll

< MD5 for: IASTOR.SYS >
[2009/06/25 20:22:55 | 000,319,000 | —- | M] (Intel Corporation) MD5=ABFEBC5F846C71AFEBD7F8F6BA740C03 – C:\cmdcons\iastor.sys
[2009/06/25 20:22:55 | 000,319,000 | —- | M] (Intel Corporation) MD5=ABFEBC5F846C71AFEBD7F8F6BA740C03 – C:\iastor.sys
[2009/06/25 20:22:55 | 000,319,000 | —- | M] (Intel Corporation) MD5=ABFEBC5F846C71AFEBD7F8F6BA740C03 – C:\pnp\001\iastor.sys
[2009/06/25 20:22:55 | 000,319,000 | —- | M] (Intel Corporation) MD5=ABFEBC5F846C71AFEBD7F8F6BA740C03 – C:\WINDOWS\system32\drivers\iastor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/14 00:42:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/14 00:42:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 01:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\ERDNT\cache\netlogon.dll

< MD5 for: RUNDLL32.EXE >
[2008/04/14 00:42:34 | 000,033,280 | —- | M] (Microsoft Corporation) MD5=037B1E7798960E0420003D05BB577EE6 – C:\WINDOWS\ServicePackFiles\i386\rundll32.exe
[2008/04/14 00:42:34 | 000,033,280 | —- | M] (Microsoft Corporation) MD5=037B1E7798960E0420003D05BB577EE6 – C:\WINDOWS\system32\rundll32.exe

< MD5 for: SCECLI.DLL >
[2004/08/04 01:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 00:42:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/14 00:42:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< MD5 for: USERINIT.EXE >
[2004/08/04 01:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/14 00:42:40 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/14 00:42:40 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 01:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/14 00:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/14 00:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/06/20 13:46:57 | 000,147,968 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dnsapi.dll
[2010/02/25 06:54:36 | 011,070,976 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\ieframe.dll
[2010/02/25 02:24:35 | 001,985,536 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\iertutil.dll
[2008/04/14 00:42:02 | 000,274,944 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\mstask.dll
[2008/04/14 00:42:04 | 000,067,072 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\ntdsapi.dll
[2008/06/17 15:02:19 | 008,461,312 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\shell32.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2005/04/04 14:34:03 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2005/04/04 14:34:03 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2005/04/04 14:34:03 | 000,880,640 | —- | M] () – C:\WINDOWS\system32\config\system.sav
< End of report >

Many thanks,
Mark

inzanity

Post #44April 28, 2010, 8:02 AM UTC

Hi,

Let's try this:

You need to boot your computer in Recovery Console. To do this:

Restart your computer.
Remove OTLPE disc from your computer.
When Windows presents you with a choice menu, select Microsoft Windows Recovery Console by moving your arrow keys up/down then press the Enter key.
If you have multiple Windows installation, RC will list each one and choose which installation you would like to log on. I you only have one then type 1 and press Enter.
Type your password if any or just press Enter if you don't have one.

Once you are in Recovery Console, type:

reg query "HKLM\system\currentcontrolset\services\iastor"

Copy the output and post it here please. Thanks.

Shiftlemac

Post #45April 28, 2010, 8:30 AM UTC

Hi, I'm just getting "The command is not recognised"? (running from the C:\WINDOWS> prompt) Thanks, Mark

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Google Chrome Not Working

✨ Ask AI

Ask AI