Trojan or adaware - Mozilla redirect and constantly trying to connect

Hi jdurham05

My name is Blottedisk and I'll be happy to assist you with all your malware problems you have on your computer. Solving any malware-related problem may or may not solve other issues you have with your machine. Before we start fixing your computer, there are a few points you need to know:

• The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then the thread will be locked due to inactivity. However, if you will be away, let us know and we will be sure to keep the thread open.
• Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Options box to the right of your topic title and selecting Track This Topic.. Please don't start a new topic, but reply on this one.
• Malware Logs can sometimes take a lot of time to research and interpret. Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
• If you don't understand something, please ask! If you find any new problems and/or details, please post them!
• Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process. Please do not delete anything unless instructed to. Do not use the comptuer exept for downloading tools and checking this topic
• Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice. This may cause a delay in response time, but I will do my best to keep it as short as possible.

Remember: absence of symptoms does not mean your computer is clean.

Reply to this topic until I say your computer is clean. Please bear with me, I will post back to you as soon as I can.

Thanks

thanks I look forward to your help.

Hi again, sorry for the delay in replying.


Please follow these steps:


Step 1 | Please download GooredFix from one of the locations below and save it to your Desktop

Download Mirror #1
Download Mirror #2

• Ensure all Firefox windows are closed.
• To run the tool, double-click it.
• When prompted to run the scan, click Yes.
• GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

Step 2 | Please download OTL from one of the following mirrors:

This is THE Mirror

——————————————————————–

• Save it to your desktop
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click on Minimal Output at the top
• Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
• Double click inside the Custom Scan box at the bottom
• A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
• Click the OK button and navigate to the file scan.txt which we just saved to your desktop
• Select scan.txt and click Open. Writing will now appear under the Custom Scan box
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in this topic.
• You may need two posts to fit them both in.

Step 3 | Please download Rootkit Unhooker and save it to your Desktop

• Double click on RKUnhookerLE to run it
• Click the Report tab, then click Scan
• Check Drivers, Stealth and uncheck the rest
• Click OK
• Wait until it's finished and then go to File > Save Report
• Save the report to your Desktop
• Copy the entire contents of the report and paste it in a reply here.

Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"


Please post back with the following logs:

GooredFix.txt
OTL.txt
Extras.txt
Rootkit Unhooker log

The only thing I didn't get was the extras.txt as it didn't appear after I did the scan properly. GooredFix by jpshortstuff (03.07.10.1) Log created at 08:36 on 26/10/2010 (Jimmy) Firefox version 3.6.11 (en-US) ========== GooredScan ========== ========== GooredLog ========== C:\Program Files\Mozilla Firefox\extensions\ {972ce4c6-7e08-4474-a285-3208198ce6fd} [21:03 22/08/2009] {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [16:30 11/02/2009] {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [19:21 01/04/2009] {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} [00:22 10/06/2009] C:\Documents and Settings\Jimmy\Application Data\Mozilla\Firefox\Profiles\fqbk8c9u.default\extensions\ {AE93811A-5C9A-4d34-8462-F7B864FC4696} [22:25 15/04/2010] [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [16:29 11/02/2009] "{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [23:19 10/06/2009] -=E.O.F=-

The otl keeps crashing the browser saying that it's resetting I've attached the txt file. Here's the root kit RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #2 ============================================== >Drivers ============================================== 0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2150400 bytes 0x804D7000 RAW 2150400 bytes 0x804D7000 WMIxWDM 2150400 bytes 0xBF800000 Win32k 1855488 bytes 0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xF6009000 C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 1368064 bytes (Intel Corporation, Intel Graphics Miniport Driver) 0xAA599000 C:\WINDOWS\system32\drivers\sthda.sys 1015808 bytes (SigmaTel, Inc., NDRC) 0xAA444000 C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys 1011712 bytes (Conexant Systems, Inc., HSF_DP driver) 0xBF077000 C:\WINDOWS\System32\ialmdd5.DLL 925696 bytes (Intel Corporation, DirectDraw® Driver for Intel® Graphics Technology) 0x9F95C000 C:\WINDOWS\system32\DRIVERS\eamon.sys 770048 bytes (ESET, Amon monitor) 0xAA38E000 C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys 745472 bytes (Conexant Systems, Inc., HSF_CNXT driver) 0xF5F39000 C:\WINDOWS\system32\DRIVERS\bcmwl5.sys 606208 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver) 0xF7372000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xA5D35000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xF5DAD000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xA5F25000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0x9F6BA000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver) 0xF5EB5000 C:\WINDOWS\system32\DRIVERS\rixdptsk.sys 311296 bytes (REDC, RICOH XD SM Driver) 0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0x9EC4E000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xAA53B000 C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys 237568 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver) 0xBF042000 C:\WINDOWS\System32\ialmdev5.DLL 217088 bytes (Intel Corporation, Component GHAL Driver) 0xF5E0B000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector) 0xF5E86000 C:\WINDOWS\system32\DRIVERS\SynTP.sys 192512 bytes (Synaptics, Inc., Synaptics Touchpad Driver) 0xF74CE000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0x9F789000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xF7345000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0x9E838000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer) 0xA5E6D000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xF5FCD000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a) 0xA5EBA000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xF7478000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver) 0xA5EE2000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xAA575000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xF5F15000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0x9F939000 C:\WINDOWS\system32\DRIVERS\epfw.sys 143360 bytes (ESET, ESET Personal Firewall driver) 0xF5E63000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xA5E98000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0xBF020000 C:\WINDOWS\System32\ialmdnt5.dll 139264 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver) 0x806E4000 ACPI_HAL 134400 bytes 0x806E4000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xF7428000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xF749E000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xA5FB1000 C:\WINDOWS\system32\DRIVERS\ehdrv.sys 118784 bytes (ESET, ESET Helper driver) 0xF732B000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xF7460000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0x9FA18000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes 0xF7448000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver) 0x9F562000 C:\WINDOWS\system32\drivers\tmcomm.sys 98304 bytes (Trend Micro Inc., TrendMicro Common Module) 0xF73FF000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xF5E4C000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0x9F8FC000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xF5F01000 C:\WINDOWS\system32\DRIVERS\sdbus.sys 81920 bytes (Microsoft Corporation, SecureDigital Bus Driver) 0xF5FF5000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xA5F08000 C:\WINDOWS\system32\DRIVERS\epfwtdi.sys 77824 bytes (ESET, ESET Personal Firewall TDI filter) 0xA5F7E000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xF7416000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xF74BD000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xF5E3B000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xF76CD000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xF6C8C000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xF6CCC000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager) 0xF760D000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver) 0xA917D000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client) 0xF778D000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xF6C7C000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xA5479000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xF77ED000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xF761D000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver) 0xBF012000 C:\WINDOWS\System32\ialmrnt5.dll 57344 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver) 0xF765D000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xF6CAC000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0xF6C5C000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xF6CBC000 C:\WINDOWS\system32\DRIVERS\rimsptsk.sys 53248 bytes (REDC, RICOH MS Driver) 0xF763D000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xF6CDC000 C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys 49152 bytes (Broadcom Corporation, Broadcom Corporation NDIS 5.1 ethernet driver) 0xF775D000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xF6C6C000 C:\WINDOWS\system32\DRIVERS\Epfwndis.sys 45056 bytes (ESET, ESET Personal Firewall NDIS filter) 0xF76BD000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xF6C9C000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xF762D000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xF6C4C000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xF75FD000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xF6177000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xF777D000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xF764D000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xF774D000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xF776D000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xF769D000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0x9EBAE000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xF766D000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xA918D000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xF788D000 cercsr6.sys 32768 bytes (Adaptec, Inc., DELL CERC SATA1.5/6ch Miniport Driver) 0xF78DD000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver) 0xAA11E000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xF79B5000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xF799D000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0xF787D000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xF79BD000 C:\WINDOWS\system32\DRIVERS\rimmptsk.sys 28672 bytes (REDC, RICOH MMC Driver) 0xF79D5000 C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter) 0xF79CD000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xF79C5000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xF79AD000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xF79A5000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xAA126000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xF7885000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xF79E5000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xF79ED000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xF79DD000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xA0323000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xF7A19000 C:\WINDOWS\system32\DRIVERS\BATTC.SYS 16384 bytes (Microsoft Corporation, Battery Class Driver) 0xF7AB1000 C:\WINDOWS\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0x9F781000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 16384 bytes (Conexant, Diagnostic Interface DRIVER) 0xF7AE1000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xF7AE9000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xAA347000 C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS 16384 bytes (Dell Computer Corporation, OMCI Device Driver) 0xF7A11000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xF7A15000 compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver) 0xA0491000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xF7AC9000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xF5D85000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xF7AAD000 C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 12288 bytes (Microsoft Corporation, Windows Management Interface for ACPI) 0xF7B8B000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xF7AFF000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver) 0xA171B000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes 0xF7B89000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xF7B8D000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xF7B8F000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xF7B41000 C:\WINDOWS\system32\DRIVERS\serscan.sys 8192 bytes (Microsoft Corporation, Serial Imaging Device Driver) 0xF7B43000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xF7B3F000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xF7AFD000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0x86B2D000 C:\WINDOWS\system32\KDCOM.DLL 7040 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xF7D00000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0x9FEC1000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xA83E7000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xF7BC5000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) !!!!!!!!!!!Hidden driver: 0x86ADC298 ?_empty_? 3432 bytes ============================================== >Stealth ============================================== 0xF7460000 WARNING: suspicious driver modification [atapi.sys::0x86ADC298] 0x06550000 Hidden Image–>Act.Interop.SHDocVw.dll [ EPROCESS 0x85A9E580 ] PID: 2828, 135168 bytes 0x03D60000 Hidden Image–>Act.Outlook.Message.Reader.dll [ EPROCESS 0x86068370 ] PID: 2308, 167936 bytes 0x861A7F53 Unknown page with executable code, 173 bytes 0x03E00000 Hidden Image–>msvcm90.dll [ EPROCESS 0x86068370 ] PID: 2308, 270336 bytes 0x07730000 Hidden Image–>System.Transactions.dll [ EPROCESS 0x85FFCB00 ] PID: 2356, 270336 bytes 0x07300000 Hidden Image–>System.Data.dll [ EPROCESS 0x85FFCB00 ] PID: 2356, 2961408 bytes 0x039F0000 Hidden Image–>Act.Outlook.Service.Desktop.dll [ EPROCESS 0x86068370 ] PID: 2308, 307200 bytes 0x06490000 Hidden Image–>Act.UI.InternetExplorer.Plugins.AttachFile.dll [ EPROCESS 0x85A9E580 ] PID: 2828, 36864 bytes 0x86239E44 Unknown page with executable code, 444 bytes 0x86241D66 Unknown page with executable code, 666 bytes

I'm unable to load the OTL file again as the browser keeps crashing; hopefully you can use the txt file I've attached for it. Is this virus or what ever going to be on my other computers on the network? I ask as I get an error that there's a duplicate IP address conflict at certain times?

Hi again,

Thanks for the logs. We'll see that IP issue later. Now please go to the following site to scan a file: Virus Total

• Click on Browse, and upload the following files for analysis:
  
  
  • C:\Documents and Settings\All Users\Application Data\FFFD049189.sys
    C:\WINDOWS\System32\7DF316C31A.sys
    C:\Documents and Settings\Jimmy\Desktop\couponprinter.exe
• Then click Submit. Allow each file to be scanned, and then please copy and paste the results here for me to see.
• If it says already scanned – click "reanalyze now"
• Please post the results in your next reply.
• Note: You will not be able to upload and scan all files at once. You will have to submit and scan each file separately.

After that please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2

——————————————————————–

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  

  :dir
  C:\Documents and Settings\All Users\Application Data /s /n*.sys
  C:\WINDOWS\System32 /s /n*.sys

  
  
• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

C:\Documents and Settings\All Users\Application Data\FFFD049189.sys - it says that no body in the community has reviewed this file. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: FFFD049189.sys Submission date: 2010-10-29 01:51:19 (UTC) Current status: queued (#1) queued analysing finished Result: 0/ 43 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2010.10.29.00 2010.10.28 - AntiVir 7.10.13.67 2010.10.28 - Antiy-AVL 2.0.3.7 2010.10.28 - Authentium 5.2.0.5 2010.10.29 - Avast 4.8.1351.0 2010.10.29 - Avast5 5.0.594.0 2010.10.29 - AVG 9.0.0.851 2010.10.28 - BitDefender 7.2 2010.10.29 - CAT-QuickHeal 11.00 2010.10.26 - ClamAV 0.96.2.0-git 2010.10.28 - Comodo 6544 2010.10.29 - DrWeb 5.0.2.03300 2010.10.29 - Emsisoft 5.0.0.50 2010.10.29 - eSafe 7.0.17.0 2010.10.28 - eTrust-Vet 36.1.7941 2010.10.28 - F-Prot 4.6.2.117 2010.10.28 - F-Secure 9.0.16160.0 2010.10.29 - Fortinet 4.2.249.0 2010.10.28 - GData 21 2010.10.29 - Ikarus T3.1.1.90.0 2010.10.29 - Jiangmin 13.0.900 2010.10.28 - K7AntiVirus 9.67.2856 2010.10.28 - Kaspersky 7.0.0.125 2010.10.29 - McAfee 5.400.0.1158 2010.10.29 - McAfee-GW-Edition 2010.1C 2010.10.28 - Microsoft 1.6301 2010.10.28 - NOD32 5573 2010.10.29 - Norman 6.06.10 2010.10.28 - nProtect 2010-10-28.01 2010.10.28 - Panda 10.0.2.7 2010.10.29 - PCTools 7.0.3.5 2010.10.29 - Prevx 3.0 2010.10.29 - Rising 22.71.02.04 2010.10.28 - Sophos 4.59.0 2010.10.29 - Sunbelt 7161 2010.10.29 - SUPERAntiSpyware 4.40.0.1006 2010.10.29 - Symantec 20101.2.0.161 2010.10.29 - TheHacker 6.7.0.1.073 2010.10.28 - TrendMicro 9.120.0.1004 2010.10.28 - TrendMicro-HouseCall 9.120.0.1004 2010.10.29 - VBA32 3.12.14.1 2010.10.28 - ViRobot 2010.10.25.4110 2010.10.28 - VirusBuster 12.70.10.0 2010.10.28 - Additional information Show all MD5 : 0c7485146fd39e7f5af77ae2e1ae9b8d SHA1 : bf511c8aeea2449a7aef6666838f17205d66a3c8 SHA256: 9818f410f5de186c4fcd5a3baa97a7b18904f1ca34b4cc20ea6833fd3c3f488d ssdeep: 3:hl/VrFiA//AG7n:tFjXR7n File size : 88 bytes First seen: 2010-10-29 01:51:19 Last seen : 2010-10-29 01:51:19 TrID: MS Flight Simulator Aircraft Performance Info (100.0%) sigcheck: publisher….: n/a copyright….: n/a product……: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments…..: n/a signers……: - signing date.: - verified…..: Unsigned VT Community 0 This file has never been reviewed by any VT Community member. Be the first one to comment on it!

C:\WINDOWS\System32\7DF316C31A.sys 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: 7DF316C31A.sys Submission date: 2010-10-29 01:55:48 (UTC) Current status: queued queued analysing finished Result: 0/ 42 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2010.10.29.00 2010.10.28 - AntiVir 7.10.13.67 2010.10.28 - Antiy-AVL 2.0.3.7 2010.10.28 - Authentium 5.2.0.5 2010.10.29 - Avast 4.8.1351.0 2010.10.29 - Avast5 5.0.594.0 2010.10.29 - AVG 9.0.0.851 2010.10.28 - BitDefender 7.2 2010.10.29 - CAT-QuickHeal 11.00 2010.10.26 - ClamAV 0.96.2.0-git 2010.10.28 - Comodo 6544 2010.10.29 - DrWeb 5.0.2.03300 2010.10.29 - Emsisoft 5.0.0.50 2010.10.29 - eSafe 7.0.17.0 2010.10.28 - eTrust-Vet 36.1.7941 2010.10.28 - F-Prot 4.6.2.117 2010.10.28 - F-Secure 9.0.16160.0 2010.10.29 - Fortinet 4.2.249.0 2010.10.28 - GData 21 2010.10.29 - Ikarus T3.1.1.90.0 2010.10.29 - Jiangmin 13.0.900 2010.10.28 - K7AntiVirus 9.67.2856 2010.10.28 - Kaspersky 7.0.0.125 2010.10.29 - McAfee 5.400.0.1158 2010.10.29 - McAfee-GW-Edition 2010.1C 2010.10.28 - Microsoft 1.6301 2010.10.28 - NOD32 5573 2010.10.29 - Norman 6.06.10 2010.10.28 - nProtect 2010-10-28.01 2010.10.28 - Panda 10.0.2.7 2010.10.29 - PCTools 7.0.3.5 2010.10.29 - Prevx 3.0 2010.10.29 - Rising 22.71.02.04 2010.10.28 - Sophos 4.59.0 2010.10.29 - Sunbelt 7161 2010.10.29 - SUPERAntiSpyware 4.40.0.1006 2010.10.29 - Symantec 20101.2.0.161 2010.10.29 - TheHacker 6.7.0.1.073 2010.10.28 - TrendMicro 9.120.0.1004 2010.10.28 - TrendMicro-HouseCall 9.120.0.1004 2010.10.29 - ViRobot 2010.10.25.4110 2010.10.28 - VirusBuster 12.70.10.0 2010.10.28 - Additional information Show all MD5 : e4c0ee0368594ff67a28cb9246f99bbf SHA1 : 12d46d253954339b52161ffbb979edc66d98d643 SHA256: 6f6b1d59c6c563c5c05bf2fda9ff2ed13066b118976ccad0ba545f8c5f955ad5 ssdeep: 3:hl/8mRWDq46l7n:QmwL6lj File size : 88 bytes First seen: 2010-10-29 01:55:48 Last seen : 2010-10-29 01:55:48 TrID: MS Flight Simulator Aircraft Performance Info (100.0%) sigcheck: publisher….: n/a copyright….: n/a product……: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments…..: n/a signers……: - signing date.: - verified…..: Unsigned VT Community 0 This file has never been reviewed by any VT Community member. Be the first one to comment on it!

SystemLook 04.09.10 by jpshortstuff Log created at 19:01 on 28/10/2010 by Jimmy Administrator - Elevation successful ========== dir ========== C:\Documents and Settings\All Users\Application Data - Parameters: "/s /n*.sys" —Files— FFFD049189.sys -r-hs– 88 bytes [01:10 03/03/2010] [01:10 03/03/2010] KGyGaAvL.sys –ahs– 952 bytes [01:10 03/03/2010] [17:20 28/10/2010] C:\Documents and Settings\All Users\Application Data\ACT d—— [03:33 10/03/2007] C:\Documents and Settings\All Users\Application Data\ACT\Act For Windows 12 d—— [01:11 03/03/2010] C:\Documents and Settings\All Users\Application Data\ACT\ACT for Windows 9 d—— [03:33 10/03/2007] C:\Documents and Settings\All Users\Application Data\Adobe d—— [00:37 12/01/2007] C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat d—— [00:37 12/01/2007] C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\7.0 d—— [00:37 12/01/2007] C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\7.0\Replicate d—— [00:37 12/01/2007] C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\7.0\Replicate\Security d—— [00:37 12/01/2007] C:\Documents and Settings\All Users\Application Data\Adobe\Updater5 d—— [03:46 11/08/2007] C:\Documents and Settings\All Users\Application Data\Adobe Systems d—— [04:07 06/10/2006] C:\Documents and Settings\All Users\Application Data\Adobe Systems\Product licenses d—— [04:07 06/10/2006] C:\Documents and Settings\All Users\Application Data\AOL Downloads d—— [07:07 09/01/2007] C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3 d—— [07:07 09/01/2007] C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\html d—— [07:07 09/01/2007] C:\Documents and Settings\All Users\Application Data\Apple d—— [00:21 27/01/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache d—— [00:21 27/01/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 1.1.3.26 d—— [00:21 27/01/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 1.1.4.7 d—— [22:29 19/03/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.0.0.33 d—— [19:26 12/07/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.0.1.5 d—— [06:12 01/08/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.1.0.25 d—— [04:05 17/09/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.1.1.13 d—— [16:37 09/10/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.1.2.7 d—— [15:17 05/12/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.4.0.27 d—— [17:28 12/03/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.4.1.7 d—— [17:32 09/04/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.5.1.3 d—— [15:58 11/06/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.5.2.2 d—— [17:32 16/07/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 2.6.0.32 d—— [02:02 10/09/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 3.0.0.102 d—— [17:34 01/04/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 3.0.1.3 d—— [21:20 13/05/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 3.1.0.62 d—— [19:32 17/06/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Mobile Device Support 3.2.0.47 d—— [17:23 23/09/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Apple Software Update 2.1.1.116 d—— [17:29 07/08/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\AppleApplicationSupport 1.0 d—— [02:05 10/09/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\AppleApplicationSupport 1.0.1 d—— [18:34 12/11/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\AppleApplicationSupport 1.1.0 d—— [19:22 11/02/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\AppleApplicationSupport 1.2.1 d—— [17:32 01/04/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\AppleApplicationSupport 1.3.0 d—— [19:30 17/06/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\AppleApplicationSupport 1.3.1 d—— [18:17 19/08/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\AppleApplicationSupport 1.3.2 d—— [17:22 23/09/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\Bonjour 2.0.3.0 d—— [20:15 30/09/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\iPhone Configuration Utility 2.1.0.163 d—— [17:32 10/09/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 2.1.0.24 d—— [04:15 17/09/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 2.1.1.13 d—— [17:16 09/10/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 2.1.2.7 d—— [21:52 05/12/2008] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 2.3.0.23 d—— [18:46 12/02/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 2.5.0.28 d—— [16:06 11/06/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 2.6.0.29 d—— [02:05 10/09/2009] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 3.0.0.101 d—— [17:38 01/04/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 3.0.1.2 d—— [19:57 20/05/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 3.1.0.14 d—— [17:39 15/07/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 3.1.1.0 d—— [17:50 19/08/2010] C:\Documents and Settings\All Users\Application Data\Apple\Installer Cache\MobileMe 3.1.2.0 d—— [20:11 30/09/2010] C:\Documents and Settings\All Users\Application Data\Apple\Lockdown d—— [19:16 13/06/2009] C:\Documents and Settings\All Users\Application Data\Apple Computer d—— [15:52 06/10/2006] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache d—— [15:53 06/10/2006] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.0.1.22 d—— [20:31 30/09/2010] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.1.0.59 d—— [14:37 14/03/2007] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.1.1.5 d—— [06:20 18/04/2007] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.6.0.29 d—— [00:30 27/01/2008] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.6.1.9 d—— [22:33 19/03/2008] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.6.2.9 d—— [17:42 03/04/2008] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\QuickTime 7.1.5.120 d—— [14:33 14/03/2007] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\QuickTime 7.4.1.14 d—— [22:31 19/03/2008] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\QuickTime 7.4.5.67 d—— [17:34 03/04/2008] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\QuickTime 7.68.75.0 d—— [20:18 30/09/2010] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 3.525.13.0 d—— [22:34 19/03/2008] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 3.525.17.0 d—— [17:30 17/04/2008] C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 3.525.21.0 d—— [19:14 03/07/2008] C:\Documents and Settings\All Users\Application Data\Apple Computer\iTunes d—— [15:53 06/10/2006] C:\Documents and Settings\All Users\Application Data\Apple Computer\iTunes\SC Info d—— [20:33 30/09/2010] C:\Documents and Settings\All Users\Application Data\Apple Computer\QuickTime d—— [15:52 06/10/2006] C:\Documents and Settings\All Users\Application Data\Brother d—— [02:07 11/05/2010] C:\Documents and Settings\All Users\Application Data\Brother\BrLog d—— [02:07 11/05/2010] C:\Documents and Settings\All Users\Application Data\DVD Shrink d—— [04:21 06/10/2006] C:\Documents and Settings\All Users\Application Data\ESET d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Antispam d—— [17:48 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Charon d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Installer d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Logs d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Logs\eScan d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Oldfiles d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Stats d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\SupportRequests d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles d—— [17:47 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\base_nonnups d—— [13:47 19/04/2010] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\continuous d—— [17:57 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_62.67.184.68 d—— [18:55 20/03/2010] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_89.202.149.36 d—— [18:49 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_89.202.157.227 d—— [20:49 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_90.183.101.10 d—— [04:39 06/03/2010] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_93.184.71.27 d—— [17:49 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u40.eset.com d—— [18:11 09/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u41.eset.com d—— [17:50 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u42.eset.com d—— [08:38 03/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u43.eset.com d—— [01:38 03/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u44.eset.com d—— [18:38 02/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u45.eset.com d—— [17:49 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u46.eset.com d—— [04:38 02/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u47.eset.com d—— [04:07 04/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u48.eset.com d—— [21:38 01/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u49.eset.com d—— [14:38 01/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u50.eset.com d—— [05:11 09/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u51.eset.com d—— [09:38 03/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u52.eset.com d—— [02:38 03/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u53.eset.com d—— [19:38 02/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u54.eset.com d—— [12:38 02/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u55.eset.com d—— [05:38 02/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u56.eset.com d—— [22:38 01/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u57.eset.com d—— [15:38 01/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u58.eset.com d—— [08:38 01/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_u59.eset.com d—— [23:08 04/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_um10.eset.com d—— [00:38 01/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_um12.eset.com d—— [17:50 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_um14.eset.com d—— [17:52 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_um16.eset.com d—— [16:04 22/09/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_um18.eset.com d—— [01:18 16/03/2010] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\http_update.eset.com d—— [14:07 14/08/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\oldfiles d—— [17:57 31/07/2009] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\reverse d—— [13:47 19/04/2010] C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles\temp d—— [17:57 31/07/2009] C:\Documents and Settings\All Users\Application Data\FLEXnet d—— [20:19 24/07/2008] C:\Documents and Settings\All Users\Application Data\FLEXnetold d—— [03:30 11/08/2007] C:\Documents and Settings\All Users\Application Data\Google d—— [16:56 18/10/2006] C:\Documents and Settings\All Users\Application Data\Google\Custom Buttons d—— [16:56 18/10/2006] C:\Documents and Settings\All Users\Application Data\Google\Google Toolbar d—— [15:32 12/03/2009] C:\Documents and Settings\All Users\Application Data\Google\Google Toolbar\Component d—— [15:32 12/03/2009] C:\Documents and Settings\All Users\Application Data\Google\Google Toolbar\Update d—— [19:40 24/06/2010] C:\Documents and Settings\All Users\Application Data\HotSync d—— [19:35 09/10/2006] C:\Documents and Settings\All Users\Application Data\HotSync\Conduits d—— [19:35 09/10/2006] C:\Documents and Settings\All Users\Application Data\InstallShield d—— [19:37 11/05/2010] C:\Documents and Settings\All Users\Application Data\InstallShield\UpdateService d—— [19:37 11/05/2010] C:\Documents and Settings\All Users\Application Data\InstallShield\UpdateService\Database d—— [19:37 11/05/2010] C:\Documents and Settings\All Users\Application Data\Lavasoft d—— [18:02 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware d—— [18:02 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update d—— [18:02 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\backup d—— [18:02 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\backup\Help d—— [18:07 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\backup\Lang d—— [18:07 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\new d—— [18:02 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\new\Help d—— [18:07 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\new\Lang d—— [18:07 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\License d—— [18:03 25/09/2008] C:\Documents and Settings\All Users\Application Data\Lavasoft\MiniMessage d—— [18:09 25/09/2008] C:\Documents and Settings\All Users\Application Data\LogiShrd d—— [21:33 02/04/2009] C:\Documents and Settings\All Users\Application Data\LogiShrd\Unifying d—— [17:35 22/09/2009] C:\Documents and Settings\All Users\Application Data\LogiShrd\Unifying\Firmware d—— [17:35 22/09/2009] C:\Documents and Settings\All Users\Application Data\LogiShrd\Updater d—— [21:33 02/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Audio d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Audio\5000001 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000001 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000002 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000003 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000004 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000005 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000006 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000006\hbmps d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000007 d—— [17:32 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000008 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\4000009 d—— [17:32 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\400000A d—— [17:32 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\400000A\hbmps d—— [17:32 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\400000C d—— [17:32 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Display\400000D d—— [17:32 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200000F d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000027 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000028 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000029 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200002A d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200002B d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200002C d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200002D d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200002E d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200002F d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000031 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000032 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000033 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000034 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000035 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000036 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000037 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000038 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000039 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200003a d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200003b d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200003C d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200004C d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200004D d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200004E d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000050 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000051 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000052 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000053 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000054 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000055 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000056 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000057 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000058 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200005A d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200005B d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200005C d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200005D d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200005E d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200005F d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000060 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000061 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000062 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000063 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000064 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000065 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000066 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000067 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000068 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\2000069 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200006A d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200006B d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200006C d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200006D d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200006E d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\200006F d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\AresFamily d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\CommonIcons d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Keyboard\generic d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100000F d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000010 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000016 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000017 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100001F d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000020 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000037 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000038 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000039 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100003A d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100003B d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100003C d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100003D d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100003E d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100003F d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000040 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000041 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000042 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000043 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000044 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000045 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000046 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000047 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000048 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000049 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100004A d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100004B d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100004C d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100004D d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100004E d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100004F d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000050 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000051 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000052 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000053 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000054 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000055 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000056 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000057 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000058 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000059 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100005A d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100005B d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100005C d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100005D d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100005e d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100005F d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000060 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000061 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000062 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000063 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000064 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000065 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000067 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000068 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000069 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100006A d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100006B d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100006C d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100006D d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100006E d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100006F d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000070 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000071 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000072 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000073 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000074 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000075 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000076 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000077 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000078 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000079 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100007A d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100007B d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100007C d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100007D d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100007E d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100007F d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000080 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000081 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000082 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000083 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000085 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000086 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000087 d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000088 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000089 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100008A d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100008B d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100008c d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100008D d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100008e d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100008f d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000090 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000091 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000092 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000093 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000094 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000095 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000096 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000097 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000098 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\1000099 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100009A d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100009B d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100009C d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100009D d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100009E d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\100009F d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\10000A0 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\10000A1 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\10000A2 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\10000A3 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\10000A4 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\10000A5 d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\AddaxFamily d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\Duke Familly d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\ElFamily d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\generic d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\GomeraFamily d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\MMY101 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\MombasaFamily d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\moutonFamily d—— [17:33 22/09/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\MX8ButtonFamily d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\M_S69 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\ROEM_SantaFeFamily d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\SantaFeFamily d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\smtraFamily d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\PointingDevice\TaosFamily d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver d—— [17:54 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver\3000000 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver\3000009 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver\3000013 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver\3000014 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver\3000015 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver\3000016 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver\3000017 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver\3000018 d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Logitech\SetPoint\Devices\Receiver\300001A d—— [17:55 16/04/2009] C:\Documents and Settings\All Users\Application Data\Malwarebytes d—— [18:09 11/04/2009] C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware d—— [18:09 11/04/2009] C:\Documents and Settings\All Users\Application Data\Maxtor d—— [23:36 27/04/2009] C:\Documents and Settings\All Users\Application Data\Maxtor\MSS d—— [23:36 27/04/2009] C:\Documents and Settings\All Users\Application Data\Maxtor\MSS\log d—— [18:27 28/04/2009] C:\Documents and Settings\All Users\Application Data\McAfee.com d—— [01:02 06/10/2006] C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent d—— [01:03 06/10/2006] C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache d—— [01:03 06/10/2006] C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\RegWiz d—— [01:03 06/10/2006] C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\RegWiz\RegApp d—— [01:03 06/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft d—s– [16:36 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto d—s– [16:36 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\DSS d—s– [16:36 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\DSS\MachineKeys d—s– [16:36 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA d—s– [16:36 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys d—s– [16:36 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18 d—s– [00:00 06/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson d—— [00:08 06/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\HTML Help d—— [23:51 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL d—— [23:33 10/12/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production d—— [23:33 10/12/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp d—— [23:33 10/12/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\Machine Debug Manager d—— [03:32 06/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Media Index d—— [23:50 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Media Player d—— [23:50 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\MSDAIPP d—— [03:46 17/08/2010] C:\Documents and Settings\All Users\Application Data\Microsoft\MSDAIPP\OFFLINE d—— [03:46 17/08/2010] C:\Documents and Settings\All Users\Application Data\Microsoft\Mse d—— [19:13 07/05/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\Mse\1033 d—— [19:13 07/05/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\Network d—— [23:44 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections d—— [23:44 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm d—— [23:44 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk d—— [23:44 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader d—— [01:07 06/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE d—— [03:27 06/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA d—— [03:27 06/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Provisioning d—— [00:25 06/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures d—— [23:48 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures d—— [23:48 05/10/2006] C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT d—— [22:18 20/07/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax d—— [22:18 20/07/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog d—— [22:18 20/07/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages d—— [22:18 20/07/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\Inbox d—— [22:18 20/07/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\Queue d–hs– [22:18 20/07/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\SentItems d—— [22:18 20/07/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\WLSetup d—— [23:34 10/12/2009] C:\Documents and Settings\All Users\Application Data\Microsoft\WLSetup\Logs d—— [23:34 10/12/2009] C:\Documents and Settings\All Users\Application Data\Nero d—— [02:22 23/12/2006] C:\Documents and Settings\All Users\Application Data\Nero\DrWeb d—— [02:22 23/12/2006] C:\Documents and Settings\All Users\Application Data\NOS d—— [13:57 17/09/2009] C:\Documents and Settings\All Users\Application Data\NOS\Adobe_Downloads d—— [13:58 17/09/2009] C:\Documents and Settings\All Users\Application Data\Sage Software SB, Inc d—— [17:55 12/04/2007] C:\Documents and Settings\All Users\Application Data\Sage Software SB, Inc\ACT! d—— [17:55 12/04/2007] C:\Documents and Settings\All Users\Application Data\Sage Software SB, Inc\ACT!\9.0.557.0 d—— [17:55 12/04/2007] C:\Documents and Settings\All Users\Application Data\Sage Software SB, Inc\ACT!\9.1.162.0 d—— [18:18 12/04/2007] C:\Documents and Settings\All Users\Application Data\Sage Software SB, Inc\ACT!\ActUpdate d–h— [17:55 12/04/2007] C:\Documents and Settings\All Users\Application Data\Sage Software SB, Inc\ACT!\ActUpdate_9948 d–h— [19:03 25/07/2009] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc d—— [00:52 03/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage d—— [23:15 03/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0 d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Activities d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Activities\Activity_Series d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Activities\Alarms d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Activities\Annual_Events d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Activities\Clearing_and_history d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Activities\Manage_Activities d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Activities\Scheduling d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Activities\Task_List d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Calendars d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Communications d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Communications\Documents Tab d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Communications\Fax d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Communications\Word_processor d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Communications\Word_processor\Documents d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Communications\Word_processor\Documents\Editing_and_formatting d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Communications\Word_processor\MSWord menu d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Communications\Word_processor\Options d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Communications\Word_processor\Templates d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Companies d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Contacts d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Custom for efficiency d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Custom for efficiency\Columns d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Custom for efficiency\Shortcut keys d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Custom for efficiency\Tools and menu commands d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data\Define fields d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data\Designing layouts d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data\Designing layouts and reports d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data\Designing layouts and reports\Control properties layout d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data\Designing layouts and reports\Control properties layout\A-C d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data\Designing layouts and reports\Control properties layout\D-H d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data\Designing layouts and reports\Control properties layout\I-O d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data\Designing layouts and reports\Control properties layout\P-Z d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Customizing data\Designing reports d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Dashboard d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Databases d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Dialer d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Email d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Getting_Started d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Graphics d—— [21:33 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Groups d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Import_Export d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Installation d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Internet d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Lookups d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Notes_Histories d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Opportunities d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Outlook d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Outlook\Outlook_Calendar d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Outlook\Outlook_Email d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Preferences d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Printing d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Reports d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Resources d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Resources\Images d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Resources\Snippets d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Resources\Stylesheets d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Resources\TableStyles d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Scenarios d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Scheduler d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Security d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Shared Tasks d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\SkinSupport d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Spelling_check d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\Synchronization d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Content\User_Teams d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Data d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Data\SkinWebHelp d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Skin d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\12.1.181.0\WebHelp\Skin\Images d—— [21:34 29/03/2010] C:\Documents and Settings\All Users\Application Data\Sage Software, Inc\ACT! by Sage\ActUpdate d–h— [21:20 29/03/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft d—— [19:34 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort d—— [19:34 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11 d—— [19:34 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config d—— [19:34 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg d—— [19:37 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\FolderCache d—— [19:34 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\FolderCache\Cache0 d—— [19:34 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Data d—— [19:34 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\ptdspool d—— [19:34 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\SSBkgdUpdate d—— [19:34 11/05/2010] C:\Documents and Settings\All Users\Application Data\ScanSoft\Swizard d—— [19:37 11/05/2010] C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy d—— [15:55 12/01/2007] C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Backups d—— [20:23 25/09/2008] C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes d—— [19:57 25/09/2008] C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs d—— [15:56 12/01/2007] C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery d—— [15:56 12/01/2007] C:\Documents and Settings\All Users\Application Data\Symantec d—— [22:33 17/05/2007] C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP d—— [16:18 03/06/2008] C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\Quarantine d—— [01:23 04/06/2008] C:\Documents and Settings\All Users\Application Data\Symantec\SubEng d—— [15:12 02/09/2008] C:\Documents and Settings\All Users\Application Data\Trend Micro d—— [02:19 06/10/2006] C:\Documents and Settings\All Users\Application Data\Trend Micro\PC-cillin d—— [02:19 06/10/2006] C:\Documents and Settings\All Users\Application Data\Trend Micro\PC-cillin\log d—— [02:19 06/10/2006] C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage d—— [01:32 10/10/2006] C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data d—— [01:32 10/10/2006] C:\Documents and Settings\All Users\Application Data\Zeon d—— [15:48 17/08/2010] C:\Documents and Settings\All Users\Application Data\Zeon\DocuCom d—— [15:48 17/08/2010] C:\Documents and Settings\All Users\Application Data\Zeon\DocuCom\ZNSL d—— [15:48 17/08/2010] C:\Documents and Settings\All Users\Application Data\ZoomBrowser d—— [23:16 25/11/2008] C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3} d—— [17:39 12/03/2009] C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}\x86 d—— [17:39 12/03/2009] C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} d—— [17:51 01/04/2010] C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86 d—— [17:55 01/04/2010] C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\x86 d—— [20:33 30/09/2010] GEARAspiWDM.sys –a—- 26600 bytes [20:17 18/05/2009] [20:17 18/05/2009] C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} d—— [02:23 10/09/2009] C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86 d—— [02:26 10/09/2009] C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} d—— [17:46 09/04/2009] C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86 d—— [17:47 09/04/2009] C:\WINDOWS\System32 - Parameters: "/s /n*.sys" —Files— 7DF316C31A.sys -r-hs– 88 bytes [03:44 10/03/2007] [23:27 14/03/2007] ansi.sys –a—- 9029 bytes [12:00 04/08/2004] [12:00 04/08/2004] country.sys –a—- 27097 bytes [12:00 04/08/2004] [12:00 04/08/2004] himem.sys –a—- 4768 bytes [12:00 04/08/2004] [12:00 04/08/2004] key01.sys –a—- 42809 bytes [12:00 04/08/2004] [12:00 04/08/2004] keyboard.sys –a—- 42537 bytes [12:00 04/08/2004] [12:00 04/08/2004] KGyGaAvL.sys –ahs– 1890 bytes [03:44 10/03/2007] [00:28 03/03/2010] ntdos.sys –a—- 27866 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntdos404.sys –a—- 29146 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntdos411.sys –a—- 29370 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntdos412.sys –a—- 29274 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntdos804.sys –a—- 29146 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio.sys –a—- 33840 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio404.sys –a—- 34560 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio411.sys –a—- 35648 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio412.sys –a—- 35424 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio804.sys –a—- 34560 bytes [12:00 04/08/2004] [12:00 04/08/2004] watchdog.sys –a—- 17664 bytes [12:00 04/08/2004] [18:44 13/04/2008] win32k.sys –a—- 1851904 bytes [12:00 04/08/2004] [13:44 23/06/2010] C:\WINDOWS\System32\1025 d—— [16:27 05/10/2006] C:\WINDOWS\System32\1028 d—— [16:27 05/10/2006] C:\WINDOWS\System32\1031 d—— [16:27 05/10/2006] C:\WINDOWS\System32\1033 d—— [16:27 05/10/2006] C:\WINDOWS\System32\1037 d—— [16:27 05/10/2006] C:\WINDOWS\System32\1041 d—— [16:27 05/10/2006] C:\WINDOWS\System32\1042 d—— [16:27 05/10/2006] C:\WINDOWS\System32\1054 d—— [16:27 05/10/2006] C:\WINDOWS\System32\2052 d—— [16:27 05/10/2006] C:\WINDOWS\System32\3076 d—— [16:27 05/10/2006] C:\WINDOWS\System32\3com_dmi d—— [16:27 05/10/2006] C:\WINDOWS\System32\appmgmt d—— [04:59 06/10/2006] C:\WINDOWS\System32\appmgmt\MACHINE d—s– [04:59 06/10/2006] C:\WINDOWS\System32\appmgmt\S-1-5-21-1708537768-1637723038-839522115-1003 d—s– [04:59 06/10/2006] C:\WINDOWS\System32\bits d—— [22:17 25/09/2008] C:\WINDOWS\System32\CatRoot d—— [16:36 05/10/2006] C:\WINDOWS\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE} d—— [16:36 05/10/2006] C:\WINDOWS\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} d—— [16:36 05/10/2006] C:\WINDOWS\System32\CatRoot2 d—— [16:36 05/10/2006] C:\WINDOWS\System32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE} d—— [16:36 05/10/2006] C:\WINDOWS\System32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} d—— [16:36 05/10/2006] C:\WINDOWS\System32\Com d—— [23:46 05/10/2006] C:\WINDOWS\System32\config d—— [16:27 05/10/2006] C:\WINDOWS\System32\config\systemprofile d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data dr-h— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft d—s– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache d—s– [03:59 06/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content d—s– [03:59 06/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData d—s– [03:59 06/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\Internet Explorer d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\Media Player d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\SystemCertificates d—s– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My d—s– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates d—s– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs d—s– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs d—s– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Cookies d–hs– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Desktop d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Favorites d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings dr-h— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\Application Data d–h— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\Application Data\Microsoft d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\Application Data\Microsoft\CD Burning d—— [03:02 06/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Media Player d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\Application Data\Microsoft\OFFICE d—— [16:22 19/11/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0 d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\History d–hs– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\History\History.IE5 d–hs– [00:00 06/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008092520080926 d–hs– [22:33 25/09/2008] C:\WINDOWS\System32\config\systemprofile\Local Settings\temp d—— [00:02 10/06/2009] C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files d–hs– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5 d–hs– [22:46 12/10/2010] C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\P29ZR73S d–hs– [22:46 12/10/2010] C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\QNZ02570 d–hs– [22:46 12/10/2010] C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SEA8E8T8 d–hs– [22:46 12/10/2010] C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\VJ03BX1Z d–hs– [22:46 12/10/2010] C:\WINDOWS\System32\config\systemprofile\My Documents d—— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\NetHood d–h— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\PrintHood d–h— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Recent d–h— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\SendTo dr-h— [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Start Menu dr—– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Start Menu\Programs dr—– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Start Menu\Programs\Accessories dr—– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Start Menu\Programs\Accessories\Accessibility dr—– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Start Menu\Programs\Accessories\Entertainment dr—– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Start Menu\Programs\Startup dr—– [23:53 05/10/2006] C:\WINDOWS\System32\config\systemprofile\Templates d–h— [23:53 05/10/2006] C:\WINDOWS\System32\dhcp d—— [16:27 05/10/2006] C:\WINDOWS\System32\DirectX d—— [23:49 05/10/2006] C:\WINDOWS\System32\DirectX\Dinput d—— [23:49 05/10/2006] C:\WINDOWS\System32\dllcache dr-hsc- [16:27 05/10/2006] afd.sys —–c- 138496 bytes [11:40 20/06/2008] [10:04 14/08/2008] ansi.sys –a–c- 9029 bytes [12:00 04/08/2004] [12:00 04/08/2004] atmepvc.sys –a–c- 31360 bytes [12:00 04/08/2004] [12:00 04/08/2004] atmuni.sys –a–c- 352256 bytes [12:00 04/08/2004] [12:00 04/08/2004] beep.sys –a–c- 4224 bytes [12:00 04/08/2004] [12:00 04/08/2004] bthport.sys —–c- 272128 bytes [20:55 10/06/2008] [11:05 13/06/2008] cap7146.sys –a–c- 54528 bytes [23:51 05/10/2006] [12:00 04/08/2004] country.sys –a–c- 27097 bytes [12:00 04/08/2004] [12:00 04/08/2004] dmload.sys –a–c- 5888 bytes [12:00 04/08/2004] [12:00 04/08/2004] dxapi.sys –a–c- 10496 bytes [12:00 04/08/2004] [12:00 04/08/2004] dxgthk.sys –a–c- 3328 bytes [12:00 04/08/2004] [12:00 04/08/2004] et4000.sys –a–c- 25856 bytes [23:51 05/10/2006] [12:00 04/08/2004] fs_rec.sys –a–c- 7936 bytes [12:00 04/08/2004] [12:00 04/08/2004] hidusb.sys –a–c- 10368 bytes [21:30 02/04/2009] [18:45 13/04/2008] himem.sys –a–c- 4768 bytes [12:00 04/08/2004] [12:00 04/08/2004] http.sys —–c- 265728 bytes [16:20 20/10/2009] [16:20 20/10/2009] ipfltdrv.sys –a–c- 32896 bytes [12:00 04/08/2004] [12:00 04/08/2004] kbdclass.sys –a–c- 24576 bytes [12:00 04/08/2004] [18:39 13/04/2008] kbdhid.sys –a–c- 14592 bytes [21:30 02/04/2009] [18:39 13/04/2008] key01.sys –a–c- 42809 bytes [12:00 04/08/2004] [12:00 04/08/2004] keyboard.sys –a–c- 42537 bytes [12:00 04/08/2004] [12:00 04/08/2004] ksecdd.sys —–c- 92928 bytes [11:18 24/06/2009] [11:18 24/06/2009] mcd.sys –a–c- 7680 bytes [12:00 04/08/2004] [12:00 04/08/2004] mga.sys –a–c- 92416 bytes [23:52 05/10/2006] [12:00 04/08/2004] mnmdd.sys –a–c- 4224 bytes [12:00 04/08/2004] [12:00 04/08/2004] mouclass.sys –a–c- 23040 bytes [22:58 03/08/2004] [18:39 13/04/2008] mouhid.sys –a–c- 12160 bytes [21:30 02/04/2009] [20:48 17/08/2001] mrxsmb.sys —–c- 455680 bytes [00:50 12/11/2008] [13:11 24/02/2010] ntdos.sys –a–c- 27866 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntdos404.sys –a–c- 29146 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntdos411.sys –a–c- 29370 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntdos412.sys –a–c- 29274 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntdos804.sys –a–c- 29146 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio.sys –a–c- 33840 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio404.sys –a–c- 34560 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio411.sys –a–c- 35648 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio412.sys –a–c- 35424 bytes [12:00 04/08/2004] [12:00 04/08/2004] ntio804.sys –a–c- 34560 bytes [12:00 04/08/2004] [12:00 04/08/2004] null.sys –a–c- 2944 bytes [12:00 04/08/2004] [12:00 04/08/2004] nwlnkflt.sys –a–c- 12416 bytes [12:00 04/08/2004] [12:00 04/08/2004] nwlnkfwd.sys –a–c- 32512 bytes [12:00 04/08/2004] [12:00 04/08/2004] nwlnknb.sys –a–c- 63232 bytes [12:00 04/08/2004] [12:00 04/08/2004] nwlnkspx.sys –a–c- 55936 bytes [12:00 04/08/2004] [12:00 04/08/2004] parvdm.sys –a–c- 6784 bytes [12:00 04/08/2004] [12:00 04/08/2004] pciide.sys –a–c- 3328 bytes [12:00 04/08/2004] [20:51 17/08/2001] ptilink.sys –a–c- 17792 bytes [12:00 04/08/2004] [12:00 04/08/2004] rasacd.sys –a–c- 8832 bytes [12:00 04/08/2004] [12:00 04/08/2004] raspti.sys –a–c- 16512 bytes [12:00 04/08/2004] [12:00 04/08/2004] rawwan.sys –a–c- 34432 bytes [12:00 04/08/2004] [12:00 04/08/2004] rdpcdd.sys –a–c- 4224 bytes [12:00 04/08/2004] [12:00 04/08/2004] rmcast.sys —–c- 203136 bytes [20:55 10/06/2008] [14:02 08/05/2008] rootmdm.sys –a–c- 5888 bytes [12:00 04/08/2004] [12:00 04/08/2004] serscan.sys –a–c- 6784 bytes [02:24 11/05/2010] [20:53 17/08/2001] smclib.sys –a–c- 14592 bytes [12:00 04/08/2004] [12:00 04/08/2004] srv.sys —–c- 354304 bytes [14:14 15/10/2008] [15:27 21/06/2010] tcpip.sys —–c- 361600 bytes [11:51 20/06/2008] [11:51 20/06/2008] tcpip6.sys —–c- 226880 bytes [11:08 20/06/2008] [12:02 11/02/2010] tdasync.sys –a–c- 13192 bytes [23:53 05/10/2006] [12:00 04/08/2004] tdipx.sys –a–c- 21896 bytes [23:53 05/10/2006] [12:00 04/08/2004] tdspx.sys –a–c- 19464 bytes [23:53 05/10/2006] [12:00 04/08/2004] usbccgp.sys –a–c- 32128 bytes [21:30 02/04/2009] [18:45 13/04/2008] weitekp9.sys –a–c- 31232 bytes [23:53 05/10/2006] [12:00 04/08/2004] win32k.sys —–c- 1851904 bytes [14:13 15/10/2008] [13:44 23/06/2010] wmiacpi.sys –a–c- 8832 bytes [21:15 27/06/2007] [18:36 13/04/2008] wmilib.sys –a–c- 4352 bytes [12:00 04/08/2004] [12:00 04/08/2004] ws2ifsl.sys –a–c- 12032 bytes [12:00 04/08/2004] [12:00 04/08/2004] C:\WINDOWS\System32\drivers d—— [16:27 05/10/2006] 1394bus.sys –a—- 53376 bytes [12:00 04/08/2004] [18:46 13/04/2008] acpi.sys –a—- 187776 bytes [12:00 04/08/2004] [18:36 13/04/2008] acpiec.sys –a—- 11648 bytes [12:00 04/08/2004] [12:00 04/08/2004] aec.sys –a—- 142592 bytes [00:08 06/10/2006] [16:39 13/04/2008] afd.sys –a—- 138496 bytes [12:00 04/08/2004] [10:04 14/08/2008] agp440.sys ——- 42368 bytes [10:47 29/08/2008] [18:36 13/04/2008] agpcpq.sys ——- 44928 bytes [10:47 29/08/2008] [18:36 13/04/2008] alim1541.sys ——- 42752 bytes [10:47 29/08/2008] [18:36 13/04/2008] amdagp.sys ——- 43008 bytes [10:47 29/08/2008] [18:36 13/04/2008] amdk6.sys –a—- 37376 bytes [22:59 03/08/2004] [18:31 13/04/2008] amdk7.sys –a—- 37760 bytes [22:59 03/08/2004] [18:31 13/04/2008] arp1394.sys –a—- 60800 bytes [22:58 03/08/2004] [18:51 13/04/2008] asyncmac.sys –a—- 14336 bytes [12:00 04/08/2004] [18:57 13/04/2008] atapi.sys –a—- 96512 bytes [12:00 04/08/2004] [18:40 13/04/2008] ati1btxx.sys ——- 56623 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati1mdxx.sys ——- 11615 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati1pdxx.sys ——- 12047 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati1raxx.sys ——- 30671 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati1rvxx.sys ——- 63663 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati1snxx.sys ——- 26367 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati1ttxx.sys ——- 21343 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati1tuxx.sys ——- 36463 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati1xbxx.sys ——- 29455 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati1xsxx.sys ——- 34735 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati2mtaa.sys ——- 327040 bytes [10:48 29/08/2008] [05:29 04/08/2004] ati2mtag.sys ——- 701440 bytes [10:48 29/08/2008] [05:29 04/08/2004] atinbtxx.sys ——- 57856 bytes [10:48 29/08/2008] [05:29 04/08/2004] atinmdxx.sys ——- 13824 bytes [10:48 29/08/2008] [05:29 04/08/2004] atinpdxx.sys ——- 14336 bytes [10:48 29/08/2008] [05:29 04/08/2004] atinraxx.sys ——- 52224 bytes [10:48 29/08/2008] [05:29 04/08/2004] atinrvxx.sys ——- 104960 bytes [10:48 29/08/2008] [05:29 04/08/2004] atinsnxx.sys ——- 28672 bytes [10:48 29/08/2008] [05:29 04/08/2004] atinttxx.sys ——- 13824 bytes [10:48 29/08/2008] [05:29 04/08/2004] atintuxx.sys ——- 73216 bytes [10:48 29/08/2008] [05:29 04/08/2004] atinxbxx.sys ——- 31744 bytes [10:48 29/08/2008] [05:29 04/08/2004] atinxsxx.sys ——- 63488 bytes [10:48 29/08/2008] [05:29 04/08/2004] atmarpc.sys –a—- 59904 bytes [12:00 04/08/2004] [18:51 13/04/2008] atmepvc.sys –a—- 31360 bytes [12:00 04/08/2004] [12:00 04/08/2004] atmlane.sys –a—- 55808 bytes [12:00 04/08/2004] [18:51 13/04/2008] atmuni.sys –a—- 352256 bytes [12:00 04/08/2004] [12:00 04/08/2004] audstub.sys –a—- 3072 bytes [16:40 05/10/2006] [13:59 17/08/2001] battc.sys –a—- 14208 bytes [16:38 05/10/2006] [18:36 13/04/2008] bcm4sbxp.sys –a—- 45312 bytes [18:32 05/08/2005] [18:32 05/08/2005] BCMWL5.SYS –a—- 604928 bytes [00:25 06/10/2006] [06:28 13/10/2006] BCMWLNPF.SYS –a—- 33664 bytes [00:19 05/05/2010] [03:48 02/11/2006] beep.sys –a—- 4224 bytes [12:00 04/08/2004] [12:00 04/08/2004] bridge.sys –a—- 71552 bytes [12:00 04/08/2004] [18:53 13/04/2008] bthenum.sys ——- 17024 bytes [10:48 29/08/2008] [18:46 13/04/2008] bthmodem.sys ——- 37888 bytes [10:48 29/08/2008] [18:46 13/04/2008] bthpan.sys ——- 101120 bytes [10:48 29/08/2008] [18:51 13/04/2008] bthport.sys ——- 272128 bytes [20:55 10/06/2008] [11:05 13/06/2008] bthprint.sys ——- 36480 bytes [10:48 29/08/2008] [18:46 13/04/2008] bthusb.sys ——- 18944 bytes [10:48 29/08/2008] [18:46 13/04/2008] cbidf2k.sys –a—- 13952 bytes [12:00 04/08/2004] [12:00 04/08/2004] cdaudio.sys –a—- 18688 bytes [13:52 17/08/2001] [12:00 04/08/2004] cdfs.sys –a—- 63744 bytes [12:00 04/08/2004] [19:14 13/04/2008] cdr4_xp.sys ——- 9072 bytes [17:59 04/12/2008] [23:16 07/04/2008] cdralw2k.sys ——- 9200 bytes [17:59 04/12/2008] [23:16 07/04/2008] cdrom.sys –a—- 62976 bytes [12:00 04/08/2004] [18:40 13/04/2008] cercsr6.sys –a—- 39904 bytes [01:48 22/03/2005] [01:48 22/03/2005] cinemst2.sys –a—- 262528 bytes [14:02 17/08/2001] [12:00 04/08/2004] classpnp.sys –a—- 49536 bytes [12:00 04/08/2004] [19:16 13/04/2008] cmbatt.sys –a—- 13952 bytes [16:38 05/10/2006] [18:36 13/04/2008] compbatt.sys –a—- 10240 bytes [16:38 05/10/2006] [18:36 13/04/2008] cpqdap01.sys –a—- 11776 bytes [13:24 17/08/2001] [12:00 04/08/2004] crusoe.sys –a—- 36736 bytes [22:59 03/08/2004] [18:31 13/04/2008] disk.sys –a—- 36352 bytes [12:00 04/08/2004] [18:40 13/04/2008] diskdump.sys –a—- 14208 bytes [12:00 04/08/2004] [18:40 13/04/2008] dmboot.sys –a—- 799744 bytes [12:00 04/08/2004] [18:44 13/04/2008] dmio.sys –a—- 153344 bytes [12:00 04/08/2004] [18:44 13/04/2008] dmload.sys –a—- 5888 bytes [12:00 04/08/2004] [12:00 04/08/2004] dmusic.sys –a—- 52864 bytes [00:08 06/10/2006] [18:45 13/04/2008] drmk.sys –a—- 60160 bytes [00:07 06/10/2006] [18:45 13/04/2008] drmkaud.sys –a—- 2944 bytes [00:08 06/10/2006] [18:45 13/04/2008] dxapi.sys –a—- 10496 bytes [12:00 04/08/2004] [12:00 04/08/2004] dxg.sys –a—- 71168 bytes [12:00 04/08/2004] [18:38 13/04/2008] dxgthk.sys –a—- 3328 bytes [12:00 04/08/2004] [12:00 04/08/2004] eamon.sys ——- 114472 bytes [22:41 14/05/2009] [22:41 14/05/2009] ehdrv.sys ——- 107256 bytes [22:47 14/05/2009] [22:47 14/05/2009] enum1394.sys –a—- 6400 bytes [16:39 05/10/2006] [13:46 17/08/2001] epfw.sys ——- 133000 bytes [22:49 14/05/2009] [22:49 14/05/2009] epfwndis.sys ——- 33096 bytes [22:49 14/05/2009] [22:49 14/05/2009] epfwtdi.sys ——- 55768 bytes [22:49 14/05/2009] [22:49 14/05/2009] fastfat.sys –a—- 143744 bytes [12:00 04/08/2004] [19:14 13/04/2008] fdc.sys –a—- 27392 bytes [12:00 04/08/2004] [18:40 13/04/2008] fips.sys –a—- 44544 bytes [12:00 04/08/2004] [18:33 13/04/2008] flpydisk.sys –a—- 20480 bytes [12:00 04/08/2004] [18:40 13/04/2008] fltmgr.sys –a—- 129792 bytes [23:48 05/10/2006] [18:32 13/04/2008] fsvga.sys –a—- 12160 bytes [13:57 17/08/2001] [12:00 04/08/2004] fs_rec.sys –a—- 7936 bytes [12:00 04/08/2004] [12:00 04/08/2004] ftdisk.sys –a—- 125056 bytes [12:00 04/08/2004] [12:00 04/08/2004] gagp30kx.sys ——- 46464 bytes [10:50 29/08/2008] [18:36 13/04/2008] GEARAspiWDM.sys –a—- 26600 bytes [19:01 29/01/2008] [21:17 18/05/2009] hdaudbus.sys ——- 144384 bytes [00:45 13/08/2004] [16:36 13/04/2008] Hdaudio.sys ——- 113664 bytes [00:45 13/08/2004] [00:45 13/08/2004] hidbth.sys ——- 25600 bytes [10:50 29/08/2008] [18:46 13/04/2008] hidclass.sys –a—- 36864 bytes [12:00 04/08/2004] [18:45 13/04/2008] hidir.sys ——- 19200 bytes [10:50 29/08/2008] [18:45 13/04/2008] hidparse.sys –a—- 24960 bytes [12:00 04/08/2004] [18:45 13/04/2008] hidusb.sys –a—- 10368 bytes [21:30 02/04/2009] [18:45 13/04/2008] hsfbs2s2.sys ——- 220032 bytes [10:50 29/08/2008] [05:41 04/08/2004] hsfcxts2.sys ——- 685056 bytes [10:50 29/08/2008] [05:41 04/08/2004] hsfdpsp2.sys ——- 1041536 bytes [10:50 29/08/2008] [05:41 04/08/2004] HSXHWAZL.sys –a—- 192512 bytes [00:20 06/10/2006] [08:40 01/12/2005] HSX_CNXT.sys –a—- 669696 bytes [00:20 06/10/2006] [08:40 01/12/2005] HSX_DPV.sys –a—- 936960 bytes [00:20 06/10/2006] [08:40 01/12/2005] http.sys –a—- 265728 bytes [12:00 04/08/2004] [16:20 20/10/2009] i8042prt.sys –a—- 52480 bytes [12:00 04/08/2004] [19:18 13/04/2008] ialmnt5.sys –a—- 1364574 bytes [00:27 06/10/2006] [01:09 14/12/2005] imagedrv.sys –a—- 5888 bytes [19:08 15/08/2005] [19:08 15/08/2005] imagesrv.sys –a—- 127488 bytes [19:08 15/08/2005] [19:08 15/08/2005] imapi.sys –a—- 42112 bytes [12:00 04/08/2004] [18:40 13/04/2008] intelppm.sys –a—- 36352 bytes [12:00 04/08/2004] [18:31 13/04/2008] ip6fw.sys –a—- 36608 bytes [12:00 04/08/2004] [18:53 13/04/2008] ipfltdrv.sys –a—- 32896 bytes [12:00 04/08/2004] [12:00 04/08/2004] ipinip.sys –a—- 20864 bytes [12:00 04/08/2004] [18:57 13/04/2008] ipnat.sys –a—- 152832 bytes [12:00 04/08/2004] [18:57 13/04/2008] ipsec.sys –a—- 75264 bytes [12:00 04/08/2004] [19:19 13/04/2008] irbus.sys ——- 46592 bytes [10:51 29/08/2008] [18:45 13/04/2008] irenum.sys –a—- 11264 bytes [16:37 05/10/2006] [18:54 13/04/2008] isapnp.sys –a—- 37248 bytes [12:00 04/08/2004] [18:36 13/04/2008] kbdclass.sys –a—- 24576 bytes [12:00 04/08/2004] [18:39 13/04/2008] kbdhid.sys –a—- 14592 bytes [21:30 02/04/2009] [18:39 13/04/2008] kmixer.sys –a—- 172416 bytes [00:08 06/10/2006] [18:45 13/04/2008] ks.sys –a—- 141056 bytes [23:15 03/08/2004] [19:16 13/04/2008] ksecdd.sys –a—- 92928 bytes [12:00 04/08/2004] [11:18 24/06/2009] LHidFilt.Sys –a—- 35472 bytes [21:38 02/04/2009] [16:56 17/06/2009] LMouFilt.Sys –a—- 37392 bytes [21:38 02/04/2009] [16:56 17/06/2009] mbam.sys –a—- 20952 bytes [18:09 11/04/2009] [22:39 29/04/2010] mbamswissarmy.sys –a—- 38224 bytes [18:09 11/04/2009] [22:39 29/04/2010] mcd.sys –a—- 7680 bytes [12:00 04/08/2004] [12:00 04/08/2004] mdmxsdk.sys –a—- 12544 bytes [00:20 06/10/2006] [06:57 05/10/2005] mf.sys –a—- 63744 bytes [23:07 03/08/2004] [18:36 13/04/2008] mnmdd.sys –a—- 4224 bytes [12:00 04/08/2004] [12:00 04/08/2004] modem.sys –a—- 30080 bytes [23:08 03/08/2004] [19:00 13/04/2008] mouclass.sys –a—- 23040 bytes [22:58 03/08/2004] [18:39 13/04/2008] mouhid.sys –a—- 12160 bytes [21:30 02/04/2009] [20:48 17/08/2001] mountmgr.sys –a—- 42368 bytes [12:00 04/08/2004] [18:39 13/04/2008] mqac.sys –a—- 92544 bytes [12:00 04/08/2004] [18:39 13/04/2008] mrxdav.sys –a—- 180608 bytes [12:00 04/08/2004] [18:32 13/04/2008] mrxsmb.sys –a—- 455680 bytes [12:00 04/08/2004] [13:11 24/02/2010] msfs.sys –a—- 19072 bytes [12:00 04/08/2004] [18:32 13/04/2008] msgpc.sys –a—- 35072 bytes [12:00 04/08/2004] [18:56 13/04/2008] mskssrv.sys –a—- 7552 bytes [00:08 06/10/2006] [18:39 13/04/2008] mspclock.sys –a—- 5376 bytes [00:08 06/10/2006] [18:39 13/04/2008] mspqm.sys –a—- 4992 bytes [00:08 06/10/2006] [18:39 13/04/2008] mssmbios.sys –a—- 15488 bytes [23:07 03/08/2004] [18:36 13/04/2008] mtlmnt5.sys ——- 126686 bytes [10:57 29/08/2008] [05:41 04/08/2004] mtlstrm.sys ——- 1309184 bytes [10:57 29/08/2008] [05:41 04/08/2004] mtxparhm.sys ——- 452736 bytes [10:57 29/08/2008] [05:29 04/08/2004] mup.sys –a—- 105344 bytes [12:00 04/08/2004] [19:17 13/04/2008] mutohpen.sys ——- 12672 bytes [10:57 29/08/2008] [18:43 13/04/2008] ndis.sys –a—- 182656 bytes [12:00 04/08/2004] [19:20 13/04/2008] ndistapi.sys –a—- 10112 bytes [12:00 04/08/2004] [18:57 13/04/2008] ndisuio.sys –a—- 14592 bytes [23:03 03/08/2004] [18:55 13/04/2008] ndiswan.sys –a—- 91520 bytes [12:00 04/08/2004] [19:20 13/04/2008] ndproxy.sys –a—- 40576 bytes [12:00 04/08/2004] [18:57 13/04/2008] netbios.sys –a—- 34688 bytes [12:00 04/08/2004] [18:56 13/04/2008] netbt.sys –a—- 162816 bytes [12:00 04/08/2004] [19:21 13/04/2008] nic1394.sys –a—- 61824 bytes [22:58 03/08/2004] [18:51 13/04/2008] nikedrv.sys –a—- 12032 bytes [13:24 17/08/2001] [12:00 04/08/2004] nmnt.sys –a—- 40320 bytes [12:00 04/08/2004] [18:53 13/04/2008] npfs.sys –a—- 30848 bytes [12:00 04/08/2004] [18:32 13/04/2008] ntfs.sys –a—- 574976 bytes [12:00 04/08/2004] [19:15 13/04/2008] ntmtlfax.sys ——- 180360 bytes [10:57 29/08/2008] [05:41 04/08/2004] null.sys –a—- 2944 bytes [12:00 04/08/2004] [12:00 04/08/2004] nv4_mini.sys ——- 1897408 bytes [10:57 29/08/2008] [05:29 04/08/2004] NvAtaBus.sys –a—- 92800 bytes [22:45 17/05/2005] [22:45 17/05/2005] nvraid.sys –a—- 76288 bytes [22:45 17/05/2005] [22:45 17/05/2005] nwlnkflt.sys –a—- 12416 bytes [12:00 04/08/2004] [12:00 04/08/2004] nwlnkfwd.sys –a—- 32512 bytes [12:00 04/08/2004] [12:00 04/08/2004] nwlnkipx.sys –a—- 88320 bytes [12:00 04/08/2004] [18:56 13/04/2008] nwlnknb.sys –a—- 63232 bytes [12:00 04/08/2004] [12:00 04/08/2004] nwlnkspx.sys –a—- 55936 bytes [12:00 04/08/2004] [12:00 04/08/2004] nwrdr.sys –a—- 163584 bytes [12:00 04/08/2004] [18:34 13/04/2008] ohci1394.sys –a—- 61696 bytes [12:00 04/08/2004] [18:46 13/04/2008] omci.sys ——- 13632 bytes [00:04 06/10/2006] [15:42 22/08/2001] oprghdlr.sys –a—- 3456 bytes [12:00 04/08/2004] [12:00 04/08/2004] p3.sys –a—- 42752 bytes [22:59 03/08/2004] [18:31 13/04/2008] parport.sys –a—- 80128 bytes [22:59 03/08/2004] [18:40 13/04/2008] partmgr.sys –a—- 19712 bytes [12:00 04/08/2004] [18:40 13/04/2008] parvdm.sys –a—- 6784 bytes [12:00 04/08/2004] [12:00 04/08/2004] pci.sys –a—- 68224 bytes [12:00 04/08/2004] [18:36 13/04/2008] pciide.sys –a—- 3328 bytes [12:00 04/08/2004] [20:51 17/08/2001] pciidex.sys –a—- 24960 bytes [12:00 04/08/2004] [18:40 13/04/2008] pcmcia.sys –a—- 120192 bytes [12:00 04/08/2004] [18:36 13/04/2008] portcls.sys –a—- 146048 bytes [18:58 16/03/2004] [19:19 13/04/2008] processr.sys –a—- 35840 bytes [22:59 03/08/2004] [18:31 13/04/2008] psched.sys –a—- 69120 bytes [12:00 04/08/2004] [18:56 13/04/2008] ptilink.sys –a—- 17792 bytes [12:00 04/08/2004] [12:00 04/08/2004] pxhelp20.sys –a—- 43872 bytes [23:16 07/04/2008] [23:16 07/04/2008] rasacd.sys –a—- 8832 bytes [12:00 04/08/2004] [12:00 04/08/2004] rasl2tp.sys –a—- 51328 bytes [12:00 04/08/2004] [19:19 13/04/2008] raspppoe.sys –a—- 41472 bytes [12:00 04/08/2004] [18:57 13/04/2008] raspptp.sys –a—- 48384 bytes [12:00 04/08/2004] [19:19 13/04/2008] raspti.sys –a—- 16512 bytes [12:00 04/08/2004] [12:00 04/08/2004] rawwan.sys –a—- 34432 bytes [12:00 04/08/2004] [12:00 04/08/2004] rcblan.sys –a—- 39704 bytes [00:43 29/01/2008] [00:27 25/01/2007] rdbss.sys –a—- 175744 bytes [12:00 04/08/2004] [19:28 13/04/2008] rdpcdd.sys –a—- 4224 bytes [12:00 04/08/2004] [12:00 04/08/2004] rdpdr.sys –a—- 196224 bytes [23:45 05/10/2006] [18:32 13/04/2008] rdpwd.sys –a—- 139656 bytes [23:46 05/10/2006] [00:13 14/04/2008] recagent.sys ——- 13776 bytes [10:58 29/08/2008] [05:41 04/08/2004] redbook.sys –a—- 57600 bytes [16:39 05/10/2006] [18:40 13/04/2008] rfcomm.sys ——- 59136 bytes [10:58 29/08/2008] [18:46 13/04/2008] rimmptsk.sys –a—- 28544 bytes [00:14 06/10/2006] [01:58 15/07/2005] rimsptsk.sys –a—- 51328 bytes [00:14 06/10/2006] [02:00 13/07/2005] rio8drv.sys –a—- 12032 bytes [13:24 17/08/2001] [12:00 04/08/2004] riodrv.sys –a—- 12032 bytes [13:24 17/08/2001] [12:00 04/08/2004] rixdptsk.sys –a—- 307968 bytes [00:14 06/10/2006] [00:28 15/07/2005] rmcast.sys –a—- 203136 bytes [12:00 04/08/2004] [14:02 08/05/2008] rndismp.sys –a—- 30592 bytes [12:00 04/08/2004] [18:56 13/04/2008] rndismpx.sys ——- 30592 bytes [10:58 29/08/2008] [18:56 13/04/2008] rootmdm.sys –a—- 5888 bytes [12:00 04/08/2004] [12:00 04/08/2004] s3gnbm.sys ——- 166912 bytes [10:59 29/08/2008] [05:29 04/08/2004] scsiport.sys –a—- 96384 bytes [12:00 04/08/2004] [18:40 13/04/2008] sdbus.sys –a—- 79232 bytes [12:00 04/08/2004] [18:36 13/04/2008] secdrv.sys –a—- 20480 bytes [12:00 04/08/2004] [10:25 13/11/2007] serenum.sys –a—- 15744 bytes [12:00 04/08/2004] [18:40 13/04/2008] serial.sys –a—- 64512 bytes [12:00 04/08/2004] [19:15 13/04/2008] serscan.sys –a—- 6784 bytes [02:24 11/05/2010] [20:53 17/08/2001] sffdisk.sys –a—- 11904 bytes [12:00 04/08/2004] [18:40 13/04/2008] sffp_mmc.sys ——- 10240 bytes [10:59 29/08/2008] [18:40 13/04/2008] sffp_sd.sys –a—- 11008 bytes [12:00 04/08/2004] [18:40 13/04/2008] sfloppy.sys –a—- 11392 bytes [12:00 04/08/2004] [18:40 13/04/2008] sisagp.sys ——- 40960 bytes [10:59 29/08/2008] [18:36 13/04/2008] slnt7554.sys ——- 129535 bytes [10:59 29/08/2008] [05:41 04/08/2004] slntamr.sys ——- 404990 bytes [10:59 29/08/2008] [05:41 04/08/2004] slnthal.sys ——- 95424 bytes [10:59 29/08/2008] [05:41 04/08/2004] slwdmsup.sys ——- 13240 bytes [10:59 29/08/2008] [05:41 04/08/2004] smbali.sys ——- 5888 bytes [10:59 29/08/2008] [18:36 13/04/2008] smclib.sys –a—- 14592 bytes [12:00 04/08/2004] [12:00 04/08/2004] sonydcam.sys –a—- 25344 bytes [23:09 03/08/2004] [18:46 13/04/2008] splitter.sys –a—- 6272 bytes [00:08 06/10/2006] [18:45 13/04/2008] sr.sys –a—- 73472 bytes [23:48 05/10/2006] [18:36 13/04/2008] srv.sys –a—- 354304 bytes [12:00 04/08/2004] [15:27 21/06/2010] sthda.sys –a—- 1047816 bytes [00:07 06/10/2006] [22:36 16/11/2005] stream.sys –a—- 49408 bytes [23:08 03/08/2004] [18:45 13/04/2008] swenum.sys –a—- 4352 bytes [22:58 03/08/2004] [18:39 13/04/2008] swmidi.sys –a—- 56576 bytes [00:08 06/10/2006] [18:45 13/04/2008] SynTP.sys –a—- 191936 bytes [00:21 06/10/2006] [19:36 29/11/2005] sysaudio.sys –a—- 60800 bytes [00:08 06/10/2006] [19:15 13/04/2008] tape.sys –a—- 14976 bytes [12:00 04/08/2004] [18:40 13/04/2008] tcpip.sys –a—- 361600 bytes [12:00 04/08/2004] [11:51 20/06/2008] tcpip6.sys –a—- 226880 bytes [12:00 04/08/2004] [12:02 11/02/2010] tdi.sys –a—- 19072 bytes [12:00 04/08/2004] [19:00 13/04/2008] tdpipe.sys –a—- 12040 bytes [23:46 05/10/2006] [00:13 14/04/2008] tdtcp.sys –a—- 21896 bytes [23:46 05/10/2006] [00:13 14/04/2008] termdd.sys –a—- 40840 bytes [23:45 05/10/2006] [00:13 14/04/2008] tmcomm.sys –a—- 102664 bytes [20:07 24/09/2008] [20:06 24/09/2008] tosdvd.sys –a—- 51712 bytes [14:01 17/08/2001] [12:00 04/08/2004] tsbvcap.sys –a—- 21376 bytes [14:06 17/08/2001] [12:00 04/08/2004] tunmp.sys –a—- 12288 bytes [23:03 03/08/2004] [18:56 13/04/2008] uagp35.sys ——- 44672 bytes [11:00 29/08/2008] [18:36 13/04/2008] udfs.sys –a—- 66048 bytes [12:00 04/08/2004] [18:32 13/04/2008] update.sys –a—- 384768 bytes [12:00 04/08/2004] [18:39 13/04/2008] usb8023.sys –a—- 12800 bytes [12:00 04/08/2004] [18:56 13/04/2008] usb8023x.sys ——- 12800 bytes [11:01 29/08/2008] [18:56 13/04/2008] usbaapl.sys –a—- 41984 bytes [00:21 27/01/2008] [03:47 20/04/2010] usbcamd.sys –a—- 25600 bytes [14:03 17/08/2001] [18:45 13/04/2008] usbcamd2.sys –a—- 25728 bytes [14:03 17/08/2001] [18:45 13/04/2008] usbccgp.sys –a—- 32128 bytes [21:30 02/04/2009] [18:45 13/04/2008] usbd.sys –a—- 4736 bytes [12:00 04/08/2004] [12:00 04/08/2004] usbehci.sys –a—- 30208 bytes [12:00 04/08/2004] [18:45 13/04/2008] usbhub.sys –a—- 59520 bytes [12:00 04/08/2004] [18:45 13/04/2008] usbintel.sys –a—- 15872 bytes [23:08 03/08/2004] [18:45 13/04/2008] usbport.sys –a—- 143872 bytes [12:00 04/08/2004] [18:45 13/04/2008] usbscan.sys –a—- 15104 bytes [15:13 19/10/2006] [18:45 13/04/2008] usbstor.sys –a—- 26368 bytes [00:36 06/10/2006] [18:45 13/04/2008] usbuhci.sys –a—- 20608 bytes [12:00 04/08/2004] [18:45 13/04/2008] usbvideo.sys ——- 121984 bytes [11:01 29/08/2008] [18:46 13/04/2008] vdmindvd.sys –a—- 58112 bytes [14:02 17/08/2001] [12:00 04/08/2004] vga.sys –a—- 20992 bytes [12:00 04/08/2004] [18:44 13/04/2008] viaagp.sys ——- 42240 bytes [11:01 29/08/2008] [18:36 13/04/2008] videoprt.sys –a—- 81664 bytes [12:00 04/08/2004] [18:44 13/04/2008] volsnap.sys –a—- 52352 bytes [12:00 04/08/2004] [18:41 13/04/2008] wacompen.sys ——- 14208 bytes [11:01 29/08/2008] [18:43 13/04/2008] wadv07nt.sys ——- 11807 bytes [11:01 29/08/2008] [05:29 04/08/2004] wadv08nt.sys ——- 11295 bytes [11:01 29/08/2008] [05:29 04/08/2004] wadv09nt.sys ——- 11871 bytes [11:01 29/08/2008] [05:29 04/08/2004] wadv11nt.sys ——- 11935 bytes [11:01 29/08/2008] [05:29 04/08/2004] wanarp.sys –a—- 34560 bytes [12:00 04/08/2004] [18:57 13/04/2008] watv06nt.sys ——- 22271 bytes [11:01 29/08/2008] [05:29 04/08/2004] watv10nt.sys ——- 25471 bytes [11:01 29/08/2008] [05:29 04/08/2004] wdf01000.sys ——- 492000 bytes [14:22 02/11/2006] [14:22 02/11/2006] wdfldr.sys ——- 32224 bytes [14:22 02/11/2006] [14:22 02/11/2006] wdmaud.sys –a—- 83072 bytes [00:08 06/10/2006] [19:17 13/04/2008] wmiacpi.sys –a—- 8832 bytes [21:15 27/06/2007] [18:36 13/04/2008] wmilib.sys –a—- 4352 bytes [12:00 04/08/2004] [12:00 04/08/2004] wpdusb.sys –a—- 38528 bytes [01:46 23/09/2004] [04:00 19/10/2006] ws2ifsl.sys –a—- 12032 bytes [12:00 04/08/2004] [12:00 04/08/2004] WudfPf.sys ——- 77568 bytes [02:55 29/09/2006] [02:55 29/09/2006] WudfRd.sys ——- 82944 bytes [03:00 29/09/2006] [03:00 29/09/2006] C:\WINDOWS\System32\drivers\disdn d—— [16:27 05/10/2006] C:\WINDOWS\System32\drivers\etc d—— [16:27 05/10/2006] C:\WINDOWS\System32\drivers\UMDF d—— [20:01 13/03/2010] C:\WINDOWS\System32\DRVSTORE d—-c- [00:14 06/10/2006] C:\WINDOWS\System32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C d—-c- [02:26 10/09/2009] C:\WINDOWS\System32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C\x86 d—-c- [02:26 10/09/2009] GEARAspiWDM.sys –a–c- 26600 bytes [02:26 10/09/2009] [21:17 18/05/2009] C:\WINDOWS\System32\DRVSTORE\GEARAspiWD_4F4AA3475F1B13A1E8212B6D40B351211BC358CE d—-c- [17:40 12/03/2009] C:\WINDOWS\System32\DRVSTORE\GEARAspiWD_4F4AA3475F1B13A1E8212B6D40B351211BC358CE\x86 d—-c- [17:40 12/03/2009] GEARAspiWDM.sys –a–c- 23848 bytes [17:40 12/03/2009] [19:19 15/01/2009] C:\WINDOWS\System32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3 d—-c- [04:19 17/09/2008] C:\WINDOWS\System32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3\x86 d—-c- [04:19 17/09/2008] GEARAspiWDM.sys –a–c- 15464 bytes [04:19 17/09/2008] [20:12 17/04/2008] C:\WINDOWS\System32\DRVSTORE\GEARAspiWD_F475AF659D36685632E9BD97B57E9D9661FF3FFD d—-c- [17:47 09/04/2009] C:\WINDOWS\System32\DRVSTORE\GEARAspiWD_F475AF659D36685632E9BD97B57E9D9661FF3FFD\x86 d—-c- [17:47 09/04/2009] GEARAspiWDM.sys –a–c- 23400 bytes [17:47 09/04/2009] [23:32 19/03/2009] C:\WINDOWS\System32\DRVSTORE\lfhidhid_AE49CF7A8ECC1A99B793E188BDD77103BF9A4571 d—-c- [21:38 02/04/2009] LHidFilt.sys –a–c- 34832 bytes [21:38 02/04/2009] [22:32 11/04/2007] C:\WINDOWS\System32\DRVSTORE\lfhidusb_34C0B169C0F0216ABB2FADCF857761C40513C0EC d—-c- [21:38 02/04/2009] LUsbFilt.sys –a–c- 28688 bytes [21:38 02/04/2009] [22:33 11/04/2007] C:\WINDOWS\System32\DRVSTORE\lfkbdhid_3787EF478DB0DC00ADEE4DCD2D3B66B57B8CE09C d—-c- [21:38 02/04/2009] LHidFilt.sys –a–c- 34832 bytes [21:38 02/04/2009] [22:32 11/04/2007] C:\WINDOWS\System32\DRVSTORE\lfmouhid_10C7F3421939DA6E2806F5500B0342437634A347 d—-c- [21:38 02/04/2009] LHidFilt.sys –a–c- 34832 bytes [21:38 02/04/2009] [22:32 11/04/2007] LMouFilt.sys –a–c- 36112 bytes [21:38 02/04/2009] [22:32 11/04/2007] C:\WINDOWS\System32\DRVSTORE\netaapl_3A00C5601D92D37DDCB0AE45518D6B42BE1588E6 d—-c- [19:33 17/06/2010] netaapl.sys –a–c- 18432 bytes [19:33 17/06/2010] [03:29 20/04/2010] C:\WINDOWS\System32\DRVSTORE\remoteusbl_27786FDB897C737C5AF2CB1EDDE9F74AA5312406 d—-c- [00:43 29/01/2008] C:\WINDOWS\System32\DRVSTORE\remoteusbl_27786FDB897C737C5AF2CB1EDDE9F74AA5312406\i386 d—-c- [00:43 29/01/2008] rcblan.sys –a–c- 39704 bytes [00:43 29/01/2008] [00:27 25/01/2007] C:\WINDOWS\System32\DRVSTORE\rimmptsk_EA24AF82DAB6BA6CF6FB1A3004EE91F51D3FDCF9 d—-c- [00:14 06/10/2006] rimmptsk.sys –a–c- 28544 bytes [00:14 06/10/2006] [01:58 15/07/2005] C:\WINDOWS\System32\DRVSTORE\rixdptsk_30B42BE4DA4D11DB80E5D3DD10180621BA0A53DD d—-c- [00:14 06/10/2006] rixdptsk.sys –a–c- 307968 bytes [00:14 06/10/2006] [00:28 15/07/2005] C:\WINDOWS\System32\DRVSTORE\usbaapl_5BE1FFC476B2D9925B428CF102B47444B9A16508 d—-c- [17:23 23/09/2010] usbaapl.sys –a–c- 41984 bytes [17:23 23/09/2010] [03:47 20/04/2010] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021 d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Continous Storage d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Continous Storage\1D1OWFM6WKF6TLM3S2BGKKUUDG d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Discrete Storage d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\EC-License d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\License-DLL d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\License-DLL\EK11VP4MDB5FUT5CC5AIQIYITG d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\License-DLL\NTX5AHQ45D41ELCFQ3JBE6OLHG d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\License-DLL\YHDHQFB6MQPKUH1RCE15QGJMCA d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\License-DLL\ZCJUDW1USBGHUFWFYWCFVZKG1B d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Licenses d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Publisher Runtime d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Publisher Runtime\UZK2Q4ZNLHKBGBJMZZLFOHB3GH d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Publisher Runtime\UZK2Q4ZNLHKBGBJMZZLFOHB3GH\Objects d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Publisher Runtime\UZK2Q4ZNLHKBGBJMZZLFOHB3GH\Security d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Runtime d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Runtime\Objects d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Runtime\Security d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Temp d—— [19:03 19/03/2007] C:\WINDOWS\System32\E177E04D548C4006A465EEB92D3DE021\Test Storage d—— [19:03 19/03/2007] C:\WINDOWS\System32\en d—— [22:17 25/09/2008] C:\WINDOWS\System32\en-US d—— [03:57 18/01/2007] C:\WINDOWS\System32\export d—— [16:27 05/10/2006] C:\WINDOWS\System32\FxsTmp d—— [22:19 20/07/2009] C:\WINDOWS\System32\GroupPolicy d—— [00:22 05/05/2010] C:\WINDOWS\System32\GroupPolicy\ADM d—— [00:22 05/05/2010] C:\WINDOWS\System32\ias d—— [16:27 05/10/2006] C:\WINDOWS\System32\icsxml d—— [16:27 05/10/2006] C:\WINDOWS\System32\IME d—— [16:27 05/10/2006] C:\WINDOWS\System32\IME\CINTLGNT d—— [16:27 05/10/2006] C:\WINDOWS\System32\IME\PINTLGNT d—— [16:27 05/10/2006] C:\WINDOWS\System32\IME\TINTLGNT d—— [16:27 05/10/2006] C:\WINDOWS\System32\inetsrv d—— [16:27 05/10/2006] C:\WINDOWS\System32\IOSUBSYS d—— [17:59 04/12/2008] C:\WINDOWS\System32\LogFiles d—— [15:53 06/10/2006] C:\WINDOWS\System32\LogFiles\HTTPERR d—— [15:53 06/10/2006] C:\WINDOWS\System32\LogFiles\WUDF d—— [20:01 13/03/2010] C:\WINDOWS\System32\Macromed d—— [23:48 05/10/2006] C:\WINDOWS\System32\Macromed\Flash d—— [23:48 05/10/2006] C:\WINDOWS\System32\Macromed\Flash\FlashPlayerTrust d—— [02:59 11/08/2007] C:\WINDOWS\System32\Microsoft d—s– [00:00 06/10/2006] C:\WINDOWS\System32\Microsoft\Protect d—s– [00:00 06/10/2006] C:\WINDOWS\System32\Microsoft\Protect\S-1-5-18 d—s– [00:00 06/10/2006] C:\WINDOWS\System32\Microsoft\Protect\S-1-5-18\User d—s– [00:00 06/10/2006] C:\WINDOWS\System32\MsDtc d—— [23:46 05/10/2006] C:\WINDOWS\System32\MsDtc\Trace d—— [23:46 05/10/2006] C:\WINDOWS\System32\mui d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0009 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0401 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0402 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0404 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0405 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0406 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0407 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0408 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0409 d—— [01:42 10/10/2006] C:\WINDOWS\System32\mui\040b d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\040C d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\040D d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\040e d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0410 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0411 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0412 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0413 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0414 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0415 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0416 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0418 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0419 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\041a d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\041b d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\041D d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\041e d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\041f d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0424 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0425 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0426 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0427 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0804 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0816 d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\0C0A d—— [16:27 05/10/2006] C:\WINDOWS\System32\mui\dispspec d—— [16:27 05/10/2006] C:\WINDOWS\System32\npp d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe\actsetup d—— [23:48 05/10/2006] C:\WINDOWS\System32\oobe\error d—— [23:48 05/10/2006] C:\WINDOWS\System32\oobe\html d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe\html\dslmain d—— [23:49 05/10/2006] C:\WINDOWS\System32\oobe\html\iconnect d—— [23:49 05/10/2006] C:\WINDOWS\System32\oobe\html\ispsgnup d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe\html\isptype d—— [23:49 05/10/2006] C:\WINDOWS\System32\oobe\html\mouse d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe\html\mouse\images d—— [23:48 05/10/2006] C:\WINDOWS\System32\oobe\html\oemcust d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe\html\oemhw d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe\html\oemreg d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe\html\sconnect d—— [23:49 05/10/2006] C:\WINDOWS\System32\oobe\icserror d—— [23:48 05/10/2006] C:\WINDOWS\System32\oobe\images d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe\isperror d—— [23:48 05/10/2006] C:\WINDOWS\System32\oobe\regerror d—— [23:48 05/10/2006] C:\WINDOWS\System32\oobe\sample d—— [16:27 05/10/2006] C:\WINDOWS\System32\oobe\setup d—— [16:27 05/10/2006] C:\WINDOWS\System32\PreInstall d—— [01:13 06/10/2006] C:\WINDOWS\System32\PreInstall\WinSE d—— [01:13 06/10/2006] C:\WINDOWS\System32\PreInstall\WinSE\wxp_x86_0409_v1 d—— [01:13 06/10/2006] C:\WINDOWS\System32\ras d—— [16:27 05/10/2006] C:\WINDOWS\System32\ReinstallBackups d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0000 d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0000\DriverFiles d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0001 d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0001\DriverFiles d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0001\DriverFiles\i386 d—— [00:11 06/10/2006] isapnp.sys –a–c- 35840 bytes [00:11 06/10/2006] [12:00 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0002 d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0002\DriverFiles d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0002\DriverFiles\i386 d—— [00:11 06/10/2006] pci.sys –a–c- 68224 bytes [00:11 06/10/2006] [12:00 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0003 d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0003\DriverFiles d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0003\DriverFiles\i386 d—— [00:11 06/10/2006] pci.sys –a–c- 68224 bytes [00:11 06/10/2006] [06:07 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0004 d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0004\DriverFiles d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0004\DriverFiles\i386 d—— [00:11 06/10/2006] atapi.sys –a–c- 95360 bytes [00:11 06/10/2006] [12:00 04/08/2004] pciide.sys –a–c- 3328 bytes [00:11 06/10/2006] [12:00 04/08/2004] pciidex.sys –a–c- 25088 bytes [00:11 06/10/2006] [12:00 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0005 d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0005\DriverFiles d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0005\DriverFiles\i386 d—— [00:11 06/10/2006] usbhub.sys –a–c- 57600 bytes [00:11 06/10/2006] [12:00 04/08/2004] usbport.sys –a–c- 142976 bytes [00:11 06/10/2006] [12:00 04/08/2004] usbuhci.sys –a–c- 20480 bytes [00:11 06/10/2006] [12:00 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0006 d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0006\DriverFiles d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0006\DriverFiles\i386 d—— [00:11 06/10/2006] usbhub.sys –a–c- 57600 bytes [00:11 06/10/2006] [06:08 04/08/2004] usbport.sys –a–c- 142976 bytes [00:11 06/10/2006] [06:08 04/08/2004] usbuhci.sys –a–c- 20480 bytes [00:11 06/10/2006] [06:08 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0007 d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0007\DriverFiles d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0007\DriverFiles\i386 d—— [00:11 06/10/2006] usbhub.sys –a–c- 57600 bytes [00:11 06/10/2006] [06:08 04/08/2004] usbport.sys –a–c- 142976 bytes [00:11 06/10/2006] [06:08 04/08/2004] usbuhci.sys –a–c- 20480 bytes [00:11 06/10/2006] [06:08 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0008 d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0008\DriverFiles d—— [00:11 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0008\DriverFiles\i386 d—— [00:11 06/10/2006] usbhub.sys –a–c- 57600 bytes [00:11 06/10/2006] [06:08 04/08/2004] usbport.sys –a–c- 142976 bytes [00:11 06/10/2006] [06:08 04/08/2004] usbuhci.sys –a–c- 20480 bytes [00:11 06/10/2006] [06:08 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0009 d—— [00:12 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0009\DriverFiles d—— [00:12 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0009\DriverFiles\i386 d—— [00:12 06/10/2006] usbehci.sys –a–c- 26624 bytes [00:12 06/10/2006] [12:00 04/08/2004] usbhub.sys –a–c- 57600 bytes [00:12 06/10/2006] [06:08 04/08/2004] usbport.sys –a–c- 142976 bytes [00:12 06/10/2006] [06:08 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0010 d—— [00:21 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0010\DriverFiles d—— [00:21 06/10/2006] C:\WINDOWS\System32\ReinstallBackups\0010\DriverFiles\i386 d—— [00:21 06/10/2006] i8042prt.sys –a–c- 52736 bytes [00:21 06/10/2006] [12:00 04/08/2004] mouclass.sys –a–c- 23040 bytes [00:21 06/10/2006] [12:00 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0011 d—— [04:06 17/09/2008] C:\WINDOWS\System32\ReinstallBackups\0011\DriverFiles d—— [04:06 17/09/2008] usbaapl.sys –a–c- 32000 bytes [04:06 17/09/2008] [16:35 10/07/2008] C:\WINDOWS\System32\ReinstallBackups\0012 d—— [22:03 25/09/2008] C:\WINDOWS\System32\ReinstallBackups\0012\DriverFiles d—— [22:03 25/09/2008] C:\WINDOWS\System32\ReinstallBackups\0012\DriverFiles\i386 d—— [22:03 25/09/2008] intelppm.sys –a–c- 36096 bytes [22:03 25/09/2008] [12:00 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0013 d—— [22:03 25/09/2008] C:\WINDOWS\System32\ReinstallBackups\0013\DriverFiles d—— [22:03 25/09/2008] C:\WINDOWS\System32\ReinstallBackups\0013\DriverFiles\i386 d—— [22:03 25/09/2008] intelppm.sys –a–c- 36096 bytes [22:03 25/09/2008] [12:00 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0014 d—— [22:03 25/09/2008] C:\WINDOWS\System32\ReinstallBackups\0014\DriverFiles d—— [22:03 25/09/2008] C:\WINDOWS\System32\ReinstallBackups\0014\DriverFiles\i386 d—— [22:03 25/09/2008] sdbus.sys –a–c- 67584 bytes [22:03 25/09/2008] [12:00 04/08/2004] C:\WINDOWS\System32\ReinstallBackups\0015 d—— [22:03 25/09/2008] C:\WINDOWS\System32\ReinstallBackups\0015\DriverFiles d—— [22:03 25/09/2008] C:\WINDOWS\System32\ReinstallBackups\0016 d—— [22:03 25/09/2008] C:\WINDOWS\System32\ReinstallBackups\0016\DriverFiles d—— [22:03 25/09/2008] hdaudbus.sys –a–c- 137728 bytes [22:03 25/09/2008] [00:45 13/08/2004] C:\WINDOWS\System32\ReinstallBackups\0017 d—— [21:38 02/04/2009] C:\WINDOWS\System32\ReinstallBackups\0017\DriverFiles d—— [21:38 02/04/2009] C:\WINDOWS\System32\ReinstallBackups\0017\DriverFiles\i386 d—— [21:38 02/04/2009] kbdclass.sys –a–c- 24576 bytes [21:38 02/04/2009] [18:39 13/04/2008] kbdhid.sys –a–c- 14592 bytes [21:38 02/04/2009] [18:39 13/04/2008] C:\WINDOWS\System32\ReinstallBackups\0018 d—— [21:40 02/04/2009] C:\WINDOWS\System32\ReinstallBackups\0018\DriverFiles d—— [21:40 02/04/2009] C:\WINDOWS\System32\ReinstallBackups\0018\DriverFiles\i386 d—— [21:40 02/04/2009] mouclass.sys –a–c- 23040 bytes [21:40 02/04/2009] [18:39 13/04/2008] mouhid.sys –a–c- 12160 bytes [21:40 02/04/2009] [20:48 17/08/2001] C:\WINDOWS\System32\ReinstallBackups\0019 d—— [17:56 16/04/2009] C:\WINDOWS\System32\ReinstallBackups\0019\DriverFiles d—— [17:56 16/04/2009] LHidFilt.Sys –a–c- 34832 bytes [17:56 16/04/2009] [22:32 11/04/2007] C:\WINDOWS\System32\ReinstallBackups\0019\DriverFiles\i386 d—— [17:56 16/04/2009] kbdclass.sys –a–c- 24576 bytes [17:56 16/04/2009] [18:39 13/04/2008] kbdhid.sys –a–c- 14592 bytes [17:56 16/04/2009] [18:39 13/04/2008] C:\WINDOWS\System32\ReinstallBackups\0020 d—— [17:56 16/04/2009] C:\WINDOWS\System32\ReinstallBackups\0020\DriverFiles d—— [17:56 16/04/2009] LHidFilt.Sys –a–c- 34832 bytes [17:56 16/04/2009] [22:32 11/04/2007] LMouFilt.Sys –a–c- 36112 bytes [17:56 16/04/2009] [22:32 11/04/2007] C:\WINDOWS\System32\ReinstallBackups\0020\DriverFiles\i386 d—— [17:56 16/04/2009] mouclass.sys –a–c- 23040 bytes [17:56 16/04/2009] [18:39 13/04/2008] mouhid.sys –a–c- 12160 bytes [17:56 16/04/2009] [20:48 17/08/2001] C:\WINDOWS\System32\ReinstallBackups\0021 d—— [02:03 10/09/2009] C:\WINDOWS\System32\ReinstallBackups\0021\DriverFiles d—— [02:03 10/09/2009] usbaapl.sys –a–c- 39424 bytes [02:03 10/09/2009] [18:42 05/06/2009] C:\WINDOWS\System32\ReinstallBackups\0022 d—— [00:19 05/05/2010] C:\WINDOWS\System32\ReinstallBackups\0022\DriverFiles d—— [00:19 05/05/2010] BCMWL5.SYS –a—- 424320 bytes [00:19 05/05/2010] [20:24 02/11/2005] C:\WINDOWS\System32\Restore d—— [23:48 05/10/2006] C:\WINDOWS\System32\scripting d—— [22:17 25/09/2008] C:\WINDOWS\System32\Setup d—— [16:27 05/10/2006] C:\WINDOWS\System32\ShellExt d—— [16:27 05/10/2006] C:\WINDOWS\System32\SoftwareDistribution d—— [01:01 06/10/2006] C:\WINDOWS\System32\SoftwareDistribution\Setup d—— [01:01 06/10/2006] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup d—— [01:01 06/10/2006] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups.dll d—— [01:01 06/10/2006] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\5.8.0.2469 d—— [01:01 06/10/2006] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.374 d—— [22:27 31/05/2007] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381 d—— [08:43 24/08/2007] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.784 d—— [15:09 28/08/2008] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788 d—— [19:27 20/11/2008] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226 d—— [01:13 02/10/2009] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll d—— [22:27 31/05/2007] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.0.6000.374 d—— [22:27 31/05/2007] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.0.6000.381 d—— [08:43 24/08/2007] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.784 d—— [15:09 28/08/2008] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788 d—— [19:27 20/11/2008] C:\WINDOWS\System32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226 d—— [01:13 02/10/2009] C:\WINDOWS\System32\spool d—— [16:27 05/10/2006] C:\WINDOWS\System32\spool\drivers d—— [16:27 05/10/2006] C:\WINDOWS\System32\spool\drivers\color d—— [16:27 05/10/2006] C:\WINDOWS\System32\spool\drivers\w32x86 d—— [16:27 05/10/2006] C:\WINDOWS\System32\spool\drivers\w32x86\3 d—— [16:27 05/10/2006] C:\WINDOWS\System32\spool\drivers\w32x86\brothermfc_495cw56f3 d—— [02:24 11/05/2010] C:\WINDOWS\System32\spool\drivers\w32x86\brotherpc_fax_v_2_1f116 d—— [02:25 11/05/2010] C:\WINDOWS\System32\spool\PRINTERS d—— [23:44 05/10/2006] C:\WINDOWS\System32\spool\prtprocs d—— [16:27 05/10/2006] C:\WINDOWS\System32\spool\prtprocs\w32x86 d—— [16:27 05/10/2006] C:\WINDOWS\System32\spool\prtprocs\x64 d—— [17:16 13/08/2008] C:\WINDOWS\System32\spool\XPSEP d—— [17:15 13/08/2008] C:\WINDOWS\System32\spool\XPSEP\amd64 d—— [17:15 13/08/2008] C:\WINDOWS\System32\spool\XPSEP\amd64\amd64 d—— [17:15 13/08/2008] C:\WINDOWS\System32\spool\XPSEP\i386 d—— [17:15 13/08/2008] C:\WINDOWS\System32\spool\XPSEP\i386\i386 d—— [17:15 13/08/2008] C:\WINDOWS\System32\URTTemp d—— [01:42 10/10/2006] C:\WINDOWS\System32\usmt d—— [16:27 05/10/2006] C:\WINDOWS\System32\wbem d—— [16:27 05/10/2006] C:\WINDOWS\System32\wbem\AutoRecover d—— [23:47 05/10/2006] C:\WINDOWS\System32\wbem\Logs d—— [16:27 05/10/2006] C:\WINDOWS\System32\wbem\mof d—— [16:27 05/10/2006] C:\WINDOWS\System32\wbem\mof\bad d—— [16:27 05/10/2006] C:\WINDOWS\System32\wbem\mof\good d—— [16:27 05/10/2006] C:\WINDOWS\System32\wbem\Performance d—— [23:47 05/10/2006] C:\WINDOWS\System32\wbem\Repository d—— [14:08 18/12/2006] C:\WINDOWS\System32\wbem\Repository\FS d—— [14:08 18/12/2006] C:\WINDOWS\System32\wbem\snmp d—— [23:51 05/10/2006] C:\WINDOWS\System32\wbem\xml d—— [16:27 05/10/2006] C:\WINDOWS\System32\windowspowershell d—— [23:11 24/07/2009] C:\WINDOWS\System32\windowspowershell\v1.0 d—— [23:11 24/07/2009] C:\WINDOWS\System32\windowspowershell\v1.0\de d—— [00:24 05/05/2010] C:\WINDOWS\System32\windowspowershell\v1.0\es d—— [00:24 05/05/2010] C:\WINDOWS\System32\windowspowershell\v1.0\examples d—— [23:11 24/07/2009] C:\WINDOWS\System32\windowspowershell\v1.0\fr d—— [00:24 05/05/2010] C:\WINDOWS\System32\windowspowershell\v1.0\it d—— [00:24 05/05/2010] C:\WINDOWS\System32\windowspowershell\v1.0\ja d—— [00:24 05/05/2010] C:\WINDOWS\System32\windowspowershell\v1.0\ko d—— [00:24 05/05/2010] C:\WINDOWS\System32\windowspowershell\v1.0\Modules d—— [18:27 11/08/2010] C:\WINDOWS\System32\windowspowershell\v1.0\Modules\BitsTransfer d—— [18:27 11/08/2010] C:\WINDOWS\System32\windowspowershell\v1.0\Modules\BitsTransfer\en d—— [18:27 11/08/2010] C:\WINDOWS\System32\windowspowershell\v1.0\pt-br d—— [00:25 05/05/2010] C:\WINDOWS\System32\windowspowershell\v1.0\ru d—— [00:23 05/05/2010] C:\WINDOWS\System32\windowspowershell\v1.0\zh-chs d—— [00:25 05/05/2010] C:\WINDOWS\System32\windowspowershell\v1.0\zh-cht d—— [00:24 05/05/2010] C:\WINDOWS\System32\winrm d—— [18:27 11/08/2010] C:\WINDOWS\System32\winrm\0409 d—— [18:27 11/08/2010] C:\WINDOWS\System32\wins d—— [16:27 05/10/2006] C:\WINDOWS\System32\xircom d—— [23:51 05/10/2006] C:\WINDOWS\System32\XPSViewer d—— [17:17 13/08/2008] C:\WINDOWS\System32\XPSViewer\en-US d—— [23:18 10/06/2009] -= EOF =-

Hi there,


Please visit the following and have a look how you can disable your security software.

How to disable your security programs

After disabling your security programs, download Combofix from any of the links below and save it to your desktop.

Link 1
Link 2

——————————————————————–

• Double click on Combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.
• When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix