Okay, I followed your instructions step by step. OTL I didn't get the "Extras.txt" file. I ran it twice.
GMER: I have tried to run this but it re-boots at a point in the scan.
Here's my files:
OTL:
OTL logfile created on: 10/14/2010 12:44:31 PM - Run 3
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 65.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072E:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 107.34 Gb Total Space | 12.42 Gb Free Space | 11.57% Space Free | Partition Type: NTFS
Drive D: | 4.43 Gb Total Space | 0.53 Gb Free Space | 11.97% Space Free | Partition Type: FAT32
Drive E: | 149.05 Gb Total Space | 35.36 Gb Free Space | 23.72% Space Free | Partition Type: NTFS
Drive I: | 65.94 Gb Total Space | 15.74 Gb Free Space | 23.86% Space Free | Partition Type: NTFS
Drive M: | 111.81 Gb Total Space | 34.52 Gb Free Space | 30.87% Space Free | Partition Type: NTFS
Drive T: | 37.31 Gb Total Space | 13.04 Gb Free Space | 34.95% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Computer Name: TKPGOLD | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe (Sunbelt Software)
PRC - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe (Sunbelt Software)
PRC - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe (Sunbelt Software)
PRC - C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Program Files\Siber Systems\GoodSync\GoodSync.exe ()
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Squeezebox\SqueezeTray.exe (SlimDevices - A Logitech Company)
PRC - C:\Program Files\Squeezebox\server\Bin\MSWin32-x86-multi-thread\mysqld.exe ()
PRC - C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
PRC - C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIFJA.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\M-Audio Sonica Theater\Install\STInst.exe (Nemesis)
PRC - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
PRC - C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
PRC - C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
PRC - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe ()
PRC - C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Logitech\SetPoint\KEM.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\SetPoint\KHALMNPR.exe (Logitech Inc.)
PRC - C:\Program Files\M-Audio Sonica Theater\STTask.exe (M-Audio)
PRC - C:\Program Files\Softex\OmniPass\omniServ.exe ()
PRC - C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
PRC - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\pdfshell.dll (Adobe Systems, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll (Microsoft Corporation)
MOD - C:\Program Files\BillP Studios\WinPatrol\patrolpro.dll (BillP Studios)
MOD - C:\WINDOWS\system32\AcSignIcon.dll (Autodesk, Inc.)
MOD - C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll (Autodesk)
MOD - C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll (Autodesk, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll (Nero AG)
MOD - C:\WINDOWS\system32\xpsp2res.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Program Files\Logitech\SetPoint\lgscroll.dll ()
MOD - C:\WINDOWS\system32\MFC71ENU.DLL (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Ahead\Lib\MFC71.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Ahead\Lib\msvcp71.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Ahead\Lib\msvcr71.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (WnsService) – G:\+OldMachine\Bootdrive\cgi-bin\WnsService.exe File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (SBAMSvc) – C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe (Sunbelt Software)
SRV - (SBPIMSvc) – C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe (Sunbelt Software)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (SqueezeMySQL) – C:\Program Files\Squeezebox\server\Bin\MSWin32-x86-multi-thread\mysqld.exe ()
SRV - (szserver) – C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe (iS3, Inc.)
SRV - (SonicaTheaterInstallerService) – C:\Program Files\M-Audio Sonica Theater\Install\STInst.exe (Nemesis)
SRV - (EPSON_EB_RPCV4_01) EPSON V5 Service4(01) – C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION)
SRV - (Autodesk Licensing Service) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (AcrSch2Svc) – C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (Just Flight Limited License Service) – C:\Program Files\Common Files\Just Flight Limited Shared\Service\JustFlightLimitedLicSvc.exe (Just Flight Limited)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
SRV - (EpsonBidirectionalService) – C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe (SEIKO EPSON CORPORATION)
SRV - (UxTuneUp) – C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (mi-raysat_3dsmax9_32) mental ray 3.5 Satellite (32-bit) – C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe ()
SRV - (O&O Defrag) – C:\WINDOWS\system32\oodag.exe (O&O Software GmbH)
SRV - (omniserv) – C:\Program Files\Softex\OmniPass\omniServ.exe ()
========== Driver Services (SafeList) ==========
DRV - (SDManager) – C:\Program Files\SpywareDetector\SDManager.sys File not found
DRV - (SDActMon) – C:\Program Files\SpywareDetector\SDActMon.sys File not found
DRV - (PCDRDRV) – C:\PROGRA~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys File not found
DRV - (C-Dilla) – C:\WINDOWS\System32\drivers\CDANT.SYS File not found
DRV - (ATI Remote Wonder II) – C:\WINDOWS\System32\drivers\ATIRWVD.SYS File not found
DRV - (SbTis) – C:\WINDOWS\system32\drivers\sbtis.sys (Sunbelt Software, Inc.)
DRV - (sbapifs) – C:\WINDOWS\system32\drivers\sbapifs.sys (Sunbelt Software)
DRV - (sbaphd) – C:\WINDOWS\system32\drivers\sbaphd.sys (Sunbelt Software)
DRV - (SBRE) – C:\WINDOWS\system32\drivers\SBREDrv.sys (Sunbelt Software)
DRV - (szkg5) – C:\WINDOWS\system32\drivers\szkg.sys (iS3 Inc.)
DRV - (ma763007) – C:\WINDOWS\system32\drivers\MA763007.sys (Nemesis)
DRV - (MCSTRM) – C:\WINDOWS\System32\drivers\mcstrm.sys (RealNetworks, Inc.)
DRV - (tifsfilter) – C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis)
DRV - (timounter) – C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis)
DRV - (snapman) – C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (Cdralw2k) – C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) – C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (ATIAVAIW) – C:\WINDOWS\system32\drivers\atinavt2.sys (ATI Technologies Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (atitray) – C:\Program Files\Radeon Omega Drivers\v3.8.231\ATI Tray Tools\atitray.sys ()
DRV - (atinevxx) – C:\WINDOWS\system32\drivers\atinevxx.sys (ATI Technologies Inc.)
DRV - (Iviaspi) – C:\WINDOWS\system32\drivers\iviaspi.sys (InterVideo, Inc.)
DRV - (rxpvbus) – C:\WINDOWS\system32\drivers\rxpvbus.sys (Reality XP)
DRV - (speedfan) – C:\WINDOWS\system32\speedfan.sys (Windows ® 2000 DDK provider)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (MarvinBus) – C:\WINDOWS\system32\drivers\MarvinBus.sys (Pinnacle Systems GmbH)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (MPE) – C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (atinrvxx) – C:\WINDOWS\system32\drivers\atinrvxx.sys (ATI Technologies Inc.)
DRV - (MVDCODEC) – C:\WINDOWS\system32\drivers\atinmdxx.sys (ATI Technologies Inc.)
DRV - (L8042mou) – C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (ASAPIW2k) – C:\WINDOWS\system32\drivers\asapiW2k.sys (Pinnacle Systems GmbH)
DRV - (itchfltr) – C:\WINDOWS\system32\drivers\itchfltr.sys (Logitech, Inc.)
DRV - (cdrbsdrv) – C:\WINDOWS\System32\drivers\CDRBSDRV.SYS (B.H.A Corporation)
DRV - (SSHDRV64) – C:\WINDOWS\system32\drivers\SSHDRV64.sys ()
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (pwd_2K) – C:\WINDOWS\System32\drivers\pwd_2K.sys (Roxio)
DRV - (cdudf_xp) – C:\WINDOWS\System32\drivers\cdudf_xp.sys (Roxio)
DRV - (UdfReadr_xp) – C:\WINDOWS\System32\drivers\udfreadr_xp.sys (Roxio)
DRV - (mmc_2K) – C:\WINDOWS\System32\drivers\Mmc_2k.sys (Roxio)
DRV - (dvd_2K) – C:\WINDOWS\System32\drivers\Dvd_2k.sys (Roxio)
DRV - (BENDER) – C:\WINDOWS\system32\drivers\bender.sys (Pinnacle Systems GmbH)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (fasttx2k) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (SISAGP) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (drvmcdb) – C:\WINDOWS\System32\DRIVERS\drvmcdb.sys (VERITAS Software, Inc.)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (NVENET) – C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (nv_agp) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (SaiNtHid) – C:\WINDOWS\system32\drivers\SaiNtHid.sys (Saitek)
DRV - (SaiClass) – C:\WINDOWS\system32\drivers\SaiNtBus.sys (Saitek)
DRV - (SaiMini) – C:\WINDOWS\system32\drivers\SaiMini.sys (Saitek)
DRV - (PCLEPCI) – C:\WINDOWS\system32\drivers\Pclepci.sys (Pinnacle Systems GmbH)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)
DRV - (Sentinel) – C:\WINDOWS\System32\Drivers\SENTINEL.SYS ()
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com/ig?hl=en
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "AddThis"
FF - prefs.js..browser.search.defaulturl: "
http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig?hl=en&source=iglk"
FF - prefs.js..extensions.enabledItems: {3e0e7d2a-070f-4a47-b019-91fe5385ba79}:3.1.0
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.071101000055
FF - prefs.js..extensions.enabledItems: paypalfirefoxplugin@orbiscom:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.6.1
FF - prefs.js..extensions.enabledItems: {d57c9ff1-6389-48fc-b770-f78bd89b6e8a}:1.33
FF - prefs.js..extensions.enabledItems: {317B5128-0B0B-49b2-B2DB-1E7560E16C74}:2.6.6
FF - prefs.js..extensions.enabledItems: {9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}:3.0.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {1E2593B2-E106-4697-BCE7-A9D30DE05D73}:6.2.41
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {340c2bbc-ce74-4362-90b5-7c26312808ef}:1.5
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {a45e6b3a-725d-4b20-afde-e7486bfe317c}:3.5.4
FF - prefs.js..keyword.URL: "
http://search.addthis.com/search?pco=fxe-3.1.0&locale=en-US&sl=ub&q="
FF - prefs.js..network.proxy.no_proxies_on: "localhost"
FF - HKLM\software\mozilla\Firefox\Extensions\\paypalfirefoxplugin@orbiscom: C:\Program Files\PayPal\PayPal Plug-In [2009/02/03 09:31:47 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E2593B2-E106-4697-BCE7-A9D30DE05D73}: C:\Program Files\HttpWatch\Firefox\ [2010/04/29 13:55:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/07/20 16:45:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/23 15:16:45 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/10 16:49:03 | 000,000,000 | —D | M]
[2008/08/26 14:22:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/10/14 11:09:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions
[2010/04/29 14:06:00 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010/09/14 08:10:00 | 000,000,000 | —D | M] (FireShot) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010/07/12 08:38:20 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/09/04 10:35:39 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/10/12 15:03:18 | 000,000,000 | —D | M] (SeoQuake) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2010/10/12 15:03:22 | 000,000,000 | —D | M] (Firefox Sync) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
[2010/09/14 08:09:53 | 000,000,000 | —D | M] (AddThis) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2007/12/04 17:12:52 | 000,000,000 | —D | M] (Aquatint Black) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{526fd696-27a0-11dc-8314-0800200c9a66}
[2007/10/19 10:20:08 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{5c434b90-6318-11da-8cd6-0800200c9a69}
[2010/04/15 11:48:12 | 000,000,000 | —D | M] (CookieSafe) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}
[2007/07/31 15:23:08 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2010/10/12 15:03:19 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/03/25 08:00:21 | 000,000,000 | —D | M] (Aluminium Kai 2) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{a45e6b3a-725d-4b20-afde-e7486bfe317c}
[2008/10/03 15:47:43 | 000,000,000 | —D | M] (Broncofox) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{d494da20-8750-11db-b606-0800200c9a66}
[2009/12/07 09:37:47 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}
[2006/04/27 16:05:32 | 000,000,000 | —D | M] (Metal Lion) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{F2BF34A6-7865-4526-8FA1-F21C4E694AF3}
[2006/04/27 16:01:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\[removed]
[2009/01/22 20:23:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\[removed]
[2010/09/14 08:10:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\[removed]
[2010/02/06 12:47:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\[removed]
[2008/06/18 15:21:34 | 000,001,712 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\searchplugins\ask.xml
[2010/04/01 15:43:02 | 000,005,500 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\searchplugins\foodtv.xml
[2008/06/18 15:21:36 | 000,000,908 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\searchplugins\IMDB.xml
[2010/10/11 14:44:43 | 000,002,143 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\searchplugins\marketwatch.xml
[2010/10/14 11:09:16 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2006/10/19 08:56:40 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/04/22 08:59:53 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/05 19:51:19 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 05:00:04 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
O1 HOSTS File: ([2009/07/13 10:59:23 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ZILLAbar Browser Helper Object) - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll (iS3, Inc)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (STOPzilla Browser Helper Object) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll (iS3, Inc.)
O2 - BHO: (OToolbarHelper Class) - {EAD3A971-6A23-4246-8691-C9244E858967} - C:\Program Files\PayPal\PayPal Plug-In\PayPalHelper.dll ()
O2 - BHO: (HttpWatch Basic) - {F1F69322-008F-4895-B2BF-AD194219825A} - C:\Program Files\HttpWatch\httpwatchsc.dll (Simtec Limited)
O3 - HKLM\..\Toolbar: (&Save Flash) - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll (TODO: )
O3 - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\p4y9thml.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fsaddin-0.80.dll File not found
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (STOPzilla) - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll (iS3, Inc)
O3 - HKLM\..\Toolbar: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (PayPal Plug-In) - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - C:\Program Files\PayPal\PayPal Plug-In\OToolbar.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (hp toolkit) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (&Save Flash) - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll (TODO: )
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [AtiPTA] C:\WINDOWS\System32\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [FUFAXSTM] C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LtcyCfgApply] C:\Program Files\Ltcycfg2\LtcyCfg.exe ()
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [SBAMTray] C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe (Sunbelt Software)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKCU..\Run: [WorkForce 610(Network)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFJA.EXE (SEIKO EPSON CORPORATION)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe (Logitech Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\M-Audio Sonica Theater Control Panel Launcher.lnk = C:\Program Files\M-Audio Sonica Theater\STTask.exe (M-Audio)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Epson all-in-one Registration.lnk = Y:\Common\EpsonReg\EpsonReg.exe File not found
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Squeezebox Server Tray Tool.lnk = C:\Program Files\Squeezebox\SqueezeTray.exe (SlimDevices - A Logitech Company)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: _NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = FF FF BF 03 [binary data]
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: HttpWatch Basic - {D103E85B-5D67-42c1-8C83-F01079DBAB26} - C:\Program Files\HttpWatch\httpwatch.dll (Simtec Limited)
O9 - Extra 'Tools' menuitem : HttpWatch Basic - {D103E85B-5D67-42c1-8C83-F01079DBAB26} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2BF30C8B-72D5-40FF-B169-BFE1D503E7E8}
http://plpadmin.tempdomainname.com/CabFile…gradeFinder.cab (NewUpgradeFinder Control)
O16 - DPF: {49232000-16E4-426C-A231-62846947304B}
http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab (SysData Class)
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2}
http://simcity.ea.com/update/EARTPX.cab (EARTPatchX Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
http://update.microsoft.com/windowsupdate/…b?1123110157281 (WUWebControl Class)
O16 - DPF: {6DD4EA80-8981-40FB-B2FC-06B8EDC632B8}
http://www.2for1.com/downloads/PrintControl.CAB (PrintControl.PrinterControl)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
http://www.update.microsoft.com/microsoftu…b?1213284287968 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F}
http://v4.windowsupdate.microsoft.com/CAB/…7869.3365972222 (Reg Error: Key error.)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09}
https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx (Get_ActiveX Control)
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA}
http://simcity.ea.com/exchange/lots/telepo…ty4LotTeleX.cab (MaxisSimCity4LotTeleX Control)
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD}
http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab (MaxisSimCity4PatcherX Control)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} http://fdl.msn.com/public/investor/v13/ticker.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\mctp {d7b95390-b1c5-11d0-b111-0080c712fe82} - C:\Program Files\Microsoft ActiveSync\aatp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe) - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/04/09 23:19:17 | 000,000,000 | -HS- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 07:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{ab51d5d6-7c67-11da-950c-000c6e741192}\Shell - "" = AutoRun
O33 - MountPoints2\{ab51d5d6-7c67-11da-950c-000c6e741192}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ab51d5d6-7c67-11da-950c-000c6e741192}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{b263b309-0474-11df-abfa-000c6e741192}\Shell - "" = AutoRun
O33 - MountPoints2\{b263b309-0474-11df-abfa-000c6e741192}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b263b309-0474-11df-abfa-000c6e741192}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{c6191098-c565-11de-abe0-000c6e741192}\Shell\AutoRun\command - "" = F:\Setup.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (SDEarlyDelete) - File not found
O34 - HKLM BootExecute: (SDEarlyDelete \??\C:\Program Files\SpywareDetector) - File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (OODBS) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
Drivers32: MSACM.CEGSM - C:\WINDOWS\System32\mobileV.acm ()
Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: SENTINEL - C:\WINDOWS\System32\SNTI386.DLL ()
Drivers32: vidc.aasc - aasc32.dll File not found
Drivers32: vidc.aflc - flccodec32.dll File not found
Drivers32: vidc.afli - flccodec32.dll File not found
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MFZ0 - C:\WINDOWS\System32\MyFlashZip0.ax (Moyea Inc.)
Drivers32: VIDC.MJPG - C:\WINDOWS\System32\Pvmjpg21.dll (Pegasus Imaging Corporation)
Drivers32: VIDC.PIM1 - C:\WINDOWS\System32\pclepim1.dll (Pinnacle Systems)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
MsConfig - Services: "iPodService"
MsConfig - Services: "szserver"
MsConfig - Services: "O&O Defrag"
MsConfig - Services: "iPod Service"
MsConfig - Services: "Fax"
MsConfig - Services: "aawservice"
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ WinCinema Manager.lnk - C:\Program Files\Sandisk\Common\Bin\WinCinemaMgr.exe - (InterVideo Inc.)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR Media Server.lnk - E:\PROGRA~1\NETGEAR\MEDIAS~1\MEDIAS~1.EXE - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Pandora.lnk - C:\Program Files\Pandora\Pandora.exe - ()
MsConfig - StartUpReg:
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - hkey= - key= - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
MsConfig - StartUpReg:
iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg:
NeroFilterCheck - hkey= - key= - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
MsConfig - StartUpReg:
SDActiveMonitor - hkey= - key= - C:\Program Files\SpywareDetector\SDActiveMonitor.exe (Max Secure Software Pvt. Ltd.)
MsConfig - StartUpReg:
SDAutoLiveupdate - hkey= - key= - C:\Program Files\SpywareDetector\LiveUpdateSD.exe File not found
MsConfig - StartUpReg:
SpybotSD TeaTimer - hkey= - key= - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SBAMSvc - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe (Sunbelt Software)
SafeBootMin: SBPIMSvc - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe (Sunbelt Software)
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SBAMSvc - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe (Sunbelt Software)
SafeBootNet: SBPIMSvc - C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe (Sunbelt Software)
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: UploadMgr - Service
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
ActiveX: {057997dd-71e4-43cc-b161-3f8180691a9e} - Q824145
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - Internet Explorer Classes for Java
ActiveX: {0E9A3196-39EA-409D-8EB4-20D7FABC191A} - Microsoft .NET Framework 1.0 Hotfix (KB928367)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {11C03E0C-D05F-82BA-67BB-31F259DFF753} - Windows Media Player
ActiveX: {14303301-758B-402B-9A0D-2C6A591680DB} - Microsoft .NET Framework 1.0 Service Pack 3 (KB867461)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2cc9d512-6db6-4f1c-8979-9a41fae88de0} - Q837009
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {377483c2-e4b4-4ee8-b577-9aed264c8735} - Q822925
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4153B7E9-C945-F703-40D7-D5A533428550} - Windows Media Player
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {55F03DBE-C832-DAAE-A2AD-447D4860725D} - DirectAnimation
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Reg Error: Value error.
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {78705f0d-e8db-4b2d-8193-982bdda15ecd} - .NET Framework
ActiveX: {795d0712-722c-43ec-906a-fc5e678eada9} - Q831167
ActiveX: {81B52903-4C11-11D6-B6E1-00B0D049139F} - Microsoft .NET Framework 1.0 Service Pack 2 (KB867461)
ActiveX: {871F8A30-15A2-11D6-8711-0002B3281F8B} - Microsoft .NET Framework 1.0 Service Pack 1 (KB867461)
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {96543d59-497a-4801-a1f3-5936aacaf7b1} - Q828750
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894
ActiveX: {f5173cf0-1dfb-4978-8e50-a90169ee7ca9} - Q823353
ActiveX: {F5776D81-AE53-4935-8E84-B0B283D8BCEF} - Q330994
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620578542714880)
========== Files/Folders - Created Within 30 Days ==========
[2010/10/14 08:15:39 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/10/04 17:29:04 | 000,069,976 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\sbapifs.sys
[2010/10/04 17:29:03 | 000,021,464 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\sbaphd.sys
[2010/10/04 17:18:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Sunbelt
[2010/10/04 17:18:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sunbelt
[2010/10/04 17:15:00 | 000,212,568 | —- | C] (Sunbelt Software, Inc.) – C:\WINDOWS\System32\drivers\sbtis.sys
[2010/10/04 17:14:50 | 000,000,000 | —D | C] – C:\Program Files\Sunbelt Software
[2010/10/04 16:51:08 | 016,278,832 | —- | C] (Sunbelt Software ) – C:\Documents and Settings\Owner\Desktop\vipre.exe
[2010/09/23 14:30:41 | 008,534,336 | —- | C] (Mozilla) – C:\Documents and Settings\Owner\Desktop\Firefox Setup 3.6.10.exe
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010/10/14 12:45:00 | 000,000,422 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{C6CC27F2-E98C-48E6-A4E1-5BEC594B125D}.job
[2010/10/14 12:24:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/14 12:01:00 | 000,000,234 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/10/14 08:40:59 | 000,869,051 | —- | M] () – C:\Documents and Settings\Owner\Desktop\SecurityCheck.exe
[2010/10/14 08:40:21 | 000,293,376 | —- | M] () – C:\Documents and Settings\Owner\Desktop\444tuyzp.exe
[2010/10/14 08:16:09 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/10/13 23:24:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/13 08:15:36 | 000,000,189 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2010/10/13 08:13:47 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/10/13 08:13:41 | 2146,881,536 | -HS- | M] () – C:\hiberfil.sys
[2010/10/12 15:06:31 | 000,001,636 | —- | M] () – C:\Firefox Sync Key.html
[2010/10/10 16:49:04 | 000,001,772 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/10/06 16:14:01 | 867,517,440 | —- | M] () – C:\Outlook backup.pst
[2010/10/05 07:08:57 | 000,007,069 | —- | M] () – C:\index_bad.html
[2010/10/05 07:08:57 | 000,004,465 | —- | M] () – C:\index.html.HACKED
[2010/10/04 17:19:51 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/10/04 16:52:25 | 016,278,832 | —- | M] (Sunbelt Software ) – C:\Documents and Settings\Owner\Desktop\vipre.exe
[2010/10/04 09:00:14 | 000,053,760 | —- | M] () – C:\Download OTL to your desktop.doc
[2010/09/23 15:16:52 | 000,001,663 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/09/23 14:31:15 | 008,534,336 | —- | M] (Mozilla) – C:\Documents and Settings\Owner\Desktop\Firefox Setup 3.6.10.exe
[2010/09/20 12:36:00 | 000,049,936 | —- | M] () – C:\RWP Roger Petkoff Resume 2010[1]zver2.pdf
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/10/14 08:40:58 | 000,869,051 | —- | C] () – C:\Documents and Settings\Owner\Desktop\SecurityCheck.exe
[2010/10/14 08:40:21 | 000,293,376 | —- | C] () – C:\Documents and Settings\Owner\Desktop\444tuyzp.exe
[2010/10/12 15:06:22 | 000,001,636 | —- | C] () – C:\Firefox Sync Key.html
[2010/10/10 16:49:03 | 000,001,772 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/10/07 08:46:23 | 000,196,883 | —- | C] () – C:\Documents and Settings\Owner\Desktop\dougdavis2.jpg
[2010/10/04 09:03:46 | 000,053,760 | —- | C] () – C:\Download OTL to your desktop.doc
[2010/09/20 12:36:00 | 000,049,936 | —- | C] () – C:\RWP Roger Petkoff Resume 2010[1]zver2.pdf
[2010/03/24 09:01:57 | 000,000,000 | —- | C] () – C:\WINDOWS\EEventManager.INI
[2010/03/19 08:52:27 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2010/03/19 08:48:49 | 000,000,089 | —- | C] () – C:\WINDOWS\EPWF610.ini
[2010/03/16 19:36:36 | 000,000,067 | —- | C] () – C:\WINDOWS\swf2avi.INI
[2009/01/13 17:49:48 | 000,000,101 | —- | C] () – C:\WINDOWS\VSWizard.ini
[2008/11/29 11:13:12 | 000,015,040 | —- | C] () – C:\WINDOWS\System32\uddriver.sys
[2008/11/24 10:35:01 | 000,000,013 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\˜113.›sys
[2008/06/25 13:44:05 | 000,000,378 | —- | C] () – C:\Documents and Settings\Owner\Application Data\flashfavorite.htm
[2008/04/18 11:00:49 | 000,000,110 | —- | C] () – C:\WINDOWS\System32\SDEarlyDelete.ini
[2008/01/28 18:02:18 | 000,006,148 | -H– | C] () – C:\Documents and Settings\Owner\Application Data\.DS_Store
[2007/04/20 14:48:20 | 000,000,049 | —- | C] () – C:\WINDOWS\topo4.INI
[2007/04/13 09:47:09 | 000,000,000 | —- | C] () – C:\WINDOWS\MTSTACK.INI
[2007/04/02 16:11:44 | 000,000,110 | —- | C] () – C:\WINDOWS\TOPO.INI
[2007/03/27 01:55:48 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2006/12/08 06:50:14 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2006/05/04 16:03:52 | 000,063,488 | —- | C] () – C:\WINDOWS\xobglu16.dll
[2006/05/04 16:03:52 | 000,023,552 | —- | C] () – C:\WINDOWS\xobglu32.dll
[2006/04/17 16:13:01 | 000,009,392 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2006/04/03 14:55:27 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2006/01/26 06:51:56 | 000,110,080 | —- | C] () – C:\WINDOWS\System32\nlame.dll
[2006/01/03 10:15:34 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\Msvcrt10.dll
[2006/01/03 10:15:28 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\adistres.dll
[2005/12/09 09:11:48 | 000,104,060 | —- | C] () – C:\WINDOWS\System32\ShellEx.dll
[2005/12/06 18:11:11 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2005/12/06 18:11:11 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2005/12/06 18:11:11 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2005/12/06 18:11:11 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2005/12/06 18:11:10 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2005/12/06 18:11:10 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2005/12/02 14:39:29 | 000,001,392 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/11/17 16:32:09 | 000,000,000 | —- | C] () – C:\WINDOWS\winpm.INI
[2005/11/17 16:28:38 | 003,592,192 | —- | C] () – C:\WINDOWS\System32\qt-mt323.dll
[2005/11/01 12:15:00 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2005/11/01 10:14:44 | 000,373,248 | —- | C] () – C:\WINDOWS\EyeCand3.INI
[2005/11/01 09:55:13 | 000,000,076 | —- | C] () – C:\WINDOWS\System32\PhotoRg2.ini
[2005/11/01 09:54:44 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\ereglb32.dll
[2005/11/01 09:54:44 | 000,023,040 | —- | C] () – C:\WINDOWS\System32\ergint32.dll
[2005/10/30 15:51:27 | 000,000,000 | —- | C] () – C:\WINDOWS\ATIMMC.INI
[2005/10/29 14:11:26 | 000,094,720 | —- | C] () – C:\WINDOWS\System32\SH30W32.DLL
[2005/10/29 14:11:22 | 000,000,443 | —- | C] () – C:\WINDOWS\8272A4GS.INI
[2005/10/29 14:11:22 | 000,000,412 | —- | C] () – C:\WINDOWS\VIAPLAY.INI
[2005/10/29 14:11:22 | 000,000,000 | R— | C] () – C:\WINDOWS\VMARK.INI
[2005/08/31 15:47:22 | 000,000,017 | —- | C] () – C:\WINDOWS\MovingPicture.ini
[2005/08/09 16:13:31 | 000,831,488 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2005/08/09 16:13:31 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2005/07/12 12:30:19 | 000,318,014 | —- | C] () – C:\WINDOWS\System32\flt1chk4.dll
[2005/05/11 10:40:26 | 000,000,032 | —- | C] () – C:\WINDOWS\CD-Start.INI
[2005/03/04 16:12:57 | 000,335,872 | —- | C] () – C:\WINDOWS\System32\ldf252.dll
[2005/03/04 04:00:08 | 000,001,257 | —- | C] () – C:\WINDOWS\GARMINWT.INI
[2005/01/20 16:23:56 | 000,156,672 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2005/01/19 12:14:07 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\dfltchk2.dll
[2005/01/10 21:43:14 | 000,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2004/11/18 10:18:06 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\gpvbd.dll
[2004/11/18 10:18:06 | 000,027,136 | —- | C] () – C:\WINDOWS\System32\AuthDVD.DLL
[2004/11/14 14:38:10 | 000,104,612 | —- | C] () – C:\WINDOWS\System32\TomcatShellEx.dll
[2004/11/14 14:38:09 | 000,107,520 | —- | C] () – C:\WINDOWS\System32\dvrms.dll
[2004/11/14 14:38:05 | 001,778,176 | —- | C] () – C:\WINDOWS\System32\avcodec.dll
[2004/11/14 14:38:05 | 000,182,272 | —- | C] () – C:\WINDOWS\System32\avformat.dll
[2004/11/14 14:38:03 | 000,916,480 | —- | C] () – C:\WINDOWS\System32\FFMpeg.dll
[2004/09/16 14:24:26 | 003,375,104 | —- | C] () – C:\WINDOWS\System32\qt-mt331.dll
[2004/04/29 13:21:24 | 000,064,512 | —- | C] () – C:\WINDOWS\System32\drivers\SENTINEL.SYS
[2004/04/29 13:21:24 | 000,038,400 | —- | C] () – C:\WINDOWS\System32\SNTI386.DLL
[2004/04/29 13:21:24 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\RNBOVDD.DLL
[2004/04/07 08:51:51 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2004/02/26 18:01:51 | 000,109,568 | —- | C] () – C:\WINDOWS\System32\drivers\SSHDRV64.sys
[2003/12/22 15:40:06 | 001,663,068 | —- | C] () – C:\WINDOWS\System32\libmmd.dll
[2003/12/08 12:16:11 | 000,000,488 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/12/04 10:24:33 | 000,000,084 | —- | C] () – C:\WINDOWS\ALBUM.INI
[2003/11/19 19:41:42 | 000,074,842 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2003/11/08 23:31:34 | 000,544,768 | —- | C] () – C:\WINDOWS\System32\SZFrame.dll
[2003/11/05 22:35:14 | 000,018,432 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/10/24 17:18:21 | 000,000,053 | —- | C] () – C:\WINDOWS\WININIT.INI
[2003/10/07 13:17:24 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2003/09/23 16:38:03 | 000,003,758 | —- | C] () – C:\WINDOWS\FORGXP32.ini
[2003/09/23 16:28:56 | 000,061,952 | —- | C] () – C:\WINDOWS\System32\rmmerge2.DLL
[2003/09/23 16:28:56 | 000,009,728 | —- | C] () – C:\WINDOWS\System32\rmevents.DLL
[2003/09/12 11:01:05 | 000,000,386 | —- | C] () – C:\WINDOWS\I5E1000.INI
[2003/09/10 13:56:54 | 000,001,110 | —- | C] () – C:\WINDOWS\winamp.ini
[2003/09/06 08:43:49 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\PsisDecd.dll
[2003/09/05 10:05:14 | 000,000,219 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2003/09/05 08:59:28 | 000,000,005 | —- | C] () – C:\Documents and Settings\All Users\Application Data\DirectCDUserName.txt
[2003/09/04 19:22:37 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\SaiCfg.dll
[2003/09/04 17:20:57 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2003/07/08 08:33:00 | 000,031,744 | —- | C] () – C:\WINDOWS\System32\flt1chk2.dll
[2003/04/10 05:35:00 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/04/10 05:21:36 | 000,000,051 | —- | C] () – C:\WINDOWS\System32\mshrml.ini
[2003/04/10 02:51:07 | 000,000,438 | —- | C] () – C:\WINDOWS\System32\1_ssetup.ini
[2003/04/10 02:51:07 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\sunistlog.ini
[2003/04/10 01:32:34 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2003/04/10 01:32:34 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/10 01:06:10 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/04/10 01:03:38 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/04/10 01:03:38 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/04/10 00:57:15 | 000,000,052 | —- | C] () – C:\WINDOWS\intuprof.ini
[2003/04/10 00:57:04 | 000,000,626 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/04/10 00:16:44 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/04/09 23:44:58 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/04/09 23:44:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/04/09 23:44:29 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/04/09 23:23:21 | 000,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/04/09 23:05:45 | 000,000,659 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/04/09 16:10:31 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/10/15 16:54:04 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2002/02/27 18:50:00 | 000,197,120 | —- | C] () – C:\WINDOWS\System32\patchw32.dll
[2001/08/14 19:47:08 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\vxpsapi.dll
[2001/08/10 13:14:16 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\ImapiRoxPS.dll
[2000/04/14 17:50:02 | 000,343,040 | —- | C] () – C:\WINDOWS\System32\Lffpx7.dll
[1998/06/11 15:08:06 | 000,095,232 | —- | C] () – C:\WINDOWS\System32\Lfkodak.dll
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2007/10/24 14:54:31 | 000,018,550 | —- | M] () – C:\2005081_SP.s01
[2008/02/04 21:00:00 | 000,065,024 | —- | M] () – C:\Ap Lit terms examples1.doc
[2008/05/05 10:18:00 | 006,925,662 | —- | M] () – C:\April Mix-0.mp3
[2006/11/24 16:16:29 | 000,000,020 | -HS- | M] () – C:\ArcDeviceInfo
[2003/04/09 23:19:17 | 000,000,000 | -HS- | M] () – C:\AUTOEXEC.BAT
[2009/12/31 15:23:36 | 000,577,527 | —- | M] () – C:\bookmarks-2009-12-31.json
[2010/01/23 10:19:48 | 000,585,789 | —- | M] () – C:\bookmarks-2010-01-23.json
[2010/04/09 17:01:19 | 000,606,986 | —- | M] () – C:\bookmarks-2010-04-09.json
[2008/09/12 10:16:02 | 000,000,460 | —- | M] () – C:\Boot.bak
[2010/07/30 13:13:56 | 000,000,460 | RHS- | M] () – C:\boot.ini
[2005/10/07 10:49:13 | 000,008,064 | —- | M] () – C:\caavsetup.log
[2009/09/13 20:11:22 | 000,055,582 | —- | M] () – C:\caavsetupLog.txt
[2010/10/04 16:55:50 | 000,000,170 | —- | M] () – C:\caEntitlementLog.txt
[2010/10/04 17:06:10 | 001,538,084 | —- | M] () – C:\caisslog.txt
[2010/04/21 09:07:08 | 000,043,520 | —- | M] () – C:\Castle Rock Coupons.doc
[2010/04/20 14:10:00 | 000,045,056 | —- | M] () – C:\Castle Rock Coupons.wps
[2010/01/10 10:38:00 | 000,721,407 | —- | M] () – C:\CD cover 1yrAnn.jpg
[2007/08/02 12:13:18 | 000,004,289 | —- | M] () – C:\chatlog_45915532.txt
[2010/06/09 09:38:00 | 000,541,166 | —- | M] () – C:\Class of 1975.pdf
[2002/08/29 06:00:00 | 000,245,920 | RHS- | M] () – C:\cmldr
[2003/04/09 23:19:17 | 000,000,000 | -HS- | M] () – C:\CONFIG.SYS
[2010/04/16 15:20:33 | 000,107,295 | —- | M] () – C:\crmuseum.jpg
[2004/10/20 11:42:02 | 000,328,488 | —- | M] (InterMute Inc.) – C:\CWSInstall.exe
[2008/04/30 20:57:54 | 000,095,103 | —- | M] () – C:\dancing_with_the_stars.jpg
[2010/04/12 16:18:00 | 000,059,624 | —- | M] () – C:\Davis 2009 federeal extension.pdf
[2010/06/14 20:07:00 | 000,230,155 | —- | M] () – C:\Davis 2010 2nd qtr estimates.pdf
[2010/09/13 17:21:00 | 000,221,028 | —- | M] () – C:\Davis 2010 3rd qtr estimates.pdf
[2006/10/20 17:27:48 | 000,009,518 | —- | M] () – C:\debug.log
[2007/12/18 17:36:46 | 000,145,790 | —- | M] () – C:\devicetable.log
[2010/10/04 09:00:14 | 000,053,760 | —- | M] () – C:\Download OTL to your desktop.doc
[2008/10/25 14:58:00 | 000,062,209 | —- | M] () – C:\drunkpumpkin.jpg
[2009/08/06 10:24:54 | 000,000,000 | —- | M] () – C:\DTSHDSpOut.txt
[2008/12/22 18:10:27 | 000,003,068 | —- | M] () – C:\Enlish.lng
[2008/02/10 12:26:54 | 000,402,345 | —- | M] () – C:\evermotionexample.jpg
[2009/04/03 23:34:18 | 003,042,398 | RHS- | M] () – C:\ExecSignature.txt
[2006/03/09 18:48:02 | 000,002,048 | —- | M] () – C:\e_partitiontable.dat
[2009/06/23 09:43:31 | 018,071,615 | —- | M] () – C:\Fetch_5.5.dmg
[2010/10/12 15:06:31 | 000,001,636 | —- | M] () – C:\Firefox Sync Key.html
[2010/10/06 16:58:17 | 000,000,604 | —- | M] () – C:\Fixing_pst_files.txt
[2006/08/18 16:00:40 | 000,002,525 | —- | M] () – C:\gateway.asp.htm
[2006/11/29 11:21:00 | 002,950,837 | —- | M] () – C:\GodWill.txt
[2008/08/26 10:02:38 | 000,419,174 | —- | M] () – C:\greely.jpg
[2008/12/29 10:06:11 | 000,025,088 | —- | M] () – C:\Hi Linda.doc
[2010/10/13 08:13:41 | 2146,881,536 | -HS- | M] () – C:\hiberfil.sys
[2008/04/14 13:25:15 | 000,815,716 | —- | M] () – C:\hjbuilder.tif
[2009/10/15 21:40:00 | 000,106,648 | —- | M] () – C:\hpCDE.log
[2009/12/15 14:50:00 | 000,034,189 | —- | M] () – C:\image001.jpg
[2010/10/05 07:08:57 | 000,004,465 | —- | M] () – C:\index.html.HACKED
[2010/10/05 07:08:57 | 000,007,069 | —- | M] () – C:\index_bad.html
[2003/04/09 23:19:17 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/02/05 09:40:32 | 000,000,657 | -H– | M] () – C:\IPH.PH
[2009/06/24 19:25:52 | 000,022,237 | —- | M] () – C:\JavaRa.log
[2010/05/24 08:44:21 | 000,000,000 | —- | M] () – C:\Log.txt
[2007/12/28 09:24:22 | 000,020,480 | —- | M] () – C:\LOVELAND COLORADO.dgn
[2010/01/09 17:31:18 | 090,484,342 | —- | M] () – C:\Make it Through Final.AIF
[2010/01/04 17:59:38 | 041,566,274 | —- | M] () – C:\Make it Through.AIF
[2008/07/21 11:43:16 | 000,056,965 | —- | M] () – C:\mallards.TXT
[2008/07/21 11:59:11 | 000,014,336 | —- | M] () – C:\mallards.xls
[2007/08/21 20:38:31 | 064,069,493 | RHS- | M] () – C:\MaxSecurePattern.DB
[2009/04/20 17:19:42 | 046,143,028 | RHS- | M] () – C:\MaxSecureSig.DB
[2006/04/27 12:51:28 | 000,000,290 | —- | M] () – C:\megaCITY.ini
[2006/01/02 13:44:14 | 000,000,267 | —- | M] () – C:\megaScenery.ini
[2005/10/31 15:49:03 | 000,000,428 | —- | M] () – C:\mmcInst.log
[2009/10/19 16:42:28 | 000,000,000 | —- | M] () – C:\MMiPodExcept.log
[2009/10/19 16:42:31 | 000,000,000 | —- | M] () – C:\MMWMDMExcept.log
[2003/04/09 23:19:17 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/03/27 16:53:35 | 000,032,256 | —- | M] () – C:\mtnpinewomensclub.doc
[2010/04/15 15:02:00 | 000,066,059 | —- | M] () – C:\Name badges.pdf
[2008/03/31 12:47:31 | 000,022,552 | —- | M] () – C:\netgear.cfg
[2004/09/09 14:22:19 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/09/09 14:22:19 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/10/06 16:14:01 | 867,517,440 | —- | M] () – C:\Outlook backup.pst
[2010/10/13 08:13:36 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2009/06/08 10:15:03 | 006,768,808 | —- | M] () – C:\pccolorado.tif
[2009/06/09 15:33:02 | 000,003,429 | —- | M] () – C:\Poly_CSG_Log.txt
[2008/03/03 12:19:04 | 000,057,856 | —- | M] () – C:\PS Miller App 08.doc
[2009/01/24 11:04:32 | 000,290,874 | —- | M] () – C:\reither.jpg
[2009/12/21 16:54:00 | 000,087,040 | —- | M] () – C:\Relocation Partnership Agreement_RelocationGuide.com 12 18 09.doc
[2010/09/20 12:36:00 | 000,049,936 | —- | M] () – C:\RWP Roger Petkoff Resume 2010[1]zver2.pdf
[2010/09/09 11:26:13 | 000,000,180 | —- | M] () – C:\salesforce.txt
[2010/09/09 17:08:27 | 000,000,025 | —- | M] () – C:\salesforce2.txt
[2008/10/01 09:02:19 | 001,153,938 | RHS- | M] () – C:\SdHeuristic.txt
[2009/04/03 23:45:12 | 002,334,774 | RHS- | M] () – C:\SDSignature.txt
[2009/02/10 11:48:56 | 029,091,941 | RHS- | M] () – C:\SDVirus.txt
[2003/01/14 11:06:52 | 000,019,456 | —- | M] () – C:\signaturefile.doc
[2003/01/14 11:08:54 | 000,002,687 | —- | M] () – C:\signaturefile.rtf
[2003/01/14 11:10:38 | 000,000,123 | —- | M] () – C:\signaturefile.txt
[2009/12/22 12:53:04 | 001,554,638 | —- | M] () – C:\sisters to T Xmas 09.jpg
[2009/12/10 18:04:14 | 004,940,525 | —- | M] () – C:\sliced.psd
[2010/09/09 08:10:53 | 000,000,023 | —- | M] () – C:\social.txt
[2005/12/17 16:52:53 | 000,044,239 | —- | M] () – C:\sound32.dll
[2008/04/07 14:46:38 | 000,003,995 | —- | M] () – C:\test.avi
[2010/04/06 20:50:01 | 000,056,320 | —- | M] () – C:\The Economy.doc
[2009/12/21 10:24:15 | 000,712,192 | —- | M] () – C:\The emails.doc
[2009/03/09 21:28:00 | 000,072,192 | —- | M] () – C:\Time 2 Paint Half Page Ad.pub
[2010/05/04 15:30:00 | 001,101,306 | —- | M] () – C:\USAfguide.wav
[2007/12/29 10:47:45 | 000,026,540 | —- | M] () – C:\video.pass
[2008/12/01 15:43:36 | 016,069,600 | —- | M] () – C:\walllagging.tif
[2008/12/01 14:27:24 | 010,087,544 | —- | M] () – C:\wallsection.tif
[2009/12/20 10:12:00 | 000,023,720 | —- | M] () – C:\Window Card.xlsx
[2010/10/11 09:47:23 | 000,398,210 | —- | M] () – C:\winzip.log
[2008/01/22 18:00:24 | 001,477,632 | —- | M] () – C:\Zone 3 Proposed - Archifects.dgn
[2008/01/22 17:59:29 | 000,028,790 | —- | M] () – C:\Zone 3 Proposed - Archifects.s01
< %systemroot%\Fonts\*.com >
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2003/04/09 23:18:28 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 06:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 04:50:04 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
[2001/10/05 10:48:42 | 000,356,883 | —- | M] () – C:\WINDOWS\andreasautumnleaves.jpg
[2002/04/23 09:19:46 | 000,054,567 | —- | M] () – C:\WINDOWS\archifects.jpg
[2004/02/11 19:01:54 | 000,200,804 | —- | M] () – C:\WINDOWS\stevieloslonely.jpg
< %systemroot%\*.png >
< %systemroot%\*.scr >
[2003/03/03 20:43:00 | 000,679,517 | R— | M] (d3Digital illusions) – C:\WINDOWS\eDimensional.scr
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
[2003/04/09 16:08:43 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2003/04/09 16:08:43 | 000,602,112 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2003/04/09 16:08:42 | 000,385,024 | —- | M] () – C:\WINDOWS\system32\config\system.sav
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2004/09/09 14:28:37 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
[2009/04/20 13:43:50 | 000,000,000 | —- | M] () – C:\WINDOWS\system32\SDRemoveDB.db
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2004/09/09 14:49:54 | 000,000,177 | -HS- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2003/04/09 23:23:06 | 000,000,079 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
< %USERPROFILE%\Desktop\*.exe >
[2010/10/14 08:40:21 | 000,293,376 | —- | M] () – C:\Documents and Settings\Owner\Desktop\444tuyzp.exe
[2010/07/20 16:44:20 | 002,955,416 | —- | M] (Siber Systems) – C:\Documents and Settings\Owner\Desktop\AiRoboForm.exe
[2010/09/23 14:31:15 | 008,534,336 | —- | M] (Mozilla) – C:\Documents and Settings\Owner\Desktop\Firefox Setup 3.6.10.exe
[2010/08/16 13:41:48 | 008,245,424 | —- | M] (Ventis Media Inc. ) – C:\Documents and Settings\Owner\Desktop\MediaMonkey_3.2.2.1300.exe
[2010/10/14 08:16:09 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/10/14 08:40:59 | 000,869,051 | —- | M] () – C:\Documents and Settings\Owner\Desktop\SecurityCheck.exe
[2010/06/10 15:56:57 | 000,579,597 | —- | M] () – C:\Documents and Settings\Owner\Desktop\unlocker1.8.9.exe
[2010/10/04 16:52:25 | 016,278,832 | —- | M] (Sunbelt Software ) – C:\Documents and Settings\Owner\Desktop\vipre.exe
[2010/08/30 14:03:28 | 001,052,224 | —- | M] (BillP Studios) – C:\Documents and Settings\Owner\Desktop\wpsetup.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >
< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >
< %PROGRAMFILES%\Internet Explorer\*.tmp >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %USERPROFILE%\My Documents\*.exe >
< %USERPROFILE%\*.exe >
[2010/05/07 12:54:54 | 000,072,080 | —- | M] () – C:\Documents and Settings\Owner\g2mdlhlpx.exe
[2007/08/02 11:40:18 | 000,557,056 | —- | M] (Citrix Online) – C:\Documents and Settings\Owner\GoToAssist_phone__317_en.exe
[2010/08/24 16:52:27 | 001,062,984 | —- | M] (Citrix Online, a division of Citrix Systems, Inc.) – C:\Documents and Settings\Owner\gotomypc_540.exe
< %systemroot%\ADDINS\*.* >
[2002/08/29 06:00:00 | 000,000,791 | —- | M] () – C:\WINDOWS\addins\fxsext.ecf
< %systemroot%\assembly\*.bak2 >
< %systemroot%\Config\*.* >
< %systemroot%\REPAIR\*.bak2 >
< %systemroot%\SECURITY\Database\*.sdb /x >
< %systemroot%\SYSTEM\*.bak2 >
< %systemroot%\Web\*.bak2 >
< %systemroot%\Driver Cache\*.* >
< %PROGRAMFILES%\Mozilla Firefox\0*.exe >
< %ProgramFiles%\Microsoft Common\*.* >
< %ProgramFiles%\TinyProxy. >
< %USERPROFILE%\Favorites\*.url /x >
< %systemroot%\system32\*.bk >
< %systemroot%\*.te >
< %systemroot%\system32\system32\*.* >
< %ALLUSERSPROFILE%\*.dat /x >
< %systemroot%\system32\drivers\*.rmv >
< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >
< dir /b "%systemroot%\*.exe" | find /i " " /c >
Radeon Omega Drivers v3.8.205 Uninstall.exe
Radeon Omega Drivers v3.8.231 Uninstall.exe
< %PROGRAMFILES%\Microsoft\*.* >
< %systemroot%\System32\Wbem\proquota.exe >
< %PROGRAMFILES%\Mozilla Firefox\*.dat >
< %USERPROFILE%\Cookies\*.txt /x >
[2009/12/09 11:21:11 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Owner\Cookies\desktop.ini
[2010/10/14 11:08:36 | 000,131,072 | —- | M] () – C:\Documents and Settings\Owner\Cookies\index.dat
< %SystemRoot%\system32\fonts\*.* >
< %systemroot%\system32\winlog\*.* >
< %systemroot%\system32\Language\*.* >
< %systemroot%\system32\Settings\*.* >
< %systemroot%\system32\*.quo >
< %SYSTEMROOT%\AppPatch\*.exe >
< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 23:10:26 | 000,317,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\inf\unregmp2.exe
< %SYSTEMROOT%\Installer\*.exe >
< %systemroot%\system32\config\*.bak2 >
< %systemroot%\system32\Computers\*.* >
< %SystemRoot%\system32\Sound\*.* >
< %SystemRoot%\system32\SpecialImg\*.* >
< %SystemRoot%\system32\code\*.* >
< %SystemRoot%\system32\draft\*.* >
< %SystemRoot%\system32\MSSSys\*.* >
< %ProgramFiles%\Javascript\*.* >
< %systemroot%\pchealth\helpctr\System\*.exe /s >
< %systemroot%\Web\*.exe >
< %systemroot%\system32\msn\*.* >
< %systemroot%\system32\*.tro >
< %AppData%\Microsoft\Installer\msupdates\*.* >
< %ProgramFiles%\Messenger\*.exe >
[2004/10/13 10:24:37 | 001,694,208 | —- | M] (Microsoft Corporation) – C:\Program Files\Messenger\msmsgs.exe
[2002/08/20 23:08:38 | 000,069,663 | —- | M] (Microsoft Corporation) – C:\Program Files\Messenger\msmsgsin.exe
< %systemroot%\system32\systhem32\*.* >
< %systemroot%\system\*.exe >
[1998/05/07 17:04:38 | 000,052,736 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system\hpsysdrv.exe
< %USERPROFILE%\Templates\*.tmp >
< %SYSTEMDRIVE%\explorexxx.exe\*.* >
< %Windir%\Installer\*.tmp >
[7 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]
< %systemroot%\System32\*.xco >
< %ProgramFiles%\system32\*.* >
< %systemroot%\System32\windos\*.* >
< %SystemRoot%\system32\sandbox\*.* >
< %SystemRoot%\system32\*.amo >
< %SystemRoot%\system32\Windows Live\*.* >
< %ProgramFiles%\logs\*.* >
< %ProgramFiles%\Bifrost\*.* >
< %SystemRoot%\system32\*.goo >
< %systemroot%\system32\IME\*.* >
< %systemroot%\BackUp\*.* >
< %systemroot%\system32\*.ico >
[2005/11/22 18:05:00 | 000,020,254 | —- | M] () – C:\WINDOWS\system32\ATI_CUBE.ICO
[2003/09/21 16:41:40 | 000,000,318 | —- | M] () – C:\WINDOWS\system32\omega_drivers.ico
[2002/05/01 22:06:52 | 000,002,238 | —- | M] () – C:\WINDOWS\system32\thistle_icon.ico
< %systemroot%\system\*.dat >
[2010/10/13 08:15:36 | 000,000,189 | —- | M] () – C:\WINDOWS\system\hpsysdrv.DAT
< %systemroot%\system\*.exe >
[1998/05/07 17:04:38 | 000,052,736 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system\hpsysdrv.exe
< %AppData%\Macromedia\Common\*.* >
[2009/05/26 16:23:52 | 000,000,026 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Macromedia\Common\Personal Dictionary.tlx
< %SYSTEMDRIVE%\dir\*.* /s >
< %systemroot%\system32\ras\*.exe >
< %SYSTEMDRIVE%\MFILES\*.* >
< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >
< %systemroot%\system32\services\*.* >
< %systemroot%\Spooler\*.* >
< %ProgramFiles%\system32\*.* >
< %systemroot%\system32\Setup\*.dll /x >
< %systemroot%\system32\*.mine >
< %SYSTEMDRIVE%\cleansweep.exe\*.* >
< %systemroot%\system32\ras\*.dll >
< %systemroot%\system32\ras\*.drv >
< %systemroot%\*.iq >
< %systemroot%\system32\XP\*.* >
< %SYSTEMDRIVE%\Extracted\*.* >
< %systemroot%\system32\windows\*.* >
< %systemroot%\logs\*.* >
< %SYSTEMDRIVE%\Win.Msi\*.* >
< %systemroot%\regedit\*.* >
< %systemroot%\system32\skype\*.* >
< %AppData%\Adobe\dlluplwin25\*.* >
< %UserProfile%\*.dat >
[2006/04/26 15:08:02 | 005,242,880 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_56061
[2008/04/16 08:46:50 | 014,942,208 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_45001
[2008/08/14 12:46:14 | 018,612,224 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_74171
[2006/04/06 08:50:04 | 005,242,880 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_19133
[2006/05/25 10:38:24 | 005,242,880 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_86242
[2006/08/08 14:21:57 | 005,242,880 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_63601
[2007/04/12 09:35:32 | 009,175,040 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_26852
[2007/12/06 10:31:21 | 012,582,912 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_68135
[2009/06/23 14:10:25 | 014,381,056 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_91025
[2005/11/17 17:57:50 | 007,340,032 | —- | M] () – C:\Documents and Settings\Owner\NTUSER.DAT_BAK_10905
[2007/03/15 11:38:28 | 007,864,320 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_51305
[2005/08/12 12:57:15 | 006,815,744 | —- | M] () – C:\Documents and Settings\Owner\NTUSER.DAT_BAK_77487
[2007/05/21 10:22:36 | 014,155,776 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_18796
[2007/11/12 10:26:53 | 012,058,624 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_13558
[2009/04/19 10:45:14 | 020,185,088 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_60339
[2007/08/02 19:57:35 | 010,747,904 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_75916
[2006/10/19 08:44:23 | 005,505,024 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat_BAK_65986
[2010/10/14 11:29:05 | 011,010,048 | —- | M] () – C:\Documents and Settings\Owner\ntuser.dat
[2004/11/16 10:22:37 | 004,980,736 | -H– | M] () – C:\Documents and Settings\Owner\NTUSER.DAT_BAK_66829
[2005/01/11 10:28:44 | 006,029,312 | —- | M] () – C:\Documents and Settings\Owner\NTUSER.DAT_BAK_80719
[2005/05/19 11:33:03 | 006,029,312 | —- | M] () – C:\Documents and Settings\Owner\NTUSER.DAT_BAK_86093
< %UserProfile%\*.dll >
< %systemroot%\system32\*.sxo >
< %SYSTEMDRIVE%\Gazma\*.* /s >
< %systemroot%\system32\spynet\*.* >
< %systemroot%\system32\System\*.* >
< %appdata%\Microsoft\Windows\*.* >
< %systemroot%\system32\WinDir\*.* >
< %systemroot%\_\*.* >
< %systemroot%\system32\windows32\*.* >
< %ProgramFiles%\win\*.* >
< %AppData%\Microsoft\CD Burning\*.* >
< %systemroot%\*.cab >
< %systemroot%\K.Backup\*.* >
< %ProgramFiles%\Massenger\*.* >
< %systemroot%\System32\*.doc >
< %systemroot%\Office12\*.* >
< %systemroot%\System32\Rundl32.exe\*.* >
< %ProgramFiles%\yahoo.net\*.* >
< %systemroot%\system32\*.igo >
< %systemroot%\*.rew >
< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2009/02/05 11:00:00 | 000,374,704 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\EFXIJRMV.exe
[2009/02/24 14:38:04 | 000,309,152 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_DUPA30.EXE
[2007/11/15 05:02:00 | 000,175,616 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FAMTFJA.EXE
[2008/10/27 05:05:00 | 000,171,008 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FARNFJA.EXE
[2009/01/26 06:00:00 | 000,199,680 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIFJA.EXE
[2007/12/17 01:03:00 | 000,177,152 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FBCSFJA.EXE
[2008/12/15 10:51:00 | 000,136,192 | —- | M] (SEIKO EPSON Corporation) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FHUTFJA.EXE
[2009/02/25 07:05:00 | 000,808,888 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FINSFJA.EXE
[2009/08/17 04:00:00 | 000,204,800 | —- | M] (SEIKO EPSON CORP.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FPREFJA.EXE
[2007/01/11 04:02:00 | 000,113,664 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S40RP7.EXE
[2007/12/17 04:00:00 | 000,143,872 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S40ST7.EXE
[2008/11/16 13:01:00 | 000,146,432 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SAG4ST.EXE
[2006/12/19 12:14:00 | 000,131,072 | —- | M] (SEIKO EPSON CORPORATION) – C:\WINDOWS\system32\spool\drivers\w32x86\3\SAGENT4.EXE
< %USERPROFILE%\.COMMgr\*.* >
< %USERPROFILE%\Desktop\*.bat >
< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >
[2006/08/22 08:48:04 | 000,043,008 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Visualizations\Annabelle.rpv
[2006/08/22 08:48:04 | 000,080,384 | —- | M] () – C:\Program Files\Common Files\Real\Visualizations\CosmicBelt.rpv
[2006/08/22 08:48:04 | 000,007,168 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Visualizations\Fire.rpv
[2006/08/22 08:48:05 | 000,007,680 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Visualizations\FreqBands.rpv
[2008/09/18 13:10:16 | 000,141,312 | —- | M] () – C:\Program Files\Common Files\Real\Visualizations\G-Force.rpv
[2006/08/22 08:48:05 | 000,069,632 | —- | M] () – C:\Program Files\Common Files\Real\Visualizations\Nebula.rpv
[2009/03/18 07:17:00 | 000,164,864 | —- | M] () – C:\Program Files\Common Files\Real\Visualizations\WhiteCap.rpv
< %PROGRAMFILES%\Internet Explorer\*.Jmp >
< %PROGRAMFILES%\Windows NT\system\*.dll >
< %systemroot%\system32\*.ext >
< %systemroot%\system32\Com\*.cfg >
< %systemroot%\system32\btz\*.* >
< %systemroot%\system32\EMP\*.* >
< %systemroot%\system32\expo\*.* >
< %systemroot%\system32\inet2\*.* >
< %systemroot%\system32\xrem\*.* >
< %ProgramFiles%\Microsoft\*.* >
< %systemroot%\usgwmt\*.* >
< %ProgramFiles%\B\*.* >
< %SYSTEMDRIVE%\lspp\*.* >
< %systemroot%\Kral\*.* >
< %SYSTEMDRIVE%\windowsdvd.exe\*.* >
< %systemroot%\system32\*.ipo >
< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >
< %systemroot%\system32\*.mof >
< %systemroot%\*.atm >
< %systemroot%\system32\svhost\*.* >
< %ProgramFiles%\system32\*.* >
< %ProgramFiles%\Docmentt\*.* >
< %systemroot%\Help\*.vbs >
< %ProgramFiles%\Windows WinSxs\*.* /s >
< %ProgramFiles%\Outlook Express\IDT\*.* /s >
< %ProgramFiles%\Microsoft Office\365\*.* /s >
< %ProgramFiles%\Windows Live\*.* >
< %systemroot%\system32\win32\*.* >
< %SYSTEMDRIVE%\RECYCLER\*.* >
< %systemroot%\Fresh1\*.* >
< %ProgramFiles%\Kekj\*.* /s >
< %systemroot%\GDU\*.* >
< %systemroot%\KA\*.* >
< %systemroot%\R\*.* >
< %systemroot%\system32\*.fyo >
< %USERPROFILE%\System\*.* >
< %systemroot%\Source\*.* >
< %systemroot%\system32\ac\*.* >
< %ProgramFiles%\MSDN\*.* >
< %AppData%\AdobeUM\winvcldll54\*.* /s >
< %ProgramFiles%\Internet Explorer\*.ico >
< %systemroot%\system32\*.ojo >
< %systemroot%\system32\d323s\*.* >
< %systemroot%\system32\re\*.* >
< %UserProfile%\Microsoft\*.dll >
< %UserProfile%\Microsoft\*.log >
< %systemroot%\Bios\*.* >
< %ProgramFiles%\Spool\*.* >
< %ProgramFiles%\promp3\*.* >
< %SYSTEMDRIVE%\Driver\*.* /s >
< %SYSTEMDRIVE%\inetserver.exe\*.* >
< %systemroot%\java\trustlib\*.* >
< %ProgramFiles%\Common Files\designer\*.exe >
< %ProgramFiles%\*. >
[2005/11/17 16:28:34 | 000,000,000 | —D | M] – C:\Program Files\7tools
[2005/03/04 16:12:57 | 000,000,000 | —D | M] – C:\Program Files\ACD Systems
[2007/04/12 16:13:02 | 000,000,000 | —D | M] – C:\Program Files\Acronis
[2003/09/05 08:57:27 | 000,000,000 | —D | M] – C:\Program Files\Adaptec
[2010/10/10 16:48:35 | 000,000,000 | —D | M] – C:\Program Files\Adobe
[2005/12/08 23:36:05 | 000,000,000 | —D | M] – C:\Program Files\AdorageI-GfxDatas
[2005/08/31 14:48:50 | 000,000,000 | —D | M] – C:\Program Files\AdorageI-SAL
[2007/12/18 15:24:59 | 000,000,000 | —D | M] – C:\Program Files\Ahead
[2007/07/09 10:54:54 | 000,000,000 | —D | M] – C:\Program Files\allTunes
[2008/06/10 21:07:59 | 000,000,000 | —D | M] – C:\Program Files\Amazon
[2004/10/11 17:49:27 | 000,000,000 | —D | M] – C:\Program Files\AnswerWorks 4.0
[2009/10/06 18:24:28 | 000,000,000 | —D | M] – C:\Program Files\Apple Software Update
[2009/03/18 16:54:33 | 000,000,000 | —D | M] – C:\Program Files\ApplyThis
[2003/09/04 17:20:26 | 000,000,000 | —D | M] – C:\Program Files\ArcSoft
[2010/02/05 10:06:01 | 000,000,000 | —D | M] – C:\Program Files\Ask.com
[2005/10/31 15:48:46 | 000,000,000 | —D | M] – C:\Program Files\ATI Multimedia
[2007/11/01 15:36:14 | 000,000,000 | —D | M] – C:\Program Files\AutoCAD 2004
[2008/03/05 17:41:29 | 000,000,000 | —D | M] – C:\Program Files\AutoCAD R14
[2007/05/10 14:26:13 | 000,000,000 | —D | M] – C:\Program Files\Autodesk
[2007/01/19 13:13:40 | 000,000,000 | —D | M] – C:\Program Files\AutoGK
[2009/01/17 11:07:59 | 000,000,000 | —D | M] – C:\Program Files\AvantGo Connect
[2007/01/19 13:13:26 | 000,000,000 | —D | M] – C:\Program Files\AviSynth 2.5
[2006/04/01 10:14:17 | 000,000,000 | —D | M] – C:\Program Files\Axaware
[2004/01/06 12:54:06 | 000,000,000 | —D | M] – C:\Program Files\BackWeb
[2006/04/03 14:55:27 | 000,000,000 | —D | M] – C:\Program Files\Belarc
[2007/04/24 13:48:39 | 000,000,000 | —D | M] – C:\Program Files\BentleyV8
[2007/11/15 22:06:00 | 000,000,000 | —D | M] – C:\Program Files\Best Buy Rhapsody
[2010/08/30 14:30:16 | 000,000,000 | —D | M] – C:\Program Files\BillP Studios
[2006/12/29 11:05:45 | 000,000,000 | —D | M] – C:\Program Files\BirdsEyeView
[2010/07/09 14:06:47 | 000,000,000 | —D | M] – C:\Program Files\Bonjour
[2009/11/25 14:18:45 | 000,000,000 | R–D | M] – C:\Program Files\BrowserMaster
[2005/11/07 14:18:18 | 000,000,000 | —D | M] – C:\Program Files\Bryce 4.0
[2004/08/20 16:16:18 | 000,000,000 | —D | M] – C:\Program Files\CDEX
[2009/12/01 19:55:23 | 000,000,000 | —D | M] – C:\Program Files\Citrix
[2009/03/16 14:07:26 | 000,000,000 | —D | M] – C:\Program Files\CoffeeCup Software
[2010/09/08 16:37:44 | 000,000,000 | —D | M] – C:\Program Files\Common Files
[2003/04/09 23:15:53 | 000,000,000 | —D | M] – C:\Program Files\ComPlus Applications
[2009/12/08 15:31:50 | 000,000,000 | —D | M] – C:\Program Files\CoreFTP
[2005/11/07 12:04:15 | 000,000,000 | —D | M] – C:\Program Files\CyberLink
[2006/04/07 13:15:04 | 000,000,000 | —D | M] – C:\Program Files\DBX Extractor
[2005/08/03 14:06:40 | 000,000,000 | —D | M] – C:\Program Files\DiscWizard for Windows
[2008/06/05 08:59:30 | 000,000,000 | —D | M] – C:\Program Files\DiskTrix
[2010/09/08 16:44:46 | 000,000,000 | —D | M] – C:\Program Files\DivX
[2007/01/19 13:11:55 | 000,000,000 | —D | M] – C:\Program Files\DVD Decrypter
[2007/12/19 21:11:15 | 000,000,000 | —D | M] – C:\Program Files\DVDx
[2007/11/01 15:36:14 | 000,000,000 | —D | M] – C:\Program Files\DWG TrueView 2008
[2005/11/06 21:39:23 | 000,000,000 | —D | M] – C:\Program Files\EndItAll
[2010/03/19 09:03:51 | 000,000,000 | —D | M] – C:\Program Files\epson
[2010/03/27 11:32:51 | 000,000,000 | —D | M] – C:\Program Files\Epson Software
[2010/03/19 08:57:49 | 000,000,000 | —D | M] – C:\Program Files\EpsonNet
[2005/08/23 10:38:22 | 000,000,000 | —D | M] – C:\Program Files\ewido
[2005/11/01 10:05:02 | 000,000,000 | —D | M] – C:\Program Files\Extensis
[2009/11/09 14:25:25 | 000,000,000 | —D | M] – C:\Program Files\Fiesta Download Manager
[2008/06/25 16:32:37 | 000,000,000 | —D | M] – C:\Program Files\Flash Favorite
[2006/06/04 18:42:25 | 000,000,000 | —D | M] – C:\Program Files\Font Reviewer
[2005/11/07 13:13:48 | 000,000,000 | —D | M] – C:\Program Files\FontLister
[2005/11/06 21:44:17 | 000,000,000 | —D | M] – C:\Program Files\Freeware
[2005/09/23 11:17:59 | 000,000,000 | —D | M] – C:\Program Files\FSAutoStart
[2007/01/19 13:12:52 | 000,000,000 | —D | M] – C:\Program Files\Gabest
[2005/05/29 16:07:46 | 000,000,000 | —D | M] – C:\Program Files\GARMIN
[2009/08/04 16:54:21 | 000,000,000 | —D | M] – C:\Program Files\Google
[2009/02/11 09:03:14 | 000,000,000 | —D | M] – C:\Program Files\H264 PRO IRS
[2006/04/21 09:29:04 | 000,000,000 | —D | M] – C:\Program Files\Hewlett-Packard
[2004/02/26 17:02:19 | 000,000,000 | —D | M] – C:\Program Files\HighMAT CD Writing Wizard
[2003/04/10 01:12:29 | 000,000,000 | —D | M] – C:\Program Files\HP Instant Support
[2003/04/10 00:23:02 | 000,000,000 | —D | M] – C:\Program Files\HP Photosmart 11
[2010/04/29 13:55:12 | 000,000,000 | —D | M] – C:\Program Files\HttpWatch
[2007/08/08 16:39:14 | 000,000,000 | —D | M] – C:\Program Files\ImgBurn
[2010/03/19 08:59:10 | 000,000,000 | -H-D | M] – C:\Program Files\InstallShield Installation Information
[2003/04/10 00:51:34 | 000,000,000 | —D | M] – C:\Program Files\IntelliMover Data Transfer Demo
[2006/12/13 19:33:40 | 000,000,000 | —D | M] – C:\Program Files\InterActual
[2010/08/18 06:37:05 | 000,000,000 | —D | M] – C:\Program Files\Internet Explorer
[2005/12/06 18:11:01 | 000,000,000 | —D | M] – C:\Program Files\InterVideo
[2010/07/09 14:19:33 | 000,000,000 | —D | M] – C:\Program Files\iPod
[2010/07/09 14:21:01 | 000,000,000 | —D | M] – C:\Program Files\iTunes
[2010/03/16 19:36:35 | 000,000,000 | —D | M] – C:\Program Files\iWisoft Flash SWF to Video Converter
[2009/10/29 12:03:07 | 000,000,000 | —D | M] – C:\Program Files\iXi Tools
[2010/08/05 19:51:13 | 000,000,000 | —D | M] – C:\Program Files\Java
[2009/01/14 09:34:37 | 000,000,000 | —D | M] – C:\Program Files\Lavasoft
[2008/06/10 20:05:51 | 000,000,000 | —D | M] – C:\Program Files\LegalSounds
[2004/11/18 09:31:34 | 000,000,000 | —D | M] – C:\Program Files\LitexMedia
[2005/11/07 12:03:44 | 000,000,000 | —D | M] – C:\Program Files\Logitech
[2006/01/27 10:30:41 | 000,000,000 | —D | M] – C:\Program Files\Ltcycfg2
[2008/03/13 10:36:38 | 000,000,000 | —D | M] – C:\Program Files\M-Audio Sonica Theater
[2007/08/06 15:42:37 | 000,000,000 | —D | M] – C:\Program Files\M2Soft
[2005/11/02 15:58:22 | 000,000,000 | —D | M] – C:\Program Files\Macromedia
[2004/02/04 15:00:25 | 000,000,000 | —D | M] – C:\Program Files\Maxis
[2010/08/16 13:46:32 | 000,000,000 | —D | M] – C:\Program Files\MediaMonkey
[2004/11/18 10:18:06 | 000,000,000 | —D | M] – C:\Program Files\MediaTwins Software
[2008/08/14 18:24:36 | 000,000,000 | —D | M] – C:\Program Files\Messenger
[2009/12/31 13:55:27 | 000,000,000 | —D | M] – C:\Program Files\Microsoft ActiveSync
[2008/06/13 17:39:43 | 000,000,000 | —D | M] – C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2003/04/09 23:19:32 | 000,000,000 | —D | M] – C:\Program Files\microsoft frontpage
[2005/01/07 13:33:56 | 000,000,000 | —D | M] – C:\Program Files\Microsoft Games
[2009/02/16 09:44:43 | 000,000,000 | —D | M] – C:\Program Files\Microsoft Office
[2008/08/26 08:09:23 | 000,000,000 | —D | M] – C:\Program Files\Microsoft Works
[2006/04/11 20:37:37 | 000,000,000 | —D | M] – C:\Program Files\Microsoft.NET
[2006/04/21 16:08:49 | 000,000,000 | —D | M] – C:\Program Files\Motherboard Monitor 5
[2005/11/07 14:24:53 | 000,000,000 | —D | M] – C:\Program Files\MOV Converter
[2006/10/20 14:47:31 | 000,000,000 | —D | M] – C:\Program Files\Movie Converter
[2010/03/24 09:11:14 | 000,000,000 | —D | M] – C:\Program Files\Movie Maker
[2010/03/16 19:52:11 | 000,000,000 | —D | M] – C:\Program Files\Moyea
[2010/10/13 08:58:02 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox
[2006/04/11 20:35:03 | 000,000,000 | —D | M] – C:\Program Files\msaccrt
[2009/09/29 08:41:34 | 000,000,000 | —D | M] – C:\Program Files\MSBuild
[2009/02/16 09:44:22 | 000,000,000 | —D | M] – C:\Program Files\MSECache
[2003/04/09 23:14:54 | 000,000,000 | —D | M] – C:\Program Files\MSN Gaming Zone
[2006/11/16 19:02:28 | 000,000,000 | —D | M] – C:\Program Files\MSXML 4.0
[2007/08/15 15:45:55 | 000,000,000 | —D | M] – C:\Program Files\MSXML 6.0
[2006/04/21 08:42:02 | 000,000,000 | —D | M] – C:\Program Files\MultiRes
[2008/07/21 18:13:49 | 000,000,000 | —D | M] – C:\Program Files\Musicmatch
[2006/11/24 16:15:21 | 000,000,000 | —D | M] – C:\Program Files\My Book
[2007/12/18 15:30:38 | 000,000,000 | —D | M] – C:\Program Files\Nero
[2004/09/09 14:25:33 | 000,000,000 | —D | M] – C:\Program Files\NetMeeting
[2003/10/09 16:14:57 | 000,000,000 | —D | M] – C:\Program Files\NFR
[2005/05/26 10:21:51 | 000,000,000 | —D | M] – C:\Program Files\NuRoads2
[2005/08/31 16:20:25 | 000,000,000 | —D | M] – C:\Program Files\OLYMPUS
[2005/10/11 13:40:41 | 000,000,000 | —D | M] – C:\Program Files\OO Software
[2006/09/27 21:36:29 | 000,000,000 | —D | M] – C:\Program Files\Ordix Mpack Pro
[2010/06/09 08:21:43 | 000,000,000 | —D | M] – C:\Program Files\Outlook Express
[2010/05/13 08:16:57 | 000,000,000 | —D | M] – C:\Program Files\Pandora
[2009/02/03 09:31:37 | 000,000,000 | —D | M] – C:\Program Files\PayPal
[2003/04/10 01:33:00 | 000,000,000 | —D | M] – C:\Program Files\PC-Doctor for Windows
[2005/08/31 13:43:44 | 000,000,000 | —D | M] – C:\Program Files\Pinnacle
[2005/08/31 16:19:25 | 000,000,000 | —D | M] – C:\Program Files\PIXELA
[2009/02/23 18:08:56 | 000,000,000 | —D | M] – C:\Program Files\PluginLab
[2005/11/09 16:16:31 | 000,000,000 | —D | M] – C:\Program Files\Plus!
[2005/11/07 14:26:26 | 000,000,000 | —D | M] – C:\Program Files\Poser 4
[2007/12/28 17:44:00 | 000,000,000 | —D | M] – C:\Program Files\pqDVD
[2005/08/31 14:53:58 | 000,000,000 | —D | M] – C:\Program Files\proDAD
[2006/04/07 13:45:51 | 000,000,000 | —D | M] – C:\Program Files\Prolific Publishing, Inc
[2006/03/09 18:31:41 | 000,000,000 | —D | M] – C:\Program Files\PTDD Group
[2005/10/29 14:17:55 | 000,000,000 | —D | M] – C:\Program Files\Quark
[2003/04/10 00:57:16 | 000,000,000 | —D | M] – C:\Program Files\Quicken
[2010/07/09 14:16:00 | 000,000,000 | —D | M] – C:\Program Files\QuickTime
[2006/04/21 08:40:27 | 000,000,000 | —D | M] – C:\Program Files\Radeon Omega Drivers
[2006/04/21 08:19:45 | 000,000,000 | —D | M] – C:\Program Files\Ray Adams
[2006/08/22 08:48:41 | 000,000,000 | —D | M] – C:\Program Files\Real
[2009/09/29 08:41:17 | 000,000,000 | —D | M] – C:\Program Files\Reference Assemblies
[2006/10/20 17:22:32 | 000,000,000 | —D | M] – C:\Program Files\RER MOV Converter
[2010/07/09 13:55:01 | 000,000,000 | —D | M] – C:\Program Files\Safari
[2003/09/04 19:32:30 | 000,000,000 | —D | M] – C:\Program Files\Saitek
[2010/03/17 09:29:16 | 000,000,000 | —D | M] – C:\Program Files\salesforce.com
[2007/07/16 13:18:05 | 000,000,000 | —D | M] – C:\Program Files\Sandisk
[2010/03/25 14:50:40 | 000,000,000 | —D | M] – C:\Program Files\Save Flash
[2010/07/20 17:20:05 | 000,000,000 | —D | M] – C:\Program Files\Siber Systems
[2007/03/04 15:01:55 | 000,000,000 | —D | M] – C:\Program Files\SimCity 4 Startup Manager
[2003/04/10 00:49:39 | 000,000,000 | —D | M] – C:\Program Files\Simple Backup for My Pictures
[2008/06/26 16:33:55 | 000,000,000 | —D | M] – C:\Program Files\SlimServer
[2008/11/23 13:04:08 | 000,000,000 | —D | M] – C:\Program Files\Smartparts
[2005/08/31 13:48:08 | 000,000,000 | —D | M] – C:\Program Files\SmartSound Software
[2003/04/10 05:20:31 | 000,000,000 | —D | M] – C:\Program Files\Softex
[2006/10/24 13:54:12 | 000,000,000 | —D | M] – C:\Program Files\Sonic Foundry
[2008/01/22 15:35:05 | 000,000,000 | —D | M] – C:\Program Files\Sonic Foundry ACID 2.0
[2005/01/11 10:25:01 | 000,000,000 | —D | M] – C:\Program Files\Sonic Foundry MP3 Plug-In
[2006/10/24 09:56:00 | 000,000,000 | —D | M] – C:\Program Files\Sonic Foundry Plug-Ins
[2006/10/24 09:55:15 | 000,000,000 | —D | M] – C:\Program Files\Sonic Foundry Setup
[2010/01/10 10:34:06 | 000,000,000 | —D | M] – C:\Program Files\Sound Forge XP
[2009/04/10 16:57:21 | 000,000,000 | —D | M] – C:\Program Files\SoundSpectrum
[2009/03/18 14:19:24 | 000,000,000 | —D | M] – C:\Program Files\SpeedFan
[2010/10/04 17:13:46 | 000,000,000 | —D | M] – C:\Program Files\Spybot - Search & Destroy
[2009/05/27 09:57:29 | 000,000,000 | —D | M] – C:\Program Files\SpywareDetector
[2009/12/11 11:49:30 | 000,000,000 | —D | M] – C:\Program Files\SQLyog Community
[2010/07/29 19:50:29 | 000,000,000 | —D | M] – C:\Program Files\Squeezebox
[2010/03/30 20:22:07 | 000,000,000 | —D | M] – C:\Program Files\SqueezeCenter
[2009/06/10 15:07:56 | 000,000,000 | —D | M] – C:\Program Files\STOPzilla!
[2010/10/04 17:14:50 | 000,000,000 | —D | M] – C:\Program Files\Sunbelt Software
[2005/10/29 14:11:19 | 000,000,000 | —D | M] – C:\Program Files\Symantec
[2006/04/20 11:44:55 | 000,000,000 | —D | M] – C:\Program Files\SystemBooster2
[2006/09/01 08:20:22 | 000,000,000 | —D | M] – C:\Program Files\The Weather Channel FW
[2007/04/20 14:53:06 | 000,000,000 | —D | M] – C:\Program Files\TOPO!
[2006/12/03 12:56:44 | 000,000,000 | —D | M] – C:\Program Files\TOSHIBA
[2003/12/10 15:19:40 | 000,000,000 | —D | M] – C:\Program Files\Tranquillity
[2008/07/21 20:05:21 | 000,000,000 | —D | M] – C:\Program Files\Trend Micro
[2010/10/14 11:34:34 | 000,000,000 | —D | M] – C:\Program Files\Trillian
[2009/02/12 16:04:12 | 000,000,000 | —D | M] – C:\Program Files\TuneUp Utilities 2006
[2010/07/23 15:14:24 | 000,000,000 | —D | M] – C:\Program Files\TweetDeck
[2004/06/21 12:18:48 | 000,000,000 | —D | M] – C:\Program Files\Ubi Soft
[2005/10/30 15:13:25 | 000,000,000 | -H-D | M] – C:\Program Files\Uninstall Information
[2003/04/10 01:04:00 | 000,000,000 | —D | M] – C:\Program Files\Updates from HP
[2005/11/09 16:36:38 | 000,000,000 | —D | M] – C:\Program Files\vidflash
[2009/06/18 14:34:34 | 000,000,000 | —D | M] – C:\Program Files\ViewBuild Professional
[2009/01/13 18:08:44 | 000,000,000 | —D | M] – C:\Program Files\viewsonic
[2009/02/25 11:55:22 | 000,000,000 | —D | M] – C:\Program Files\Visio
[2007/05/16 10:16:41 | 000,000,000 | —D | M] – C:\Program Files\Vocal Remover
[2009/02/08 10:11:37 | 000,000,000 | —D | M] – C:\Program Files\Western Digital Technologies
[2005/10/30 15:13:43 | 000,000,000 | —D | M] – C:\Program Files\Windows Media Components
[2008/02/13 21:42:34 | 000,000,000 | —D | M] – C:\Program Files\Windows Media Connect 2
[2008/02/13 21:42:29 | 000,000,000 | —D | M] – C:\Program Files\Windows Media Player
[2004/09/09 14:25:25 | 000,000,000 | —D | M] – C:\Program Files\Windows NT
[2007/07/10 07:54:27 | 000,000,000 | -H-D | M] – C:\Program Files\WindowsUpdate
[2007/05/10 13:10:10 | 000,000,000 | —D | M] – C:\Program Files\WinRAR
[2010/08/08 12:35:30 | 000,000,000 | —D | M] – C:\Program Files\WinUnRAR
[2009/12/11 16:55:58 | 000,000,000 | —D | M] – C:\Program Files\WS_FTP Pro
[2003/04/09 23:19:32 | 000,000,000 | —D | M] – C:\Program Files\xerox
[2009/03/26 14:36:12 | 000,000,000 | -H-D | M] – C:\Program Files\Zero G Registry
< %systemroot%\system32\*.tso >
< %ALLUSERSPROFILE%\Documents\Server\*.* >
< %systemroot%\*.pif >
[2002/08/29 06:00:00 | 000,000,707 | —- | M] () – C:\WINDOWS\_default.pif
< %systemroot%\system32\n7533\*.* >
< %systemroot%\Us18336\*.* >
< %systemroot%\system32\*.zip >
< %systemroot%\system32\*.wgo >
< %ProgramFiles%\Microsoft Office\OFFICE11\*.* >
[2007/03/22 19:07:56 | 000,091,488 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\ADDRPARS.DLL
[2007/04/19 14:10:18 | 000,045,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\AUTHZAX.DLL
[2007/03/22 19:29:56 | 000,099,160 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\AW.DLL
[2002/07/29 15:32:10 | 000,073,728 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\BIDI32.DLL
[2007/03/22 19:06:08 | 000,355,168 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\CDLMSO.DLL
[2008/08/11 12:52:46 | 000,080,392 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\DLGSETP.DLL
[2007/03/22 19:23:32 | 000,019,800 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\DSITF.DLL
[2007/05/10 13:44:02 | 000,121,688 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\DSSM.EXE
[2008/01/14 20:51:06 | 000,137,736 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\ENVELOPE.DLL
[2010/06/23 17:14:32 | 010,354,000 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
[2003/03/19 23:23:56 | 000,001,652 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\EXCEL.PIP
[2005/03/01 14:27:48 | 000,247,808 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\EXCHCSP.DLL
[2009/12/11 13:50:58 | 000,079,660 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\EXLPRTID.XML
[2009/06/15 16:43:00 | 000,350,024 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\EXSEC32.DLL
[2007/03/22 19:06:34 | 000,017,248 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\FINDER.EXE
[2007/06/06 12:46:12 | 001,961,312 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\FPCUTL.DLL
[2007/04/19 14:15:26 | 000,192,344 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\FPDTC.DLL
[2009/06/22 21:14:58 | 001,700,168 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\GDIPLUS.DLL
[2007/04/19 13:57:32 | 002,152,792 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\GRAPH.EXE
[1998/12/08 19:53:54 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\HLP95EN.DLL
[2007/04/19 14:10:30 | 000,116,576 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\IEAWSDC.DLL
[2008/02/06 21:33:38 | 000,127,496 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\IMPMAIL.DLL
[2007/03/20 18:35:08 | 000,000,619 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\INTLBAND.HTM
[2007/03/22 19:25:44 | 000,067,424 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\INTLDATE.DLL
[2007/04/19 14:00:16 | 000,103,256 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MCPS.DLL
[2007/12/14 18:46:54 | 000,182,792 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MIMEDIR.DLL
[2007/03/22 19:06:46 | 000,033,120 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MLSHEXT.DLL
[2000/04/03 13:13:40 | 000,003,638 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\MSN.ICO
[2007/04/19 14:10:34 | 000,127,840 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSOAUTH.DLL
[2007/03/22 19:04:52 | 000,109,912 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSOCF.DLL
[2007/03/22 19:04:52 | 000,130,912 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSOCFU.DLL
[2007/03/22 19:29:22 | 000,031,072 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\MSODCW.DLL
[2003/07/14 22:52:58 | 000,067,128 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSOHEV.DLL
[2007/04/19 14:07:38 | 000,061,280 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSOHTMED.EXE
[2007/04/19 14:07:24 | 000,036,192 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSOSTYLE.DLL
[2007/04/19 14:07:32 | 000,045,408 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSOSVFBR.DLL
[2007/03/22 19:08:34 | 000,203,104 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSOUTL.OLB
[2003/04/09 16:20:56 | 000,001,900 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\MSOUTLO.PIP
[2000/11/09 10:49:16 | 001,200,177 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSOWCW.DLL
[2007/03/22 19:05:32 | 000,251,224 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSPPT.OLB
[2007/04/19 14:00:30 | 000,637,792 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSTORDB.EXE
[2007/04/19 14:00:22 | 000,130,912 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSTORE.EXE
[2007/04/19 14:00:30 | 000,489,824 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSTORES.DLL
[2001/01/23 12:41:10 | 000,831,562 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSUSP.DLL
[2007/04/19 14:09:02 | 000,157,024 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSWEBCAP.DLL
[2007/03/22 19:05:50 | 000,668,000 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB
[2003/03/04 16:57:20 | 000,141,952 | —- | M] (Microsoft) – C:\Program Files\Microsoft Office\OFFICE11\MULTIMGR.DLL
[2001/01/29 20:03:26 | 000,090,112 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\MULTIQ.DLL
[2007/04/19 14:10:26 | 000,080,216 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\NAME.DLL
[2001/01/23 11:15:48 | 000,001,696 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISECHS.TXT
[2001/01/23 11:15:48 | 000,001,696 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISECHT.TXT
[2001/01/23 11:15:50 | 000,149,848 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISEDEU.TXT
[2001/01/23 11:15:50 | 000,000,755 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISEENG.TXT
[2001/01/23 11:15:50 | 000,000,755 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISEENU.TXT
[2001/01/23 11:15:50 | 000,019,684 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISEESN.TXT
[2001/01/23 11:15:50 | 000,049,196 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISEFRA.TXT
[2001/01/23 11:15:50 | 000,019,618 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISEITA.TXT
[2001/01/23 11:15:50 | 000,002,060 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISEJPN.TXT
[2001/01/23 11:15:50 | 000,001,486 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISEKOR.TXT
[2001/01/23 11:15:50 | 000,000,745 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISENEU.TXT
[2001/01/23 11:15:50 | 000,013,256 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISENLD.TXT
[2001/01/23 11:15:50 | 000,013,730 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISESVE.TXT
[2001/01/23 11:15:50 | 000,000,697 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\NOISETHA.TXT
[2007/03/22 19:23:30 | 000,017,248 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\NPOFFICE.DLL
[2007/03/22 19:06:22 | 000,287,576 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OIS.EXE
[2003/04/25 17:27:54 | 000,000,420 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\OIS.PIP
[2007/04/19 13:50:52 | 000,837,472 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OISAPP.DLL
[2007/03/22 19:06:08 | 000,046,432 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\oisctrl.dll
[2007/03/22 19:06:22 | 000,245,600 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OISGRAPH.DLL
[2007/11/19 20:38:52 | 000,236,040 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OLKFSTUB.DLL
[2009/12/11 13:50:58 | 000,079,692 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\OLKPRTID.XML
[2007/04/19 14:09:46 | 001,061,720 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OMFC.DLL
[2003/07/12 03:59:46 | 000,016,504 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\OPW11USR.INI
[2007/04/19 13:52:16 | 000,030,560 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OUTLACCT.DLL
[2009/08/05 10:45:04 | 000,106,312 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\OUTLCTL.DLL
[2010/07/29 12:29:38 | 003,609,408 | —- | M] (Microsoft Corp.) – C:\Program Files\Microsoft Office\OFFICE11\OUTLFLTR.DAT
[2005/11/04 13:36:46 | 000,307,440 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OUTLFLTR.DLL
[2010/05/20 15:19:18 | 007,627,608 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OUTLLIB.DLL
[2009/04/10 16:47:34 | 000,102,744 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OUTLMIME.DLL
[2010/05/20 15:19:06 | 000,196,440 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
[2007/11/19 19:38:32 | 000,150,016 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OUTLPH.DLL
[2009/02/09 21:28:22 | 000,066,904 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OUTLRPC.DLL
[2007/04/19 13:52:54 | 000,050,016 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OUTLVBS.DLL
[2007/03/22 19:07:28 | 000,052,576 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OUTLWAB.DLL
[2007/04/19 14:10:32 | 000,648,544 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OWSCLT.DLL
[2007/04/19 14:10:18 | 000,099,680 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\OWSSUPP.DLL
[2010/04/17 00:14:14 | 006,418,776 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE
[2003/03/19 23:23:38 | 000,001,532 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\POWERPOI.PIP
[2009/12/11 13:50:58 | 000,079,716 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\PPTPRTID.XML
[2010/01/14 16:48:00 | 001,790,808 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\PPTVIEW.EXE
[2007/03/22 19:18:32 | 000,116,576 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\PROFLWIZ.EXE
[2007/03/22 19:07:10 | 000,041,824 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\RECALL.DLL
[2003/03/25 11:45:28 | 000,005,974 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\REFBAR.ICO
[2003/03/25 11:45:28 | 000,005,974 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO
[2007/06/06 12:07:40 | 000,100,192 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\REFEDIT.DLL
[2007/04/19 14:10:18 | 000,063,840 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL
[2003/02/19 13:05:30 | 000,108,800 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\REMINDER.WAV
[2002/12/13 23:30:44 | 000,002,664 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\RESETO11.OPS
[2007/03/22 19:09:02 | 000,394,080 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\RTFHTML.DLL
[2007/03/22 19:25:58 | 000,218,456 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\SAEXT.DLL
[2007/03/22 19:07:40 | 000,069,984 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\SENDTO.DLL
[2007/04/19 14:10:20 | 000,065,888 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\SEQCHK10.DLL
[2003/06/02 12:58:08 | 000,262,216 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\SMSW.CHM
[2007/05/10 13:42:52 | 002,839,904 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\STSLIST.DLL
[2007/04/19 14:10:28 | 000,185,696 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\STSUPLD.DLL
[2007/03/22 19:25:44 | 000,079,200 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\UCSCRIBE.DLL
[2002/10/30 12:21:18 | 000,246,424 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\UNICOWS.DLL
[2001/01/23 11:46:56 | 000,013,576 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\USPDAT10.XML
[2001/01/23 11:46:58 | 000,113,911 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\USPMAP.XML
[2001/01/23 11:46:56 | 000,167,035 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\USPTYPES.XML
[2003/04/02 11:21:12 | 000,111,632 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\WAVTOASF.EXE
[2003/01/13 15:04:18 | 000,092,752 | —- | M] (Indicus Pvt. Ltd for Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\WDBIMP.DLL
[2010/06/23 17:07:02 | 012,315,992 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
[2003/06/06 11:25:46 | 000,001,764 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\WORD.PIP
[2002/12/02 15:54:08 | 000,001,532 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\WORDMAIL.PIP
[2009/12/11 13:51:00 | 000,079,676 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\WRDPRTID.XML
[2000/09/27 11:27:48 | 000,053,248 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\WWPAB.CNV
[2000/03/07 22:45:34 | 000,237,568 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\XL5EN32.OLB
[1999/12/09 21:21:30 | 000,032,768 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\XLCALL32.DLL
[2003/05/29 12:22:08 | 000,010,217 | —- | M] () – C:\Program Files\Microsoft Office\OFFICE11\XML2WORD.XSL
< %systemroot%\system32\dllcache\*.com >
< %systemroot%\system32\dllchache\*.* >
< %systemroot%\system32\038840\*.* >
< %systemroot%\system32\13E92A\*.* >
< %systemroot%\system32\1CB5AD\*.* >
< %systemroot%\system32\52682A\*.* >
< %USERPROFILE%\My Documents\*.htm >
[2009/02/28 11:16:55 | 000,600,833 | —- | M] () – C:\Documents and Settings\Owner\My Documents\bookmarks.html
< %SYSTEMDRIVE%\Mr_CF\*.* >
< %USERPROFILE%\My Documents\*.dll >
< %USERPROFILE%\My Documents\*.ccc >
< %systemroot%\system32\Sis\*.* >
< %systemroot%\Microsft\*.* >
< %SYSTEMDRIVE%\driverwinx.exe\*.* >
< %systemroot%\BifroXx\*.* >
< %SYSTEMDRIVE%\TSTP\*.* >
< %systemroot%\winsn\*.* >
< %ProgramFiles%\windata\*.* >
< %SYSTEMDRIVE%\msixxxxxxx.exe\*.* >
< %systemroot%\system32\*.sao >
< %systemroot%\system32\*.iem >
< %systemroot%\system32\*.mdd >
< %systemroot%\system32\*.wlo >
< %systemroot%\system32\*.skn >
< %SYSTEMDRIVE%\Winup\*.* >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-07 14:14:41
========== Alternate Data Streams ==========
@Alternate Data Stream - 60 bytes -> C:\WinZip:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\winzip.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Temporary Items:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Temp:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\sysprep:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\sound32.dll:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\signaturefile.txt:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\signaturefile.rtf:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\signaturefile.doc:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\mmcInst.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\megaScenery.ini:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\megaCITY.ini:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\I386:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\GodWill.txt:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\gateway.asp.htm:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\e_partitiontable.dat:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Download:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\NTUSER.DAT_BAK_86093:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\NTUSER.DAT_BAK_80719:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\NTUSER.DAT_BAK_77487:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\NTUSER.DAT_BAK_10905:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\My Documents\SimCity 4:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\My Documents\Pinnacle Studio:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\My Documents\My Videos:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\My Documents\My Received Files:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\My Documents\My eBooks:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\My Documents\My Albums:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\My Documents\Links 2003:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Owner\My Documents\Flight Simulator Files:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\devicetable.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\DesktopFolderDB:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\debug.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\CWSInstall.exe:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\CONFIG.SYS:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\caavsetup.log:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\AUTOEXEC.BAT:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\ATI:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Archifects:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\6in1ico:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\+ToBurn:AFP_AfpInfo
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B7BEAFF
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F7B65412
< End of report >
Security Check:
Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 2
Out of date service pack!!
Internet Explorer 7
Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
VIPRE Antivirus
```````````````````````````````
Anti-malware/Other Utilities Check:
HijackThis 2.0.2
TuneUp Utilities 2006
Java™ 6 Update 21
Adobe Flash Player 10.1.85.3
Adobe Reader 9.4.0
````````````````````````````````
Process Check:
objlist.exe by Laurent
WinPatrol winpatrol.exe
BillP Studios WinPatrol winpatrol.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)
``````````End of Log````````````
Thanks.
