What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

hijack this log, viruses, blue screen, problems

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
You are running two Antivirus and multiple antispyware programs

AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Microsoft Forefront Client Security *On-access scanning disabled* (Updated) {926A3D4F-E4E7-4F47-9902-4EDD55FFE1AF}

You need to remove one of these antivirus,i would also remove iobit 360.


Please do the following



COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    FixCSet::

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

DirLook::
c:\programdata\SMGHNYE
c:\programdata\552284
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.




Next

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.



Next

I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #17
when i go to control panel to delete programs i receieve error " illegal operation attempted on a registry key that has been marked for deletion":
Post #18
when i go to control panel to delete programs i receieve error " illegal operation attempted on a registry key that has been marked for deletion": ~ when trying to open notepad
Post #21
ComboFix 10-11-15.05 - kristyn 11/15/2010 18:37:59.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3573.2319 [GMT -6:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
Command switches used :: c:\users\kristyn\Desktop\CFScript - Shortcut.lnk
AV: Microsoft Forefront Client Security *On-access scanning disabled* (Updated) {926A3D4F-E4E7-4F47-9902-4EDD55FFE1AF}
SP: Microsoft Forefront Client Security *disabled* (Updated) {926A3D4F-E4E7-4F47-9902-4EDD55FFE1AE}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-10-16 to 2010-11-16 )))))))))))))))))))))))))))))))
.

2010-11-16 00:42 . 2010-11-16 00:42 ——– d—–w- c:\users\ryan\AppData\Local\temp
2010-11-16 00:42 . 2010-11-16 00:42 ——– d—–w- c:\users\Guest\AppData\Local\temp
2010-11-16 00:42 . 2010-11-16 00:42 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-11-15 12:41 . 2010-10-07 23:21 6146896 —-a-w- c:\programdata\Microsoft\Microsoft Forefront\Client Security\Client\Antimalware\Definition Updates\{71010F41-A76B-4E28-A484-14225130B3F2}\mpengine.dll
2010-11-14 22:12 . 2010-11-14 22:12 ——– d—–w- C:\_OTL
2010-11-13 20:56 . 2010-11-13 20:56 ——– d—–w- c:\programdata\Souptoys
2010-11-13 20:56 . 2010-11-13 20:56 ——– d—–w- c:\program files\Souptoys
2010-11-13 20:40 . 2010-11-13 20:40 ——– d—–w- c:\program files\Sight Words Sentence Builder
2010-11-13 20:00 . 2010-11-13 20:00 ——– d—–w- c:\programdata\IObit
2010-11-13 20:00 . 2010-11-13 20:00 ——– d—–w- c:\program files\IObit
2010-11-13 15:04 . 2010-04-29 21:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-13 15:04 . 2010-04-29 21:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-11-13 15:04 . 2010-11-13 15:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-11-12 12:09 . 2010-10-07 23:21 6146896 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{46D1176C-F04D-4555-A012-9C9BFA08C3AC}\mpengine.dll
2010-11-12 03:18 . 2010-11-13 05:35 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-11-12 03:18 . 2010-11-12 13:50 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2010-10-28 14:35 . 2010-10-28 16:09 ——– d—–w- c:\users\kristyn
2010-10-27 18:50 . 2010-10-27 18:50 ——– d-sh–w- c:\programdata\SMGHNYE
2010-10-27 18:50 . 2010-11-07 16:31 ——– d-sh–w- c:\programdata\552284

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2009-10-03 14:02 222080 ——w- c:\windows\system32\MpSigStub.exe
2010-10-07 23:21 . 2009-08-14 12:20 6146896 —-a-w- c:\programdata\Microsoft\Microsoft Forefront\Client Security\Client\Antimalware\Definition Updates\Backup\mpengine.dll
2010-09-08 16:17 . 2010-09-08 16:17 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 16:17 . 2010-09-08 16:17 69632 —-a-w- c:\windows\system32\QuickTime.qts
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-11-08 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-01-24 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-12 133656]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-25 136600]
"Microsoft Forefront Client Security Antimalware Service"="c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exe" [2010-01-19 1033600]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FCSAM]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R2 FCSAM;Microsoft Forefront Client Security Antimalware Service;c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MsMpEng.exe [2010-01-19 16880]
R2 gupdate1c98fc81ab179ca;Google Update Service (gupdate1c98fc81ab179ca);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 133104]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2006-11-02 16896]
S2 CFUACProxy_officeguardianv2;CFUACProxy_officeguardianv2;c:\programdata\OfficeGuardianV2\UACProxy.exe [2010-05-05 87944]
S2 FcsSas;Microsoft Forefront Client Security State Assessment Service;c:\program files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exe [2007-04-06 73120]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 23:49]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 23:49]

2010-11-16 c:\windows\Tasks\User_Feed_Synchronization-{A45ABC42-C9BC-4516-BD9D-9B67032392E0}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]

2010-11-15 c:\windows\Tasks\User_Feed_Synchronization-{AFD52921-7C36-4FC1-AAD4-F0EA44948EB2}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]

2010-11-16 c:\windows\Tasks\User_Feed_Synchronization-{EF181C9C-A97E-4F97-AF98-3186403252C7}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-15 18:42
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-11-15 18:44:35
ComboFix-quarantined-files.txt 2010-11-16 00:44
ComboFix2.txt 2010-11-15 13:06

Pre-Run: 87,130,505,216 bytes free
Post-Run: 87,195,455,488 bytes free

- - End Of File - - D6517A63714D4A988FA44EAA315F265B
Post #22
Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4052 Windows 6.0.6000 Internet Explorer 8.0.6001.18904 11/15/2010 8:21:25 PM mbam-log-2010-11-15 (20-21-25).txt Scan type: Quick scan Objects scanned: 134948 Time elapsed: 4 minute(s), 52 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #27
this appears to be the log: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK esets_scanner_update returned -1 esets_gle=53251
Post #28
I should have noticed this before.You did not save Combofix to your desktop as the instructions said to,you need to delete the copy you have and save a new copy to your desktop from one of the links below

If using Firefox click tools>options>general>always ask me where to save files.


Link 1
Link 2

Now you should have it on your desktop please do the following


COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

DirLook::
c:\programdata\SMGHNYE
c:\programdata\552284
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.




Next

Open OTL,click run scan and post the new log.
Post #29
ComboFix 10-11-16.02 - kristyn 11/16/2010 17:01:42.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3573.2343 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\kristyn\Desktop\CFScript.txt
AV: Microsoft Forefront Client Security *On-access scanning disabled* (Updated) {926A3D4F-E4E7-4F47-9902-4EDD55FFE1AF}
SP: Microsoft Forefront Client Security *disabled* (Updated) {926A3D4F-E4E7-4F47-9902-4EDD55FFE1AE}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-10-16 to 2010-11-16 )))))))))))))))))))))))))))))))
.

2010-11-16 23:12 . 2010-11-16 23:12 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-11-16 23:12 . 2010-11-16 23:12 ——– d—–w- c:\users\ryan\AppData\Local\temp
2010-11-16 23:12 . 2010-11-16 23:12 ——– d—–w- c:\users\Guest\AppData\Local\temp
2010-11-16 23:12 . 2010-11-16 23:12 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-11-16 07:22 . 2010-10-07 23:21 6146896 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7AE603AA-A368-405C-8131-EB7699A8F796}\mpengine.dll
2010-11-16 02:25 . 2010-11-16 02:25 ——– d—–w- c:\program files\ESET
2010-11-15 12:41 . 2010-10-07 23:21 6146896 —-a-w- c:\programdata\Microsoft\Microsoft Forefront\Client Security\Client\Antimalware\Definition Updates\{71010F41-A76B-4E28-A484-14225130B3F2}\mpengine.dll
2010-11-14 22:12 . 2010-11-14 22:12 ——– d—–w- C:\_OTL
2010-11-13 20:56 . 2010-11-13 20:56 ——– d—–w- c:\programdata\Souptoys
2010-11-13 20:56 . 2010-11-13 20:56 ——– d—–w- c:\program files\Souptoys
2010-11-13 20:40 . 2010-11-13 20:40 ——– d—–w- c:\program files\Sight Words Sentence Builder
2010-11-13 20:00 . 2010-11-13 20:00 ——– d—–w- c:\programdata\IObit
2010-11-13 20:00 . 2010-11-13 20:00 ——– d—–w- c:\program files\IObit
2010-11-13 15:04 . 2010-04-29 21:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-13 15:04 . 2010-04-29 21:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-11-13 15:04 . 2010-11-13 15:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-11-12 03:18 . 2010-11-13 05:35 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-11-12 03:18 . 2010-11-12 13:50 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2010-10-28 14:35 . 2010-10-28 16:09 ——– d—–w- c:\users\kristyn
2010-10-27 18:50 . 2010-10-27 18:50 ——– d-sh–w- c:\programdata\SMGHNYE
2010-10-27 18:50 . 2010-11-07 16:31 ——– d-sh–w- c:\programdata\552284

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2009-10-03 14:02 222080 ——w- c:\windows\system32\MpSigStub.exe
2010-10-07 23:21 . 2009-08-14 12:20 6146896 —-a-w- c:\programdata\Microsoft\Microsoft Forefront\Client Security\Client\Antimalware\Definition Updates\Backup\mpengine.dll
2010-09-08 16:17 . 2010-09-08 16:17 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 16:17 . 2010-09-08 16:17 69632 —-a-w- c:\windows\system32\QuickTime.qts
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\programdata\552284 —-

2010-10-28 14:22 . 2010-10-28 14:22 288 —-a-w- c:\programdata\552284\134022.reg
2010-10-27 18:50 . 2010-10-27 18:50 64 —-a-w- c:\programdata\552284\adrglkxgoav7tm9disv.dll
2010-10-27 18:50 . 2010-10-27 18:50 4286 —-a-w- c:\programdata\552284\mcp.ico
2010-10-27 18:50 . 2010-10-28 14:22 4286 —-a-w- c:\programdata\552284\SME.ico
2010-10-27 18:50 . 2010-10-28 14:21 102 —-a-w- c:\programdata\552284\552284ee0173d957f46d71a72edd8a01.ocx

—- Directory of c:\programdata\SMGHNYE —-

2010-10-27 18:50 . 2010-10-28 14:22 36748 –sha-w- c:\programdata\SMGHNYE\SMTFJZWALDE.cfg


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-11-08 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-01-24 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-12 133656]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-25 136600]
"Microsoft Forefront Client Security Antimalware Service"="c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exe" [2010-01-19 1033600]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FCSAM]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R2 FCSAM;Microsoft Forefront Client Security Antimalware Service;c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MsMpEng.exe [2010-01-19 16880]
R2 gupdate1c98fc81ab179ca;Google Update Service (gupdate1c98fc81ab179ca);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 133104]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2006-11-02 16896]
S2 CFUACProxy_officeguardianv2;CFUACProxy_officeguardianv2;c:\programdata\OfficeGuardianV2\UACProxy.exe [2010-05-05 87944]
S2 FcsSas;Microsoft Forefront Client Security State Assessment Service;c:\program files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exe [2007-04-06 73120]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 23:49]

2010-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 23:49]

2010-11-16 c:\windows\Tasks\User_Feed_Synchronization-{A45ABC42-C9BC-4516-BD9D-9B67032392E0}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]

2010-11-16 c:\windows\Tasks\User_Feed_Synchronization-{AFD52921-7C36-4FC1-AAD4-F0EA44948EB2}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]

2010-11-16 c:\windows\Tasks\User_Feed_Synchronization-{EF181C9C-A97E-4F97-AF98-3186403252C7}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-16 17:12
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-11-16 17:13:55
ComboFix-quarantined-files.txt 2010-11-16 23:13
ComboFix2.txt 2010-11-16 00:44
ComboFix3.txt 2010-11-15 13:06

Pre-Run: 85,416,665,088 bytes free
Post-Run: 85,484,937,216 bytes free

- - End Of File - - 6D1D718C4E4A3A94A99F7999E05A2179
Post #30
OTL logfile created on: 11/16/2010 5:22:56 PM - Run 3
OTL by OldTimer - Version 3.2.17.3 Folder = c:\Users\kristyn\Downloads
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free
7.00 Gb Paging File | 6.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 229.83 Gb Total Space | 79.64 Gb Free Space | 34.65% Space Free | Partition Type: NTFS
Drive D: | 875.44 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: KRISTY-PC | User Name: kristyn | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - c:\Users\kristyn\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\ProgramData\OfficeGuardianV2\UACProxy.exe (Storage Appliance Corp.)
PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10e.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe (Amazon.com)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - c:\Users\kristyn\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (CFUACProxy_officeguardianv2) – C:\ProgramData\OfficeGuardianV2\UACProxy.exe (Storage Appliance Corp.)
SRV - (FCSAM) – c:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (ADVService) – C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe (Amazon.com)
SRV - (WinHttpAutoProxySvc) – winhttp.dll (Microsoft Corporation)
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (FcsSas) – C:\Program Files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\Windows\System32\DRIVERS\LV302V32.SYS File not found
DRV - (PCTINDIS5) – C:\Windows\System32\PCTINDIS5.SYS File not found
DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (LVUSBSta) – C:\Windows\System32\DRIVERS\LVUSBSta.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (catchme) – C:\Users\kristyn\AppData\Local\Temp\catchme.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (VX3000) – C:\Windows\System32\drivers\VX3000.sys (Microsoft Corporation)
DRV - (PCASp50) – C:\Windows\System32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (swmsflt) – C:\Windows\System32\drivers\swmsflt.sys ()
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (NETw4v32) Intel® – C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (motmodem) – C:\Windows\System32\drivers\motmodem.sys (Motorola)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (iaStor) – C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) NVIDIA nForce™ – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (WSDPrintDevice) – C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)
DRV - (WINUSB) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (HSF_DPV) – C:\Windows\System32\drivers\VSTDPV3.SYS (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (winachsf) – C:\Windows\System32\drivers\VSTCNXT3.SYS (Conexant Systems, Inc.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (bcm4sbxp) – C:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 5E 4B F8 1B 82 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: ([2010/11/14 16:12:24 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [Microsoft Forefront Client Security Antimalware Service] c:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] 1.1.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 15:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/16 17:13:57 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Local\temp
[2010/11/16 17:13:23 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/11/15 20:25:18 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/11/15 06:55:57 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/11/15 06:55:57 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/11/15 06:55:57 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/11/15 06:55:57 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/11/15 06:54:44 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/11/15 06:51:19 | 000,000,000 | —D | C] – C:\Qoobox
[2010/11/14 16:12:19 | 000,000,000 | —D | C] – C:\_OTL
[2010/11/13 20:01:23 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\WinRAR
[2010/11/13 14:56:54 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\Souptoys
[2010/11/13 14:56:54 | 000,000,000 | —D | C] – C:\ProgramData\Souptoys
[2010/11/13 14:56:37 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Playsets
[2010/11/13 14:56:36 | 000,000,000 | —D | C] – C:\ProgramData\Souptoys2
[2010/11/13 14:56:34 | 000,000,000 | —D | C] – C:\Program Files\Souptoys
[2010/11/13 14:40:30 | 000,000,000 | —D | C] – C:\Program Files\Sight Words Sentence Builder
[2010/11/13 14:00:30 | 000,000,000 | —D | C] – C:\ProgramData\IObit
[2010/11/13 14:00:14 | 000,000,000 | —D | C] – C:\Program Files\IObit
[2010/11/13 09:05:23 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\Malwarebytes
[2010/11/13 09:04:59 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/11/13 09:04:55 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/11/13 09:04:54 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/11 21:18:39 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2010/11/11 21:18:39 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/11/07 06:47:43 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Local\Apple
[2010/11/02 18:27:15 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\PeerNetworking
[2010/10/28 11:00:07 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Local\Adobe
[2010/10/28 10:09:28 | 000,000,000 | —D | C] – C:\Users\kristyn\x
[2010/10/28 09:58:51 | 000,000,000 | —D | C] – C:\Users\kristyn\Office Genuine Advantage
[2010/10/28 08:49:59 | 020,617,000 | —- | C] (Skype Technologies S.A.) – C:\Users\kristyn\Documents\SkypeSetupFull.exe
[2010/10/28 08:49:57 | 000,000,000 | —D | C] – C:\Users\kristyn\Documents\ryan
[2010/10/28 08:49:54 | 000,000,000 | —D | C] – C:\Users\kristyn\Documents\MySpaceIM Pics
[2010/10/28 08:49:53 | 000,000,000 | —D | C] – C:\Users\kristyn\Documents\My Google Gadgets
[2010/10/28 08:49:53 | 000,000,000 | —D | C] – C:\Users\kristyn\Documents\My Albums
[2010/10/28 08:49:47 | 003,371,384 | —- | C] (Malwarebytes Corporation ) – C:\Users\kristyn\Documents\mbam-setup.exe
[2010/10/28 08:49:41 | 000,000,000 | —D | C] – C:\Users\kristyn\Documents\Downloads
[2010/10/28 08:49:39 | 000,000,000 | —D | C] – C:\Users\kristyn\Documents\Documents on Kristyn's MOTO Q 9h
[2010/10/28 08:49:37 | 000,000,000 | —D | C] – C:\Users\kristyn\Documents\Collage Projects
[2010/10/28 08:49:31 | 003,480,997 | —- | C] (BitWise Communications, LLC ) – C:\Users\kristyn\Documents\BitWiseSetup.exe
[2010/10/28 08:49:26 | 003,001,016 | —- | C] (Siber Systems) – C:\Users\kristyn\Documents\AiRoboForm-cnetc.exe
[2010/10/28 08:49:26 | 000,000,000 | —D | C] – C:\Users\kristyn\Documents\angel
[2010/10/28 08:49:16 | 000,000,000 | —D | C] – C:\Users\kristyn\Desktop\My Pictures
[2010/10/28 08:49:05 | 000,000,000 | —D | C] – C:\Users\kristyn\Desktop\Adobe Reader 9 Installer
[2010/10/28 08:48:59 | 000,000,000 | —D | C] – C:\Users\kristyn\calendars
[2010/10/28 08:48:19 | 000,000,000 | —D | C] – C:\Users\kristyn\.SunDownloadManager
[2010/10/28 08:40:39 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\Yahoo!
[2010/10/28 08:40:39 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Local\Yahoo
[2010/10/28 08:38:05 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\Adobe
[2010/10/28 08:36:30 | 000,000,000 | —D | C] – C:\Users\kristyn\Documents\My RoboForm Data
[2010/10/28 08:36:22 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\Apple Computer
[2010/10/28 08:36:19 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Local\Apple Computer
[2010/10/28 08:36:13 | 000,000,000 | R–D | C] – C:\Users\kristyn\Searches
[2010/10/28 08:36:09 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\Identities
[2010/10/28 08:36:06 | 000,000,000 | R–D | C] – C:\Users\kristyn\Contacts
[2010/10/28 08:36:05 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Local\VirtualStore
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\AppData\Local\Temporary Internet Files
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\Templates
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\Start Menu
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\SendTo
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\Recent
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\PrintHood
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\NetHood
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\Documents\My Videos
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\Documents\My Pictures
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\Documents\My Music
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\My Documents
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\Local Settings
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\AppData\Local\History
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\Cookies
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\Application Data
[2010/10/28 08:35:59 | 000,000,000 | -HSD | C] – C:\Users\kristyn\AppData\Local\Application Data
[2010/10/28 08:35:58 | 000,000,000 | –SD | C] – C:\Users\kristyn\AppData\Roaming\Microsoft
[2010/10/28 08:35:58 | 000,000,000 | R–D | C] – C:\Users\kristyn\Videos
[2010/10/28 08:35:58 | 000,000,000 | R–D | C] – C:\Users\kristyn\Saved Games
[2010/10/28 08:35:58 | 000,000,000 | R–D | C] – C:\Users\kristyn\Pictures
[2010/10/28 08:35:58 | 000,000,000 | R–D | C] – C:\Users\kristyn\Music
[2010/10/28 08:35:58 | 000,000,000 | R–D | C] – C:\Users\kristyn\Links
[2010/10/28 08:35:58 | 000,000,000 | R–D | C] – C:\Users\kristyn\Favorites
[2010/10/28 08:35:58 | 000,000,000 | R–D | C] – C:\Users\kristyn\Downloads
[2010/10/28 08:35:58 | 000,000,000 | R–D | C] – C:\Users\kristyn\Documents
[2010/10/28 08:35:58 | 000,000,000 | R–D | C] – C:\Users\kristyn\Desktop
[2010/10/28 08:35:58 | 000,000,000 | -H-D | C] – C:\Users\kristyn\AppData
[2010/10/28 08:35:58 | 000,000,000 | —D | C] – C:\Users\kristyn\Roaming
[2010/10/28 08:35:58 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Local\Microsoft
[2010/10/28 08:35:58 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\Media Center Programs
[2010/10/28 08:35:58 | 000,000,000 | —D | C] – C:\Users\kristyn\AppData\Roaming\Macromedia
[2010/10/27 12:50:38 | 000,000,000 | -HSD | C] – C:\ProgramData\SMGHNYE
[2010/10/27 12:50:08 | 000,000,000 | -HSD | C] – C:\ProgramData\552284
[14 C:\Users\kristyn\Documents\*.tmp files -> C:\Users\kristyn\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2078/11/26 04:47:22 | 000,058,672 | —- | M] () – C:\Users\kristyn\Documents\07012009a 016.JPG
[2078/11/26 04:47:14 | 000,058,038 | —- | M] () – C:\Users\kristyn\Documents\07012009a 015.JPG
[2078/11/26 04:47:04 | 000,058,993 | —- | M] () – C:\Users\kristyn\Documents\07012009a 014.JPG
[2078/11/26 04:46:48 | 000,058,621 | —- | M] () – C:\Users\kristyn\Documents\07012009a 013.JPG
[2078/11/26 04:46:38 | 000,058,721 | —- | M] () – C:\Users\kristyn\Documents\07012009a 012.JPG
[2078/11/26 04:46:20 | 000,058,713 | —- | M] () – C:\Users\kristyn\Documents\07012009a 011.JPG
[2078/11/26 04:46:10 | 000,059,189 | —- | M] () – C:\Users\kristyn\Documents\07012009a 010.JPG
[2078/11/26 04:46:00 | 000,059,229 | —- | M] () – C:\Users\kristyn\Documents\07012009a 009.JPG
[2078/11/26 04:45:48 | 000,059,227 | —- | M] () – C:\Users\kristyn\Documents\07012009a 008.JPG
[2078/11/26 04:45:38 | 000,059,392 | —- | M] () – C:\Users\kristyn\Documents\07012009a 007.JPG
[2078/11/26 04:45:24 | 000,060,053 | —- | M] () – C:\Users\kristyn\Documents\07012009a 006.JPG
[2078/11/26 04:45:14 | 000,060,016 | —- | M] () – C:\Users\kristyn\Documents\07012009a 005.JPG
[2078/11/26 04:45:00 | 000,059,610 | —- | M] () – C:\Users\kristyn\Documents\07012009a 004.JPG
[2078/11/24 11:26:04 | 000,058,862 | —- | M] () – C:\Users\kristyn\Documents\070109 058.JPG
[2078/11/24 10:52:32 | 000,060,027 | —- | M] () – C:\Users\kristyn\Documents\070109 057.JPG
[2078/11/24 10:52:20 | 000,060,109 | —- | M] () – C:\Users\kristyn\Documents\070109 056.JPG
[2078/11/24 10:50:24 | 000,060,539 | —- | M] () – C:\Users\kristyn\Documents\070109 055.JPG
[2078/11/24 10:50:10 | 000,059,396 | —- | M] () – C:\Users\kristyn\Documents\070109 054.JPG
[2078/11/24 09:37:56 | 000,059,711 | —- | M] () – C:\Users\kristyn\Documents\070109 053.JPG
[2078/11/24 09:37:44 | 000,059,761 | —- | M] () – C:\Users\kristyn\Documents\070109 052.JPG
[2078/11/24 09:37:12 | 000,060,927 | —- | M] () – C:\Users\kristyn\Documents\070109 051.JPG
[2078/11/24 09:36:58 | 000,061,157 | —- | M] () – C:\Users\kristyn\Documents\070109 050.JPG
[2078/11/24 09:33:46 | 000,059,094 | —- | M] () – C:\Users\kristyn\Documents\070109 049.JPG
[2078/11/24 09:31:54 | 000,060,832 | —- | M] () – C:\Users\kristyn\Documents\070109 048.JPG
[2078/11/24 09:17:00 | 000,059,973 | —- | M] () – C:\Users\kristyn\Documents\070109 046.JPG
[2078/11/24 09:16:44 | 000,060,058 | —- | M] () – C:\Users\kristyn\Documents\070109 045.JPG
[2078/11/24 09:16:32 | 000,059,285 | —- | M] () – C:\Users\kristyn\Documents\070109 044.JPG
[2078/11/24 09:07:10 | 000,060,055 | —- | M] () – C:\Users\kristyn\Documents\070109 043.JPG
[2078/11/24 09:06:54 | 000,059,263 | —- | M] () – C:\Users\kristyn\Documents\070109 042.JPG
[2078/11/24 09:04:46 | 000,058,995 | —- | M] () – C:\Users\kristyn\Documents\070109 041.JPG
[2078/11/24 08:41:22 | 000,059,723 | —- | M] () – C:\Users\kristyn\Documents\070109 040.JPG
[2078/11/24 08:41:12 | 000,059,683 | —- | M] () – C:\Users\kristyn\Documents\070109 039.JPG
[2078/11/24 08:39:48 | 000,060,551 | —- | M] () – C:\Users\kristyn\Documents\070109 038.JPG
[2078/11/24 08:18:32 | 000,060,520 | —- | M] () – C:\Users\kristyn\Documents\070109 037.JPG
[2078/11/24 07:39:12 | 000,061,741 | —- | M] () – C:\Users\kristyn\Documents\070109 035.JPG
[2078/11/24 07:05:24 | 000,058,657 | —- | M] () – C:\Users\kristyn\Documents\070109 034.JPG
[2078/11/24 07:04:16 | 000,059,995 | —- | M] () – C:\Users\kristyn\Documents\070109 033.JPG
[2078/11/24 07:03:56 | 000,058,979 | —- | M] () – C:\Users\kristyn\Documents\070109 032.JPG
[2078/11/24 07:01:48 | 000,059,296 | —- | M] () – C:\Users\kristyn\Documents\070109 031.JPG
[2078/11/24 06:59:06 | 000,058,936 | —- | M] () – C:\Users\kristyn\Documents\070109 030.JPG
[2078/11/24 05:26:24 | 000,060,419 | —- | M] () – C:\Users\kristyn\Documents\070109 029.JPG
[2078/11/24 05:26:10 | 000,060,641 | —- | M] () – C:\Users\kristyn\Documents\070109 028.JPG
[2078/11/24 05:26:00 | 000,060,425 | —- | M] () – C:\Users\kristyn\Documents\070109 027.JPG
[2078/11/11 15:10:20 | 000,058,893 | —- | M] () – C:\Users\kristyn\Documents\070109 026.JPG
[2078/11/11 15:08:56 | 000,058,979 | —- | M] () – C:\Users\kristyn\Documents\070109 025.JPG
[2078/11/11 15:08:18 | 000,058,506 | —- | M] () – C:\Users\kristyn\Documents\070109 024.JPG
[2078/11/11 15:08:08 | 000,059,444 | —- | M] () – C:\Users\kristyn\Documents\070109 023.JPG
[2078/11/11 15:07:56 | 000,059,125 | —- | M] () – C:\Users\kristyn\Documents\070109 022.JPG
[2078/11/11 14:43:54 | 000,057,359 | —- | M] () – C:\Users\kristyn\Documents\070109 021.JPG
[2078/11/11 14:42:54 | 000,059,187 | —- | M] () – C:\Users\kristyn\Documents\070109 020.JPG
[2078/11/11 14:42:40 | 000,058,715 | —- | M] () – C:\Users\kristyn\Documents\070109 019.JPG
[2078/11/11 14:42:08 | 000,059,474 | —- | M] () – C:\Users\kristyn\Documents\070109 018.JPG
[2078/11/11 14:41:28 | 000,059,290 | —- | M] () – C:\Users\kristyn\Documents\070109 017.JPG
[2078/11/11 14:41:16 | 000,059,223 | —- | M] () – C:\Users\kristyn\Documents\070109 016.JPG
[2078/11/11 14:40:44 | 000,060,623 | —- | M] () – C:\Users\kristyn\Documents\070109 015.JPG
[2078/11/11 14:40:14 | 000,061,016 | —- | M] () – C:\Users\kristyn\Documents\070109 014.JPG
[2078/11/11 14:39:30 | 000,060,868 | —- | M] () – C:\Users\kristyn\Documents\070109 013.JPG
[2078/11/11 14:39:04 | 000,059,050 | —- | M] () – C:\Users\kristyn\Documents\070109 012.JPG
[2078/11/11 14:38:48 | 000,059,418 | —- | M] () – C:\Users\kristyn\Documents\070109 011.JPG
[2078/11/11 14:38:26 | 000,059,348 | —- | M] () – C:\Users\kristyn\Documents\070109 010.JPG
[2078/11/11 14:38:12 | 000,059,386 | —- | M] () – C:\Users\kristyn\Documents\070109 009.JPG
[2078/11/11 14:37:50 | 000,058,618 | —- | M] () – C:\Users\kristyn\Documents\070109 008.JPG
[2078/11/11 14:37:36 | 000,059,020 | —- | M] () – C:\Users\kristyn\Documents\070109 007.JPG
[2078/11/11 14:37:20 | 000,059,177 | —- | M] () – C:\Users\kristyn\Documents\070109 006.JPG
[2078/11/11 14:36:58 | 000,059,214 | —- | M] () – C:\Users\kristyn\Documents\070109 005.JPG
[2078/11/11 14:36:44 | 000,058,822 | —- | M] () – C:\Users\kristyn\Documents\070109 004.JPG
[2078/11/11 14:30:40 | 000,059,491 | —- | M] () – C:\Users\kristyn\Documents\070109 003.JPG
[2078/11/11 14:29:50 | 000,057,371 | —- | M] () – C:\Users\kristyn\Documents\070109 002.JPG
[2010/11/16 17:22:59 | 000,000,424 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{EF181C9C-A97E-4F97-AF98-3186403252C7}.job
[2010/11/16 17:19:59 | 000,000,416 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{A45ABC42-C9BC-4516-BD9D-9B67032392E0}.job
[2010/11/16 17:17:56 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/16 17:15:40 | 000,003,680 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/11/16 17:15:40 | 000,003,680 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/11/16 17:15:34 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/11/16 17:15:32 | 3747,655,680 | -HS- | M] () – C:\hiberfil.sys
[2010/11/16 17:14:38 | 000,000,836 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/11/16 17:14:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/16 16:59:05 | 003,910,384 | R— | M] () – C:\Users\kristyn\Desktop\ComboFix.exe
[2010/11/16 16:46:59 | 000,000,422 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{AFD52921-7C36-4FC1-AAD4-F0EA44948EB2}.job
[2010/11/15 22:57:47 | 340,253,247 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/11/15 18:28:41 | 003,232,349 | —- | M] () – C:\Users\kristyn\Desktop\MOV-0004.rar
[2010/11/14 16:12:24 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2010/11/13 21:12:06 | 000,000,680 | —- | M] () – C:\Users\kristyn\AppData\Local\d3d9caps.dat
[2010/11/13 14:56:43 | 000,001,513 | —- | M] () – C:\Users\Public\Desktop\Souptoys Playsets.lnk
[2010/11/13 14:56:37 | 000,000,897 | —- | M] () – C:\Users\Public\Desktop\Toybox.lnk
[2010/11/13 14:40:44 | 000,000,952 | —- | M] () – C:\Users\kristyn\Desktop\Sight Words Sentence Builder.lnk
[2010/11/13 14:00:37 | 000,000,135 | —- | M] () – C:\Users\kristyn\Desktop\IObit Freeware.url
[2010/11/13 09:05:04 | 000,000,818 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/11 21:20:27 | 000,001,079 | —- | M] () – C:\Users\kristyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/11/11 21:20:27 | 000,001,055 | —- | M] () – C:\Users\kristyn\Desktop\Spybot - Search & Destroy.lnk
[2010/11/08 01:20:24 | 000,089,088 | —- | M] () – C:\Windows\MBR.exe
[2010/11/07 20:49:48 | 000,631,848 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/11/07 20:49:48 | 000,108,626 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/11/07 06:30:20 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2010/11/02 18:54:36 | 000,000,193 | —- | M] () – C:\Users\kristyn\Desktop\Yahoo! Messenger 10 - Chat, Instant message, SMS, Video Call, PC Calls.url
[2010/11/02 18:27:16 | 000,024,206 | —- | M] () – C:\Users\kristyn\AppData\Roaming\UserTile.png
[2010/10/31 21:29:54 | 000,000,376 | —- | M] () – C:\Windows\ODBC.INI
[2010/10/31 21:17:12 | 000,011,264 | —- | M] () – C:\Users\kristyn\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/28 08:48:07 | 000,002,413 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/10/28 08:38:41 | 000,000,938 | —- | M] () – C:\Users\kristyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/10/28 08:37:58 | 000,000,943 | —- | M] () – C:\Users\kristyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/10/28 08:36:00 | 000,000,632 | RHS- | M] () – C:\Users\kristyn\ntuser.pol
[2010/10/19 14:51:33 | 000,222,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[14 C:\Users\kristyn\Documents\*.tmp files -> C:\Users\kristyn\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/16 16:58:51 | 003,910,384 | R— | C] () – C:\Users\kristyn\Desktop\ComboFix.exe
[2010/11/15 06:55:57 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010/11/15 06:55:57 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/11/15 06:55:57 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2010/11/15 06:55:57 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/11/15 06:55:57 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/11/13 14:56:43 | 000,001,513 | —- | C] () – C:\Users\Public\Desktop\Souptoys Playsets.lnk
[2010/11/13 14:56:37 | 000,000,897 | —- | C] () – C:\Users\Public\Desktop\Toybox.lnk
[2010/11/13 14:40:44 | 000,000,952 | —- | C] () – C:\Users\kristyn\Desktop\Sight Words Sentence Builder.lnk
[2010/11/13 14:00:37 | 000,000,135 | —- | C] () – C:\Users\kristyn\Desktop\IObit Freeware.url
[2010/11/13 09:05:04 | 000,000,818 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/11 21:20:27 | 000,001,079 | —- | C] () – C:\Users\kristyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/11/11 21:20:27 | 000,001,055 | —- | C] () – C:\Users\kristyn\Desktop\Spybot - Search & Destroy.lnk
[2010/11/02 18:27:16 | 000,024,206 | —- | C] () – C:\Users\kristyn\AppData\Roaming\UserTile.png
[2010/11/01 02:00:55 | 000,000,680 | —- | C] () – C:\Users\kristyn\AppData\Local\d3d9caps.dat
[2010/10/28 10:59:54 | 000,011,264 | —- | C] () – C:\Users\kristyn\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/28 10:09:28 | 000,005,949 | —- | C] () – C:\Users\kristyn\_setup.xml
[2010/10/28 08:50:05 | 000,000,162 | -H– | C] () – C:\Users\kristyn\Documents\~$w to cope with your abuser.doc
[2010/10/28 08:50:05 | 000,000,162 | -H– | C] () – C:\Users\kristyn\Documents\~$purchased all of these for uploads to my new mp3 player.doc
[2010/10/28 08:50:05 | 000,000,162 | -H– | C] () – C:\Users\kristyn\Documents\~$ladya.doc
[2010/10/28 08:50:05 | 000,000,162 | -H– | C] () – C:\Users\kristyn\Documents\~$ammy Nominees 2000.doc
[2010/10/28 08:50:04 | 005,154,304 | —- | C] () – C:\Users\kristyn\Documents\WindowsDefender.msi
[2010/10/28 08:50:04 | 000,141,091 | —- | C] () – C:\Users\kristyn\Documents\w_geta04.pdf
[2010/10/28 08:50:04 | 000,080,896 | —- | C] () – C:\Users\kristyn\Documents\Wrap up.doc
[2010/10/28 08:50:04 | 000,032,768 | —- | C] () – C:\Users\kristyn\Documents\Write the names down of the last 21 people that wrote on your wall.doc
[2010/10/28 08:49:57 | 000,207,360 | —- | C] () – C:\Users\kristyn\Documents\Questionskristynsharpe.doc
[2010/10/28 08:49:57 | 000,207,360 | —- | C] () – C:\Users\kristyn\Documents\Questions.doc
[2010/10/28 08:49:57 | 000,055,755 | —- | C] () – C:\Users\kristyn\Documents\Photo on 2010-07-04 at 14.19.jpg
[2010/10/28 08:49:57 | 000,025,600 | —- | C] () – C:\Users\kristyn\Documents\resume.doc
[2010/10/28 08:49:55 | 000,352,256 | —- | C] () – C:\Users\kristyn\Documents\phonenumbers.xls
[2010/10/28 08:49:54 | 001,495,945 | —- | C] () – C:\Users\kristyn\Documents\phone080909.xml
[2010/10/28 08:49:54 | 000,893,815 | —- | C] () – C:\Users\kristyn\Documents\myphone080109.xml
[2010/10/28 08:49:53 | 000,147,456 | —- | C] () – C:\Users\kristyn\Documents\movie quiz.doc
[2010/10/28 08:49:53 | 000,005,473 | —- | C] () – C:\Users\kristyn\Documents\me1..jpg
[2010/10/28 08:49:43 | 000,506,287 | —- | C] () – C:\Users\kristyn\Documents\MagiCall2_PPC_Eng.CAB
[2010/10/28 08:49:43 | 000,217,667 | —- | C] () – C:\Users\kristyn\Documents\march 09.xps
[2010/10/28 08:49:43 | 000,199,944 | —- | C] () – C:\Users\kristyn\Documents\MagiCall2_SP_Eng.CAB
[2010/10/28 08:49:43 | 000,081,408 | —- | C] () – C:\Users\kristyn\Documents\ladya.doc
[2010/10/28 08:49:43 | 000,025,600 | —- | C] () – C:\Users\kristyn\Documents\Kristyn Sharpe resume.doc
[2010/10/28 08:49:42 | 002,247,123 | —- | C] () – C:\Users\kristyn\Documents\JMC_WindowsMobile_Setup_2.1.zip
[2010/10/28 08:49:42 | 000,217,725 | —- | C] () – C:\Users\kristyn\Documents\jan 09.xps
[2010/10/28 08:49:42 | 000,132,608 | —- | C] () – C:\Users\kristyn\Documents\I purchased all of these for uploads to my new mp3 player.doc
[2010/10/28 08:49:42 | 000,049,664 | —- | C] () – C:\Users\kristyn\Documents\How to cope with your abuser.doc
[2010/10/28 08:49:42 | 000,028,672 | —- | C] () – C:\Users\kristyn\Documents\Grammy Nominees 2000.doc
[2010/10/28 08:49:42 | 000,025,600 | —- | C] () – C:\Users\kristyn\Documents\I return movies.doc
[2010/10/28 08:49:42 | 000,024,576 | —- | C] () – C:\Users\kristyn\Documents\Introduction.doc
[2010/10/28 08:49:42 | 000,024,049 | —- | C] () – C:\Users\kristyn\Documents\jimmy.jpg
[2010/10/28 08:49:41 | 000,671,774 | —- | C] () – C:\Users\kristyn\Documents\flyer4mail.jpg
[2010/10/28 08:49:41 | 000,538,984 | —- | C] () – C:\Users\kristyn\Documents\form_aa151402[1].pdf
[2010/10/28 08:49:41 | 000,220,096 | —- | C] () – C:\Users\kristyn\Documents\feb 09.xps
[2010/10/28 08:49:41 | 000,034,816 | —- | C] () – C:\Users\kristyn\Documents\ETB_direct_deposit.pdf
[2010/10/28 08:49:41 | 000,020,182 | —- | C] () – C:\Users\kristyn\Documents\ew2.pdf
[2010/10/28 08:49:41 | 000,019,968 | —- | C] () – C:\Users\kristyn\Documents\Elvis number one5.doc
[2010/10/28 08:49:38 | 000,190,464 | —- | C] () – C:\Users\kristyn\Documents\Disney Vacation Planner.xls
[2010/10/28 08:49:37 | 000,351,232 | —- | C] () – C:\Users\kristyn\Documents\diconversation.doc
[2010/10/28 08:49:37 | 000,224,648 | —- | C] () – C:\Users\kristyn\Documents\dec 08.xps
[2010/10/28 08:49:37 | 000,121,344 | —- | C] () – C:\Users\kristyn\Documents\DiningOptions.doc
[2010/10/28 08:49:37 | 000,058,880 | —- | C] () – C:\Users\kristyn\Documents\Cover.doc
[2010/10/28 08:49:37 | 000,055,808 | —- | C] () – C:\Users\kristyn\Documents\DiscountAirline.doc
[2010/10/28 08:49:27 | 001,430,713 | —- | C] () – C:\Users\kristyn\Documents\attachments_2009_02_13.zip
[2010/10/28 08:49:27 | 000,082,944 | —- | C] () – C:\Users\kristyn\Documents\Answers to Your Questions.doc
[2010/10/28 08:49:27 | 000,067,072 | —- | C] () – C:\Users\kristyn\Documents\birthdays.doc
[2010/10/28 08:49:26 | 000,133,632 | —- | C] () – C:\Users\kristyn\Documents\Animal.doc
[2010/10/28 08:49:25 | 001,295,064 | —- | C] () – C:\Users\kristyn\Documents\action_plan_englisha.pdf
[2010/10/28 08:49:25 | 000,075,794 | —- | C] () – C:\Users\kristyn\Documents\adobe.jpg
[2010/10/28 08:49:25 | 000,061,216 | —- | C] () – C:\Users\kristyn\Documents\addpoc.pdf
[2010/10/28 08:49:24 | 001,295,064 | —- | C] () – C:\Users\kristyn\Documents\action_plan_english.pdf
[2010/10/28 08:49:24 | 000,297,865 | —- | C] () – C:\Users\kristyn\Documents\28363-r.rtf
[2010/10/28 08:49:24 | 000,259,161 | —- | C] () – C:\Users\kristyn\Documents\2008TaxReturn.PDF
[2010/10/28 08:49:24 | 000,058,672 | —- | C] () – C:\Users\kristyn\Documents\07012009a 016.JPG
[2010/10/28 08:49:24 | 000,058,038 | —- | C] () – C:\Users\kristyn\Documents\07012009a 015.JPG
[2010/10/28 08:49:24 | 000,021,453 | —- | C] () – C:\Users\kristyn\Documents\1222bill.pdf
[2010/10/28 08:49:23 | 000,059,392 | —- | C] () – C:\Users\kristyn\Documents\07012009a 007.JPG
[2010/10/28 08:49:23 | 000,059,229 | —- | C] () – C:\Users\kristyn\Documents\07012009a 009.JPG
[2010/10/28 08:49:23 | 000,059,227 | —- | C] () – C:\Users\kristyn\Documents\07012009a 008.JPG
[2010/10/28 08:49:23 | 000,059,189 | —- | C] () – C:\Users\kristyn\Documents\07012009a 010.JPG
[2010/10/28 08:49:23 | 000,058,993 | —- | C] () – C:\Users\kristyn\Documents\07012009a 014.JPG
[2010/10/28 08:49:23 | 000,058,721 | —- | C] () – C:\Users\kristyn\Documents\07012009a 012.JPG
[2010/10/28 08:49:23 | 000,058,713 | —- | C] () – C:\Users\kristyn\Documents\07012009a 011.JPG
[2010/10/28 08:49:23 | 000,058,621 | —- | C] () – C:\Users\kristyn\Documents\07012009a 013.JPG
[2010/10/28 08:49:22 | 000,061,157 | —- | C] () – C:\Users\kristyn\Documents\070109 050.JPG
[2010/10/28 08:49:22 | 000,060,927 | —- | C] () – C:\Users\kristyn\Documents\070109 051.JPG
[2010/10/28 08:49:22 | 000,060,832 | —- | C] () – C:\Users\kristyn\Documents\070109 048.JPG
[2010/10/28 08:49:22 | 000,060,539 | —- | C] () – C:\Users\kristyn\Documents\070109 055.JPG
[2010/10/28 08:49:22 | 000,060,109 | —- | C] () – C:\Users\kristyn\Documents\070109 056.JPG
[2010/10/28 08:49:22 | 000,060,053 | —- | C] () – C:\Users\kristyn\Documents\07012009a 006.JPG
[2010/10/28 08:49:22 | 000,060,027 | —- | C] () – C:\Users\kristyn\Documents\070109 057.JPG
[2010/10/28 08:49:22 | 000,060,016 | —- | C] () – C:\Users\kristyn\Documents\07012009a 005.JPG
[2010/10/28 08:49:22 | 000,059,761 | —- | C] () – C:\Users\kristyn\Documents\070109 052.JPG
[2010/10/28 08:49:22 | 000,059,711 | —- | C] () – C:\Users\kristyn\Documents\070109 053.JPG
[2010/10/28 08:49:22 | 000,059,610 | —- | C] () – C:\Users\kristyn\Documents\07012009a 004.JPG
[2010/10/28 08:49:22 | 000,059,396 | —- | C] () – C:\Users\kristyn\Documents\070109 054.JPG
[2010/10/28 08:49:22 | 000,059,094 | —- | C] () – C:\Users\kristyn\Documents\070109 049.JPG
[2010/10/28 08:49:22 | 000,058,862 | —- | C] () – C:\Users\kristyn\Documents\070109 058.JPG
[2010/10/28 08:49:22 | 000,027,135 | —- | C] () – C:\Users\kristyn\Documents\07012009a 003.JPG
[2010/10/28 08:49:21 | 000,061,741 | —- | C] () – C:\Users\kristyn\Documents\070109 035.JPG
[2010/10/28 08:49:21 | 000,060,641 | —- | C] () – C:\Users\kristyn\Documents\070109 028.JPG
[2010/10/28 08:49:21 | 000,060,551 | —- | C] () – C:\Users\kristyn\Documents\070109 038.JPG
[2010/10/28 08:49:21 | 000,060,520 | —- | C] () – C:\Users\kristyn\Documents\070109 037.JPG
[2010/10/28 08:49:21 | 000,060,425 | —- | C] () – C:\Users\kristyn\Documents\070109 027.JPG
[2010/10/28 08:49:21 | 000,060,419 | —- | C] () – C:\Users\kristyn\Documents\070109 029.JPG
[2010/10/28 08:49:21 | 000,060,058 | —- | C] () – C:\Users\kristyn\Documents\070109 045.JPG
[2010/10/28 08:49:21 | 000,060,055 | —- | C] () – C:\Users\kristyn\Documents\070109 043.JPG
[2010/10/28 08:49:21 | 000,059,995 | —- | C] () – C:\Users\kristyn\Documents\070109 033.JPG
[2010/10/28 08:49:21 | 000,059,973 | —- | C] () – C:\Users\kristyn\Documents\070109 046.JPG
[2010/10/28 08:49:21 | 000,059,723 | —- | C] () – C:\Users\kristyn\Documents\070109 040.JPG
[2010/10/28 08:49:21 | 000,059,683 | —- | C] () – C:\Users\kristyn\Documents\070109 039.JPG
[2010/10/28 08:49:21 | 000,059,444 | —- | C] () – C:\Users\kristyn\Documents\070109 023.JPG
[2010/10/28 08:49:21 | 000,059,296 | —- | C] () – C:\Users\kristyn\Documents\070109 031.JPG
[2010/10/28 08:49:21 | 000,059,285 | —- | C] () – C:\Users\kristyn\Documents\070109 044.JPG
[2010/10/28 08:49:21 | 000,059,263 | —- | C] () – C:\Users\kristyn\Documents\070109 042.JPG
[2010/10/28 08:49:21 | 000,058,995 | —- | C] () – C:\Users\kristyn\Documents\070109 041.JPG
[2010/10/28 08:49:21 | 000,058,979 | —- | C] () – C:\Users\kristyn\Documents\070109 032.JPG
[2010/10/28 08:49:21 | 000,058,979 | —- | C] () – C:\Users\kristyn\Documents\070109 025.JPG
[2010/10/28 08:49:21 | 000,058,936 | —- | C] () – C:\Users\kristyn\Documents\070109 030.JPG
[2010/10/28 08:49:21 | 000,058,893 | —- | C] () – C:\Users\kristyn\Documents\070109 026.JPG
[2010/10/28 08:49:21 | 000,058,657 | —- | C] () – C:\Users\kristyn\Documents\070109 034.JPG
[2010/10/28 08:49:21 | 000,058,506 | —- | C] () – C:\Users\kristyn\Documents\070109 024.JPG
[2010/10/28 08:49:21 | 000,058,305 | —- | C] () – C:\Users\kristyn\Documents\070109 036.JPG
[2010/10/28 08:49:20 | 000,061,016 | —- | C] () – C:\Users\kristyn\Documents\070109 014.JPG
[2010/10/28 08:49:20 | 000,060,868 | —- | C] () – C:\Users\kristyn\Documents\070109 013.JPG
[2010/10/28 08:49:20 | 000,060,623 | —- | C] () – C:\Users\kristyn\Documents\070109 015.JPG
[2010/10/28 08:49:20 | 000,059,491 | —- | C] () – C:\Users\kristyn\Documents\070109 003.JPG
[2010/10/28 08:49:20 | 000,059,474 | —- | C] () – C:\Users\kristyn\Documents\070109 018.JPG
[2010/10/28 08:49:20 | 000,059,418 | —- | C] () – C:\Users\kristyn\Documents\070109 011.JPG
[2010/10/28 08:49:20 | 000,059,386 | —- | C] () – C:\Users\kristyn\Documents\070109 009.JPG
[2010/10/28 08:49:20 | 000,059,348 | —- | C] () – C:\Users\kristyn\Documents\070109 010.JPG
[2010/10/28 08:49:20 | 000,059,290 | —- | C] () – C:\Users\kristyn\Documents\070109 017.JPG
[2010/10/28 08:49:20 | 000,059,223 | —- | C] () – C:\Users\kristyn\Documents\070109 016.JPG
[2010/10/28 08:49:20 | 000,059,214 | —- | C] () – C:\Users\kristyn\Documents\070109 005.JPG
[2010/10/28 08:49:20 | 000,059,187 | —- | C] () – C:\Users\kristyn\Documents\070109 020.JPG
[2010/10/28 08:49:20 | 000,059,177 | —- | C] () – C:\Users\kristyn\Documents\070109 006.JPG
[2010/10/28 08:49:20 | 000,059,125 | —- | C] () – C:\Users\kristyn\Documents\070109 022.JPG
[2010/10/28 08:49:20 | 000,059,050 | —- | C] () – C:\Users\kristyn\Documents\070109 012.JPG
[2010/10/28 08:49:20 | 000,059,020 | —- | C] () – C:\Users\kristyn\Documents\070109 007.JPG
[2010/10/28 08:49:20 | 000,058,822 | —- | C] () – C:\Users\kristyn\Documents\070109 004.JPG
[2010/10/28 08:49:20 | 000,058,715 | —- | C] () – C:\Users\kristyn\Documents\070109 019.JPG
[2010/10/28 08:49:20 | 000,058,618 | —- | C] () – C:\Users\kristyn\Documents\070109 008.JPG
[2010/10/28 08:49:20 | 000,057,371 | —- | C] () – C:\Users\kristyn\Documents\070109 002.JPG
[2010/10/28 08:49:20 | 000,057,359 | —- | C] () – C:\Users\kristyn\Documents\070109 021.JPG
[2010/10/28 08:49:18 | 005,029,934 | —- | C] () – C:\Users\kristyn\Documents\070109 001.AVI
[2010/10/28 08:49:18 | 001,065,602 | —- | C] () – C:\Users\kristyn\Documents\014.JPG
[2010/10/28 08:49:18 | 000,000,193 | —- | C] () – C:\Users\kristyn\Desktop\Yahoo! Messenger 10 - Chat, Instant message, SMS, Video Call, PC Calls.url
[2010/10/28 08:49:15 | 003,232,349 | —- | C] () – C:\Users\kristyn\Desktop\MOV-0004.rar
[2010/10/28 08:49:13 | 002,247,123 | —- | C] () – C:\Users\kristyn\Desktop\JMC_WindowsMobile_Setup_2.1.zip
[2010/10/28 08:43:22 | 000,000,422 | -H– | C] () – C:\Windows\tasks\User_Feed_Synchronization-{AFD52921-7C36-4FC1-AAD4-F0EA44948EB2}.job
[2010/10/28 08:38:41 | 000,000,938 | —- | C] () – C:\Users\kristyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/10/28 08:37:58 | 000,000,943 | —- | C] () – C:\Users\kristyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/10/28 08:36:00 | 000,000,632 | RHS- | C] () – C:\Users\kristyn\ntuser.pol
[2010/10/28 08:35:58 | 000,000,258 | —- | C] () – C:\Users\kristyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2010/10/28 08:35:58 | 000,000,240 | —- | C] () – C:\Users\kristyn\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/06/26 16:21:02 | 000,015,498 | —- | C] () – C:\Windows\VX3000.ini
[2009/02/22 19:58:14 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/01/15 16:03:06 | 000,026,760 | R— | C] () – C:\Windows\System32\drivers\swmsflt.sys
[2008/12/18 20:48:12 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2008/11/12 10:07:24 | 000,000,419 | —- | C] () – C:\Windows\BRWMARK.INI
[2008/11/12 10:07:24 | 000,000,027 | —- | C] () – C:\Windows\BRPP2KA.INI
[2008/11/12 10:04:19 | 000,000,226 | —- | C] () – C:\Windows\Brpfx04a.ini
[2008/11/12 10:04:19 | 000,000,094 | —- | C] () – C:\Windows\brpcfx.ini
[2008/11/12 10:02:11 | 000,000,009 | —- | C] () – C:\Windows\Brfaxrx.ini
[2008/11/12 10:02:08 | 000,106,496 | —- | C] () – C:\Windows\System32\BrMuSNMP.dll
[2008/02/11 19:55:18 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1437.dll
[2006/11/02 06:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 01:10:15 | 000,002,000 | —- | C] () – C:\Windows\System32\keyboard.drv
[2005/05/06 19:06:00 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\kristyn\Documents\070109 001.AVI:TOC.WMV

< End of report >

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI