What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

unknown malware?

43 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Please Help. Random advertisements play in the background for 5 to 15 seconds at a time, randomly through out the day even if no programs are running. I scanned my system with Malware anti-malware but it didn't find anything.


Thanks in Advance!




here is my log:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:31:17 PM, on 2/7/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18999)
Boot mode: Normal

Running processes:
C:\Windows\MHotKey.exe
C:\Program Files (x86)\Greatis\RegRunSuite\watchdog.exe
C:\Windows\ChiFuncExt.exe
C:\Users\ME\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe
C:\Users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\CNYHKey.exe
C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\ModLedKey.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Java\jre6\bin\jucheck.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\iTunes\iTunes.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\ME\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACG…amp;m=dx4200-09
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files (x86)\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files (x86)\google\googletoolbar1.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [LchDrvKey] LchDrvKey.exe
O4 - HKLM\..\Run: [LedKey] CNYHKey.exe
O4 - HKLM\..\Run: [Smart Copy] "C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe" -A
O4 - HKLM\..\Run: [P2Go_Menu] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [RegRun WinBait] C:\Windows\winbait.exe
O4 - HKLM\..\Run: [@RegRunOnSecure] C:\PROGRA~2\Greatis\REGRUN~1\OnSecure.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [Google Update] "C:\Users\ME\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [caclcmd] rundll32 "C:\Windows\fcad32.dll",DllGetVersion
O4 - HKCU\..\Run: [ANT Agent] C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe
O4 - HKCU\..\Run: [Startup] C:\Users\ME\AppData\Roaming\Startup.js
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = C:\Users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: STARTUP.del
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {09E90109-A9AA-4980-BCEF-76F8D924E902} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {09E90109-A9AA-4980-BCEF-76F8D924E902} - (no file) (HKCU)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Unknown owner - C:\Windows\system32\agr64svc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: BootlogService - Greatis Software © - C:\Program Files (x86)\Greatis\RegRunSuite\BootLogService.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

–
End of file - 10454 bytes
Post #2
Hi UC_Caifan, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.


Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Right click dds.scr and select "Run as Administrator" to run the tool.
  • When done, DDS.txt will open.An additional log called Attach.txt should appear minimized on the task bar.
  • Save both reports to your desktop before closing the DDS window.

Please post back with
  • MBRCheck log
  • Both logs from DDS
Thanks
Post #3
Thanks for your help Oldman960! here are the logs requested: MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows Vista Home Premium Edition Windows Information: Service Pack 2 (build 6002), 64-bit Base Board Manufacturer: Gateway BIOS Manufacturer: American Megatrends Inc. System Manufacturer: Gateway System Product Name: DX4200-09 Logical Drives Mask: 0x000001fc Kernel Drivers (total 146): 0x0261A000 \SystemRoot\system32\ntoskrnl.exe 0x02B31000 \SystemRoot\system32\hal.dll 0x0060E000 \SystemRoot\system32\kdcom.dll 0x00618000 \SystemRoot\system32\PSHED.dll 0x0062C000 \SystemRoot\system32\CLFS.SYS 0x00689000 \SystemRoot\system32\CI.dll 0x0080E000 \SystemRoot\system32\drivers\Wdf01000.sys 0x008E8000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x008F6000 \SystemRoot\system32\drivers\acpi.sys 0x0094C000 \SystemRoot\system32\drivers\WMILIB.SYS 0x00955000 \SystemRoot\system32\drivers\msisadrv.sys 0x0095F000 \SystemRoot\system32\drivers\pci.sys 0x0098F000 \SystemRoot\System32\drivers\partmgr.sys 0x009A4000 \SystemRoot\system32\drivers\volmgr.sys 0x0073B000 \SystemRoot\System32\drivers\volmgrx.sys 0x009B8000 \SystemRoot\system32\drivers\pciide.sys 0x009BF000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x009CF000 \SystemRoot\System32\drivers\mountmgr.sys 0x009E2000 \SystemRoot\system32\drivers\atapi.sys 0x007A1000 \SystemRoot\system32\drivers\ataport.SYS 0x00A06000 \SystemRoot\system32\drivers\fltmgr.sys 0x00A4D000 \SystemRoot\system32\drivers\fileinfo.sys 0x00A61000 \SystemRoot\System32\Drivers\ksecdd.sys 0x00C04000 \SystemRoot\system32\drivers\ndis.sys 0x00AE8000 \SystemRoot\system32\drivers\msrpc.sys 0x00B38000 \SystemRoot\system32\drivers\NETIO.SYS 0x00E05000 \SystemRoot\System32\drivers\tcpip.sys 0x00F7B000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x01001000 \SystemRoot\System32\Drivers\Ntfs.sys 0x01181000 \SystemRoot\system32\drivers\volsnap.sys 0x011C5000 \SystemRoot\System32\Drivers\spldr.sys 0x011CD000 \SystemRoot\System32\Drivers\mup.sys 0x00FA7000 \SystemRoot\System32\drivers\ecache.sys 0x011DF000 \SystemRoot\system32\drivers\disk.sys 0x00FD3000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x011F3000 \SystemRoot\system32\DRIVERS\AtiPcie.sys 0x00DC7000 \SystemRoot\system32\drivers\crcdisk.sys 0x00DF3000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x00B91000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x00B9A000 \SystemRoot\system32\DRIVERS\processr.sys 0x04609000 \SystemRoot\system32\DRIVERS\atikmdag.sys 0x04C75000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x04D56000 \SystemRoot\System32\drivers\watchdog.sys 0x04E0A000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x04EF7000 \SystemRoot\system32\DRIVERS\yk60x64.sys 0x04F5C000 \SystemRoot\system32\DRIVERS\ohci1394.sys 0x04F6E000 \SystemRoot\system32\DRIVERS\1394BUS.SYS 0x04F7E000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x04F9A000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys 0x04FA7000 \SystemRoot\system32\DRIVERS\usbohci.sys 0x04FB2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x04D66000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x04D77000 \SystemRoot\system32\DRIVERS\parport.sys 0x04D93000 \SystemRoot\system32\DRIVERS\serial.sys 0x04DB0000 \SystemRoot\system32\DRIVERS\serenum.sys 0x05000000 \SystemRoot\system32\DRIVERS\agrsm64.sys 0x0513C000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x0513E000 \SystemRoot\system32\drivers\modem.sys 0x0514D000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x05186000 \SystemRoot\system32\DRIVERS\storport.sys 0x051E3000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x04DBC000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x051F0000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x00BAD000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x04DDF000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x00BDE000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x007C5000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x009EA000 \SystemRoot\system32\DRIVERS\termdd.sys 0x04DEF000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x00800000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x051FC000 \SystemRoot\system32\DRIVERS\swenum.sys 0x0520F000 \SystemRoot\system32\DRIVERS\ks.sys 0x05243000 \SystemRoot\system32\DRIVERS\circlass.sys 0x05254000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x0525F000 \SystemRoot\system32\DRIVERS\umbus.sys 0x0526F000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x052B7000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x052CB000 \SystemRoot\system32\drivers\RtHDMIVX.sys 0x052F6000 \SystemRoot\system32\drivers\portcls.sys 0x05331000 \SystemRoot\system32\drivers\drmk.sys 0x05354000 \SystemRoot\system32\drivers\ksthunk.sys 0x05C01000 \SystemRoot\system32\drivers\RTKVHD64.sys 0x05D64000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x05D6E000 \SystemRoot\System32\Drivers\Null.SYS 0x05D82000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x05DA0000 \SystemRoot\System32\drivers\vga.sys 0x05DAE000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x05DD3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x05DDC000 \SystemRoot\system32\drivers\rdpencdd.sys 0x05DE5000 \SystemRoot\System32\Drivers\Msfs.SYS 0x05D8A000 \SystemRoot\System32\Drivers\Npfs.SYS 0x05DF0000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x0535A000 \SystemRoot\system32\DRIVERS\tdx.sys 0x05377000 \SystemRoot\system32\DRIVERS\smb.sys 0x05392000 \SystemRoot\system32\drivers\afd.sys 0x05E0F000 \SystemRoot\System32\DRIVERS\netbt.sys 0x05E53000 \SystemRoot\system32\DRIVERS\pacer.sys 0x05E71000 \SystemRoot\system32\DRIVERS\netbios.sys 0x05E80000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x05E9B000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x05EE8000 \SystemRoot\system32\drivers\nsiproxy.sys 0x05EF4000 \SystemRoot\System32\Drivers\dfsc.sys 0x05F11000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x05F1A000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x05F2C000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x05F37000 \SystemRoot\System32\Drivers\crashdmp.sys 0x05F45000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x05F51000 \SystemRoot\System32\Drivers\dump_atapi.sys 0x05F59000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0x05F71000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x05F8D000 \SystemRoot\system32\DRIVERS\usbscan.sys 0x05F9D000 \SystemRoot\system32\DRIVERS\usbprint.sys 0x05FA8000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0x05FB3000 \SystemRoot\system32\drivers\RTSTOR64.SYS 0x000D0000 \SystemRoot\System32\win32k.sys 0x05FC7000 \SystemRoot\System32\drivers\Dxapi.sys 0x05FD3000 \SystemRoot\system32\DRIVERS\monitor.sys 0x05FE6000 \SystemRoot\system32\DRIVERS\usbcir.sys 0x05E00000 \SystemRoot\system32\DRIVERS\hidir.sys 0x00400000 \SystemRoot\System32\TSDDD.dll 0x006F0000 \SystemRoot\System32\cdd.dll 0x00870000 \SystemRoot\System32\ATMFD.DLL 0x00DD1000 \SystemRoot\system32\drivers\luafv.sys 0x0720E000 \SystemRoot\system32\drivers\spsys.sys 0x072CC000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x072E0000 \SystemRoot\system32\DRIVERS\nwifi.sys 0x07314000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x0731F000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x07337000 \SystemRoot\system32\drivers\HTTP.sys 0x0740F000 \SystemRoot\System32\DRIVERS\srvnet.sys 0x07438000 \SystemRoot\System32\Drivers\fastfat.SYS 0x0746D000 \SystemRoot\system32\DRIVERS\bowser.sys 0x0748B000 \SystemRoot\System32\drivers\mpsdrv.sys 0x074A5000 \SystemRoot\system32\drivers\mrxdav.sys 0x074CC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x074F5000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x0753E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x0755D000 \SystemRoot\System32\DRIVERS\srv2.sys 0x07808000 \SystemRoot\System32\DRIVERS\srv.sys 0x078B4000 \SystemRoot\system32\drivers\peauth.sys 0x0796A000 \SystemRoot\System32\Drivers\secdrv.SYS 0x07975000 \SystemRoot\System32\drivers\tcpipreg.sys 0x07985000 \SystemRoot\system32\DRIVERS\WUDFRd.sys 0x079A5000 \SystemRoot\system32\DRIVERS\WUDFPf.sys 0x079BB000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x774E0000 \Windows\System32\ntdll.dll Processes (total 78): 0 System Idle Process 4 System 456 C:\Windows\System32\smss.exe 556 csrss.exe 608 C:\Windows\System32\wininit.exe 628 csrss.exe 664 C:\Windows\System32\services.exe 676 C:\Windows\System32\lsass.exe 684 C:\Windows\System32\lsm.exe 736 C:\Windows\System32\winlogon.exe 872 C:\Windows\System32\svchost.exe 932 C:\Windows\System32\svchost.exe 984 C:\Windows\System32\svchost.exe 192 C:\Windows\System32\Ati2evxx.exe 276 C:\Windows\System32\svchost.exe 332 C:\Windows\System32\svchost.exe 464 C:\Windows\System32\svchost.exe 560 C:\Windows\System32\audiodg.exe 620 C:\Windows\System32\svchost.exe 864 C:\Windows\System32\SLsvc.exe 1032 C:\Windows\System32\svchost.exe 1144 C:\Windows\System32\svchost.exe 1352 C:\Windows\System32\spoolsv.exe 1376 C:\Windows\System32\svchost.exe 1828 C:\Windows\System32\Ati2evxx.exe 1348 C:\Windows\System32\taskeng.exe 404 C:\Windows\System32\dwm.exe 1936 C:\Windows\mHotkey.exe 1956 C:\Windows\System32\taskeng.exe 1992 C:\Windows\explorer.exe 2100 C:\Windows\System32\taskeng.exe 2156 C:\Windows\ChiFuncExt.exe 2196 C:\Windows\System32\agr64svc.exe 2236 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 2256 C:\Program Files (x86)\Bonjour\mDNSResponder.exe 2304 C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe 2440 C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE 2524 C:\Windows\System32\svchost.exe 2536 C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe 2616 C:\Windows\System32\svchost.exe 2660 C:\Windows\System32\svchost.exe 2708 C:\Windows\System32\SearchIndexer.exe 2756 C:\Windows\System32\rundll32.exe 2968 WUDFHost.exe 1268 C:\Program Files\Windows Defender\MSASCui.exe 2736 C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE 1788 C:\Windows\RAVCpl64.exe 336 C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe 2796 C:\Users\ME\AppData\Local\Google\Update\GoogleUpdate.exe 3068 C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe 2288 C:\Windows\System32\wscript.exe 756 C:\Users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe 1784 C:\Windows\CNYHKey.exe 1160 C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe 928 C:\Program Files (x86)\Java\jre6\bin\jusched.exe 2860 C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe 1900 C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe 2476 C:\Program Files (x86)\iTunes\iTunesHelper.exe 1404 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 3140 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe 3172 C:\Windows\ModLEDKey.exe 3344 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 3628 C:\Program Files\Windows Media Player\wmpnscfg.exe 220 C:\Program Files\Windows Media Player\wmpnetwk.exe 3828 C:\Program Files (x86)\iPod\bin\iPodService.exe 3676 C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe 1568 C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe 3112 C:\Windows\System32\mshta.exe 964 C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe 1272 C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe 4600 C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe 3868 C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe 4156 C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe 4192 WmiPrvSE.exe 4744 C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe 2096 C:\Windows\System32\SearchProtocolHost.exe 4792 C:\Windows\System32\SearchFilterHost.exe 1888 C:\Users\ME\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000002`71200000 (NTFS) PhysicalDrive0 Model Number: WDCWD6400AAKS-22A7B2, Rev: 01.03B01 Size Device Name MBR Status ——————————————– 596 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: 53902D02D6A9EDB1C16B4443A248CC81F6527D29 Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done! DDS (Ver_10-12-12.02) - NTFS_AMD64 Run by [removed] at 0:27:14.51 on Wed 02/09/2011 Internet Explorer: 8.0.6001.18999 BrowserJavaVersion: 1.6.0_15 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3838.2350 [GMT -8:00] SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\Ati2evxx.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\MHotKey.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\ChiFuncExt.exe C:\Windows\system32\agr64svc.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\Bonjour\mDNSResponder.exe C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\RUNDLL32.EXE C:\Windows\system32\WUDFHost.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE C:\Windows\RAVCpl64.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe C:\Users\ME\AppData\Local\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe C:\Windows\System32\WScript.exe C:\Users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Windows\CNYHKey.exe C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe C:\Program Files (x86)\Java\jre6\bin\jusched.exe C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Windows\ModLedKey.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\iPod\bin\iPodService.exe C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\System32\mshta.exe C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\ME\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=1208&m=dx4200-09 uInternet Settings,ProxyOverride = uInternet Settings,ProxyServer = http=127.0.0.1:18810 BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files (x86)\google\googletoolbar1.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files (x86)\google\googletoolbar1.dll uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter uRun: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup uRun: [Google Update] "C:\Users\ME\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe uRun: [caclcmd] rundll32 "C:\Windows\fcad32.dll",DllGetVersion uRun: [ANT Agent] C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe uRun: [Startup] C:\Users\ME\AppData\Roaming\Startup.js mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [LchDrvKey] LchDrvKey.exe mRun: [LedKey] CNYHKey.exe mRun: [Smart Copy] "C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe" -A mRun: [eRecoveryService] mRun: [P2Go_Menu] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" mRun: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start mRun: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [RegRun WinBait] C:\Windows\winbait.exe mRun: [@RegRunOnSecure] C:\PROGRA~2\Greatis\REGRUN~1\OnSecure.exe StartupFolder: C:\Users\ME\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe StartupFolder: C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STARTUP.del StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: {09E90109-A9AA-4980-BCEF-76F8D924E902} IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL SEH: ShellObj Class: {f552dde6-2090-4bf4-b924-6141e87789a5} - C:\PROGRA~2\Greatis\REGRUN~1\RRShell.dll TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun-x64: [CanonSolutionMenu] "C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" /logon mRun-x64: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon mRun-x64: [RtHDVCpl] RAVCpl64.exe mRun-x64: [Skytel] Skytel.exe mRun-x64: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" IE-X64: {09E90109-A9AA-4980-BCEF-76F8D924E902} ================= FIREFOX =================== FF - ProfilePath - C:\Users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\ FF - prefs.js: network.proxy.type - 2 FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll FF - plugin: C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll FF - plugin: C:\Users\ME\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: C:\Users\ME\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll FF - plugin: C:\Windows\system32\C2MP\npdivx32.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - Ext: vShare Plugin: vshare@toolbar - %profile%\extensions\vshare@toolbar FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: Move Media Player: [removed] - C:\Users\ME\AppData\Roaming\Move Networks FF - Ext: XULRunner: {9C14CB18-1C29-4321-9F2E-E2841195CB52} - C:\Users\ME\AppData\Local\{9C14CB18-1C29-4321-9F2E-E2841195CB52} ============= SERVICES / DRIVERS =============== R2 ETService;Empowering Technology Service;C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe [2008-12-24 24576] R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx64coinst,serviceStartProc –> RUNDLL32.EXE ykx64coinst,serviceStartProc [?] R3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk60x64.sys [2008-8-5 392192] S2 BootlogService;BootlogService;C:\Program Files (x86)\Greatis\RegRunSuite\BootLogService.exe [2011-2-7 65304] S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-10-20 89920] S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-9-28 51712] =============== File Associations =============== JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %* =============== Created Last 30 ================ 2011-02-09 07:27:14 129 —-a-w- C:\Users\ME\AppData\Roaming\3057.bat 2011-02-09 07:27:13 227840 —-a-w- C:\Users\ME\AppData\Roaming\uXFyY7NoRO.exe 2011-02-09 06:54:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\dy8hS.exe 2011-02-09 06:54:14 119 —-a-w- C:\Users\ME\AppData\Roaming\4466.bat 2011-02-09 06:29:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\bC4TZ.exe 2011-02-09 06:29:15 119 —-a-w- C:\Users\ME\AppData\Roaming\972.bat 2011-02-09 06:07:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\AZHQudIy.exe 2011-02-09 06:02:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\jmrl9O.exe 2011-02-09 06:02:14 121 —-a-w- C:\Users\ME\AppData\Roaming\3135.bat 2011-02-09 05:57:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\PEQx5qs.exe 2011-02-09 05:57:14 123 —-a-w- C:\Users\ME\AppData\Roaming\251.bat 2011-02-09 05:48:15 127 —-a-w- C:\Users\ME\AppData\Roaming\6484.bat 2011-02-09 05:48:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\HA70bCHj2.exe 2011-02-09 05:15:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\z6NC3IUH.exe 2011-02-09 05:15:14 125 —-a-w- C:\Users\ME\AppData\Roaming\7359.bat 2011-02-09 04:49:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\C5YuU.exe 2011-02-09 04:17:13 227840 —-a-w- C:\Users\ME\AppData\Roaming\ryDZOjti1G.exe 2011-02-09 04:17:13 129 —-a-w- C:\Users\ME\AppData\Roaming\9200.bat 2011-02-09 04:09:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\kHzKH.exe 2011-02-09 04:09:14 119 —-a-w- C:\Users\ME\AppData\Roaming\3027.bat 2011-02-09 03:52:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\hPFlZFSQmh.exe 2011-02-09 03:52:14 129 —-a-w- C:\Users\ME\AppData\Roaming\369.bat 2011-02-09 03:26:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\o5Svhe5xkN.exe 2011-02-09 03:26:14 129 —-a-w- C:\Users\ME\AppData\Roaming\3285.bat 2011-02-09 03:15:13 227840 —-a-w- C:\Users\ME\AppData\Roaming\eIUJ7.exe 2011-02-09 02:47:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\iQzL5QqA.exe 2011-02-09 02:47:14 125 —-a-w- C:\Users\ME\AppData\Roaming\3661.bat 2011-02-09 02:31:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\rQZhyuke.exe 2011-02-09 02:31:15 125 —-a-w- C:\Users\ME\AppData\Roaming\9295.bat 2011-02-09 02:16:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\bWOfFF.exe 2011-02-09 02:16:15 121 —-a-w- C:\Users\ME\AppData\Roaming\1903.bat 2011-02-09 01:43:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\MpnhAEh.exe 2011-02-09 01:43:14 123 —-a-w- C:\Users\ME\AppData\Roaming\3614.bat 2011-02-09 01:21:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\AOSL5Va.exe 2011-02-09 01:21:16 123 —-a-w- C:\Users\ME\AppData\Roaming\7290.bat 2011-02-09 01:04:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\KoJSkLTfZ.exe 2011-02-09 01:04:14 127 —-a-w- C:\Users\ME\AppData\Roaming\4230.bat 2011-02-09 00:49:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\YSYsGyk8.exe 2011-02-09 00:49:14 125 —-a-w- C:\Users\ME\AppData\Roaming\3195.bat 2011-02-09 00:16:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\cOyibzJxJ.exe 2011-02-09 00:16:14 127 —-a-w- C:\Users\ME\AppData\Roaming\2494.bat 2011-02-08 23:47:16 127 —-a-w- C:\Users\ME\AppData\Roaming\969.bat 2011-02-08 23:47:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\fq1l2rTJS.exe 2011-02-08 23:16:16 127 —-a-w- C:\Users\ME\AppData\Roaming\4691.bat 2011-02-08 23:16:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\Mgp8Ltmy9.exe 2011-02-08 22:45:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\tUWmg.exe 2011-02-08 22:45:16 119 —-a-w- C:\Users\ME\AppData\Roaming\2863.bat 2011-02-08 22:20:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\l9zFB2j.exe 2011-02-08 22:20:17 123 —-a-w- C:\Users\ME\AppData\Roaming\7053.bat 2011-02-08 21:47:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\ZoEFz.exe 2011-02-08 21:47:15 119 —-a-w- C:\Users\ME\AppData\Roaming\575.bat 2011-02-08 21:26:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\eelpHLd33C.exe 2011-02-08 21:26:18 129 —-a-w- C:\Users\ME\AppData\Roaming\4885.bat 2011-02-08 21:11:20 227840 —-a-w- C:\Users\ME\AppData\Roaming\UciN0.exe 2011-02-08 21:11:20 119 —-a-w- C:\Users\ME\AppData\Roaming\5797.bat 2011-02-08 20:56:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\aVz0Bh.exe 2011-02-08 20:56:18 121 —-a-w- C:\Users\ME\AppData\Roaming\9723.bat 2011-02-08 20:48:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\h0mlH.exe 2011-02-08 20:48:16 119 —-a-w- C:\Users\ME\AppData\Roaming\4672.bat 2011-02-08 20:23:20 227840 —-a-w- C:\Users\ME\AppData\Roaming\WuCUTX6.exe 2011-02-08 20:23:20 123 —-a-w- C:\Users\ME\AppData\Roaming\4667.bat 2011-02-08 20:18:22 227840 —-a-w- C:\Users\ME\AppData\Roaming\HNFMnIuQQ.exe 2011-02-08 20:18:22 127 —-a-w- C:\Users\ME\AppData\Roaming\4872.bat 2011-02-08 19:50:23 227840 —-a-w- C:\Users\ME\AppData\Roaming\ixZX2vysXk.exe 2011-02-08 19:50:23 129 —-a-w- C:\Users\ME\AppData\Roaming\4851.bat 2011-02-08 19:27:22 227840 —-a-w- C:\Users\ME\AppData\Roaming\dftLZ.exe 2011-02-08 19:27:22 119 —-a-w- C:\Users\ME\AppData\Roaming\7550.bat 2011-02-08 19:13:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\dqv5pP77.exe 2011-02-08 19:13:19 125 —-a-w- C:\Users\ME\AppData\Roaming\7197.bat 2011-02-08 18:47:22 227840 —-a-w- C:\Users\ME\AppData\Roaming\sHzno.exe 2011-02-08 18:47:22 119 —-a-w- C:\Users\ME\AppData\Roaming\6795.bat 2011-02-08 18:42:18 129 —-a-w- C:\Users\ME\AppData\Roaming\2361.bat 2011-02-08 18:42:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\b0I2kGarLQ.exe 2011-02-08 18:17:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\ufympfDb4M.exe 2011-02-08 18:17:18 129 —-a-w- C:\Users\ME\AppData\Roaming\8841.bat 2011-02-08 17:46:20 227840 —-a-w- C:\Users\ME\AppData\Roaming\AudzjcBjU.exe 2011-02-08 17:46:20 127 —-a-w- C:\Users\ME\AppData\Roaming\9595.bat 2011-02-08 17:28:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\KZFbFbAP.exe 2011-02-08 17:28:18 125 —-a-w- C:\Users\ME\AppData\Roaming\1948.bat 2011-02-08 17:13:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\OM3dtmpmu.exe 2011-02-08 17:13:18 127 —-a-w- C:\Users\ME\AppData\Roaming\800.bat 2011-02-08 16:55:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\p54Twu4d4.exe 2011-02-08 16:55:19 127 —-a-w- C:\Users\ME\AppData\Roaming\590.bat 2011-02-08 16:48:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\mexmN2V0.exe 2011-02-08 16:48:18 125 —-a-w- C:\Users\ME\AppData\Roaming\2794.bat 2011-02-08 16:35:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\xKjQHQEhih.exe 2011-02-08 16:35:06 129 —-a-w- C:\Users\ME\AppData\Roaming\931.bat 2011-02-08 16:29:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\k6nVilTcw.exe 2011-02-08 16:29:16 127 —-a-w- C:\Users\ME\AppData\Roaming\7477.bat 2011-02-08 16:17:23 129 —-a-w- C:\Users\ME\AppData\Roaming\5215.bat 2011-02-08 16:17:22 227840 —-a-w- C:\Users\ME\AppData\Roaming\Y092k7jdms.exe 2011-02-08 16:01:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\Vk9GRr.exe 2011-02-08 16:01:17 121 —-a-w- C:\Users\ME\AppData\Roaming\786.bat 2011-02-08 15:28:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\Ap27k.exe 2011-02-08 15:28:18 119 —-a-w- C:\Users\ME\AppData\Roaming\9189.bat 2011-02-08 14:56:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\nbamgGC.exe 2011-02-08 14:56:17 123 —-a-w- C:\Users\ME\AppData\Roaming\523.bat 2011-02-08 14:22:20 119 —-a-w- C:\Users\ME\AppData\Roaming\1429.bat 2011-02-08 14:22:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\VVngR.exe 2011-02-08 14:03:16 125 —-a-w- C:\Users\ME\AppData\Roaming\292.bat 2011-02-08 14:03:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\iGkc9CT7.exe 2011-02-08 13:34:21 227840 —-a-w- C:\Users\ME\AppData\Roaming\iowacY.exe 2011-02-08 13:34:21 121 —-a-w- C:\Users\ME\AppData\Roaming\2431.bat 2011-02-08 13:20:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\sg5NJc.exe 2011-02-08 13:20:19 121 —-a-w- C:\Users\ME\AppData\Roaming\5348.bat 2011-02-08 12:53:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\ANROA.exe 2011-02-08 12:53:19 119 —-a-w- C:\Users\ME\AppData\Roaming\5264.bat 2011-02-08 12:37:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\bGX5iXNT7.exe 2011-02-08 12:37:17 127 —-a-w- C:\Users\ME\AppData\Roaming\4265.bat 2011-02-08 12:04:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\sU6E6Oi4Sd.exe 2011-02-08 12:04:16 129 —-a-w- C:\Users\ME\AppData\Roaming\4313.bat 2011-02-08 11:59:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\Je42oV.exe 2011-02-08 11:59:16 121 —-a-w- C:\Users\ME\AppData\Roaming\4805.bat 2011-02-08 11:39:20 227840 —-a-w- C:\Users\ME\AppData\Roaming\NEXekUzJh.exe 2011-02-08 11:39:20 127 —-a-w- C:\Users\ME\AppData\Roaming\1699.bat 2011-02-08 11:24:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\Gw3UD.exe 2011-02-08 11:24:16 119 —-a-w- C:\Users\ME\AppData\Roaming\213.bat 2011-02-08 10:50:18 119 —-a-w- C:\Users\ME\AppData\Roaming\5400.bat 2011-02-08 10:50:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\PPvI4.exe 2011-02-08 10:25:20 227840 —-a-w- C:\Users\ME\AppData\Roaming\HefCFBg.exe 2011-02-08 10:25:20 123 —-a-w- C:\Users\ME\AppData\Roaming\9292.bat 2011-02-08 09:53:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\MUqeQXJVVA.exe 2011-02-08 09:53:18 129 —-a-w- C:\Users\ME\AppData\Roaming\5736.bat 2011-02-08 09:30:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\EickC.exe 2011-02-08 09:30:19 119 —-a-w- C:\Users\ME\AppData\Roaming\1443.bat 2011-02-08 09:02:20 227840 —-a-w- C:\Users\ME\AppData\Roaming\TQeh61cN2.exe 2011-02-08 09:02:20 127 —-a-w- C:\Users\ME\AppData\Roaming\591.bat 2011-02-08 08:33:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\QFGATY98bI.exe 2011-02-08 08:33:17 129 —-a-w- C:\Users\ME\AppData\Roaming\7117.bat 2011-02-08 08:25:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\d40kGYp7H.exe 2011-02-08 08:25:18 127 —-a-w- C:\Users\ME\AppData\Roaming\8711.bat 2011-02-08 07:55:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\ljWGwx1.exe 2011-02-08 07:55:17 123 —-a-w- C:\Users\ME\AppData\Roaming\3565.bat 2011-02-08 07:26:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\pGfyg.exe 2011-02-08 07:26:18 119 —-a-w- C:\Users\ME\AppData\Roaming\1799.bat 2011-02-08 06:53:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\sVw41JEPj.exe 2011-02-08 06:53:17 127 —-a-w- C:\Users\ME\AppData\Roaming\9213.bat 2011-02-08 06:30:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\aPcoTSzK.exe 2011-02-08 06:30:17 125 —-a-w- C:\Users\ME\AppData\Roaming\9948.bat 2011-02-08 05:59:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\JbvvEzr.exe 2011-02-08 05:59:18 123 —-a-w- C:\Users\ME\AppData\Roaming\5235.bat 2011-02-08 05:27:18 123 —-a-w- C:\Users\ME\AppData\Roaming\9727.bat 2011-02-08 05:27:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\vMzCJUq.exe 2011-02-08 05:14:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\kM2OncpDSf.exe 2011-02-08 05:14:18 129 —-a-w- C:\Users\ME\AppData\Roaming\3001.bat 2011-02-08 04:59:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\ApMa4qby.exe 2011-02-08 04:59:19 125 —-a-w- C:\Users\ME\AppData\Roaming\3908.bat 2011-02-08 04:48:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\le5Q8wotvq.exe 2011-02-08 04:48:19 129 —-a-w- C:\Users\ME\AppData\Roaming\2836.bat 2011-02-08 04:29:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\L76DC4K.exe 2011-02-08 04:22:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\eLigrz.exe 2011-02-08 04:22:18 121 —-a-w- C:\Users\ME\AppData\Roaming\8458.bat 2011-02-08 04:01:29 ——– d—–w- C:\Users\ME\AppData\Roaming\QuickScan 2011-02-08 03:54:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\OiJKB3Zwu.exe 2011-02-08 03:54:17 127 —-a-w- C:\Users\ME\AppData\Roaming\7507.bat 2011-02-08 03:20:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\t9kfB9.exe 2011-02-08 03:20:17 121 —-a-w- C:\Users\ME\AppData\Roaming\7231.bat 2011-02-08 02:50:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\WuoJRhF.exe 2011-02-08 02:50:17 123 —-a-w- C:\Users\ME\AppData\Roaming\2528.bat 2011-02-08 02:18:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\ESpiWMFV.exe 2011-02-08 02:18:19 125 —-a-w- C:\Users\ME\AppData\Roaming\7508.bat 2011-02-08 01:56:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\A1zlDSaeQ.exe 2011-02-08 01:56:17 127 —-a-w- C:\Users\ME\AppData\Roaming\3221.bat 2011-02-08 01:40:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\LLLhih.exe 2011-02-08 01:40:18 121 —-a-w- C:\Users\ME\AppData\Roaming\439.bat 2011-02-08 01:22:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\gipOK.exe 2011-02-08 01:22:19 119 —-a-w- C:\Users\ME\AppData\Roaming\4335.bat 2011-02-08 01:13:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\Kqw32.exe 2011-02-08 01:13:19 119 —-a-w- C:\Users\ME\AppData\Roaming\7970.bat 2011-02-08 00:48:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\EHaOq8A8M4.exe 2011-02-08 00:48:18 129 —-a-w- C:\Users\ME\AppData\Roaming\153.bat 2011-02-08 00:29:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\gIZ7Vq9.exe 2011-02-08 00:29:17 123 —-a-w- C:\Users\ME\AppData\Roaming\1735.bat 2011-02-07 23:55:18 125 —-a-w- C:\Users\ME\AppData\Roaming\7656.bat 2011-02-07 23:55:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\s0pfsTzz.exe 2011-02-07 23:21:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\eosT9.exe 2011-02-07 23:21:17 119 —-a-w- C:\Users\ME\AppData\Roaming\9568.bat 2011-02-07 23:07:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\tTs6y.exe 2011-02-07 23:07:18 119 —-a-w- C:\Users\ME\AppData\Roaming\9403.bat 2011-02-07 22:46:18 119 —-a-w- C:\Users\ME\AppData\Roaming\6643.bat 2011-02-07 22:46:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\orG4u.exe 2011-02-07 22:29:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\PufW3Lsgat.exe 2011-02-07 22:29:19 129 —-a-w- C:\Users\ME\AppData\Roaming\32.bat 2011-02-07 22:00:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\wfx4rNW.exe 2011-02-07 22:00:19 123 —-a-w- C:\Users\ME\AppData\Roaming\8715.bat 2011-02-07 21:33:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\INZlN83.exe 2011-02-07 21:33:19 123 —-a-w- C:\Users\ME\AppData\Roaming\4519.bat 2011-02-07 21:14:22 129 —-a-w- C:\Users\ME\AppData\Roaming\7364.bat 2011-02-07 21:14:21 227840 —-a-w- C:\Users\ME\AppData\Roaming\vtlt1cHtUq.exe 2011-02-07 20:55:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\zcmkAI.exe 2011-02-07 20:55:19 121 —-a-w- C:\Users\ME\AppData\Roaming\4765.bat 2011-02-07 20:29:21 227840 —-a-w- C:\Users\ME\AppData\Roaming\h5dDc.exe 2011-02-07 20:29:21 119 —-a-w- C:\Users\ME\AppData\Roaming\3808.bat 2011-02-07 19:55:20 227840 —-a-w- C:\Users\ME\AppData\Roaming\uQQcKv8oCf.exe 2011-02-07 19:55:20 129 —-a-w- C:\Users\ME\AppData\Roaming\7258.bat 2011-02-07 19:38:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\qF564Bvse.exe 2011-02-07 19:38:19 127 —-a-w- C:\Users\ME\AppData\Roaming\2059.bat 2011-02-07 19:28:17 121 —-a-w- C:\Users\ME\AppData\Roaming\3288.bat 2011-02-07 19:28:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\wmOaFk.exe 2011-02-07 19:09:18 227840 —-a-w- C:\Users\ME\AppData\Roaming\FwaByNg.exe 2011-02-07 19:09:18 123 —-a-w- C:\Users\ME\AppData\Roaming\5583.bat 2011-02-07 18:42:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\nvSOKWo1tp.exe 2011-02-07 18:42:16 129 —-a-w- C:\Users\ME\AppData\Roaming\5476.bat 2011-02-07 18:25:26 121 —-a-w- C:\Users\ME\AppData\Roaming\3348.bat 2011-02-07 18:25:22 227840 —-a-w- C:\Users\ME\AppData\Roaming\k4V3fu.exe 2011-02-07 17:17:25 ——– d—–w- C:\Windows\RestoreSafeDeleted 2011-02-07 17:11:21 37600 —-a-w- C:\Windows\SysWow64\Partizan.exe 2011-02-07 17:11:21 35816 —-a-w- C:\Windows\SysWow64\drivers\Partizan.sys 2011-02-07 17:11:21 24416 —-a-w- C:\Windows\SysWow64\drivers\regguard.sys 2011-02-07 17:05:38 2 –shatr- C:\Windows\winstart.bat 2011-02-07 17:05:34 37600 —-a-w- C:\Windows\System32\Partizan.exe 2011-02-07 17:05:06 20248 —-a-w- C:\Windows\WinBait.org 2011-02-07 17:05:06 20248 —-a-w- C:\Windows\WinBait.exe 2011-02-07 17:05:06 1385240 —-a-w- C:\Windows\RunGuard.exe 2011-02-07 17:05:01 ——– d—–w- C:\Program Files (x86)\Greatis 2011-02-07 16:57:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\CHd7mS38H.exe 2011-02-07 16:57:03 119 —-a-w- C:\Users\ME\AppData\Roaming\3269.bat 2011-02-07 16:57:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\QxA6EJti1m.exe 2011-02-07 16:57:01 129 —-a-w- C:\Users\ME\AppData\Roaming\3720.bat 2011-02-07 16:38:01 127 —-a-w- C:\Users\ME\AppData\Roaming\9982.bat 2011-02-07 16:38:00 227840 —-a-w- C:\Users\ME\AppData\Roaming\hLsB8w3gu.exe 2011-02-07 16:37:59 227840 —-a-w- C:\Users\ME\AppData\Roaming\hGGiPGiBjZ.exe 2011-02-07 16:37:59 129 —-a-w- C:\Users\ME\AppData\Roaming\7762.bat 2011-02-07 16:27:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\mngrlY4kDS.exe 2011-02-07 16:27:01 129 —-a-w- C:\Users\ME\AppData\Roaming\3151.bat 2011-02-07 16:27:00 227840 —-a-w- C:\Users\ME\AppData\Roaming\nuWYzc.exe 2011-02-07 16:27:00 121 —-a-w- C:\Users\ME\AppData\Roaming\1208.bat 2011-02-07 16:10:04 119 —-a-w- C:\Users\ME\AppData\Roaming\6416.bat 2011-02-07 16:10:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\uSYBM.exe 2011-02-07 16:10:00 227840 —-a-w- C:\Users\ME\AppData\Roaming\UZSNVPBOUv.exe 2011-02-07 16:10:00 129 —-a-w- C:\Users\ME\AppData\Roaming\7201.bat 2011-02-07 15:37:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\irtlzKdS.exe 2011-02-07 15:37:00 227840 —-a-w- C:\Users\ME\AppData\Roaming\TsvGJvUn.exe 2011-02-07 15:37:00 125 —-a-w- C:\Users\ME\AppData\Roaming\1007.bat 2011-02-07 15:12:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\bhZv9ZS.exe 2011-02-07 15:12:06 123 —-a-w- C:\Users\ME\AppData\Roaming\8856.bat 2011-02-07 15:12:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\UtBe9VpUg.exe 2011-02-07 15:07:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\aEmDxWv.exe 2011-02-07 15:07:06 123 —-a-w- C:\Users\ME\AppData\Roaming\4989.bat 2011-02-07 15:07:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\foBl0oVGO.exe 2011-02-07 15:07:01 127 —-a-w- C:\Users\ME\AppData\Roaming\3053.bat 2011-02-07 14:39:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\oCraHYzpvn.exe 2011-02-07 14:39:02 129 —-a-w- C:\Users\ME\AppData\Roaming\6553.bat 2011-02-07 14:39:00 227840 —-a-w- C:\Users\ME\AppData\Roaming\xSHkL00t3R.exe 2011-02-07 14:39:00 129 —-a-w- C:\Users\ME\AppData\Roaming\6642.bat 2011-02-07 14:09:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\ZMuCIstm.exe 2011-02-07 14:09:03 125 —-a-w- C:\Users\ME\AppData\Roaming\4708.bat 2011-02-07 14:09:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\CDAqMk4h.exe 2011-02-07 14:09:02 125 —-a-w- C:\Users\ME\AppData\Roaming\689.bat 2011-02-07 13:44:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\fbKpHYghOp.exe 2011-02-07 13:44:02 129 —-a-w- C:\Users\ME\AppData\Roaming\2419.bat 2011-02-07 13:44:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\YMhmcjja.exe 2011-02-07 13:44:01 125 —-a-w- C:\Users\ME\AppData\Roaming\894.bat 2011-02-07 13:24:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\a4why2x.exe 2011-02-07 13:24:01 123 —-a-w- C:\Users\ME\AppData\Roaming\3249.bat 2011-02-07 13:24:00 227840 —-a-w- C:\Users\ME\AppData\Roaming\USHGEwV.exe 2011-02-07 12:58:04 227840 —-a-w- C:\Users\ME\AppData\Roaming\gTN0jE.exe 2011-02-07 12:58:04 121 —-a-w- C:\Users\ME\AppData\Roaming\9882.bat 2011-02-07 12:58:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\TecS19.exe 2011-02-07 12:58:01 121 —-a-w- C:\Users\ME\AppData\Roaming\8610.bat 2011-02-07 12:42:06 129 —-a-w- C:\Users\ME\AppData\Roaming\4514.bat 2011-02-07 12:42:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\bQHK5o5Wye.exe 2011-02-07 12:42:04 227840 —-a-w- C:\Users\ME\AppData\Roaming\UbZMvQB.exe 2011-02-07 12:42:04 123 —-a-w- C:\Users\ME\AppData\Roaming\6238.bat 2011-02-07 12:17:03 125 —-a-w- C:\Users\ME\AppData\Roaming\269.bat 2011-02-07 12:17:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\qRItPiOM.exe 2011-02-07 12:17:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\iVH00Vb5.exe 2011-02-07 12:17:02 125 —-a-w- C:\Users\ME\AppData\Roaming\9312.bat 2011-02-07 12:00:04 227840 —-a-w- C:\Users\ME\AppData\Roaming\IyOeqAg.exe 2011-02-07 12:00:04 123 —-a-w- C:\Users\ME\AppData\Roaming\855.bat 2011-02-07 12:00:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\AehBfbMKO.exe 2011-02-07 11:39:02 125 —-a-w- C:\Users\ME\AppData\Roaming\9090.bat 2011-02-07 11:39:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\i1LrzVov.exe 2011-02-07 11:39:00 227840 —-a-w- C:\Users\ME\AppData\Roaming\aUb5TkBwWP.exe 2011-02-07 11:39:00 129 —-a-w- C:\Users\ME\AppData\Roaming\4606.bat 2011-02-07 11:11:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\Zry1SWmM.exe 2011-02-07 11:11:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\TjvAyTrI2.exe 2011-02-07 11:11:01 127 —-a-w- C:\Users\ME\AppData\Roaming\7807.bat 2011-02-07 11:11:01 125 —-a-w- C:\Users\ME\AppData\Roaming\2438.bat 2011-02-07 10:39:04 227840 —-a-w- C:\Users\ME\AppData\Roaming\PiHDwwJNa.exe 2011-02-07 10:39:04 127 —-a-w- C:\Users\ME\AppData\Roaming\8488.bat 2011-02-07 10:39:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\ea7oiuGkGC.exe 2011-02-07 10:39:03 129 —-a-w- C:\Users\ME\AppData\Roaming\960.bat 2011-02-07 10:22:02 127 —-a-w- C:\Users\ME\AppData\Roaming\6372.bat 2011-02-07 10:22:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\qEsiSv.exe 2011-02-07 10:22:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\JddvYKxE3.exe 2011-02-07 10:22:01 121 —-a-w- C:\Users\ME\AppData\Roaming\3761.bat 2011-02-07 09:54:02 123 —-a-w- C:\Users\ME\AppData\Roaming\2746.bat 2011-02-07 09:54:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\PSsQ3R7.exe 2011-02-07 09:54:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\c5nINk.exe 2011-02-07 09:54:01 121 —-a-w- C:\Users\ME\AppData\Roaming\5266.bat 2011-02-07 09:28:01 127 —-a-w- C:\Users\ME\AppData\Roaming\3826.bat 2011-02-07 09:28:01 123 —-a-w- C:\Users\ME\AppData\Roaming\5446.bat 2011-02-07 09:28:00 227840 —-a-w- C:\Users\ME\AppData\Roaming\pbjoawj.exe 2011-02-07 09:28:00 227840 —-a-w- C:\Users\ME\AppData\Roaming\COBz8LIXP.exe 2011-02-07 09:06:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\z57IuDS4.exe 2011-02-07 09:06:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\eq4MLt4Y.exe 2011-02-07 09:06:01 125 —-a-w- C:\Users\ME\AppData\Roaming\7743.bat 2011-02-07 09:06:01 125 —-a-w- C:\Users\ME\AppData\Roaming\6559.bat 2011-02-07 08:48:02 123 —-a-w- C:\Users\ME\AppData\Roaming\4925.bat 2011-02-07 08:48:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\vKqNVyb.exe 2011-02-07 08:48:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\KEKPPgQKt1.exe 2011-02-07 08:48:01 129 —-a-w- C:\Users\ME\AppData\Roaming\7865.bat 2011-02-07 08:16:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\j7zfpDuvl.exe 2011-02-07 08:16:02 127 —-a-w- C:\Users\ME\AppData\Roaming\6987.bat 2011-02-07 08:16:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\cyba6brscN.exe 2011-02-07 08:16:01 129 —-a-w- C:\Users\ME\AppData\Roaming\6775.bat 2011-02-07 07:50:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\c40kN.exe 2011-02-07 07:50:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\ancmt0q.exe 2011-02-07 07:50:01 123 —-a-w- C:\Users\ME\AppData\Roaming\4794.bat 2011-02-07 07:50:01 119 —-a-w- C:\Users\ME\AppData\Roaming\3848.bat 2011-02-07 07:34:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\EdSKM9qD.exe 2011-02-07 07:34:02 125 —-a-w- C:\Users\ME\AppData\Roaming\4277.bat 2011-02-07 07:34:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\KJPi82S0x.exe 2011-02-07 07:34:01 127 —-a-w- C:\Users\ME\AppData\Roaming\2498.bat 2011-02-07 07:24:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\ZoWMDA.exe 2011-02-07 07:24:03 121 —-a-w- C:\Users\ME\AppData\Roaming\7650.bat 2011-02-07 07:24:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\HFiOExp.exe 2011-02-07 07:24:01 123 —-a-w- C:\Users\ME\AppData\Roaming\1080.bat 2011-02-07 07:17:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\S9ekT.exe 2011-02-07 07:17:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\iJwkDo.exe 2011-02-07 07:17:01 121 —-a-w- C:\Users\ME\AppData\Roaming\6563.bat 2011-02-07 07:17:01 119 —-a-w- C:\Users\ME\AppData\Roaming\4769.bat 2011-02-07 06:47:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\KwPKH.exe 2011-02-07 06:47:02 119 —-a-w- C:\Users\ME\AppData\Roaming\2639.bat 2011-02-07 06:47:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\azZR0.exe 2011-02-07 06:47:01 119 —-a-w- C:\Users\ME\AppData\Roaming\4658.bat 2011-02-07 06:32:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\OU1UoXOh3T.exe 2011-02-07 06:32:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\n27hSdPJ.exe 2011-02-07 06:32:02 129 —-a-w- C:\Users\ME\AppData\Roaming\5158.bat 2011-02-07 06:32:02 125 —-a-w- C:\Users\ME\AppData\Roaming\2305.bat 2011-02-07 06:18:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\KRi2C.exe 2011-02-07 06:18:05 119 —-a-w- C:\Users\ME\AppData\Roaming\7997.bat 2011-02-07 06:18:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\L59Imtw3.exe 2011-02-07 06:18:03 125 —-a-w- C:\Users\ME\AppData\Roaming\305.bat 2011-02-07 05:54:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\CLGrS2xD.exe 2011-02-07 05:54:02 129 —-a-w- C:\Users\ME\AppData\Roaming\6066.bat 2011-02-07 05:54:02 125 —-a-w- C:\Users\ME\AppData\Roaming\1881.bat 2011-02-07 05:54:01 227840 —-a-w- C:\Users\ME\AppData\Roaming\vZEirV2GNK.exe 2011-02-07 05:44:03 125 —-a-w- C:\Users\ME\AppData\Roaming\9348.bat 2011-02-07 05:44:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\NkAhpxsQ.exe 2011-02-07 05:44:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\gjfgpo.exe 2011-02-07 05:44:02 121 —-a-w- C:\Users\ME\AppData\Roaming\726.bat 2011-02-07 05:26:03 129 —-a-w- C:\Users\ME\AppData\Roaming\6062.bat 2011-02-07 05:26:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\ktBQnjQqLq.exe 2011-02-07 05:26:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\byLFPZ0A.exe 2011-02-07 05:26:02 125 —-a-w- C:\Users\ME\AppData\Roaming\5991.bat 2011-02-07 05:14:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\VqA1EwwHCf.exe 2011-02-07 05:14:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\oBe0WFhrHF.exe 2011-02-07 05:14:02 129 —-a-w- C:\Users\ME\AppData\Roaming\6526.bat 2011-02-07 05:14:02 129 —-a-w- C:\Users\ME\AppData\Roaming\6435.bat 2011-02-07 04:57:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\KIcBXWi.exe 2011-02-07 04:57:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\A6JW0.exe 2011-02-07 04:57:02 123 —-a-w- C:\Users\ME\AppData\Roaming\6887.bat 2011-02-07 04:57:02 123 —-a-w- C:\Users\ME\AppData\Roaming\2128.bat 2011-02-07 04:27:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\QIISia.exe 2011-02-07 04:27:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\JJNimOjurp.exe 2011-02-07 04:27:02 129 —-a-w- C:\Users\ME\AppData\Roaming\9498.bat 2011-02-07 04:27:02 121 —-a-w- C:\Users\ME\AppData\Roaming\9491.bat 2011-02-07 04:20:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\WrVvdHbS.exe 2011-02-07 04:20:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\IlpD1VjS.exe 2011-02-07 04:20:02 125 —-a-w- C:\Users\ME\AppData\Roaming\9864.bat 2011-02-07 04:20:02 125 —-a-w- C:\Users\ME\AppData\Roaming\8545.bat 2011-02-07 03:54:03 121 —-a-w- C:\Users\ME\AppData\Roaming\3837.bat 2011-02-07 03:54:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\sU8qq2.exe 2011-02-07 03:54:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\Bo8VON.exe 2011-02-07 03:54:02 121 —-a-w- C:\Users\ME\AppData\Roaming\8408.bat 2011-02-07 03:29:04 123 —-a-w- C:\Users\ME\AppData\Roaming\5559.bat 2011-02-07 03:29:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\iwNDp5q.exe 2011-02-07 03:29:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\hWDV91lp.exe 2011-02-07 03:29:03 125 —-a-w- C:\Users\ME\AppData\Roaming\7885.bat 2011-02-07 03:13:04 227840 —-a-w- C:\Users\ME\AppData\Roaming\pAg6A.exe 2011-02-07 03:13:04 119 —-a-w- C:\Users\ME\AppData\Roaming\2689.bat 2011-02-07 03:13:03 129 —-a-w- C:\Users\ME\AppData\Roaming\6040.bat 2011-02-07 03:13:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\Qu2dF7kXVa.exe 2011-02-07 03:06:07 123 —-a-w- C:\Users\ME\AppData\Roaming\6953.bat 2011-02-07 03:06:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\FQEUD5G.exe 2011-02-07 03:06:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\hAzOCQIC6.exe 2011-02-07 03:06:02 127 —-a-w- C:\Users\ME\AppData\Roaming\1157.bat 2011-02-07 02:57:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\G8iEIjE.exe 2011-02-07 02:57:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\dwbLm.exe 2011-02-07 02:57:02 123 —-a-w- C:\Users\ME\AppData\Roaming\2451.bat 2011-02-07 02:57:02 119 —-a-w- C:\Users\ME\AppData\Roaming\3519.bat 2011-02-07 02:42:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\SweZNpmQ.exe 2011-02-07 02:42:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\qz4Cw9f.exe 2011-02-07 02:42:02 125 —-a-w- C:\Users\ME\AppData\Roaming\3959.bat 2011-02-07 02:42:02 123 —-a-w- C:\Users\ME\AppData\Roaming\7644.bat 2011-02-07 02:36:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\p0xOB.exe 2011-02-07 02:36:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\aepPP4.exe 2011-02-07 02:36:02 121 —-a-w- C:\Users\ME\AppData\Roaming\2393.bat 2011-02-07 02:36:02 119 —-a-w- C:\Users\ME\AppData\Roaming\1135.bat 2011-02-07 02:20:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\Zw7Ff10.exe 2011-02-07 02:20:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\KzMFNWHt.exe 2011-02-07 02:20:02 125 —-a-w- C:\Users\ME\AppData\Roaming\7473.bat 2011-02-07 02:20:02 123 —-a-w- C:\Users\ME\AppData\Roaming\9683.bat 2011-02-07 01:57:03 123 —-a-w- C:\Users\ME\AppData\Roaming\162.bat 2011-02-07 01:57:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\zOlNvDk.exe 2011-02-07 01:57:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\xK4ta.exe 2011-02-07 01:57:02 119 —-a-w- C:\Users\ME\AppData\Roaming\8829.bat 2011-02-07 01:45:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\sZsPMtFids.exe 2011-02-07 01:45:03 129 —-a-w- C:\Users\ME\AppData\Roaming\3329.bat 2011-02-07 01:45:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\Nio4grc7.exe 2011-02-07 01:45:02 125 —-a-w- C:\Users\ME\AppData\Roaming\8600.bat 2011-02-07 01:36:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\YV2kr.exe 2011-02-07 01:36:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\VCqOken9i.exe 2011-02-07 01:36:02 127 —-a-w- C:\Users\ME\AppData\Roaming\6376.bat 2011-02-07 01:36:02 119 —-a-w- C:\Users\ME\AppData\Roaming\2694.bat 2011-02-07 01:11:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\Hl1qQOZNr.exe 2011-02-07 01:11:05 127 —-a-w- C:\Users\ME\AppData\Roaming\67.bat 2011-02-07 01:11:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\pfF6rg.exe 2011-02-07 01:11:03 121 —-a-w- C:\Users\ME\AppData\Roaming\1372.bat 2011-02-07 00:38:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\vHYNF.exe 2011-02-07 00:38:03 119 —-a-w- C:\Users\ME\AppData\Roaming\766.bat 2011-02-07 00:38:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\aWueNO.exe 2011-02-07 00:38:02 121 —-a-w- C:\Users\ME\AppData\Roaming\9715.bat 2011-02-07 00:06:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\mrK6egHRTv.exe 2011-02-07 00:06:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\cHMLqg3T.exe 2011-02-07 00:06:02 129 —-a-w- C:\Users\ME\AppData\Roaming\2156.bat 2011-02-07 00:06:02 125 —-a-w- C:\Users\ME\AppData\Roaming\6415.bat 2011-02-07 00:00:03 127 —-a-w- C:\Users\ME\AppData\Roaming\8445.bat 2011-02-07 00:00:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\L6dI4twZS.exe 2011-02-07 00:00:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\buAxHNVmcP.exe 2011-02-07 00:00:02 129 —-a-w- C:\Users\ME\AppData\Roaming\8984.bat 2011-02-06 23:52:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\kmTmW0y.exe 2011-02-06 23:52:03 129 —-a-w- C:\Users\ME\AppData\Roaming\8427.bat 2011-02-06 23:52:03 123 —-a-w- C:\Users\ME\AppData\Roaming\6513.bat 2011-02-06 23:52:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\vqrrIOtAUn.exe 2011-02-06 23:18:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\q0WYC.exe 2011-02-06 23:18:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\baIUzZ.exe 2011-02-06 23:18:02 121 —-a-w- C:\Users\ME\AppData\Roaming\5704.bat 2011-02-06 23:18:02 119 —-a-w- C:\Users\ME\AppData\Roaming\3466.bat 2011-02-06 22:48:03 129 —-a-w- C:\Users\ME\AppData\Roaming\5484.bat 2011-02-06 22:48:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\He90Fit5AF.exe 2011-02-06 22:48:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\FhfpoaY4.exe 2011-02-06 22:48:02 125 —-a-w- C:\Users\ME\AppData\Roaming\6133.bat 2011-02-06 22:41:03 129 —-a-w- C:\Users\ME\AppData\Roaming\870.bat 2011-02-06 22:41:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\M64SdvUh.exe 2011-02-06 22:41:02 227840 —-a-w- C:\Users\ME\AppData\Roaming\LTUZOMP7UN.exe 2011-02-06 22:41:02 125 —-a-w- C:\Users\ME\AppData\Roaming\9201.bat 2011-02-06 22:28:04 121 —-a-w- C:\Users\ME\AppData\Roaming\9647.bat 2011-02-06 22:28:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\IWhESG4Vzn.exe 2011-02-06 22:28:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\eKHpqS.exe 2011-02-06 22:28:03 129 —-a-w- C:\Users\ME\AppData\Roaming\6990.bat 2011-02-06 22:07:04 119 —-a-w- C:\Users\ME\AppData\Roaming\6305.bat 2011-02-06 22:07:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\Ykwlh.exe 2011-02-06 22:07:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\NxN4P.exe 2011-02-06 22:07:03 119 —-a-w- C:\Users\ME\AppData\Roaming\3684.bat 2011-02-06 21:57:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\vgKONPhTtz.exe 2011-02-06 21:57:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\pRSNLswi.exe 2011-02-06 21:57:05 129 —-a-w- C:\Users\ME\AppData\Roaming\4080.bat 2011-02-06 21:57:05 125 —-a-w- C:\Users\ME\AppData\Roaming\1744.bat 2011-02-06 21:43:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\eHgNw.exe 2011-02-06 21:43:10 119 —-a-w- C:\Users\ME\AppData\Roaming\5686.bat 2011-02-06 21:43:04 227840 —-a-w- C:\Users\ME\AppData\Roaming\qYYtY2CMqB.exe 2011-02-06 21:43:04 129 —-a-w- C:\Users\ME\AppData\Roaming\1550.bat 2011-02-06 21:33:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\ZHzcHsN.exe 2011-02-06 21:33:03 227840 —-a-w- C:\Users\ME\AppData\Roaming\TcQ4iDyMub.exe 2011-02-06 21:33:03 129 —-a-w- C:\Users\ME\AppData\Roaming\3874.bat 2011-02-06 21:33:03 123 —-a-w- C:\Users\ME\AppData\Roaming\6710.bat 2011-02-06 21:27:07 129 —-a-w- C:\Users\ME\AppData\Roaming\5540.bat 2011-02-06 21:27:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\FNWne2DIuQ.exe 2011-02-06 21:27:05 123 —-a-w- C:\Users\ME\AppData\Roaming\5595.bat 2011-02-06 21:27:04 227840 —-a-w- C:\Users\ME\AppData\Roaming\zO9S3By.exe 2011-02-06 21:13:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\zEsb1.exe 2011-02-06 21:13:06 119 —-a-w- C:\Users\ME\AppData\Roaming\395.bat 2011-02-06 21:13:04 227840 —-a-w- C:\Users\ME\AppData\Roaming\wbNnH.exe 2011-02-06 21:13:04 119 —-a-w- C:\Users\ME\AppData\Roaming\1713.bat 2011-02-06 20:51:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\KSygq.exe 2011-02-06 20:51:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\kiWjfV7Ulu.exe 2011-02-06 20:51:08 129 —-a-w- C:\Users\ME\AppData\Roaming\6472.bat 2011-02-06 20:51:08 119 —-a-w- C:\Users\ME\AppData\Roaming\4263.bat 2011-02-06 20:30:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\BYz3qFd3.exe 2011-02-06 20:30:11 125 —-a-w- C:\Users\ME\AppData\Roaming\1235.bat 2011-02-06 20:30:09 121 —-a-w- C:\Users\ME\AppData\Roaming\2892.bat 2011-02-06 20:30:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\DQkfNk.exe 2011-02-06 20:02:14 125 —-a-w- C:\Users\ME\AppData\Roaming\272.bat 2011-02-06 20:02:13 227840 —-a-w- C:\Users\ME\AppData\Roaming\W0B5wqn6.exe 2011-02-06 20:02:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\RmF1RE.exe 2011-02-06 20:02:07 121 —-a-w- C:\Users\ME\AppData\Roaming\3823.bat 2011-02-06 19:30:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\pIBvQy.exe 2011-02-06 19:30:15 121 —-a-w- C:\Users\ME\AppData\Roaming\3502.bat 2011-02-06 19:30:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\j1OFydvdva.exe 2011-02-06 19:30:09 129 —-a-w- C:\Users\ME\AppData\Roaming\1385.bat 2011-02-06 19:08:12 227840 —-a-w- C:\Users\ME\AppData\Roaming\sum3p.exe 2011-02-06 19:08:12 119 —-a-w- C:\Users\ME\AppData\Roaming\2306.bat 2011-02-06 19:08:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\M0weAT7A.exe 2011-02-06 19:08:07 125 —-a-w- C:\Users\ME\AppData\Roaming\3263.bat 2011-02-06 19:02:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\J84PBkrOo.exe 2011-02-06 19:02:17 127 —-a-w- C:\Users\ME\AppData\Roaming\9935.bat 2011-02-06 19:02:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\fODbAAf.exe 2011-02-06 19:02:11 123 —-a-w- C:\Users\ME\AppData\Roaming\9766.bat 2011-02-06 18:40:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\tJmunPHDeK.exe 2011-02-06 18:40:10 129 —-a-w- C:\Users\ME\AppData\Roaming\6758.bat 2011-02-06 18:40:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\YwpgmOVks.exe 2011-02-06 18:40:09 127 —-a-w- C:\Users\ME\AppData\Roaming\7064.bat 2011-02-06 18:10:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\oWBrLHgCh.exe 2011-02-06 18:10:17 127 —-a-w- C:\Users\ME\AppData\Roaming\998.bat 2011-02-06 18:10:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\PEGdp.exe 2011-02-06 18:10:08 119 —-a-w- C:\Users\ME\AppData\Roaming\5578.bat 2011-02-06 18:02:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\hfB41.exe 2011-02-06 18:02:11 119 —-a-w- C:\Users\ME\AppData\Roaming\8300.bat 2011-02-06 18:02:07 129 —-a-w- C:\Users\ME\AppData\Roaming\607.bat 2011-02-06 18:02:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\h1vSkLK316.exe 2011-02-06 17:44:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\ZVdhc0.exe 2011-02-06 17:44:17 121 —-a-w- C:\Users\ME\AppData\Roaming\2699.bat 2011-02-06 17:44:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\vIBUn1xNc8.exe 2011-02-06 17:44:11 129 —-a-w- C:\Users\ME\AppData\Roaming\7417.bat 2011-02-06 17:12:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\sOn2vgAVA.exe 2011-02-06 17:12:11 127 —-a-w- C:\Users\ME\AppData\Roaming\9444.bat 2011-02-06 17:12:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\ecVgfhXm.exe 2011-02-06 17:07:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\ONbAvKNJ.exe 2011-02-06 17:07:06 125 —-a-w- C:\Users\ME\AppData\Roaming\2551.bat 2011-02-06 17:07:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\qBQrlRxd4z.exe 2011-02-06 17:07:05 129 —-a-w- C:\Users\ME\AppData\Roaming\917.bat 2011-02-06 16:39:12 127 —-a-w- C:\Users\ME\AppData\Roaming\831.bat 2011-02-06 16:39:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\eBYvhgd8D.exe 2011-02-06 16:39:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\c4CUHSFnbf.exe 2011-02-06 16:39:09 129 —-a-w- C:\Users\ME\AppData\Roaming\2935.bat 2011-02-06 16:12:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\V0gQqlQ.exe 2011-02-06 16:12:10 123 —-a-w- C:\Users\ME\AppData\Roaming\5765.bat 2011-02-06 16:12:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\K3NBICE.exe 2011-02-06 16:12:05 123 —-a-w- C:\Users\ME\AppData\Roaming\6410.bat 2011-02-06 15:54:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\XuR91lY.exe 2011-02-06 15:54:09 123 —-a-w- C:\Users\ME\AppData\Roaming\4766.bat 2011-02-06 15:54:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\M1eEaQ.exe 2011-02-06 15:54:06 121 —-a-w- C:\Users\ME\AppData\Roaming\7078.bat 2011-02-06 15:48:11 125 —-a-w- C:\Users\ME\AppData\Roaming\2773.bat 2011-02-06 15:48:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\tYJrEzO4T.exe 2011-02-06 15:48:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\pzUAXLF.exe 2011-02-06 15:48:09 123 —-a-w- C:\Users\ME\AppData\Roaming\5905.bat 2011-02-06 15:26:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\OwNWr4zu1X.exe 2011-02-06 15:26:15 129 —-a-w- C:\Users\ME\AppData\Roaming\1167.bat 2011-02-06 15:26:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\fI513oYlZ6.exe 2011-02-06 15:26:11 129 —-a-w- C:\Users\ME\AppData\Roaming\1688.bat 2011-02-06 14:59:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\DInMc7T5v.exe 2011-02-06 14:59:14 127 —-a-w- C:\Users\ME\AppData\Roaming\3716.bat 2011-02-06 14:27:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\tC7n5G.exe 2011-02-06 14:27:08 121 —-a-w- C:\Users\ME\AppData\Roaming\4486.bat 2011-02-06 14:27:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\Kkgt5JpG.exe 2011-02-06 14:27:07 125 —-a-w- C:\Users\ME\AppData\Roaming\5997.bat 2011-02-06 14:20:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\efPhfC.exe 2011-02-06 14:20:10 121 —-a-w- C:\Users\ME\AppData\Roaming\2958.bat 2011-02-06 14:20:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\udf97lf.exe 2011-02-06 14:20:07 123 —-a-w- C:\Users\ME\AppData\Roaming\8246.bat 2011-02-06 13:57:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\WNZGlMh.exe 2011-02-06 13:57:15 123 —-a-w- C:\Users\ME\AppData\Roaming\9525.bat 2011-02-06 13:57:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\jDHtBW10.exe 2011-02-06 13:57:09 125 —-a-w- C:\Users\ME\AppData\Roaming\6088.bat 2011-02-06 13:40:09 119 —-a-w- C:\Users\ME\AppData\Roaming\4569.bat 2011-02-06 13:40:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\hXwPd.exe 2011-02-06 13:40:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\lzdyR.exe 2011-02-06 13:40:07 119 —-a-w- C:\Users\ME\AppData\Roaming\3284.bat 2011-02-06 13:13:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\evW95.exe 2011-02-06 13:13:16 119 —-a-w- C:\Users\ME\AppData\Roaming\891.bat 2011-02-06 13:13:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\nanBKQj3.exe 2011-02-06 13:13:08 125 —-a-w- C:\Users\ME\AppData\Roaming\2132.bat 2011-02-06 13:01:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\gatVyZoV.exe 2011-02-06 13:01:14 125 —-a-w- C:\Users\ME\AppData\Roaming\2047.bat 2011-02-06 13:01:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\z6Vu0FeLF.exe 2011-02-06 13:01:11 127 —-a-w- C:\Users\ME\AppData\Roaming\9861.bat 2011-02-06 12:56:13 227840 —-a-w- C:\Users\ME\AppData\Roaming\HzD660q.exe 2011-02-06 12:56:13 123 —-a-w- C:\Users\ME\AppData\Roaming\2508.bat 2011-02-06 12:56:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\Do0ZY.exe 2011-02-06 12:56:06 119 —-a-w- C:\Users\ME\AppData\Roaming\1290.bat 2011-02-06 12:40:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\bjMmNoswyu.exe 2011-02-06 12:40:11 129 —-a-w- C:\Users\ME\AppData\Roaming\6851.bat 2011-02-06 12:40:11 125 —-a-w- C:\Users\ME\AppData\Roaming\1205.bat 2011-02-06 12:40:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\Jgg9PBYn.exe 2011-02-06 12:15:12 227840 —-a-w- C:\Users\ME\AppData\Roaming\wrtWd.exe 2011-02-06 12:15:12 119 —-a-w- C:\Users\ME\AppData\Roaming\5557.bat 2011-02-06 12:15:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\m87AEf.exe 2011-02-06 12:15:07 121 —-a-w- C:\Users\ME\AppData\Roaming\3530.bat 2011-02-06 12:06:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\pxTSfsmN7.exe 2011-02-06 12:06:10 127 —-a-w- C:\Users\ME\AppData\Roaming\8109.bat 2011-02-06 12:06:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\LUOiglrHR.exe 2011-02-06 12:06:07 127 —-a-w- C:\Users\ME\AppData\Roaming\4713.bat 2011-02-06 11:39:19 227840 —-a-w- C:\Users\ME\AppData\Roaming\nY8FNolA.exe 2011-02-06 11:39:19 125 —-a-w- C:\Users\ME\AppData\Roaming\4040.bat 2011-02-06 11:39:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\ttYw4JWg.exe 2011-02-06 11:39:06 127 —-a-w- C:\Users\ME\AppData\Roaming\3383.bat 2011-02-06 11:30:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\rIVh00R0Z.exe 2011-02-06 11:30:09 127 —-a-w- C:\Users\ME\AppData\Roaming\6923.bat 2011-02-06 11:30:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\dJcv9.exe 2011-02-06 11:30:08 119 —-a-w- C:\Users\ME\AppData\Roaming\3447.bat 2011-02-06 11:14:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\yEGH1iwl8U.exe 2011-02-06 11:14:07 129 —-a-w- C:\Users\ME\AppData\Roaming\7603.bat 2011-02-06 11:14:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\w9ahpU.exe 2011-02-06 11:14:05 121 —-a-w- C:\Users\ME\AppData\Roaming\8986.bat 2011-02-06 10:45:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\x58O7jBlw.exe 2011-02-06 10:45:07 127 —-a-w- C:\Users\ME\AppData\Roaming\974.bat 2011-02-06 10:45:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\eiibeTRI1Y.exe 2011-02-06 10:45:05 129 —-a-w- C:\Users\ME\AppData\Roaming\1063.bat 2011-02-06 10:21:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\S06tB.exe 2011-02-06 10:21:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\IHuELwBK.exe 2011-02-06 10:21:07 125 —-a-w- C:\Users\ME\AppData\Roaming\864.bat 2011-02-06 10:21:07 119 —-a-w- C:\Users\ME\AppData\Roaming\1604.bat 2011-02-06 10:12:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\t9jqhcuW.exe 2011-02-06 10:12:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\lPmFsmiq.exe 2011-02-06 10:12:06 125 —-a-w- C:\Users\ME\AppData\Roaming\38.bat 2011-02-06 10:12:06 125 —-a-w- C:\Users\ME\AppData\Roaming\1926.bat 2011-02-06 09:40:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\DoUbHLO.exe 2011-02-06 09:40:06 123 —-a-w- C:\Users\ME\AppData\Roaming\1729.bat 2011-02-06 09:40:05 127 —-a-w- C:\Users\ME\AppData\Roaming\7174.bat 2011-02-06 09:40:04 227840 —-a-w- C:\Users\ME\AppData\Roaming\kX3teIji7.exe 2011-02-06 09:15:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\umiQHxn.exe 2011-02-06 09:15:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\SgVSS.exe 2011-02-06 09:15:06 123 —-a-w- C:\Users\ME\AppData\Roaming\4619.bat 2011-02-06 09:15:06 119 —-a-w- C:\Users\ME\AppData\Roaming\7628.bat 2011-02-06 09:09:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\o8130QcBuL.exe 2011-02-06 09:09:06 129 —-a-w- C:\Users\ME\AppData\Roaming\9210.bat 2011-02-06 09:09:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\AjQCHGWF.exe 2011-02-06 09:09:05 125 —-a-w- C:\Users\ME\AppData\Roaming\2139.bat 2011-02-06 08:52:06 127 —-a-w- C:\Users\ME\AppData\Roaming\196.bat 2011-02-06 08:52:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\AMiE9HU.exe 2011-02-06 08:52:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\AcfvlPgtP.exe 2011-02-06 08:52:05 123 —-a-w- C:\Users\ME\AppData\Roaming\6212.bat 2011-02-06 08:41:06 129 —-a-w- C:\Users\ME\AppData\Roaming\9063.bat 2011-02-06 08:41:06 127 —-a-w- C:\Users\ME\AppData\Roaming\1748.bat 2011-02-06 08:41:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\vYLTinQ33r.exe 2011-02-06 08:41:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\euFjGlToG.exe 2011-02-06 08:15:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\XijkZKay.exe 2011-02-06 08:15:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\eaCcGP.exe 2011-02-06 08:15:06 127 —-a-w- C:\Users\ME\AppData\Roaming\8850.bat 2011-02-06 08:15:06 125 —-a-w- C:\Users\ME\AppData\Roaming\1973.bat 2011-02-06 08:04:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\R1EyVR.exe 2011-02-06 08:04:10 121 —-a-w- C:\Users\ME\AppData\Roaming\6539.bat 2011-02-06 08:04:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\ygY633L.exe 2011-02-06 08:04:08 123 —-a-w- C:\Users\ME\AppData\Roaming\2590.bat 2011-02-06 07:56:06 127 —-a-w- C:\Users\ME\AppData\Roaming\686.bat 2011-02-06 07:56:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\X7g94hQ.exe 2011-02-06 07:56:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\c8YMPBe3t.exe 2011-02-06 07:56:05 123 —-a-w- C:\Users\ME\AppData\Roaming\4641.bat 2011-02-06 07:27:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\lVCQMTK.exe 2011-02-06 07:27:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\kgZXbW.exe 2011-02-06 07:27:05 123 —-a-w- C:\Users\ME\AppData\Roaming\7469.bat 2011-02-06 07:27:05 121 —-a-w- C:\Users\ME\AppData\Roaming\5079.bat 2011-02-06 07:05:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\QEBz5YdnV2.exe 2011-02-06 07:05:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\lqIKEpBy.exe 2011-02-06 07:05:05 129 —-a-w- C:\Users\ME\AppData\Roaming\6222.bat 2011-02-06 07:05:05 125 —-a-w- C:\Users\ME\AppData\Roaming\3434.bat 2011-02-06 07:00:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\Q3UDLulw.exe 2011-02-06 07:00:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\EEfN3Xibz.exe 2011-02-06 07:00:07 127 —-a-w- C:\Users\ME\AppData\Roaming\9073.bat 2011-02-06 07:00:07 125 —-a-w- C:\Users\ME\AppData\Roaming\3115.bat 2011-02-06 06:27:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\S8p8s4.exe 2011-02-06 06:27:09 121 —-a-w- C:\Users\ME\AppData\Roaming\8273.bat 2011-02-06 06:27:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\IUe1uNKt.exe 2011-02-06 06:27:06 125 —-a-w- C:\Users\ME\AppData\Roaming\8004.bat 2011-02-06 05:53:06 127 —-a-w- C:\Users\ME\AppData\Roaming\6149.bat 2011-02-06 05:53:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\vxmD9g.exe 2011-02-06 05:53:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\oVHmBc7pQ.exe 2011-02-06 05:53:05 121 —-a-w- C:\Users\ME\AppData\Roaming\5184.bat 2011-02-06 05:36:07 121 —-a-w- C:\Users\ME\AppData\Roaming\4924.bat 2011-02-06 05:36:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\dZOirO.exe 2011-02-06 05:36:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\dWx1R.exe 2011-02-06 05:36:06 119 —-a-w- C:\Users\ME\AppData\Roaming\2951.bat 2011-02-06 05:28:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\n7kI5.exe 2011-02-06 05:28:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\aQUTZeIKNS.exe 2011-02-06 05:28:05 129 —-a-w- C:\Users\ME\AppData\Roaming\8648.bat 2011-02-06 05:28:05 119 —-a-w- C:\Users\ME\AppData\Roaming\4191.bat 2011-02-06 05:01:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\mqPEDG.exe 2011-02-06 05:01:06 121 —-a-w- C:\Users\ME\AppData\Roaming\861.bat 2011-02-06 05:01:06 121 —-a-w- C:\Users\ME\AppData\Roaming\2487.bat 2011-02-06 05:01:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\Gfx1bF.exe 2011-02-06 04:55:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\qBbDzi5e.exe 2011-02-06 04:55:06 125 —-a-w- C:\Users\ME\AppData\Roaming\3658.bat 2011-02-06 04:55:06 123 —-a-w- C:\Users\ME\AppData\Roaming\9514.bat 2011-02-06 04:55:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\Nc8X28B.exe 2011-02-06 04:41:06 119 —-a-w- C:\Users\ME\AppData\Roaming\529.bat 2011-02-06 04:41:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\rcASS.exe 2011-02-06 04:41:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\OJbfQcIa.exe 2011-02-06 04:41:05 125 —-a-w- C:\Users\ME\AppData\Roaming\5871.bat 2011-02-06 04:18:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\OVFSi.exe 2011-02-06 04:18:06 125 —-a-w- C:\Users\ME\AppData\Roaming\6180.bat 2011-02-06 04:18:06 119 —-a-w- C:\Users\ME\AppData\Roaming\6237.bat 2011-02-06 04:18:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\kwK5fzh9.exe 2011-02-06 03:47:07 127 —-a-w- C:\Users\ME\AppData\Roaming\2362.bat 2011-02-06 03:47:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\OmM4nuNAK.exe 2011-02-06 03:47:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\M9moSa.exe 2011-02-06 03:47:06 121 —-a-w- C:\Users\ME\AppData\Roaming\7943.bat 2011-02-06 03:41:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\dV2g7Smmd.exe 2011-02-06 03:41:06 127 —-a-w- C:\Users\ME\AppData\Roaming\5073.bat 2011-02-06 03:41:05 227840 —-a-w- C:\Users\ME\AppData\Roaming\bPC0i.exe 2011-02-06 03:41:05 119 —-a-w- C:\Users\ME\AppData\Roaming\468.bat 2011-02-06 03:36:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\enG2Z8HxA.exe 2011-02-06 03:36:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\aSNu43a.exe 2011-02-06 03:36:06 127 —-a-w- C:\Users\ME\AppData\Roaming\1793.bat 2011-02-06 03:36:06 123 —-a-w- C:\Users\ME\AppData\Roaming\6241.bat 2011-02-06 03:11:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\WIG6Zq.exe 2011-02-06 03:11:07 121 —-a-w- C:\Users\ME\AppData\Roaming\2338.bat 2011-02-06 03:11:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\mTYFNj0s.exe 2011-02-06 03:11:06 125 —-a-w- C:\Users\ME\AppData\Roaming\7796.bat 2011-02-06 03:05:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\lMYLRZTu.exe 2011-02-06 03:05:07 125 —-a-w- C:\Users\ME\AppData\Roaming\4412.bat 2011-02-06 03:05:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\hHdbL.exe 2011-02-06 03:05:06 119 —-a-w- C:\Users\ME\AppData\Roaming\9211.bat 2011-02-06 02:51:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\R2XyMDpR.exe 2011-02-06 02:51:07 125 —-a-w- C:\Users\ME\AppData\Roaming\9109.bat 2011-02-06 02:51:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\EbsPql.exe 2011-02-06 02:51:06 121 —-a-w- C:\Users\ME\AppData\Roaming\6262.bat 2011-02-06 02:31:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\SQQIHKE1h.exe 2011-02-06 02:31:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\roZ3yv13Z.exe 2011-02-06 02:31:07 127 —-a-w- C:\Users\ME\AppData\Roaming\7329.bat 2011-02-06 02:31:07 127 —-a-w- C:\Users\ME\AppData\Roaming\1630.bat 2011-02-06 02:10:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\zg4SuL.exe 2011-02-06 02:10:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\e5phK2Pef.exe 2011-02-06 02:10:06 127 —-a-w- C:\Users\ME\AppData\Roaming\1118.bat 2011-02-06 02:10:06 121 —-a-w- C:\Users\ME\AppData\Roaming\3647.bat 2011-02-06 01:50:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\dktXb.exe 2011-02-06 01:50:08 119 —-a-w- C:\Users\ME\AppData\Roaming\8535.bat 2011-02-06 01:50:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\QFRQ1SQt.exe 2011-02-06 01:50:06 125 —-a-w- C:\Users\ME\AppData\Roaming\3279.bat 2011-02-06 01:44:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\ZlcZnKw.exe 2011-02-06 01:44:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\ulySR1eTWI.exe 2011-02-06 01:44:06 129 —-a-w- C:\Users\ME\AppData\Roaming\6147.bat 2011-02-06 01:44:06 123 —-a-w- C:\Users\ME\AppData\Roaming\2193.bat 2011-02-06 01:28:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\OlplvQGQJ.exe 2011-02-06 01:28:07 127 —-a-w- C:\Users\ME\AppData\Roaming\386.bat 2011-02-06 01:28:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\pvjMi.exe 2011-02-06 01:28:06 119 —-a-w- C:\Users\ME\AppData\Roaming\2191.bat 2011-02-06 01:07:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\Qpwcq9gUMt.exe 2011-02-06 01:07:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\COKeJLu77h.exe 2011-02-06 01:07:07 129 —-a-w- C:\Users\ME\AppData\Roaming\2619.bat 2011-02-06 01:07:07 129 —-a-w- C:\Users\ME\AppData\Roaming\1293.bat 2011-02-06 00:46:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\mwdNoh3dSZ.exe 2011-02-06 00:46:09 129 —-a-w- C:\Users\ME\AppData\Roaming\5939.bat 2011-02-06 00:46:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\YAWGh8.exe 2011-02-06 00:46:08 121 —-a-w- C:\Users\ME\AppData\Roaming\6419.bat 2011-02-06 00:38:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\gBZioTZY.exe 2011-02-06 00:38:07 125 —-a-w- C:\Users\ME\AppData\Roaming\2081.bat 2011-02-06 00:38:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\UkqSY88N.exe 2011-02-06 00:38:06 125 —-a-w- C:\Users\ME\AppData\Roaming\9559.bat 2011-02-06 00:27:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\OVkkm.exe 2011-02-06 00:27:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\OIDbvzYBL.exe 2011-02-06 00:27:07 127 —-a-w- C:\Users\ME\AppData\Roaming\6106.bat 2011-02-06 00:27:07 119 —-a-w- C:\Users\ME\AppData\Roaming\1709.bat 2011-02-06 00:09:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\tbO3GmVYDV.exe 2011-02-06 00:09:11 129 —-a-w- C:\Users\ME\AppData\Roaming\1933.bat 2011-02-06 00:09:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\bLkbb6.exe 2011-02-06 00:09:06 121 —-a-w- C:\Users\ME\AppData\Roaming\4300.bat 2011-02-05 23:35:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\qwL77ES7v.exe 2011-02-05 23:35:08 127 —-a-w- C:\Users\ME\AppData\Roaming\1602.bat 2011-02-05 23:35:07 119 —-a-w- C:\Users\ME\AppData\Roaming\7409.bat 2011-02-05 23:35:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\idWXA.exe 2011-02-05 23:24:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\VM6ayeuqZ.exe 2011-02-05 23:24:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\ls0fgGQmod.exe 2011-02-05 23:24:07 129 —-a-w- C:\Users\ME\AppData\Roaming\4326.bat 2011-02-05 23:24:07 127 —-a-w- C:\Users\ME\AppData\Roaming\7209.bat 2011-02-05 23:04:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\nBayWRRf.exe 2011-02-05 23:04:07 125 —-a-w- C:\Users\ME\AppData\Roaming\2450.bat 2011-02-05 23:04:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\nFU3iiCqX.exe 2011-02-05 23:04:06 127 —-a-w- C:\Users\ME\AppData\Roaming\4199.bat 2011-02-05 22:54:08 129 —-a-w- C:\Users\ME\AppData\Roaming\7711.bat 2011-02-05 22:54:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\HxKsqma46H.exe 2011-02-05 22:54:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\IaggsjjCo.exe 2011-02-05 22:54:06 127 —-a-w- C:\Users\ME\AppData\Roaming\7008.bat 2011-02-05 22:43:07 227840 —-a-w- C:\Users\ME\AppData\Roaming\KMFnJpSs8a.exe 2011-02-05 22:43:07 129 —-a-w- C:\Users\ME\AppData\Roaming\745.bat 2011-02-05 22:43:06 227840 —-a-w- C:\Users\ME\AppData\Roaming\idFKJ1PCs.exe 2011-02-05 22:43:06 127 —-a-w- C:\Users\ME\AppData\Roaming\1426.bat 2011-02-05 22:17:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\fOTwA.exe 2011-02-05 22:17:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\a05dpIJdg.exe 2011-02-05 22:17:08 127 —-a-w- C:\Users\ME\AppData\Roaming\3788.bat 2011-02-05 22:17:08 119 —-a-w- C:\Users\ME\AppData\Roaming\8201.bat 2011-02-05 21:52:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\H3X0wxCyD.exe 2011-02-05 21:52:09 127 —-a-w- C:\Users\ME\AppData\Roaming\1501.bat 2011-02-05 21:52:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\LurKbNKKR.exe 2011-02-05 21:52:08 127 —-a-w- C:\Users\ME\AppData\Roaming\9904.bat 2011-02-05 21:19:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\GObjNfOleU.exe 2011-02-05 21:19:11 129 —-a-w- C:\Users\ME\AppData\Roaming\9405.bat 2011-02-05 21:19:08 227840 —-a-w- C:\Users\ME\AppData\Roaming\Oq1zobXAPm.exe 2011-02-05 21:19:08 129 —-a-w- C:\Users\ME\AppData\Roaming\8372.bat 2011-02-05 21:11:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\DUWf4LkRn.exe 2011-02-05 21:11:11 127 —-a-w- C:\Users\ME\AppData\Roaming\5805.bat 2011-02-05 21:11:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\jM206BD.exe 2011-02-05 21:11:10 123 —-a-w- C:\Users\ME\AppData\Roaming\3621.bat 2011-02-05 20:44:10 129 —-a-w- C:\Users\ME\AppData\Roaming\4288.bat 2011-02-05 20:44:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\vUasCnw.exe 2011-02-05 20:44:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\e9bVlCJINi.exe 2011-02-05 20:44:09 123 —-a-w- C:\Users\ME\AppData\Roaming\8016.bat 2011-02-05 20:36:12 125 —-a-w- C:\Users\ME\AppData\Roaming\8147.bat 2011-02-05 20:36:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\NYoaGLoA.exe 2011-02-05 20:36:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\gGi4mmf2j.exe 2011-02-05 20:36:09 127 —-a-w- C:\Users\ME\AppData\Roaming\9888.bat 2011-02-05 20:28:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\P2ZGo.exe 2011-02-05 20:28:14 119 —-a-w- C:\Users\ME\AppData\Roaming\9960.bat 2011-02-05 20:28:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\R4tgmK01.exe 2011-02-05 20:28:11 125 —-a-w- C:\Users\ME\AppData\Roaming\8094.bat 2011-02-05 20:23:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\gtrCbw2L.exe 2011-02-05 20:23:15 125 —-a-w- C:\Users\ME\AppData\Roaming\9765.bat 2011-02-05 20:23:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\ABiJm.exe 2011-02-05 20:23:09 119 —-a-w- C:\Users\ME\AppData\Roaming\408.bat 2011-02-05 20:10:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\i7sMW0Y2PL.exe 2011-02-05 20:10:11 129 —-a-w- C:\Users\ME\AppData\Roaming\3116.bat 2011-02-05 20:10:09 227840 —-a-w- C:\Users\ME\AppData\Roaming\ESOP7YK.exe 2011-02-05 20:02:16 119 —-a-w- C:\Users\ME\AppData\Roaming\9801.bat 2011-02-05 20:02:15 227840 —-a-w- C:\Users\ME\AppData\Roaming\dD2dT.exe 2011-02-05 20:02:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\rngpEI.exe 2011-02-05 20:02:14 121 —-a-w- C:\Users\ME\AppData\Roaming\5384.bat 2011-02-05 19:56:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\PEBMTZk.exe 2011-02-05 19:56:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\Oa6JW.exe 2011-02-05 19:56:10 123 —-a-w- C:\Users\ME\AppData\Roaming\6073.bat 2011-02-05 19:56:10 119 —-a-w- C:\Users\ME\AppData\Roaming\9577.bat 2011-02-05 19:38:12 227840 —-a-w- C:\Users\ME\AppData\Roaming\NURyfd.exe 2011-02-05 19:38:12 121 —-a-w- C:\Users\ME\AppData\Roaming\3955.bat 2011-02-05 19:38:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\QY1b0V.exe 2011-02-05 19:38:11 121 —-a-w- C:\Users\ME\AppData\Roaming\4330.bat 2011-02-05 19:10:13 227840 —-a-w- C:\Users\ME\AppData\Roaming\TK1TTP5A.exe 2011-02-05 19:10:13 227840 —-a-w- C:\Users\ME\AppData\Roaming\o305Mh.exe 2011-02-05 19:10:13 125 —-a-w- C:\Users\ME\AppData\Roaming\7207.bat 2011-02-05 19:10:13 121 —-a-w- C:\Users\ME\AppData\Roaming\2087.bat 2011-02-05 18:37:17 227840 —-a-w- C:\Users\ME\AppData\Roaming\n0v0irL.exe 2011-02-05 18:37:17 123 —-a-w- C:\Users\ME\AppData\Roaming\7474.bat 2011-02-05 18:37:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\HX4I4urw.exe 2011-02-05 18:37:14 125 —-a-w- C:\Users\ME\AppData\Roaming\5808.bat 2011-02-05 18:16:14 227840 —-a-w- C:\Users\ME\AppData\Roaming\X4fOzIjbn.exe 2011-02-05 18:16:14 127 —-a-w- C:\Users\ME\AppData\Roaming\6355.bat 2011-02-05 18:16:10 227840 —-a-w- C:\Users\ME\AppData\Roaming\QKGs69.exe 2011-02-05 18:16:10 121 —-a-w- C:\Users\ME\AppData\Roaming\9291.bat 2011-02-05 18:08:16 227840 —-a-w- C:\Users\ME\AppData\Roaming\g3ywPX.exe 2011-02-05 18:08:16 121 —-a-w- C:\Users\ME\AppData\Roaming\1899.bat 2011-02-05 18:08:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\UsUrkFoxN.exe 2011-02-05 18:08:11 127 —-a-w- C:\Users\ME\AppData\Roaming\7225.bat 2011-02-05 17:45:13 227840 —-a-w- C:\Users\ME\AppData\Roaming\Ybe7ZN4.exe 2011-02-05 17:45:13 123 —-a-w- C:\Users\ME\AppData\Roaming\65.bat 2011-02-05 17:45:11 227840 —-a-w- C:\Users\ME\AppData\Roaming\m4ylzWYntx.exe 2011-02-05 17:45:11 129 —-a-w- C:\Users\ME\AppData\Roaming\2267.bat 2011-02-05 17:14:01 129 —-a-w- C:\Users\ME\AppData\Roaming\355.bat 2011-02-05 17:14:01 127 —-a-w- C:\Users\ME\AppData\Roaming\4419.bat 2011-02-05 17:13:49 227840 —-a-w- C:\Users\ME\AppData\Roaming\FmqbiWedUt.exe 2011-02-05 17:13:49 227840 —-a-w- C:\Users\ME\AppData\Roaming\CXOFO7Uwm.exe 2011-02-05 17:10:49 227840 —-a-w- C:\Users\ME\AppData\Roaming\vckFaxBj5.exe 2011-02-05 17:10:49 127 —-a-w- C:\Users\ME\AppData\Roaming\4038.bat 2011-02-05 17:07:49 227840 —-a-w- C:\Users\ME\AppData\Roaming\yX6VtD.exe 2011-02-05 17:07:49 121 —-a-w- C:\Users\ME\AppData\Roaming\8959.bat 2011-02-05 17:03:51 227840 —-a-w- C:\Users\ME\AppData\Roaming\kBBzqT.exe 2011-02-05 17:03:51 121 —-a-w- C:\Users\ME\AppData\Roaming\8145.bat 2011-02-05 16:33:37 227840 —-a-w- C:\Users\ME\AppData\Roaming\kKN404Nhq.exe 2011-02-05 16:33:37 127 —-a-w- C:\Users\ME\AppData\Roaming\2608.bat 2011-02-05 16:29:42 227840 —-a-w- C:\Users\ME\AppData\Roaming\k5He4tw.exe 2011-02-05 16:29:42 123 —-a-w- C:\Users\ME\AppData\Roaming\7713.bat 2011-02-05 16:08:38 227840 —-a-w- C:\Users\ME\AppData\Roaming\BmlcrhTXNs.exe 2011-02-05 16:08:38 129 —-a-w- C:\Users\ME\AppData\Roaming\1456.bat 2011-02-05 16:00:31 227840 —-a-w- C:\Users\ME\AppData\Roaming\KpuUJoccpv.exe 2011-02-05 16:00:31 129 —-a-w- C:\Users\ME\AppData\Roaming\9111.bat 2011-02-05 15:58:36 227840 —-a-w- C:\Users\ME\AppData\Roaming\mxBkpkRyvW.exe 2011-02-05 15:58:36 129 —-a-w- C:\Users\ME\AppData\Roaming\6906.bat 2011-02-05 15:40:38 227840 —-a-w- C:\Users\ME\AppData\Roaming\krLOB.exe 2011-02-05 15:40:38 119 —-a-w- C:\Users\ME\AppData\Roaming\3900.bat 2011-02-05 15:31:35 125 —-a-w- C:\Users\ME\AppData\Roaming\876.bat 2011-02-05 15:31:34 227840 —-a-w- C:\Users\ME\AppData\Roaming\V3MOai8D.exe 2011-02-05 15:25:32 227840 —-a-w- C:\Users\ME\AppData\Roaming\QVVOEC41l.exe 2011-02-05 15:25:32 125 —-a-w- C:\Users\ME\AppData\Roaming\1894.bat 2011-02-05 15:24:37 227840 —-a-w- C:\Users\ME\AppData\Roaming\hW2uDG.exe 2011-02-05 15:24:37 121 —-a-w- C:\Users\ME\AppData\Roaming\5302.bat 2011-02-05 15:15:32 227840 —-a-w- C:\Users\ME\AppData\Roaming\X5yMSDg.exe 2011-02-05 15:15:32 123 —-a-w- C:\Users\ME\AppData\Roaming\4011.bat 2011-02-05 15:13:42 227840 —-a-w- C:\Users\ME\AppData\Roaming\FTFYq0GQb7.exe 2011-02-05 15:13:42 129 —-a-w- C:\Users\ME\AppData\Roaming\2158.bat 2011-02-05 15:03:37 119 —-a-w- C:\Users\ME\AppData\Roaming\5803.bat 2011-02-05 15:03:36 227840 —-a-w- C:\Users\ME\AppData\Roaming\NwE92.exe 2011-02-05 15:02:50 227840 —-a-w- C:\Users\ME\AppData\Roaming\wDWhjRANQ.exe 2011-02-05 15:02:50 127 —-a-w- C:\Users\ME\AppData\Roaming\7685.bat 2011-02-05 14:41:32 227840 —-a-w- C:\Users\ME\AppData\Roaming\KOJbu.exe 2011-02-05 14:41:32 119 —-a-w- C:\Users\ME\AppData\Roaming\3092.bat 2011-02-05 14:35:49 125 —-a-w- C:\Users\ME\AppData\Roaming\3907.bat 2011-02-05 14:35:48 227840 —-a-w- C:\Users\ME\AppData\Roaming\xg0dII2T.exe 2011-02-05 14:30:54 227840 —-a-w- C:\Users\ME\AppData\Roaming\LCfshd.exe 2011-02-05 14:30:54 121 —-a-w- C:\Users\ME\AppData\Roaming\1256.bat 2011-02-05 14:18:34 127 —-a-w- C:\Users\ME\AppData\Roaming\7480.bat 2011-02-05 14:18:33 227840 —-a-w- C:\Users\ME\AppData\Roaming\QPCYMLn4a.exe 2011-02-05 14:07:40 125 —-a-w- C:\Users\ME\AppData\Roaming\2269.bat 2011-02-05 14:07:39 227840 —-a-w- C:\Users\ME\AppData\Roaming\UlWp1vd8.exe 2011-02-05 13:58:35 227840 —-a-w- C:\Users\ME\AppData\Roaming\HuFwo7lwgV.exe 2011-02-05 13:58:35 129 —-a-w- C:\Users\ME\AppData\Roaming\5534.bat 2011-02-05 13:47:32 227840 —-a-w- C:\Users\ME\AppData\Roaming\KS8fVn0U35.exe 2011-02-05 13:47:32 123 —-a-w- C:\Users\ME\AppData\Roaming\9113.bat 2011-02-05 13:24:37 227840 —-a-w- C:\Users\ME\AppData\Roaming\JGDXW6.exe 2011-02-05 13:24:37 121 —-a-w- C:\Users\ME\AppData\Roaming\6254.bat 2011-02-05 13:18:30 227840 —-a-w- C:\Users\ME\AppData\Roaming\i25oz.exe 2011-02-05 13:18:30 125 —-a-w- C:\Users\ME\AppData\Roaming\3533.bat 2011-02-05 13:16:38 227840 —-a-w- C:\Users\ME\AppData\Roaming\piwoLF.exe 2011-02-05 13:16:38 121 —-a-w- C:\Users\ME\AppData\Roaming\2103.bat 2011-02-05 12:46:35 227840 —-a-w- C:\Users\ME\AppData\Roaming\l7ZU1Ye.exe 2011-02-05 12:46:35 123 —-a-w- C:\Users\ME\AppData\Roaming\2266.bat 2011-02-05 12:46:31 227840 —-a-w- C:\Users\ME\AppData\Roaming\IUcvsH9.exe 2011-02-05 12:46:31 123 —-a-w- C:\Users\ME\AppData\Roaming\5677.bat 2011-02-05 12:39:48 227840 —-a-w- C:\Users\ME\AppData\Roaming\IwnhBgpCr.exe 2011-02-05 12:39:48 127 —-a-w- C:\Users\ME\AppData\Roaming\4600.bat 2011-02-05 12:15:32 227840 —-a-w- C:\Users\ME\AppData\Roaming\nULmsdQ.exe 2011-02-05 12:15:32 123 —-a-w- C:\Users\ME\AppData\Roaming\3090.bat 2011-02-05 12:08:34 227840 —-a-w- C:\Users\ME\AppData\Roaming\PEqs7EL.exe 2011-02-05 12:08:34 123 —-a-w- C:\Users\ME\AppData\Roaming\6087.bat 2011-02-05 12:08:31 227840 —-a-w- C:\Users\ME\AppData\Roaming\cGan3tc.exe 2011-02-05 12:08:31 123 —-a-w- C:\Users\ME\AppData\Roaming\1944.bat 2011-02-05 11:57:34 227840 —-a-w- C:\Users\ME\AppData\Roaming\O3clj22.exe 2011-02-05 11:57:34 123 —-a-w- C:\Users\ME\AppData\Roaming\6525.bat 2011-02-05 11:46:34 129 —-a-w- C:\Users\ME\AppData\Roaming\5001.bat 2011-02-05 11:46:33 227840 —-a-w- C:\Users\ME\AppData\Roaming\PkOfNNnyBo.exe 2011-02-05 11:41:28 123 —-a-w- C:\Users\ME\AppData\Roaming\8313.bat 2011-02-05 11:41:27 227840 —-a-w- C:\Users\ME\AppData\Roaming\ZLPaXms.exe 2011-02-05 11:22:34 227840 —-a-w- C:\Users\ME\AppData\Roaming\sa63NJFZ.exe 2011-02-05 11:22:34 125 —-a-w- C:\Users\ME\AppData\Roaming\2623.bat 2011-02-05 11:11:28 227840 —-a-w- C:\Users\ME\AppData\Roaming\HfFwh.exe 2011-02-05 11:11:28 119 —-a-w- C:\Users\ME\AppData\Roaming\8685.bat 2011-02-05 10:52:33 127 —-a-w- C:\Users\ME\AppData\Roaming\8775.bat 2011-02-05 10:52:32 227840 —-a-w- C:\Users\ME\AppData\Roaming\uqLDCFjKI.exe 2011-02-05 10:45:30 121 —-a-w- C:\Users\ME\AppData\Roaming\4152.bat 2011-02-05 10:45:29 227840 —-a-w- C:\Users\ME\AppData\Roaming\uSOtxo.exe 2011-02-05 10:20:29 227840 —-a-w- C:\Users\ME\AppData\Roaming\dnYSV.exe 2011-02-05 10:20:29 119 —-a-w- C:\Users\ME\AppData\Roaming\1670.bat 2011-02-05 10:19:34 125 —-a-w- C:\Users\ME\AppData\Roaming\1044.bat 2011-02-05 10:19:33 227840 —-a-w- C:\Users\ME\AppData\Roaming\B4RMr40a.exe 2011-02-05 10:12:34 227840 —-a-w- C:\Users\ME\AppData\Roaming\AFwTK.exe 2011-02-05 10:12:34 119 —-a-w- C:\Users\ME\AppData\Roaming\3687.bat 2011-02-05 10:08:29 227840 —-a-w- C:\Users\ME\AppData\Roaming\VICxZpS.exe 2011-02-05 10:08:29 123 —-a-w- C:\Users\ME\AppData\Roaming\3501.bat 2011-02-05 10:03:34 227840 —-a-w- C:\Users\ME\AppData\Roaming\T4V0Vzxtda.exe 2011-02-05 10:03:34 129 —-a-w- C:\Users\ME\AppData\Roaming\5720.bat 2011-02-05 09:41:28 227840 —-a-w- C:\Users\ME\AppData\Roaming\zF7CSfYFU.exe 2011-02-05 09:41:28 127 —-a-w- C:\Users\ME\AppData\Roaming\957.bat 2011-02-05 09:35:32 125 —-a-w- C:\Users\ME\AppData\Roaming\5970.bat 2011-02-05 09:35:31 227840 —-a-w- C:\Users\ME\AppData\Roaming\haQ7bFaL.exe 2011-02-05 09:29:35 129 —-a-w- C:\Users\ME\AppData\Roaming\765.bat 2011-02-05 09:29:35 127 —-a-w- C:\Users\ME\AppData\Roaming\1847.bat 2011-02-05 09:29:31 227840 —-a-w- C:\Users\ME\AppData\Roaming\ttCJzsZAy.exe 2011-02-05 09:29:31 227840 —-a-w- C:\Users\ME\AppData\Roaming\NYUbB7vAJn.exe 2011-02-05 05:42:43 ——– d—–w- C:\Users\ME\AppData\Roaming\GARMIN 2011-02-05 05:42:43 ——– d—–w- C:\PROGRA~3\GARMIN 2011-02-05 05:34:34 ——– d—–w- C:\Program Files (x86)\Garmin 2011-02-04 20:41:17 7844688 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{6E379458-C716-4BD3-BA9C-6836C2E06B39}\mpengine.dll 2011-01-20 08:12:21 34152 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys 2011-01-20 08:12:21 126312 —-a-w- C:\Windows\System32\GEARAspi64.dll 2011-01-20 08:12:21 107368 —-a-w- C:\Windows\SysWow64\GEARAspi.dll 2011-01-20 08:11:32 ——– d—–w- C:\Program Files (x86)\iPod 2011-01-20 08:11:29 ——– d—–w- C:\Program Files\iTunes 2011-01-20 08:11:29 ——– d—–w- C:\Program Files (x86)\iTunes 2011-01-20 08:11:29 ——– d—–w- C:\PROGRA~3\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2011-01-20 08:04:37 ——– d—–w- C:\Program Files\Bonjour 2011-01-20 08:04:37 ——– d—–w- C:\Program Files (x86)\Bonjour ==================== Find3M ==================== 2010-12-28 16:08:18 466944 —-a-w- C:\Windows\System32\odbc32.dll 2010-12-28 15:55:03 413696 —-a-w- C:\Windows\SysWow64\odbc32.dll 2010-12-21 02:08:40 24152 —-a-w- C:\Windows\System32\drivers\mbam.sys 2010-12-14 16:15:49 1251840 —-a-w- C:\Windows\System32\sdclt.exe 2010-11-30 01:38:30 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx 2010-11-30 01:38:30 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts ============= FINISH: 0:27:59.85 =============== DDS (Ver_10-12-12.02) Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 12/24/2008 3:01:53 AM System Uptime: 2/9/2011 12:13:54 AM (0 hours ago) Motherboard: Gateway | | RS780 Processor: AMD Phenom™ 9100e Quad-Core Processor | AM2 | 1800/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 586 GiB total, 279.216 GiB free. D: is CDROM () E: is Removable F: is Removable G: is Removable H: is Removable I: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== ==== Installed Programs ====================== µTorrent 7-Zip 4.65 aaa AC3Filter (remove only) Acrobat.com Adobe AIR Adobe Community Help Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Media Player Adobe Photoshop 7.0 Adobe Reader 9.2 Amazon MP3 Downloader 1.0.10 Apple Application Support Apple Software Update Audacity 1.3.12 (Unicode) Canon MP Navigator EX 2.0 Canon MP240 series User Registration Canon Utilities Easy-PhotoPrint EX Canon Utilities My Printer Canon Utilities Solution Menu Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Vista Catalyst Control Center Localization Danish Catalyst Control Center Localization Dutch Catalyst Control Center Localization Finnish Catalyst Control Center Localization French Catalyst Control Center Localization German Catalyst Control Center Localization Italian Catalyst Control Center Localization Japanese Catalyst Control Center Localization Norwegian Catalyst Control Center Localization Spanish Catalyst Control Center Localization Swedish ccc-core-static CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Italian CCC Help Japanese CCC Help Norwegian CCC Help Spanish CCC Help Swedish Compatibility Pack for the 2007 Office system ConvertHelper 2.2 CyberLink LabelPrint CyberLink MediaShow CyberLink Power2Go D-i-v-X AVI Codec Pack Pro 2.3.0 Dragon NaturallySpeaking 10 Dropbox File Uploader Garmin Training Center Garmin USB Drivers Gateway Games Gateway Recovery Management GearDrvs Google Chrome Google Toolbar for Internet Explorer Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hugin 0.7.0 (SVN 3465) ImgBurn Java™ 6 Update 15 Java™ 6 Update 5 KB0817 Keyboard Driver LAME v3.98.3 for Audacity Malwarebytes' Anti-Malware Marvell Miniport Driver Microsoft Money Essentials Microsoft Money Shared Libraries Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Standard Edition 2003 Microsoft Office Suite Activation Assistant Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Works Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 Move Media Player Mozilla Firefox (3.6.13) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nikon Message Center Nikon Transfer Picture Control Utility PrimoPDF QuickTime Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader RegRun Security Suite Platinum Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Skins Skype™ 4.1 Smart Copy [removed] Spelling Dictionaries Support For Adobe Reader 9 SPSS 15.0 for Windows Graduate Student Version StarCraft II Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Veetle TV 0.9.18 ViewNX Xvid 1.2.1 final uninstall ==== End Of File ===========================
Post #4
Hi UC_Caifan,

I see you do not have an active antivirus program installed. I will give you link to some good free ones after we are finished. Please limit the internet activity of this computer to this thread and downloading tools.

Please read through the instructions to familarize youself with what to expect when the tool runs.

It is vitally important that combofix is renamed before it is even started to download


Please download ComboFix from Link 1or Link 2 to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
    -Tools->Options->Main tab
    -Set to "Always ask me where to Save the files".
  • During the download, before you save it to your desktop, rename Combofix to jgh.exe

  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.
  • Close any open browsers/windows before running the tool.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Right click on combofix.exe (jgh.exe), click Run as Administrator & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log. How's the computer?

Thanks
Post #5
thanks again for the help. so far no random audio after a few minutes of running combofix on the computer and the internet seem to be operating a bit faster. ComboFix 11-02-09.02 - ME 02/09/2011 12:20:17.1.4 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3838.2226 [GMT -8:00] Running from: c:\users\[removed]\Desktop\jgh.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\ME\AppData\Local\{9C14CB18-1C29-4321-9F2E-E2841195CB52} c:\users\ME\AppData\Local\{9C14CB18-1C29-4321-9F2E-E2841195CB52}\chrome.manifest c:\users\ME\AppData\Local\{9C14CB18-1C29-4321-9F2E-E2841195CB52}\chrome\content\_cfg.js c:\users\ME\AppData\Local\{9C14CB18-1C29-4321-9F2E-E2841195CB52}\chrome\content\overlay.xul c:\users\ME\AppData\Local\{9C14CB18-1C29-4321-9F2E-E2841195CB52}\install.rdf c:\users\ME\AppData\Roaming\a05dpIJdg.exe c:\users\ME\AppData\Roaming\A0ZZsyXZ.exe c:\users\ME\AppData\Roaming\A1zlDSaeQ.exe c:\users\ME\AppData\Roaming\a4why2x.exe c:\users\ME\AppData\Roaming\A6JW0.exe c:\users\ME\AppData\Roaming\a9Vqu.exe c:\users\ME\AppData\Roaming\ABiJm.exe c:\users\ME\AppData\Roaming\AcfvlPgtP.exe c:\users\ME\AppData\Roaming\AehBfbMKO.exe c:\users\ME\AppData\Roaming\aEmDxWv.exe c:\users\ME\AppData\Roaming\aepPP4.exe c:\users\ME\AppData\Roaming\AFwTK.exe c:\users\ME\AppData\Roaming\ah7VmxlD.exe c:\users\ME\AppData\Roaming\AjQCHGWF.exe c:\users\ME\AppData\Roaming\AMiE9HU.exe c:\users\ME\AppData\Roaming\ancmt0q.exe c:\users\ME\AppData\Roaming\aNNWc.exe c:\users\ME\AppData\Roaming\ANROA.exe c:\users\ME\AppData\Roaming\AOSL5Va.exe c:\users\ME\AppData\Roaming\Ap27k.exe c:\users\ME\AppData\Roaming\aPcoTSzK.exe c:\users\ME\AppData\Roaming\ApMa4qby.exe c:\users\ME\AppData\Roaming\aQUTZeIKNS.exe c:\users\ME\AppData\Roaming\aSNu43a.exe c:\users\ME\AppData\Roaming\aUb5TkBwWP.exe c:\users\ME\AppData\Roaming\AudzjcBjU.exe c:\users\ME\AppData\Roaming\aVz0Bh.exe c:\users\ME\AppData\Roaming\aWueNO.exe c:\users\ME\AppData\Roaming\AZHQudIy.exe c:\users\ME\AppData\Roaming\azZR0.exe c:\users\ME\AppData\Roaming\b0I2kGarLQ.exe c:\users\ME\AppData\Roaming\B4RMr40a.exe c:\users\ME\AppData\Roaming\baIUzZ.exe c:\users\ME\AppData\Roaming\bC4TZ.exe c:\users\ME\AppData\Roaming\bGX5iXNT7.exe c:\users\ME\AppData\Roaming\bhZv9ZS.exe c:\users\ME\AppData\Roaming\bjMmNoswyu.exe c:\users\ME\AppData\Roaming\bLkbb6.exe c:\users\ME\AppData\Roaming\BmlcrhTXNs.exe c:\users\ME\AppData\Roaming\Bo8VON.exe c:\users\ME\AppData\Roaming\bPC0i.exe c:\users\ME\AppData\Roaming\bQHK5o5Wye.exe c:\users\ME\AppData\Roaming\buAxHNVmcP.exe c:\users\ME\AppData\Roaming\bWOfFF.exe c:\users\ME\AppData\Roaming\byLFPZ0A.exe c:\users\ME\AppData\Roaming\BYz3qFd3.exe c:\users\ME\AppData\Roaming\C29IC.exe c:\users\ME\AppData\Roaming\c40kN.exe c:\users\ME\AppData\Roaming\c4CUHSFnbf.exe c:\users\ME\AppData\Roaming\c5nINk.exe c:\users\ME\AppData\Roaming\C5YuU.exe c:\users\ME\AppData\Roaming\c8YMPBe3t.exe c:\users\ME\AppData\Roaming\CbhgKD.exe c:\users\ME\AppData\Roaming\CDAqMk4h.exe c:\users\ME\AppData\Roaming\cGan3tc.exe c:\users\ME\AppData\Roaming\CHd7mS38H.exe c:\users\ME\AppData\Roaming\cHMLqg3T.exe c:\users\ME\AppData\Roaming\CLGrS2xD.exe c:\users\ME\AppData\Roaming\CLKV4Iw008.exe c:\users\ME\AppData\Roaming\COBz8LIXP.exe c:\users\ME\AppData\Roaming\COKeJLu77h.exe c:\users\ME\AppData\Roaming\cOyibzJxJ.exe c:\users\ME\AppData\Roaming\CXOFO7Uwm.exe c:\users\ME\AppData\Roaming\cyba6brscN.exe c:\users\ME\AppData\Roaming\d40kGYp7H.exe c:\users\ME\AppData\Roaming\dD2dT.exe c:\users\ME\AppData\Roaming\dftLZ.exe c:\users\ME\AppData\Roaming\DInMc7T5v.exe c:\users\ME\AppData\Roaming\dJcv9.exe c:\users\ME\AppData\Roaming\dktXb.exe c:\users\ME\AppData\Roaming\dnYSV.exe c:\users\ME\AppData\Roaming\Do0ZY.exe c:\users\ME\AppData\Roaming\DoUbHLO.exe c:\users\ME\AppData\Roaming\dqAO4bekzA.exe c:\users\ME\AppData\Roaming\DQkfNk.exe c:\users\ME\AppData\Roaming\dqv5pP77.exe c:\users\ME\AppData\Roaming\DUWf4LkRn.exe c:\users\ME\AppData\Roaming\dV2g7Smmd.exe c:\users\ME\AppData\Roaming\dwbLm.exe c:\users\ME\AppData\Roaming\dWx1R.exe c:\users\ME\AppData\Roaming\dy8hS.exe c:\users\ME\AppData\Roaming\dyckbLx.exe c:\users\ME\AppData\Roaming\dZOirO.exe c:\users\ME\AppData\Roaming\e5phK2Pef.exe c:\users\ME\AppData\Roaming\e9bVlCJINi.exe c:\users\ME\AppData\Roaming\ea7oiuGkGC.exe c:\users\ME\AppData\Roaming\eaCcGP.exe c:\users\ME\AppData\Roaming\EbsPql.exe c:\users\ME\AppData\Roaming\eBYvhgd8D.exe c:\users\ME\AppData\Roaming\ecVgfhXm.exe c:\users\ME\AppData\Roaming\EdSKM9qD.exe c:\users\ME\AppData\Roaming\EEfN3Xibz.exe c:\users\ME\AppData\Roaming\eelpHLd33C.exe c:\users\ME\AppData\Roaming\efPhfC.exe c:\users\ME\AppData\Roaming\EHaOq8A8M4.exe c:\users\ME\AppData\Roaming\eHgNw.exe c:\users\ME\AppData\Roaming\EickC.exe c:\users\ME\AppData\Roaming\eiibeTRI1Y.exe c:\users\ME\AppData\Roaming\eIUJ7.exe c:\users\ME\AppData\Roaming\eKHpqS.exe c:\users\ME\AppData\Roaming\eLigrz.exe c:\users\ME\AppData\Roaming\enG2Z8HxA.exe c:\users\ME\AppData\Roaming\eosT9.exe c:\users\ME\AppData\Roaming\eq4MLt4Y.exe c:\users\ME\AppData\Roaming\ER45h.exe c:\users\ME\AppData\Roaming\Es2H7l6hL.exe c:\users\ME\AppData\Roaming\ESOP7YK.exe c:\users\ME\AppData\Roaming\ESpiWMFV.exe c:\users\ME\AppData\Roaming\euFjGlToG.exe c:\users\ME\AppData\Roaming\evW95.exe c:\users\ME\AppData\Roaming\fbKpHYghOp.exe c:\users\ME\AppData\Roaming\FcIcjnzFr.exe c:\users\ME\AppData\Roaming\FhfpoaY4.exe c:\users\ME\AppData\Roaming\fI513oYlZ6.exe c:\users\ME\AppData\Roaming\FmqbiWedUt.exe c:\users\ME\AppData\Roaming\FNWne2DIuQ.exe c:\users\ME\AppData\Roaming\foBl0oVGO.exe c:\users\ME\AppData\Roaming\fODbAAf.exe c:\users\ME\AppData\Roaming\fOTwA.exe c:\users\ME\AppData\Roaming\fq1l2rTJS.exe c:\users\ME\AppData\Roaming\FQEUD5G.exe c:\users\ME\AppData\Roaming\FTFYq0GQb7.exe c:\users\ME\AppData\Roaming\FwaByNg.exe c:\users\ME\AppData\Roaming\g3ywPX.exe c:\users\ME\AppData\Roaming\G8iEIjE.exe c:\users\ME\AppData\Roaming\gatVyZoV.exe c:\users\ME\AppData\Roaming\gBZioTZY.exe c:\users\ME\AppData\Roaming\Gfx1bF.exe c:\users\ME\AppData\Roaming\gGi4mmf2j.exe c:\users\ME\AppData\Roaming\gipOK.exe c:\users\ME\AppData\Roaming\gIZ7Vq9.exe c:\users\ME\AppData\Roaming\gjfgpo.exe c:\users\ME\AppData\Roaming\GObjNfOleU.exe c:\users\ME\AppData\Roaming\gTN0jE.exe c:\users\ME\AppData\Roaming\gtrCbw2L.exe c:\users\ME\AppData\Roaming\Gw3UD.exe c:\users\ME\AppData\Roaming\h0mlH.exe c:\users\ME\AppData\Roaming\h1vSkLK316.exe c:\users\ME\AppData\Roaming\H3X0wxCyD.exe c:\users\ME\AppData\Roaming\h5dDc.exe c:\users\ME\AppData\Roaming\H882xYy.exe c:\users\ME\AppData\Roaming\HA70bCHj2.exe c:\users\ME\AppData\Roaming\haQ7bFaL.exe c:\users\ME\AppData\Roaming\hAzOCQIC6.exe c:\users\ME\AppData\Roaming\He90Fit5AF.exe c:\users\ME\AppData\Roaming\HefCFBg.exe c:\users\ME\AppData\Roaming\hfB41.exe c:\users\ME\AppData\Roaming\HfFwh.exe c:\users\ME\AppData\Roaming\HFiOExp.exe c:\users\ME\AppData\Roaming\hGGiPGiBjZ.exe c:\users\ME\AppData\Roaming\hHdbL.exe c:\users\ME\AppData\Roaming\HjORp.exe c:\users\ME\AppData\Roaming\Hl1qQOZNr.exe c:\users\ME\AppData\Roaming\hLsB8w3gu.exe c:\users\ME\AppData\Roaming\HNFMnIuQQ.exe c:\users\ME\AppData\Roaming\hPFlZFSQmh.exe c:\users\ME\AppData\Roaming\HQtH1.exe c:\users\ME\AppData\Roaming\HuFwo7lwgV.exe c:\users\ME\AppData\Roaming\hW2uDG.exe c:\users\ME\AppData\Roaming\hWDV91lp.exe c:\users\ME\AppData\Roaming\HX4I4urw.exe c:\users\ME\AppData\Roaming\HxKsqma46H.exe c:\users\ME\AppData\Roaming\hXwPd.exe c:\users\ME\AppData\Roaming\HzD660q.exe c:\users\ME\AppData\Roaming\i1LrzVov.exe c:\users\ME\AppData\Roaming\i25oz.exe c:\users\ME\AppData\Roaming\i6aJJOwx.exe c:\users\ME\AppData\Roaming\i7sMW0Y2PL.exe c:\users\ME\AppData\Roaming\IaggsjjCo.exe c:\users\ME\AppData\Roaming\idFKJ1PCs.exe c:\users\ME\AppData\Roaming\idWXA.exe c:\users\ME\AppData\Roaming\iGkc9CT7.exe c:\users\ME\AppData\Roaming\IHuELwBK.exe c:\users\ME\AppData\Roaming\iJwkDo.exe c:\users\ME\AppData\Roaming\IlpD1VjS.exe c:\users\ME\AppData\Roaming\INZlN83.exe c:\users\ME\AppData\Roaming\iowacY.exe c:\users\ME\AppData\Roaming\iQzL5QqA.exe c:\users\ME\AppData\Roaming\irtlzKdS.exe c:\users\ME\AppData\Roaming\IUcvsH9.exe c:\users\ME\AppData\Roaming\IUe1uNKt.exe c:\users\ME\AppData\Roaming\iVH00Vb5.exe c:\users\ME\AppData\Roaming\IWhESG4Vzn.exe c:\users\ME\AppData\Roaming\iwNDp5q.exe c:\users\ME\AppData\Roaming\IwnhBgpCr.exe c:\users\ME\AppData\Roaming\ixZX2vysXk.exe c:\users\ME\AppData\Roaming\IyOeqAg.exe c:\users\ME\AppData\Roaming\j1OFydvdva.exe c:\users\ME\AppData\Roaming\j7zfpDuvl.exe c:\users\ME\AppData\Roaming\J84PBkrOo.exe c:\users\ME\AppData\Roaming\JbvvEzr.exe c:\users\ME\AppData\Roaming\JddvYKxE3.exe c:\users\ME\AppData\Roaming\jDHtBW10.exe c:\users\ME\AppData\Roaming\Je42oV.exe c:\users\ME\AppData\Roaming\JGDXW6.exe c:\users\ME\AppData\Roaming\Jgg9PBYn.exe c:\users\ME\AppData\Roaming\JJNimOjurp.exe c:\users\ME\AppData\Roaming\jM206BD.exe c:\users\ME\AppData\Roaming\jmrl9O.exe c:\users\ME\AppData\Roaming\JSnE1.exe c:\users\ME\AppData\Roaming\K3NBICE.exe c:\users\ME\AppData\Roaming\k4V3fu.exe c:\users\ME\AppData\Roaming\k5He4tw.exe c:\users\ME\AppData\Roaming\k6nVilTcw.exe c:\users\ME\AppData\Roaming\kBBzqT.exe c:\users\ME\AppData\Roaming\KEKPPgQKt1.exe c:\users\ME\AppData\Roaming\kgZXbW.exe c:\users\ME\AppData\Roaming\kHzKH.exe c:\users\ME\AppData\Roaming\KIcBXWi.exe c:\users\ME\AppData\Roaming\kiWjfV7Ulu.exe c:\users\ME\AppData\Roaming\KJPi82S0x.exe c:\users\ME\AppData\Roaming\Kkgt5JpG.exe c:\users\ME\AppData\Roaming\kKN404Nhq.exe c:\users\ME\AppData\Roaming\kM2OncpDSf.exe c:\users\ME\AppData\Roaming\KMFnJpSs8a.exe c:\users\ME\AppData\Roaming\kmTmW0y.exe c:\users\ME\AppData\Roaming\KOJbu.exe c:\users\ME\AppData\Roaming\KoJSkLTfZ.exe c:\users\ME\AppData\Roaming\KpuUJoccpv.exe c:\users\ME\AppData\Roaming\Kqw32.exe c:\users\ME\AppData\Roaming\KRi2C.exe c:\users\ME\AppData\Roaming\krLOB.exe c:\users\ME\AppData\Roaming\KS8fVn0U35.exe c:\users\ME\AppData\Roaming\KSygq.exe c:\users\ME\AppData\Roaming\ktBQnjQqLq.exe c:\users\ME\AppData\Roaming\kwK5fzh9.exe c:\users\ME\AppData\Roaming\KwPKH.exe c:\users\ME\AppData\Roaming\kX3teIji7.exe c:\users\ME\AppData\Roaming\KZFbFbAP.exe c:\users\ME\AppData\Roaming\KzMFNWHt.exe c:\users\ME\AppData\Roaming\L59Imtw3.exe c:\users\ME\AppData\Roaming\L6dI4twZS.exe c:\users\ME\AppData\Roaming\L76DC4K.exe c:\users\ME\AppData\Roaming\l7ZU1Ye.exe c:\users\ME\AppData\Roaming\l9zFB2j.exe c:\users\ME\AppData\Roaming\LCfshd.exe c:\users\ME\AppData\Roaming\le5Q8wotvq.exe c:\users\ME\AppData\Roaming\ljWGwx1.exe c:\users\ME\AppData\Roaming\LLLhih.exe c:\users\ME\AppData\Roaming\lMYLRZTu.exe c:\users\ME\AppData\Roaming\lPmFsmiq.exe c:\users\ME\AppData\Roaming\lqIKEpBy.exe c:\users\ME\AppData\Roaming\ls0fgGQmod.exe c:\users\ME\AppData\Roaming\LTUZOMP7UN.exe c:\users\ME\AppData\Roaming\LUOiglrHR.exe c:\users\ME\AppData\Roaming\LurKbNKKR.exe c:\users\ME\AppData\Roaming\LVBkRF.exe c:\users\ME\AppData\Roaming\lVCQMTK.exe c:\users\ME\AppData\Roaming\lzdyR.exe c:\users\ME\AppData\Roaming\M0weAT7A.exe c:\users\ME\AppData\Roaming\M1eEaQ.exe c:\users\ME\AppData\Roaming\m4ylzWYntx.exe c:\users\ME\AppData\Roaming\M64SdvUh.exe c:\users\ME\AppData\Roaming\m87AEf.exe c:\users\ME\AppData\Roaming\m8LnkyiWa7.exe c:\users\ME\AppData\Roaming\M9moSa.exe c:\users\ME\AppData\Roaming\mexmN2V0.exe c:\users\ME\AppData\Roaming\Mgp8Ltmy9.exe c:\users\ME\AppData\Roaming\mngrlY4kDS.exe c:\users\ME\AppData\Roaming\MpnhAEh.exe c:\users\ME\AppData\Roaming\mqPEDG.exe c:\users\ME\AppData\Roaming\mrK6egHRTv.exe c:\users\ME\AppData\Roaming\mTYFNj0s.exe c:\users\ME\AppData\Roaming\MUqeQXJVVA.exe c:\users\ME\AppData\Roaming\mwdNoh3dSZ.exe c:\users\ME\AppData\Roaming\mxBkpkRyvW.exe c:\users\ME\AppData\Roaming\n0v0irL.exe c:\users\ME\AppData\Roaming\n27hSdPJ.exe c:\users\ME\AppData\Roaming\n7kI5.exe c:\users\ME\AppData\Roaming\nanBKQj3.exe c:\users\ME\AppData\Roaming\nbamgGC.exe c:\users\ME\AppData\Roaming\nBayWRRf.exe c:\users\ME\AppData\Roaming\Nc8X28B.exe c:\users\ME\AppData\Roaming\NcQPcX.exe c:\users\ME\AppData\Roaming\NEXekUzJh.exe c:\users\ME\AppData\Roaming\nFU3iiCqX.exe c:\users\ME\AppData\Roaming\Nio4grc7.exe c:\users\ME\AppData\Roaming\NkAhpxsQ.exe c:\users\ME\AppData\Roaming\NrB4H.exe c:\users\ME\AppData\Roaming\nULmsdQ.exe c:\users\ME\AppData\Roaming\NURyfd.exe c:\users\ME\AppData\Roaming\nuWYzc.exe c:\users\ME\AppData\Roaming\nvSOKWo1tp.exe c:\users\ME\AppData\Roaming\NwE92.exe c:\users\ME\AppData\Roaming\NxN4P.exe c:\users\ME\AppData\Roaming\nY8FNolA.exe c:\users\ME\AppData\Roaming\NYoaGLoA.exe c:\users\ME\AppData\Roaming\NYUbB7vAJn.exe c:\users\ME\AppData\Roaming\o305Mh.exe c:\users\ME\AppData\Roaming\O3clj22.exe c:\users\ME\AppData\Roaming\o5Svhe5xkN.exe c:\users\ME\AppData\Roaming\o8130QcBuL.exe c:\users\ME\AppData\Roaming\Oa6JW.exe c:\users\ME\AppData\Roaming\oBe0WFhrHF.exe c:\users\ME\AppData\Roaming\oCraHYzpvn.exe c:\users\ME\AppData\Roaming\OIDbvzYBL.exe c:\users\ME\AppData\Roaming\OiJKB3Zwu.exe c:\users\ME\AppData\Roaming\OJbfQcIa.exe c:\users\ME\AppData\Roaming\OlplvQGQJ.exe c:\users\ME\AppData\Roaming\OM3dtmpmu.exe c:\users\ME\AppData\Roaming\OmM4nuNAK.exe c:\users\ME\AppData\Roaming\ONbAvKNJ.exe c:\users\ME\AppData\Roaming\Oq1zobXAPm.exe c:\users\ME\AppData\Roaming\orG4u.exe c:\users\ME\AppData\Roaming\OU1UoXOh3T.exe c:\users\ME\AppData\Roaming\OVFSi.exe c:\users\ME\AppData\Roaming\oVHmBc7pQ.exe c:\users\ME\AppData\Roaming\OVkkm.exe c:\users\ME\AppData\Roaming\oWBrLHgCh.exe c:\users\ME\AppData\Roaming\OwNWr4zu1X.exe c:\users\ME\AppData\Roaming\p0xOB.exe c:\users\ME\AppData\Roaming\P2ZGo.exe c:\users\ME\AppData\Roaming\p54Twu4d4.exe c:\users\ME\AppData\Roaming\pAg6A.exe c:\users\ME\AppData\Roaming\pbjoawj.exe c:\users\ME\AppData\Roaming\PEBMTZk.exe c:\users\ME\AppData\Roaming\PEGdp.exe c:\users\ME\AppData\Roaming\PEqs7EL.exe c:\users\ME\AppData\Roaming\PEQx5qs.exe c:\users\ME\AppData\Roaming\pfF6rg.exe c:\users\ME\AppData\Roaming\pGfyg.exe c:\users\ME\AppData\Roaming\pGycTp7.exe c:\users\ME\AppData\Roaming\pIBvQy.exe c:\users\ME\AppData\Roaming\PiHDwwJNa.exe c:\users\ME\AppData\Roaming\piwoLF.exe c:\users\ME\AppData\Roaming\PkOfNNnyBo.exe c:\users\ME\AppData\Roaming\PPvI4.exe c:\users\ME\AppData\Roaming\pRSNLswi.exe c:\users\ME\AppData\Roaming\PSsQ3R7.exe c:\users\ME\AppData\Roaming\PufW3Lsgat.exe c:\users\ME\AppData\Roaming\pvjMi.exe c:\users\ME\AppData\Roaming\pxTSfsmN7.exe c:\users\ME\AppData\Roaming\pzUAXLF.exe c:\users\ME\AppData\Roaming\q0WYC.exe c:\users\ME\AppData\Roaming\Q3UDLulw.exe c:\users\ME\AppData\Roaming\qBbDzi5e.exe c:\users\ME\AppData\Roaming\qBQrlRxd4z.exe c:\users\ME\AppData\Roaming\QEBz5YdnV2.exe c:\users\ME\AppData\Roaming\qEsiSv.exe c:\users\ME\AppData\Roaming\qF564Bvse.exe c:\users\ME\AppData\Roaming\QFGATY98bI.exe c:\users\ME\AppData\Roaming\QFRQ1SQt.exe c:\users\ME\AppData\Roaming\QIISia.exe c:\users\ME\AppData\Roaming\QKGs69.exe c:\users\ME\AppData\Roaming\qLsf52Jj.exe c:\users\ME\AppData\Roaming\qNoFvaL.exe c:\users\ME\AppData\Roaming\QPCYMLn4a.exe c:\users\ME\AppData\Roaming\Qpwcq9gUMt.exe c:\users\ME\AppData\Roaming\qRItPiOM.exe c:\users\ME\AppData\Roaming\Qu2dF7kXVa.exe c:\users\ME\AppData\Roaming\QVVOEC41l.exe c:\users\ME\AppData\Roaming\qwL77ES7v.exe c:\users\ME\AppData\Roaming\QxA6EJti1m.exe c:\users\ME\AppData\Roaming\QY1b0V.exe c:\users\ME\AppData\Roaming\qYYtY2CMqB.exe c:\users\ME\AppData\Roaming\qz4Cw9f.exe c:\users\ME\AppData\Roaming\R1EyVR.exe c:\users\ME\AppData\Roaming\R2XyMDpR.exe c:\users\ME\AppData\Roaming\R4tgmK01.exe c:\users\ME\AppData\Roaming\rcASS.exe c:\users\ME\AppData\Roaming\rIVh00R0Z.exe c:\users\ME\AppData\Roaming\RmF1RE.exe c:\users\ME\AppData\Roaming\rngpEI.exe c:\users\ME\AppData\Roaming\roZ3yv13Z.exe c:\users\ME\AppData\Roaming\rQZhyuke.exe c:\users\ME\AppData\Roaming\ryDZOjti1G.exe c:\users\ME\AppData\Roaming\S06tB.exe c:\users\ME\AppData\Roaming\s0pfsTzz.exe c:\users\ME\AppData\Roaming\S8p8s4.exe c:\users\ME\AppData\Roaming\S9ekT.exe c:\users\ME\AppData\Roaming\sa63NJFZ.exe c:\users\ME\AppData\Roaming\sg5NJc.exe c:\users\ME\AppData\Roaming\SgVSS.exe c:\users\ME\AppData\Roaming\sHzno.exe c:\users\ME\AppData\Roaming\sOn2vgAVA.exe c:\users\ME\AppData\Roaming\SQQIHKE1h.exe c:\users\ME\AppData\Roaming\startup.js c:\users\ME\AppData\Roaming\sU6E6Oi4Sd.exe c:\users\ME\AppData\Roaming\sU8qq2.exe c:\users\ME\AppData\Roaming\sum3p.exe c:\users\ME\AppData\Roaming\sVw41JEPj.exe c:\users\ME\AppData\Roaming\SweZNpmQ.exe c:\users\ME\AppData\Roaming\sZsPMtFids.exe c:\users\ME\AppData\Roaming\T4V0Vzxtda.exe c:\users\ME\AppData\Roaming\t9jqhcuW.exe c:\users\ME\AppData\Roaming\t9kfB9.exe c:\users\ME\AppData\Roaming\tbO3GmVYDV.exe c:\users\ME\AppData\Roaming\tC7n5G.exe c:\users\ME\AppData\Roaming\TcQ4iDyMub.exe c:\users\ME\AppData\Roaming\TecS19.exe c:\users\ME\AppData\Roaming\temp.js c:\users\ME\AppData\Roaming\tJmunPHDeK.exe c:\users\ME\AppData\Roaming\TjvAyTrI2.exe c:\users\ME\AppData\Roaming\TK1TTP5A.exe c:\users\ME\AppData\Roaming\TQeh61cN2.exe c:\users\ME\AppData\Roaming\TsvGJvUn.exe c:\users\ME\AppData\Roaming\ttCJzsZAy.exe c:\users\ME\AppData\Roaming\tTs6y.exe c:\users\ME\AppData\Roaming\ttYw4JWg.exe c:\users\ME\AppData\Roaming\tUWmg.exe c:\users\ME\AppData\Roaming\tYJrEzO4T.exe c:\users\ME\AppData\Roaming\UbZMvQB.exe c:\users\ME\AppData\Roaming\UciN0.exe c:\users\ME\AppData\Roaming\udf97lf.exe c:\users\ME\AppData\Roaming\ufympfDb4M.exe c:\users\ME\AppData\Roaming\UGYcPk.exe c:\users\ME\AppData\Roaming\UkqSY88N.exe c:\users\ME\AppData\Roaming\UlWp1vd8.exe c:\users\ME\AppData\Roaming\ulySR1eTWI.exe c:\users\ME\AppData\Roaming\umiQHxn.exe c:\users\ME\AppData\Roaming\uqLDCFjKI.exe c:\users\ME\AppData\Roaming\uQQcKv8oCf.exe c:\users\ME\AppData\Roaming\USHGEwV.exe c:\users\ME\AppData\Roaming\uSOtxo.exe c:\users\ME\AppData\Roaming\UsUrkFoxN.exe c:\users\ME\AppData\Roaming\uSYBM.exe c:\users\ME\AppData\Roaming\UtBe9VpUg.exe c:\users\ME\AppData\Roaming\UVbqH9ek.exe c:\users\ME\AppData\Roaming\uXFyY7NoRO.exe c:\users\ME\AppData\Roaming\UZSNVPBOUv.exe c:\users\ME\AppData\Roaming\V0gQqlQ.exe c:\users\ME\AppData\Roaming\V3MOai8D.exe c:\users\ME\AppData\Roaming\vckFaxBj5.exe c:\users\ME\AppData\Roaming\VCqOken9i.exe c:\users\ME\AppData\Roaming\vgKONPhTtz.exe c:\users\ME\AppData\Roaming\vHYNF.exe c:\users\ME\AppData\Roaming\vIBUn1xNc8.exe c:\users\ME\AppData\Roaming\VICxZpS.exe c:\users\ME\AppData\Roaming\Vk9GRr.exe c:\users\ME\AppData\Roaming\vKqNVyb.exe c:\users\ME\AppData\Roaming\VM6ayeuqZ.exe c:\users\ME\AppData\Roaming\vMzCJUq.exe c:\users\ME\AppData\Roaming\VqA1EwwHCf.exe c:\users\ME\AppData\Roaming\vqrrIOtAUn.exe c:\users\ME\AppData\Roaming\vtlt1cHtUq.exe c:\users\ME\AppData\Roaming\vUasCnw.exe c:\users\ME\AppData\Roaming\VVngR.exe c:\users\ME\AppData\Roaming\vxmD9g.exe c:\users\ME\AppData\Roaming\vYLTinQ33r.exe c:\users\ME\AppData\Roaming\vZEirV2GNK.exe c:\users\ME\AppData\Roaming\W0B5wqn6.exe c:\users\ME\AppData\Roaming\w9ahpU.exe c:\users\ME\AppData\Roaming\Wa9cQ.exe c:\users\ME\AppData\Roaming\wbNnH.exe c:\users\ME\AppData\Roaming\wDWhjRANQ.exe c:\users\ME\AppData\Roaming\wfx4rNW.exe c:\users\ME\AppData\Roaming\WIG6Zq.exe c:\users\ME\AppData\Roaming\wmOaFk.exe c:\users\ME\AppData\Roaming\WNZGlMh.exe c:\users\ME\AppData\Roaming\wrtWd.exe c:\users\ME\AppData\Roaming\WrVvdHbS.exe c:\users\ME\AppData\Roaming\WuCUTX6.exe c:\users\ME\AppData\Roaming\WuoJRhF.exe c:\users\ME\AppData\Roaming\X4fOzIjbn.exe c:\users\ME\AppData\Roaming\x58O7jBlw.exe c:\users\ME\AppData\Roaming\X5yMSDg.exe c:\users\ME\AppData\Roaming\X7g94hQ.exe c:\users\ME\AppData\Roaming\xg0dII2T.exe c:\users\ME\AppData\Roaming\XijkZKay.exe c:\users\ME\AppData\Roaming\xK4ta.exe c:\users\ME\AppData\Roaming\xKjQHQEhih.exe c:\users\ME\AppData\Roaming\xSHkL00t3R.exe c:\users\ME\AppData\Roaming\xTFrZP.exe c:\users\ME\AppData\Roaming\XuR91lY.exe c:\users\ME\AppData\Roaming\Y092k7jdms.exe c:\users\ME\AppData\Roaming\YAWGh8.exe c:\users\ME\AppData\Roaming\Ybe7ZN4.exe c:\users\ME\AppData\Roaming\yEGH1iwl8U.exe c:\users\ME\AppData\Roaming\ygY633L.exe c:\users\ME\AppData\Roaming\Ykwlh.exe c:\users\ME\AppData\Roaming\YMhmcjja.exe c:\users\ME\AppData\Roaming\YSYsGyk8.exe c:\users\ME\AppData\Roaming\YV2kr.exe c:\users\ME\AppData\Roaming\YwpgmOVks.exe c:\users\ME\AppData\Roaming\yX6VtD.exe c:\users\ME\AppData\Roaming\z57IuDS4.exe c:\users\ME\AppData\Roaming\z6NC3IUH.exe c:\users\ME\AppData\Roaming\z6Vu0FeLF.exe c:\users\ME\AppData\Roaming\zcmkAI.exe c:\users\ME\AppData\Roaming\zEsb1.exe c:\users\ME\AppData\Roaming\zF7CSfYFU.exe c:\users\ME\AppData\Roaming\zg4SuL.exe c:\users\ME\AppData\Roaming\ZHzcHsN.exe c:\users\ME\AppData\Roaming\ZlcZnKw.exe c:\users\ME\AppData\Roaming\ZLPaXms.exe c:\users\ME\AppData\Roaming\ZMuCIstm.exe c:\users\ME\AppData\Roaming\zO9S3By.exe c:\users\ME\AppData\Roaming\ZoEFz.exe c:\users\ME\AppData\Roaming\zOlNvDk.exe c:\users\ME\AppData\Roaming\ZoWMDA.exe c:\users\ME\AppData\Roaming\Zry1SWmM.exe c:\users\ME\AppData\Roaming\ZVdhc0.exe c:\users\ME\AppData\Roaming\Zw7Ff10.exe —– File Replicators —– c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\programdata\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\programdata\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Application Data\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Application Data\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\All Users\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe c:\users\All Users\Temp\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe c:\users\ME\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P1QNTISO\cbta[1].exe c:\users\ME\AppData\Roaming\a05dpIJdg.exe c:\users\ME\AppData\Roaming\A0ZZsyXZ.exe c:\users\ME\AppData\Roaming\A1zlDSaeQ.exe c:\users\ME\AppData\Roaming\a4why2x.exe c:\users\ME\AppData\Roaming\A6JW0.exe c:\users\ME\AppData\Roaming\a9Vqu.exe c:\users\ME\AppData\Roaming\ABiJm.exe c:\users\ME\AppData\Roaming\AcfvlPgtP.exe c:\users\ME\AppData\Roaming\AehBfbMKO.exe c:\users\ME\AppData\Roaming\aEmDxWv.exe c:\users\ME\AppData\Roaming\aepPP4.exe c:\users\ME\AppData\Roaming\AFwTK.exe c:\users\ME\AppData\Roaming\ah7VmxlD.exe c:\users\ME\AppData\Roaming\AjQCHGWF.exe c:\users\ME\AppData\Roaming\AMiE9HU.exe c:\users\ME\AppData\Roaming\ancmt0q.exe c:\users\ME\AppData\Roaming\aNNWc.exe c:\users\ME\AppData\Roaming\ANROA.exe c:\users\ME\AppData\Roaming\AOSL5Va.exe c:\users\ME\AppData\Roaming\Ap27k.exe c:\users\ME\AppData\Roaming\aPcoTSzK.exe c:\users\ME\AppData\Roaming\ApMa4qby.exe c:\users\ME\AppData\Roaming\aQUTZeIKNS.exe c:\users\ME\AppData\Roaming\aSNu43a.exe c:\users\ME\AppData\Roaming\aUb5TkBwWP.exe c:\users\ME\AppData\Roaming\AudzjcBjU.exe c:\users\ME\AppData\Roaming\aVz0Bh.exe c:\users\ME\AppData\Roaming\aWueNO.exe c:\users\ME\AppData\Roaming\AZHQudIy.exe c:\users\ME\AppData\Roaming\azZR0.exe c:\users\ME\AppData\Roaming\b0I2kGarLQ.exe c:\users\ME\AppData\Roaming\B4RMr40a.exe c:\users\ME\AppData\Roaming\baIUzZ.exe c:\users\ME\AppData\Roaming\bC4TZ.exe c:\users\ME\AppData\Roaming\bGX5iXNT7.exe c:\users\ME\AppData\Roaming\bhZv9ZS.exe c:\users\ME\AppData\Roaming\bjMmNoswyu.exe c:\users\ME\AppData\Roaming\bLkbb6.exe c:\users\ME\AppData\Roaming\BmlcrhTXNs.exe c:\users\ME\AppData\Roaming\Bo8VON.exe c:\users\ME\AppData\Roaming\bPC0i.exe c:\users\ME\AppData\Roaming\bQHK5o5Wye.exe c:\users\ME\AppData\Roaming\buAxHNVmcP.exe c:\users\ME\AppData\Roaming\bWOfFF.exe c:\users\ME\AppData\Roaming\byLFPZ0A.exe c:\users\ME\AppData\Roaming\BYz3qFd3.exe c:\users\ME\AppData\Roaming\C29IC.exe c:\users\ME\AppData\Roaming\c40kN.exe c:\users\ME\AppData\Roaming\c4CUHSFnbf.exe c:\users\ME\AppData\Roaming\c5nINk.exe c:\users\ME\AppData\Roaming\C5YuU.exe c:\users\ME\AppData\Roaming\c8YMPBe3t.exe c:\users\ME\AppData\Roaming\CbhgKD.exe c:\users\ME\AppData\Roaming\CDAqMk4h.exe c:\users\ME\AppData\Roaming\cGan3tc.exe c:\users\ME\AppData\Roaming\CHd7mS38H.exe c:\users\ME\AppData\Roaming\cHMLqg3T.exe c:\users\ME\AppData\Roaming\CLGrS2xD.exe c:\users\ME\AppData\Roaming\CLKV4Iw008.exe c:\users\ME\AppData\Roaming\COBz8LIXP.exe c:\users\ME\AppData\Roaming\COKeJLu77h.exe c:\users\ME\AppData\Roaming\cOyibzJxJ.exe c:\users\ME\AppData\Roaming\CXOFO7Uwm.exe c:\users\ME\AppData\Roaming\cyba6brscN.exe c:\users\ME\AppData\Roaming\d40kGYp7H.exe c:\users\ME\AppData\Roaming\dD2dT.exe c:\users\ME\AppData\Roaming\dftLZ.exe c:\users\ME\AppData\Roaming\DInMc7T5v.exe c:\users\ME\AppData\Roaming\dJcv9.exe c:\users\ME\AppData\Roaming\dktXb.exe c:\users\ME\AppData\Roaming\dnYSV.exe c:\users\ME\AppData\Roaming\Do0ZY.exe c:\users\ME\AppData\Roaming\DoUbHLO.exe c:\users\ME\AppData\Roaming\dqAO4bekzA.exe c:\users\ME\AppData\Roaming\DQkfNk.exe c:\users\ME\AppData\Roaming\dqv5pP77.exe c:\users\ME\AppData\Roaming\DUWf4LkRn.exe c:\users\ME\AppData\Roaming\dV2g7Smmd.exe c:\users\ME\AppData\Roaming\dwbLm.exe c:\users\ME\AppData\Roaming\dWx1R.exe c:\users\ME\AppData\Roaming\dy8hS.exe c:\users\ME\AppData\Roaming\dyckbLx.exe c:\users\ME\AppData\Roaming\dZOirO.exe c:\users\ME\AppData\Roaming\e5phK2Pef.exe c:\users\ME\AppData\Roaming\e9bVlCJINi.exe c:\users\ME\AppData\Roaming\ea7oiuGkGC.exe c:\users\ME\AppData\Roaming\eaCcGP.exe c:\users\ME\AppData\Roaming\EbsPql.exe c:\users\ME\AppData\Roaming\eBYvhgd8D.exe c:\users\ME\AppData\Roaming\ecVgfhXm.exe c:\users\ME\AppData\Roaming\EdSKM9qD.exe c:\users\ME\AppData\Roaming\EEfN3Xibz.exe c:\users\ME\AppData\Roaming\eelpHLd33C.exe c:\users\ME\AppData\Roaming\efPhfC.exe c:\users\ME\AppData\Roaming\EHaOq8A8M4.exe c:\users\ME\AppData\Roaming\eHgNw.exe c:\users\ME\AppData\Roaming\EickC.exe c:\users\ME\AppData\Roaming\eiibeTRI1Y.exe c:\users\ME\AppData\Roaming\eIUJ7.exe c:\users\ME\AppData\Roaming\eKHpqS.exe c:\users\ME\AppData\Roaming\eLigrz.exe c:\users\ME\AppData\Roaming\enG2Z8HxA.exe c:\users\ME\AppData\Roaming\eosT9.exe c:\users\ME\AppData\Roaming\eq4MLt4Y.exe c:\users\ME\AppData\Roaming\ER45h.exe c:\users\ME\AppData\Roaming\Es2H7l6hL.exe c:\users\ME\AppData\Roaming\ESOP7YK.exe c:\users\ME\AppData\Roaming\ESpiWMFV.exe c:\users\ME\AppData\Roaming\euFjGlToG.exe c:\users\ME\AppData\Roaming\evW95.exe c:\users\ME\AppData\Roaming\fbKpHYghOp.exe c:\users\ME\AppData\Roaming\FcIcjnzFr.exe c:\users\ME\AppData\Roaming\FhfpoaY4.exe c:\users\ME\AppData\Roaming\fI513oYlZ6.exe c:\users\ME\AppData\Roaming\FmqbiWedUt.exe c:\users\ME\AppData\Roaming\FNWne2DIuQ.exe c:\users\ME\AppData\Roaming\foBl0oVGO.exe c:\users\ME\AppData\Roaming\fODbAAf.exe c:\users\ME\AppData\Roaming\fOTwA.exe c:\users\ME\AppData\Roaming\fq1l2rTJS.exe c:\users\ME\AppData\Roaming\FQEUD5G.exe c:\users\ME\AppData\Roaming\FTFYq0GQb7.exe c:\users\ME\AppData\Roaming\FwaByNg.exe c:\users\ME\AppData\Roaming\g3ywPX.exe c:\users\ME\AppData\Roaming\G8iEIjE.exe c:\users\ME\AppData\Roaming\gatVyZoV.exe c:\users\ME\AppData\Roaming\gBZioTZY.exe c:\users\ME\AppData\Roaming\Gfx1bF.exe c:\users\ME\AppData\Roaming\gGi4mmf2j.exe c:\users\ME\AppData\Roaming\gipOK.exe c:\users\ME\AppData\Roaming\gIZ7Vq9.exe c:\users\ME\AppData\Roaming\gjfgpo.exe c:\users\ME\AppData\Roaming\GObjNfOleU.exe c:\users\ME\AppData\Roaming\gTN0jE.exe c:\users\ME\AppData\Roaming\gtrCbw2L.exe c:\users\ME\AppData\Roaming\Gw3UD.exe c:\users\ME\AppData\Roaming\h0mlH.exe c:\users\ME\AppData\Roaming\h1vSkLK316.exe c:\users\ME\AppData\Roaming\H3X0wxCyD.exe c:\users\ME\AppData\Roaming\h5dDc.exe c:\users\ME\AppData\Roaming\H882xYy.exe c:\users\ME\AppData\Roaming\HA70bCHj2.exe c:\users\ME\AppData\Roaming\haQ7bFaL.exe c:\users\ME\AppData\Roaming\hAzOCQIC6.exe c:\users\ME\AppData\Roaming\He90Fit5AF.exe c:\users\ME\AppData\Roaming\HefCFBg.exe c:\users\ME\AppData\Roaming\hfB41.exe c:\users\ME\AppData\Roaming\HfFwh.exe c:\users\ME\AppData\Roaming\HFiOExp.exe c:\users\ME\AppData\Roaming\hGGiPGiBjZ.exe c:\users\ME\AppData\Roaming\hHdbL.exe c:\users\ME\AppData\Roaming\HjORp.exe c:\users\ME\AppData\Roaming\Hl1qQOZNr.exe c:\users\ME\AppData\Roaming\hLsB8w3gu.exe c:\users\ME\AppData\Roaming\HNFMnIuQQ.exe c:\users\ME\AppData\Roaming\hPFlZFSQmh.exe c:\users\ME\AppData\Roaming\HQtH1.exe c:\users\ME\AppData\Roaming\HuFwo7lwgV.exe c:\users\ME\AppData\Roaming\hW2uDG.exe c:\users\ME\AppData\Roaming\hWDV91lp.exe c:\users\ME\AppData\Roaming\HX4I4urw.exe c:\users\ME\AppData\Roaming\HxKsqma46H.exe c:\users\ME\AppData\Roaming\hXwPd.exe c:\users\ME\AppData\Roaming\HzD660q.exe c:\users\ME\AppData\Roaming\i1LrzVov.exe c:\users\ME\AppData\Roaming\i25oz.exe c:\users\ME\AppData\Roaming\i6aJJOwx.exe c:\users\ME\AppData\Roaming\i7sMW0Y2PL.exe c:\users\ME\AppData\Roaming\IaggsjjCo.exe c:\users\ME\AppData\Roaming\idFKJ1PCs.exe c:\users\ME\AppData\Roaming\idWXA.exe c:\users\ME\AppData\Roaming\iGkc9CT7.exe c:\users\ME\AppData\Roaming\IHuELwBK.exe c:\users\ME\AppData\Roaming\iJwkDo.exe c:\users\ME\AppData\Roaming\IlpD1VjS.exe c:\users\ME\AppData\Roaming\INZlN83.exe c:\users\ME\AppData\Roaming\iowacY.exe c:\users\ME\AppData\Roaming\iQzL5QqA.exe c:\users\ME\AppData\Roaming\irtlzKdS.exe c:\users\ME\AppData\Roaming\IUcvsH9.exe c:\users\ME\AppData\Roaming\IUe1uNKt.exe c:\users\ME\AppData\Roaming\iVH00Vb5.exe c:\users\ME\AppData\Roaming\IWhESG4Vzn.exe c:\users\ME\AppData\Roaming\iwNDp5q.exe c:\users\ME\AppData\Roaming\IwnhBgpCr.exe c:\users\ME\AppData\Roaming\ixZX2vysXk.exe c:\users\ME\AppData\Roaming\IyOeqAg.exe c:\users\ME\AppData\Roaming\j1OFydvdva.exe c:\users\ME\AppData\Roaming\j7zfpDuvl.exe c:\users\ME\AppData\Roaming\J84PBkrOo.exe c:\users\ME\AppData\Roaming\JbvvEzr.exe c:\users\ME\AppData\Roaming\JddvYKxE3.exe c:\users\ME\AppData\Roaming\jDHtBW10.exe c:\users\ME\AppData\Roaming\Je42oV.exe c:\users\ME\AppData\Roaming\JGDXW6.exe c:\users\ME\AppData\Roaming\Jgg9PBYn.exe c:\users\ME\AppData\Roaming\JJNimOjurp.exe c:\users\ME\AppData\Roaming\jM206BD.exe c:\users\ME\AppData\Roaming\jmrl9O.exe c:\users\ME\AppData\Roaming\JSnE1.exe c:\users\ME\AppData\Roaming\K3NBICE.exe c:\users\ME\AppData\Roaming\k4V3fu.exe c:\users\ME\AppData\Roaming\k5He4tw.exe c:\users\ME\AppData\Roaming\k6nVilTcw.exe c:\users\ME\AppData\Roaming\kBBzqT.exe c:\users\ME\AppData\Roaming\KEKPPgQKt1.exe c:\users\ME\AppData\Roaming\kgZXbW.exe c:\users\ME\AppData\Roaming\kHzKH.exe c:\users\ME\AppData\Roaming\KIcBXWi.exe c:\users\ME\AppData\Roaming\kiWjfV7Ulu.exe c:\users\ME\AppData\Roaming\KJPi82S0x.exe c:\users\ME\AppData\Roaming\Kkgt5JpG.exe c:\users\ME\AppData\Roaming\kKN404Nhq.exe c:\users\ME\AppData\Roaming\kM2OncpDSf.exe c:\users\ME\AppData\Roaming\KMFnJpSs8a.exe c:\users\ME\AppData\Roaming\kmTmW0y.exe c:\users\ME\AppData\Roaming\KOJbu.exe c:\users\ME\AppData\Roaming\KoJSkLTfZ.exe c:\users\ME\AppData\Roaming\KpuUJoccpv.exe c:\users\ME\AppData\Roaming\Kqw32.exe c:\users\ME\AppData\Roaming\KRi2C.exe c:\users\ME\AppData\Roaming\krLOB.exe c:\users\ME\AppData\Roaming\KS8fVn0U35.exe c:\users\ME\AppData\Roaming\KSygq.exe c:\users\ME\AppData\Roaming\ktBQnjQqLq.exe c:\users\ME\AppData\Roaming\kwK5fzh9.exe c:\users\ME\AppData\Roaming\KwPKH.exe c:\users\ME\AppData\Roaming\kX3teIji7.exe c:\users\ME\AppData\Roaming\KZFbFbAP.exe c:\users\ME\AppData\Roaming\KzMFNWHt.exe c:\users\ME\AppData\Roaming\L59Imtw3.exe c:\users\ME\AppData\Roaming\L6dI4twZS.exe c:\users\ME\AppData\Roaming\L76DC4K.exe c:\users\ME\AppData\Roaming\l7ZU1Ye.exe c:\users\ME\AppData\Roaming\l9zFB2j.exe c:\users\ME\AppData\Roaming\LCfshd.exe c:\users\ME\AppData\Roaming\le5Q8wotvq.exe c:\users\ME\AppData\Roaming\ljWGwx1.exe c:\users\ME\AppData\Roaming\LLLhih.exe c:\users\ME\AppData\Roaming\lMYLRZTu.exe c:\users\ME\AppData\Roaming\lPmFsmiq.exe c:\users\ME\AppData\Roaming\lqIKEpBy.exe c:\users\ME\AppData\Roaming\ls0fgGQmod.exe c:\users\ME\AppData\Roaming\LTUZOMP7UN.exe c:\users\ME\AppData\Roaming\LUOiglrHR.exe c:\users\ME\AppData\Roaming\LurKbNKKR.exe c:\users\ME\AppData\Roaming\LVBkRF.exe c:\users\ME\AppData\Roaming\lVCQMTK.exe c:\users\ME\AppData\Roaming\lzdyR.exe c:\users\ME\AppData\Roaming\M0weAT7A.exe c:\users\ME\AppData\Roaming\M1eEaQ.exe c:\users\ME\AppData\Roaming\m4ylzWYntx.exe c:\users\ME\AppData\Roaming\M64SdvUh.exe c:\users\ME\AppData\Roaming\m87AEf.exe c:\users\ME\AppData\Roaming\m8LnkyiWa7.exe c:\users\ME\AppData\Roaming\M9moSa.exe c:\users\ME\AppData\Roaming\mexmN2V0.exe c:\users\ME\AppData\Roaming\Mgp8Ltmy9.exe c:\users\ME\AppData\Roaming\mngrlY4kDS.exe c:\users\ME\AppData\Roaming\MpnhAEh.exe c:\users\ME\AppData\Roaming\mqPEDG.exe c:\users\ME\AppData\Roaming\mrK6egHRTv.exe c:\users\ME\AppData\Roaming\mTYFNj0s.exe c:\users\ME\AppData\Roaming\MUqeQXJVVA.exe c:\users\ME\AppData\Roaming\mwdNoh3dSZ.exe c:\users\ME\AppData\Roaming\mxBkpkRyvW.exe c:\users\ME\AppData\Roaming\n0v0irL.exe c:\users\ME\AppData\Roaming\n27hSdPJ.exe c:\users\ME\AppData\Roaming\n7kI5.exe c:\users\ME\AppData\Roaming\nanBKQj3.exe c:\users\ME\AppData\Roaming\nbamgGC.exe c:\users\ME\AppData\Roaming\nBayWRRf.exe c:\users\ME\AppData\Roaming\Nc8X28B.exe c:\users\ME\AppData\Roaming\NcQPcX.exe c:\users\ME\AppData\Roaming\NEXekUzJh.exe c:\users\ME\AppData\Roaming\nFU3iiCqX.exe c:\users\ME\AppData\Roaming\Nio4grc7.exe c:\users\ME\AppData\Roaming\NkAhpxsQ.exe c:\users\ME\AppData\Roaming\NrB4H.exe c:\users\ME\AppData\Roaming\nULmsdQ.exe c:\users\ME\AppData\Roaming\NURyfd.exe c:\users\ME\AppData\Roaming\nuWYzc.exe c:\users\ME\AppData\Roaming\nvSOKWo1tp.exe c:\users\ME\AppData\Roaming\NwE92.exe c:\users\ME\AppData\Roaming\NxN4P.exe c:\users\ME\AppData\Roaming\nY8FNolA.exe c:\users\ME\AppData\Roaming\NYoaGLoA.exe c:\users\ME\AppData\Roaming\NYUbB7vAJn.exe c:\users\ME\AppData\Roaming\o305Mh.exe c:\users\ME\AppData\Roaming\O3clj22.exe c:\users\ME\AppData\Roaming\o5Svhe5xkN.exe c:\users\ME\AppData\Roaming\o8130QcBuL.exe c:\users\ME\AppData\Roaming\Oa6JW.exe c:\users\ME\AppData\Roaming\oBe0WFhrHF.exe c:\users\ME\AppData\Roaming\oCraHYzpvn.exe c:\users\ME\AppData\Roaming\OIDbvzYBL.exe c:\users\ME\AppData\Roaming\OiJKB3Zwu.exe c:\users\ME\AppData\Roaming\OJbfQcIa.exe c:\users\ME\AppData\Roaming\OlplvQGQJ.exe c:\users\ME\AppData\Roaming\OM3dtmpmu.exe c:\users\ME\AppData\Roaming\OmM4nuNAK.exe c:\users\ME\AppData\Roaming\ONbAvKNJ.exe c:\users\ME\AppData\Roaming\Oq1zobXAPm.exe c:\users\ME\AppData\Roaming\orG4u.exe c:\users\ME\AppData\Roaming\OU1UoXOh3T.exe c:\users\ME\AppData\Roaming\OVFSi.exe c:\users\ME\AppData\Roaming\oVHmBc7pQ.exe c:\users\ME\AppData\Roaming\OVkkm.exe c:\users\ME\AppData\Roaming\oWBrLHgCh.exe c:\users\ME\AppData\Roaming\OwNWr4zu1X.exe c:\users\ME\AppData\Roaming\p0xOB.exe c:\users\ME\AppData\Roaming\P2ZGo.exe c:\users\ME\AppData\Roaming\p54Twu4d4.exe c:\users\ME\AppData\Roaming\pAg6A.exe c:\users\ME\AppData\Roaming\pbjoawj.exe c:\users\ME\AppData\Roaming\PEBMTZk.exe c:\users\ME\AppData\Roaming\PEGdp.exe c:\users\ME\AppData\Roaming\PEqs7EL.exe c:\users\ME\AppData\Roaming\PEQx5qs.exe c:\users\ME\AppData\Roaming\pfF6rg.exe c:\users\ME\AppData\Roaming\pGfyg.exe c:\users\ME\AppData\Roaming\pGycTp7.exe c:\users\ME\AppData\Roaming\pIBvQy.exe c:\users\ME\AppData\Roaming\PiHDwwJNa.exe c:\users\ME\AppData\Roaming\piwoLF.exe c:\users\ME\AppData\Roaming\PkOfNNnyBo.exe c:\users\ME\AppData\Roaming\PPvI4.exe c:\users\ME\AppData\Roaming\pRSNLswi.exe c:\users\ME\AppData\Roaming\PSsQ3R7.exe c:\users\ME\AppData\Roaming\PufW3Lsgat.exe c:\users\ME\AppData\Roaming\pvjMi.exe c:\users\ME\AppData\Roaming\pxTSfsmN7.exe c:\users\ME\AppData\Roaming\pzUAXLF.exe c:\users\ME\AppData\Roaming\q0WYC.exe c:\users\ME\AppData\Roaming\Q3UDLulw.exe c:\users\ME\AppData\Roaming\qBbDzi5e.exe c:\users\ME\AppData\Roaming\qBQrlRxd4z.exe c:\users\ME\AppData\Roaming\QEBz5YdnV2.exe c:\users\ME\AppData\Roaming\qEsiSv.exe c:\users\ME\AppData\Roaming\qF564Bvse.exe c:\users\ME\AppData\Roaming\QFGATY98bI.exe c:\users\ME\AppData\Roaming\QFRQ1SQt.exe c:\users\ME\AppData\Roaming\QIISia.exe c:\users\ME\AppData\Roaming\QKGs69.exe c:\users\ME\AppData\Roaming\qLsf52Jj.exe c:\users\ME\AppData\Roaming\qNoFvaL.exe c:\users\ME\AppData\Roaming\QPCYMLn4a.exe c:\users\ME\AppData\Roaming\Qpwcq9gUMt.exe c:\users\ME\AppData\Roaming\qRItPiOM.exe c:\users\ME\AppData\Roaming\Qu2dF7kXVa.exe c:\users\ME\AppData\Roaming\QVVOEC41l.exe c:\users\ME\AppData\Roaming\qwL77ES7v.exe c:\users\ME\AppData\Roaming\QxA6EJti1m.exe c:\users\ME\AppData\Roaming\QY1b0V.exe c:\users\ME\AppData\Roaming\qYYtY2CMqB.exe c:\users\ME\AppData\Roaming\qz4Cw9f.exe c:\users\ME\AppData\Roaming\R1EyVR.exe c:\users\ME\AppData\Roaming\R2XyMDpR.exe c:\users\ME\AppData\Roaming\R4tgmK01.exe c:\users\ME\AppData\Roaming\rcASS.exe c:\users\ME\AppData\Roaming\rIVh00R0Z.exe c:\users\ME\AppData\Roaming\RmF1RE.exe c:\users\ME\AppData\Roaming\rngpEI.exe c:\users\ME\AppData\Roaming\roZ3yv13Z.exe c:\users\ME\AppData\Roaming\rQZhyuke.exe c:\users\ME\AppData\Roaming\ryDZOjti1G.exe c:\users\ME\AppData\Roaming\S06tB.exe c:\users\ME\AppData\Roaming\s0pfsTzz.exe c:\users\ME\AppData\Roaming\S8p8s4.exe c:\users\ME\AppData\Roaming\S9ekT.exe c:\users\ME\AppData\Roaming\sa63NJFZ.exe c:\users\ME\AppData\Roaming\sg5NJc.exe c:\users\ME\AppData\Roaming\SgVSS.exe c:\users\ME\AppData\Roaming\sHzno.exe c:\users\ME\AppData\Roaming\sOn2vgAVA.exe c:\users\ME\AppData\Roaming\SQQIHKE1h.exe c:\users\ME\AppData\Roaming\sU6E6Oi4Sd.exe c:\users\ME\AppData\Roaming\sU8qq2.exe c:\users\ME\AppData\Roaming\sum3p.exe c:\users\ME\AppData\Roaming\sVw41JEPj.exe c:\users\ME\AppData\Roaming\SweZNpmQ.exe c:\users\ME\AppData\Roaming\sZsPMtFids.exe c:\users\ME\AppData\Roaming\T4V0Vzxtda.exe c:\users\ME\AppData\Roaming\t9jqhcuW.exe c:\users\ME\AppData\Roaming\t9kfB9.exe c:\users\ME\AppData\Roaming\tbO3GmVYDV.exe c:\users\ME\AppData\Roaming\tC7n5G.exe c:\users\ME\AppData\Roaming\TcQ4iDyMub.exe c:\users\ME\AppData\Roaming\TecS19.exe c:\users\ME\AppData\Roaming\tJmunPHDeK.exe c:\users\ME\AppData\Roaming\TjvAyTrI2.exe c:\users\ME\AppData\Roaming\TK1TTP5A.exe c:\users\ME\AppData\Roaming\TQeh61cN2.exe c:\users\ME\AppData\Roaming\TsvGJvUn.exe c:\users\ME\AppData\Roaming\ttCJzsZAy.exe c:\users\ME\AppData\Roaming\tTs6y.exe c:\users\ME\AppData\Roaming\ttYw4JWg.exe c:\users\ME\AppData\Roaming\tUWmg.exe c:\users\ME\AppData\Roaming\tYJrEzO4T.exe c:\users\ME\AppData\Roaming\UbZMvQB.exe c:\users\ME\AppData\Roaming\UciN0.exe c:\users\ME\AppData\Roaming\udf97lf.exe c:\users\ME\AppData\Roaming\ufympfDb4M.exe c:\users\ME\AppData\Roaming\UGYcPk.exe c:\users\ME\AppData\Roaming\UkqSY88N.exe c:\users\ME\AppData\Roaming\UlWp1vd8.exe c:\users\ME\AppData\Roaming\ulySR1eTWI.exe c:\users\ME\AppData\Roaming\umiQHxn.exe c:\users\ME\AppData\Roaming\uqLDCFjKI.exe c:\users\ME\AppData\Roaming\uQQcKv8oCf.exe c:\users\ME\AppData\Roaming\USHGEwV.exe c:\users\ME\AppData\Roaming\uSOtxo.exe c:\users\ME\AppData\Roaming\UsUrkFoxN.exe c:\users\ME\AppData\Roaming\uSYBM.exe c:\users\ME\AppData\Roaming\UtBe9VpUg.exe c:\users\ME\AppData\Roaming\UVbqH9ek.exe c:\users\ME\AppData\Roaming\uXFyY7NoRO.exe c:\users\ME\AppData\Roaming\UZSNVPBOUv.exe c:\users\ME\AppData\Roaming\V0gQqlQ.exe c:\users\ME\AppData\Roaming\V3MOai8D.exe c:\users\ME\AppData\Roaming\vckFaxBj5.exe c:\users\ME\AppData\Roaming\VCqOken9i.exe c:\users\ME\AppData\Roaming\vgKONPhTtz.exe c:\users\ME\AppData\Roaming\vHYNF.exe c:\users\ME\AppData\Roaming\vIBUn1xNc8.exe c:\users\ME\AppData\Roaming\VICxZpS.exe c:\users\ME\AppData\Roaming\Vk9GRr.exe c:\users\ME\AppData\Roaming\vKqNVyb.exe c:\users\ME\AppData\Roaming\VM6ayeuqZ.exe c:\users\ME\AppData\Roaming\vMzCJUq.exe c:\users\ME\AppData\Roaming\VqA1EwwHCf.exe c:\users\ME\AppData\Roaming\vqrrIOtAUn.exe c:\users\ME\AppData\Roaming\vtlt1cHtUq.exe c:\users\ME\AppData\Roaming\vUasCnw.exe c:\users\ME\AppData\Roaming\VVngR.exe c:\users\ME\AppData\Roaming\vxmD9g.exe c:\users\ME\AppData\Roaming\vYLTinQ33r.exe c:\users\ME\AppData\Roaming\vZEirV2GNK.exe c:\users\ME\AppData\Roaming\W0B5wqn6.exe c:\users\ME\AppData\Roaming\w9ahpU.exe c:\users\ME\AppData\Roaming\Wa9cQ.exe c:\users\ME\AppData\Roaming\wbNnH.exe c:\users\ME\AppData\Roaming\wDWhjRANQ.exe c:\users\ME\AppData\Roaming\wfx4rNW.exe c:\users\ME\AppData\Roaming\WIG6Zq.exe c:\users\ME\AppData\Roaming\wmOaFk.exe c:\users\ME\AppData\Roaming\WNZGlMh.exe c:\users\ME\AppData\Roaming\wrtWd.exe c:\users\ME\AppData\Roaming\WrVvdHbS.exe c:\users\ME\AppData\Roaming\WuCUTX6.exe c:\users\ME\AppData\Roaming\WuoJRhF.exe c:\users\ME\AppData\Roaming\X4fOzIjbn.exe c:\users\ME\AppData\Roaming\x58O7jBlw.exe c:\users\ME\AppData\Roaming\X5yMSDg.exe c:\users\ME\AppData\Roaming\X7g94hQ.exe c:\users\ME\AppData\Roaming\xg0dII2T.exe c:\users\ME\AppData\Roaming\XijkZKay.exe c:\users\ME\AppData\Roaming\xK4ta.exe c:\users\ME\AppData\Roaming\xKjQHQEhih.exe c:\users\ME\AppData\Roaming\xSHkL00t3R.exe c:\users\ME\AppData\Roaming\xTFrZP.exe c:\users\ME\AppData\Roaming\XuR91lY.exe c:\users\ME\AppData\Roaming\Y092k7jdms.exe c:\users\ME\AppData\Roaming\YAWGh8.exe c:\users\ME\AppData\Roaming\Ybe7ZN4.exe c:\users\ME\AppData\Roaming\yEGH1iwl8U.exe c:\users\ME\AppData\Roaming\ygY633L.exe c:\users\ME\AppData\Roaming\Ykwlh.exe c:\users\ME\AppData\Roaming\YMhmcjja.exe c:\users\ME\AppData\Roaming\YSYsGyk8.exe c:\users\ME\AppData\Roaming\YV2kr.exe c:\users\ME\AppData\Roaming\YwpgmOVks.exe c:\users\ME\AppData\Roaming\yX6VtD.exe c:\users\ME\AppData\Roaming\z57IuDS4.exe c:\users\ME\AppData\Roaming\z6NC3IUH.exe c:\users\ME\AppData\Roaming\z6Vu0FeLF.exe c:\users\ME\AppData\Roaming\zcmkAI.exe c:\users\ME\AppData\Roaming\zEsb1.exe c:\users\ME\AppData\Roaming\zF7CSfYFU.exe c:\users\ME\AppData\Roaming\zg4SuL.exe c:\users\ME\AppData\Roaming\ZHzcHsN.exe c:\users\ME\AppData\Roaming\ZlcZnKw.exe c:\users\ME\AppData\Roaming\ZLPaXms.exe c:\users\ME\AppData\Roaming\ZMuCIstm.exe c:\users\ME\AppData\Roaming\zO9S3By.exe c:\users\ME\AppData\Roaming\ZoEFz.exe c:\users\ME\AppData\Roaming\zOlNvDk.exe c:\users\ME\AppData\Roaming\ZoWMDA.exe c:\users\ME\AppData\Roaming\Zry1SWmM.exe c:\users\ME\AppData\Roaming\ZVdhc0.exe c:\users\ME\AppData\Roaming\Zw7Ff10.exe c:\windows\Installer\{0204009C-53D7-67E6-6631-62A1DBD66BCA}\ARPPRODUCTICON.exe c:\windows\Installer\{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}\ARPPRODUCTICON.exe c:\windows\Installer\{08D2E121-7F6A-43EB-97FD-629B44903403}\ARPPRODUCTICON.exe c:\windows\Installer\{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}\ARPPRODUCTICON.exe c:\windows\Installer\{14911AD7-62FA-2DF7-961A-314786398DDD}\ARPPRODUCTICON.exe c:\windows\Installer\{18960408-D04F-61BB-802E-13851583716E}\ARPPRODUCTICON.exe c:\windows\Installer\{1E9FC118-651D-4934-97BE-E53CAE5C7D45}\ARPPRODUCTICON.exe c:\windows\Installer\{1FF2E7A9-824F-8B73-6332-C9DD19B08A67}\ARPPRODUCTICON.exe c:\windows\Installer\{23638DF5-41EF-7AEC-8AEB-2C7B4A298D05}\ARPPRODUCTICON.exe c:\windows\Installer\{26D08718-801F-2F78-B5DC-78D50714AA95}\ARPPRODUCTICON.exe c:\windows\Installer\{2B462A9D-286B-0A4F-6FB8-E71B39AB3978}\ARPPRODUCTICON.exe c:\windows\Installer\{2D38E148-989C-9E77-E655-328FE0726761}\ARPPRODUCTICON.exe c:\windows\Installer\{3594EE90-B157-4519-9E82-8B6F4711A0A1}\ARPPRODUCTICON.exe c:\windows\Installer\{3770179C-38F3-A941-643C-5790E78D80C7}\ARPPRODUCTICON.exe c:\windows\Installer\{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}\ARPPRODUCTICON.exe c:\windows\Installer\{482020CC-FEF7-9392-69F0-6C6F26FD7BCD}\ARPPRODUCTICON.exe c:\windows\Installer\{4D19B0D8-896C-96AE-27B2-98B8B3997EBD}\ARPPRODUCTICON.exe c:\windows\Installer\{5ADE38D8-1B9C-6F79-C88F-A84B01E4175C}\ARPPRODUCTICON.exe c:\windows\Installer\{600494AA-0E7B-6F10-9426-AFF9914CA403}\ARPPRODUCTICON.exe c:\windows\Installer\{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}\ARPPRODUCTICON.exe c:\windows\Installer\{6361EA0C-499F-40C0-6924-A8D974784908}\ARPPRODUCTICON.exe c:\windows\Installer\{68C96BC9-EB2A-C0F1-0BAE-8E7FACD1CC52}\ARPPRODUCTICON.exe c:\windows\Installer\{69897DB3-8AA0-AB8B-C41F-5F18CE08DD10}\ARPPRODUCTICON.exe c:\windows\Installer\{7BBEF4EB-4996-3B90-1F79-0CED09C781F5}\ARPPRODUCTICON.exe c:\windows\Installer\{7C95F789-0941-CBF8-A906-507E1F938B23}\ARPPRODUCTICON.exe c:\windows\Installer\{8557397C-A42D-486F-97B3-A2CBC2372593}\ARPPRODUCTICON.exe c:\windows\Installer\{925D058B-564A-443A-B4B2-7E90C6432E55}\ARPPRODUCTICON.exe c:\windows\Installer\{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}\ARPPRODUCTICON.exe c:\windows\Installer\{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}\ARPPRODUCTICON.exe c:\windows\Installer\{9D05E935-B635-73BC-1320-80496C7EC481}\ARPPRODUCTICON.exe c:\windows\Installer\{9DE36FF9-B4DC-76E5-DE1A-D940D5BB1E83}\ARPPRODUCTICON.exe c:\windows\Installer\{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}\ARPPRODUCTICON.exe c:\windows\Installer\{B3920458-4EA6-A26B-7621-AB086AC4086D}\ARPPRODUCTICON.exe c:\windows\Installer\{B7BC1735-B009-2946-AA94-2A60190616BE}\ARPPRODUCTICON.exe c:\windows\Installer\{B8CCF37C-4C5D-0B17-1472-FEDB3D88F9E8}\ARPPRODUCTICON.exe c:\windows\Installer\{B9D218EA-982B-53A2-BEEA-EF4C08DDD3DB}\ARPPRODUCTICON.exe c:\windows\Installer\{BB034FA9-BC86-7231-4618-B30918CD43F7}\ARPPRODUCTICON.exe c:\windows\Installer\{BE709AB0-E637-D304-F30C-B4B84F496DA7}\ARPPRODUCTICON.exe c:\windows\Installer\{C1E7BB59-E1BE-CC2F-32B8-F0EAB1322BC4}\ARPPRODUCTICON.exe c:\windows\Installer\{C55C9458-6FAA-0DA2-3F35-CAD71AA13A89}\ARPPRODUCTICON.exe c:\windows\Installer\{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}\ARPPRODUCTICON.exe c:\windows\Installer\{D1A19B02-817E-4296-A45B-07853FD74D57}\ARPPRODUCTICON.exe c:\windows\Installer\{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}\ARPPRODUCTICON.exe c:\windows\Installer\{EB1F488E-AB5E-DB3A-A144-51802C2B0041}\ARPPRODUCTICON.exe . . ((((((((((((((((((((((((( Files Created from 2011-01-09 to 2011-02-09 ))))))))))))))))))))))))))))))) . 2011-02-09 20:38 . 2011-02-09 20:38 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-02-09 20:13 . 2011-02-09 20:13 127 —-a-w- c:\users\ME\AppData\Roaming\133.bat 2011-02-09 19:58 . 2011-02-09 19:58 125 —-a-w- c:\users\ME\AppData\Roaming\1598.bat 2011-02-09 19:39 . 2011-02-09 19:39 123 —-a-w- c:\users\ME\AppData\Roaming\4703.bat 2011-02-09 19:09 . 2011-02-09 19:09 119 —-a-w- c:\users\ME\AppData\Roaming\6925.bat 2011-02-09 18:53 . 2011-02-09 18:53 119 —-a-w- c:\users\ME\AppData\Roaming\2397.bat 2011-02-09 18:29 . 2011-02-09 18:29 121 —-a-w- c:\users\ME\AppData\Roaming\377.bat 2011-02-09 18:03 . 2011-02-09 18:03 121 —-a-w- c:\users\ME\AppData\Roaming\2493.bat 2011-02-09 17:41 . 2011-02-09 17:41 129 —-a-w- c:\users\ME\AppData\Roaming\8987.bat 2011-02-09 17:11 . 2011-02-09 17:11 123 —-a-w- c:\users\ME\AppData\Roaming\8677.bat 2011-02-09 16:47 . 2011-02-09 16:47 119 —-a-w- c:\users\ME\AppData\Roaming\6488.bat 2011-02-09 16:29 . 2011-02-09 16:29 125 —-a-w- c:\users\ME\AppData\Roaming\8807.bat 2011-02-09 16:10 . 2011-02-09 16:10 121 —-a-w- c:\users\ME\AppData\Roaming\190.bat 2011-02-09 15:46 . 2011-02-09 15:46 123 —-a-w- c:\users\ME\AppData\Roaming\4267.bat 2011-02-09 15:32 . 2011-02-09 15:32 119 —-a-w- c:\users\ME\AppData\Roaming\8574.bat 2011-02-09 14:44 . 2011-02-09 14:44 121 —-a-w- c:\users\ME\AppData\Roaming\1307.bat 2011-02-09 14:11 . 2011-02-09 14:11 119 —-a-w- c:\users\ME\AppData\Roaming\1955.bat 2011-02-09 13:56 . 2011-02-09 13:56 129 —-a-w- c:\users\ME\AppData\Roaming\9546.bat 2011-02-09 13:33 . 2011-02-09 13:33 125 —-a-w- c:\users\ME\AppData\Roaming\4552.bat 2011-02-09 13:04 . 2011-02-09 13:04 123 —-a-w- c:\users\ME\AppData\Roaming\1014.bat 2011-02-09 12:31 . 2011-02-09 12:31 119 —-a-w- c:\users\ME\AppData\Roaming\9011.bat 2011-02-09 11:44 . 2011-02-09 11:44 119 —-a-w- c:\users\ME\AppData\Roaming\868.bat 2011-02-09 11:14 . 2011-02-09 11:14 119 —-a-w- c:\users\ME\AppData\Roaming\8177.bat 2011-02-09 10:44 . 2011-02-09 10:44 119 —-a-w- c:\users\ME\AppData\Roaming\5094.bat 2011-02-09 10:24 . 2011-02-09 10:24 127 —-a-w- c:\users\ME\AppData\Roaming\5858.bat 2011-02-09 09:52 . 2011-02-09 09:52 125 —-a-w- c:\users\ME\AppData\Roaming\3317.bat 2011-02-09 09:09 . 2011-02-09 09:09 125 —-a-w- c:\users\ME\AppData\Roaming\2090.bat 2011-02-09 08:39 . 2011-02-09 08:39 121 —-a-w- c:\users\ME\AppData\Roaming\3230.bat 2011-02-09 07:27 . 2011-02-09 07:27 129 —-a-w- c:\users\ME\AppData\Roaming\3057.bat 2011-02-09 06:54 . 2011-02-09 15:07 129 —-a-w- c:\users\ME\AppData\Roaming\4466.bat 2011-02-09 06:29 . 2011-02-09 06:29 119 —-a-w- c:\users\ME\AppData\Roaming\972.bat 2011-02-09 06:02 . 2011-02-09 06:02 121 —-a-w- c:\users\ME\AppData\Roaming\3135.bat 2011-02-09 05:57 . 2011-02-09 05:57 123 —-a-w- c:\users\ME\AppData\Roaming\251.bat 2011-02-09 05:48 . 2011-02-09 05:48 127 —-a-w- c:\users\ME\AppData\Roaming\6484.bat 2011-02-09 05:15 . 2011-02-09 05:15 125 —-a-w- c:\users\ME\AppData\Roaming\7359.bat 2011-02-09 04:17 . 2011-02-09 04:17 129 —-a-w- c:\users\ME\AppData\Roaming\9200.bat 2011-02-09 04:09 . 2011-02-09 04:09 119 —-a-w- c:\users\ME\AppData\Roaming\3027.bat 2011-02-09 03:52 . 2011-02-09 03:52 129 —-a-w- c:\users\ME\AppData\Roaming\369.bat 2011-02-09 03:26 . 2011-02-09 03:26 129 —-a-w- c:\users\ME\AppData\Roaming\3285.bat 2011-02-09 02:47 . 2011-02-09 02:47 125 —-a-w- c:\users\ME\AppData\Roaming\3661.bat 2011-02-09 02:31 . 2011-02-09 02:31 125 —-a-w- c:\users\ME\AppData\Roaming\9295.bat 2011-02-09 02:16 . 2011-02-09 02:16 121 —-a-w- c:\users\ME\AppData\Roaming\1903.bat 2011-02-09 01:43 . 2011-02-09 01:43 123 —-a-w- c:\users\ME\AppData\Roaming\3614.bat 2011-02-09 01:21 . 2011-02-09 01:21 123 —-a-w- c:\users\ME\AppData\Roaming\7290.bat 2011-02-09 01:04 . 2011-02-09 01:04 127 —-a-w- c:\users\ME\AppData\Roaming\4230.bat 2011-02-09 00:49 . 2011-02-09 00:49 125 —-a-w- c:\users\ME\AppData\Roaming\3195.bat 2011-02-09 00:16 . 2011-02-09 00:16 127 —-a-w- c:\users\ME\AppData\Roaming\2494.bat 2011-02-08 23:47 . 2011-02-08 23:47 127 —-a-w- c:\users\ME\AppData\Roaming\969.bat 2011-02-08 23:16 . 2011-02-08 23:16 127 —-a-w- c:\users\ME\AppData\Roaming\4691.bat 2011-02-08 22:45 . 2011-02-08 22:45 119 —-a-w- c:\users\ME\AppData\Roaming\2863.bat 2011-02-08 22:20 . 2011-02-08 22:20 123 —-a-w- c:\users\ME\AppData\Roaming\7053.bat 2011-02-08 21:47 . 2011-02-08 21:47 119 —-a-w- c:\users\ME\AppData\Roaming\575.bat 2011-02-08 21:26 . 2011-02-08 21:26 129 —-a-w- c:\users\ME\AppData\Roaming\4885.bat 2011-02-08 21:11 . 2011-02-08 21:11 119 —-a-w- c:\users\ME\AppData\Roaming\5797.bat 2011-02-08 20:56 . 2011-02-08 20:56 121 —-a-w- c:\users\ME\AppData\Roaming\9723.bat 2011-02-08 20:48 . 2011-02-08 20:48 119 —-a-w- c:\users\ME\AppData\Roaming\4672.bat 2011-02-08 20:23 . 2011-02-08 20:23 123 —-a-w- c:\users\ME\AppData\Roaming\4667.bat 2011-02-08 20:18 . 2011-02-08 20:18 127 —-a-w- c:\users\ME\AppData\Roaming\4872.bat 2011-02-08 19:50 . 2011-02-08 19:50 129 —-a-w- c:\users\ME\AppData\Roaming\4851.bat 2011-02-08 19:27 . 2011-02-08 19:27 119 —-a-w- c:\users\ME\AppData\Roaming\7550.bat 2011-02-08 19:13 . 2011-02-08 19:13 125 —-a-w- c:\users\ME\AppData\Roaming\7197.bat 2011-02-08 18:47 . 2011-02-08 18:47 119 —-a-w- c:\users\ME\AppData\Roaming\6795.bat 2011-02-08 18:42 . 2011-02-08 18:42 129 —-a-w- c:\users\ME\AppData\Roaming\2361.bat 2011-02-08 18:17 . 2011-02-08 18:17 129 —-a-w- c:\users\ME\AppData\Roaming\8841.bat 2011-02-08 17:46 . 2011-02-08 17:46 127 —-a-w- c:\users\ME\AppData\Roaming\9595.bat 2011-02-08 17:28 . 2011-02-08 17:28 125 —-a-w- c:\users\ME\AppData\Roaming\1948.bat 2011-02-08 17:13 . 2011-02-08 17:13 127 —-a-w- c:\users\ME\AppData\Roaming\800.bat 2011-02-08 16:55 . 2011-02-08 16:55 127 —-a-w- c:\users\ME\AppData\Roaming\590.bat 2011-02-08 16:48 . 2011-02-08 16:48 125 —-a-w- c:\users\ME\AppData\Roaming\2794.bat 2011-02-08 16:35 . 2011-02-08 16:35 129 —-a-w- c:\users\ME\AppData\Roaming\931.bat 2011-02-08 16:29 . 2011-02-08 16:29 127 —-a-w- c:\users\ME\AppData\Roaming\7477.bat 2011-02-08 16:17 . 2011-02-08 16:17 129 —-a-w- c:\users\ME\AppData\Roaming\5215.bat 2011-02-08 16:01 . 2011-02-08 16:01 121 —-a-w- c:\users\ME\AppData\Roaming\786.bat 2011-02-08 15:28 . 2011-02-08 15:28 119 —-a-w- c:\users\ME\AppData\Roaming\9189.bat 2011-02-08 14:56 . 2011-02-08 14:56 123 —-a-w- c:\users\ME\AppData\Roaming\523.bat 2011-02-08 14:22 . 2011-02-08 14:22 119 —-a-w- c:\users\ME\AppData\Roaming\1429.bat 2011-02-08 14:03 . 2011-02-08 14:03 125 —-a-w- c:\users\ME\AppData\Roaming\292.bat 2011-02-08 13:34 . 2011-02-08 13:34 121 —-a-w- c:\users\ME\AppData\Roaming\2431.bat 2011-02-08 13:20 . 2011-02-08 13:20 121 —-a-w- c:\users\ME\AppData\Roaming\5348.bat 2011-02-08 12:53 . 2011-02-08 12:53 119 —-a-w- c:\users\ME\AppData\Roaming\5264.bat 2011-02-08 12:37 . 2011-02-08 12:37 127 —-a-w- c:\users\ME\AppData\Roaming\4265.bat 2011-02-08 12:04 . 2011-02-08 12:04 129 —-a-w- c:\users\ME\AppData\Roaming\4313.bat 2011-02-08 11:59 . 2011-02-08 11:59 121 —-a-w- c:\users\ME\AppData\Roaming\4805.bat 2011-02-08 11:39 . 2011-02-08 11:39 127 —-a-w- c:\users\ME\AppData\Roaming\1699.bat 2011-02-08 11:24 . 2011-02-08 11:24 119 —-a-w- c:\users\ME\AppData\Roaming\213.bat 2011-02-08 10:50 . 2011-02-08 10:50 119 —-a-w- c:\users\ME\AppData\Roaming\5400.bat 2011-02-08 10:25 . 2011-02-08 10:25 123 —-a-w- c:\users\ME\AppData\Roaming\9292.bat 2011-02-08 09:53 . 2011-02-08 09:53 129 —-a-w- c:\users\ME\AppData\Roaming\5736.bat 2011-02-08 09:30 . 2011-02-08 09:30 119 —-a-w- c:\users\ME\AppData\Roaming\1443.bat 2011-02-08 09:02 . 2011-02-08 09:02 127 —-a-w- c:\users\ME\AppData\Roaming\591.bat 2011-02-08 08:33 . 2011-02-08 08:33 129 —-a-w- c:\users\ME\AppData\Roaming\7117.bat 2011-02-08 08:25 . 2011-02-08 08:25 127 —-a-w- c:\users\ME\AppData\Roaming\8711.bat 2011-02-08 07:55 . 2011-02-08 07:55 123 —-a-w- c:\users\ME\AppData\Roaming\3565.bat 2011-02-08 07:26 . 2011-02-08 07:26 119 —-a-w- c:\users\ME\AppData\Roaming\1799.bat 2011-02-08 06:53 . 2011-02-08 06:53 127 —-a-w- c:\users\ME\AppData\Roaming\9213.bat 2011-02-08 06:30 . 2011-02-08 06:30 125 —-a-w- c:\users\ME\AppData\Roaming\9948.bat 2011-02-08 05:59 . 2011-02-08 05:59 123 —-a-w- c:\users\ME\AppData\Roaming\5235.bat 2011-02-08 05:27 . 2011-02-08 05:27 123 —-a-w- c:\users\ME\AppData\Roaming\9727.bat 2011-02-08 05:14 . 2011-02-08 05:14 129 —-a-w- c:\users\ME\AppData\Roaming\3001.bat 2011-02-08 04:59 . 2011-02-08 04:59 125 —-a-w- c:\users\ME\AppData\Roaming\3908.bat 2011-02-08 04:48 . 2011-02-08 04:48 129 —-a-w- c:\users\ME\AppData\Roaming\2836.bat 2011-02-08 04:22 . 2011-02-08 04:22 121 —-a-w- c:\users\ME\AppData\Roaming\8458.bat 2011-02-08 04:01 . 2011-02-08 04:01 ——– d—–w- c:\users\ME\AppData\Roaming\QuickScan 2011-02-08 03:54 . 2011-02-08 03:54 127 —-a-w- c:\users\ME\AppData\Roaming\7507.bat 2011-02-08 03:20 . 2011-02-08 03:20 121 —-a-w- c:\users\ME\AppData\Roaming\7231.bat 2011-02-08 02:50 . 2011-02-08 02:50 123 —-a-w- c:\users\ME\AppData\Roaming\2528.bat 2011-02-08 02:18 . 2011-02-08 02:18 125 —-a-w- c:\users\ME\AppData\Roaming\7508.bat 2011-02-08 01:56 . 2011-02-08 01:56 127 —-a-w- c:\users\ME\AppData\Roaming\3221.bat 2011-02-08 01:40 . 2011-02-08 01:40 121 —-a-w- c:\users\ME\AppData\Roaming\439.bat 2011-02-08 01:22 . 2011-02-08 01:22 119 —-a-w- c:\users\ME\AppData\Roaming\4335.bat 2011-02-08 01:13 . 2011-02-08 01:13 119 —-a-w- c:\users\ME\AppData\Roaming\7970.bat 2011-02-08 00:48 . 2011-02-08 00:48 129 —-a-w- c:\users\ME\AppData\Roaming\153.bat 2011-02-08 00:29 . 2011-02-08 00:29 123 —-a-w- c:\users\ME\AppData\Roaming\1735.bat 2011-02-07 23:55 . 2011-02-07 23:55 125 —-a-w- c:\users\ME\AppData\Roaming\7656.bat 2011-02-07 23:21 . 2011-02-07 23:21 119 —-a-w- c:\users\ME\AppData\Roaming\9568.bat 2011-02-07 23:07 . 2011-02-07 23:07 119 —-a-w- c:\users\ME\AppData\Roaming\9403.bat 2011-02-07 22:46 . 2011-02-07 22:46 119 —-a-w- c:\users\ME\AppData\Roaming\6643.bat 2011-02-07 22:29 . 2011-02-07 22:29 129 —-a-w- c:\users\ME\AppData\Roaming\32.bat 2011-02-07 22:00 . 2011-02-07 22:00 123 —-a-w- c:\users\ME\AppData\Roaming\8715.bat 2011-02-07 21:33 . 2011-02-07 21:33 123 —-a-w- c:\users\ME\AppData\Roaming\4519.bat 2011-02-07 21:14 . 2011-02-07 21:14 129 —-a-w- c:\users\ME\AppData\Roaming\7364.bat 2011-02-07 20:55 . 2011-02-07 20:55 121 —-a-w- c:\users\ME\AppData\Roaming\4765.bat 2011-02-07 20:29 . 2011-02-07 20:29 119 —-a-w- c:\users\ME\AppData\Roaming\3808.bat 2011-02-07 19:55 . 2011-02-07 19:55 129 —-a-w- c:\users\ME\AppData\Roaming\7258.bat 2011-02-07 19:38 . 2011-02-07 19:38 127 —-a-w- c:\users\ME\AppData\Roaming\2059.bat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-21 02:09 . 2010-03-07 06:33 38224 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2010-12-21 02:08 . 2010-03-06 10:44 24152 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-12-07 08:41 . 2010-07-02 22:17 0 —-a-w- c:\users\ME\AppData\Local\Lmobabefogufage.bin 2010-11-30 01:38 . 2010-11-30 01:38 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2010-11-30 01:38 . 2010-11-30 01:38 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472] "ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2008-09-10 0] "Google Update"="c:\users\ME\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-04-18 136176] "ANT Agent"="c:\program files (x86)\Garmin\ANT Agent\ANT Agent.exe" [2011-01-18 12034920] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-17 61440] "LchDrvKey"="LchDrvKey.exe" [2007-03-29 36864] "LedKey"="CNYHKey.exe" [2008-04-24 339968] "Smart Copy"="c:\program files (x86)\IOI\Smart Copy\ButtonMonitor.exe" [2008-05-21 53248] "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "SunJavaUpdateSched"="c:\program files (x86)\Java\jre6\bin\jusched.exe" [2009-07-25 149280] "ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920] "Nikon Transfer Monitor"="c:\program files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe" [2008-12-16 479232] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-30 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-14 421160] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "RegRun WinBait"="c:\windows\winbait.exe" [2011-01-18 20248] "@RegRunOnSecure"="c:\progra~2\Greatis\REGRUN~1\OnSecure.exe" [2008-12-23 61664] c:\users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-25 21979992] STARTUP.del [2011-2-5 314] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-1-24 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{F552DDE6-2090-4bf4-B924-6141E87789A5}"= "c:\progra~2\Greatis\REGRUN~1\RRShell.dll" [2009-04-06 335943] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan\0 R0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [x] R2 BootlogService;BootlogService;c:\program files (x86)\Greatis\RegRunSuite\BootLogService.exe [2011-01-18 65304] R3 RegGuard;RegGuard;c:\windows\system32\Drivers\regguard.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712] S2 ETService;Empowering Technology Service;c:\program files\GATEWAY\Gateway Recovery Management\Service\ETService.exe [2008-06-11 24576] S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx64coinst,serviceStartProc [x] S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk60x64.sys [2008-08-05 392192] . Contents of the 'Scheduled Tasks' folder 2010-10-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2826380935-2021557567-2855600642-1000Core1cb6b49155bbf30.job - c:\users\ME\AppData\Local\Google\Update\GoogleUpdate.exe [2010-04-18 21:02] . ——— x86-64 ———– [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="%ProgramFiles%\Windows Defender\MSASCui.exe -hide" [X] "CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-11 689488] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-04 2114376] "RtHDVCpl"="RAVCpl64.exe" [2008-05-20 6296064] "Skytel"="Skytel.exe" [2007-11-20 1826816] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=1208&m=dx4200-09 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = uInternet Settings,ProxyServer = http=127.0.0.1:18810 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: {{09E90109-A9AA-4980-BCEF-76F8D924E902} FF - ProfilePath - c:\users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\ FF - prefs.js: network.proxy.type - 2 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - Ext: vShare Plugin: vshare@toolbar - %profile%\extensions\vshare@toolbar FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: Move Media Player: [removed] - c:\users\ME\AppData\Roaming\Move Networks . - - - - ORPHANS REMOVED - - - - Wow6432Node-HKCU-Run-WMPNSCFG - c:\program files (x86)\Windows Media Player\WMPNSCFG.exe Wow6432Node-HKCU-Run-caclcmd - c:\windows\fcad32.dll Wow6432Node-HKLM-Run-eRecoveryService - (no file) AddRemove-aaa - c:\windows\system32\javaws.exe . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . ———————— Other Running Processes ———————— . c:\windows\MHotKey.exe c:\program files (x86)\Greatis\RegRunSuite\watchdog.exe c:\windows\ChiFuncExt.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\windows\CNYHKey.exe c:\windows\ModLedKey.exe . ************************************************************************** . Completion time: 2011-02-09 12:49:43 - machine was rebooted ComboFix-quarantined-files.txt 2011-02-09 20:49 Pre-Run: 304,275,415,040 bytes free Post-Run: 306,203,119,616 bytes free - - End Of File - - A3212657BBA55A73B4D2A58E8FA78EAB
Post #6
Hi UC_Caifan,

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\users\ME\AppData\Roaming\133.bat
c:\users\ME\AppData\Roaming\1598.bat
c:\users\ME\AppData\Roaming\4703.bat
c:\users\ME\AppData\Roaming\6925.bat
c:\users\ME\AppData\Roaming\2397.bat
c:\users\ME\AppData\Roaming\377.bat
c:\users\ME\AppData\Roaming\2493.bat
c:\users\ME\AppData\Roaming\8987.bat
c:\users\ME\AppData\Roaming\8677.bat
c:\users\ME\AppData\Roaming\6488.bat
c:\users\ME\AppData\Roaming\8807.bat
c:\users\ME\AppData\Roaming\190.bat
c:\users\ME\AppData\Roaming\4267.bat
c:\users\ME\AppData\Roaming\8574.bat
c:\users\ME\AppData\Roaming\1307.bat
c:\users\ME\AppData\Roaming\1955.bat
c:\users\ME\AppData\Roaming\9546.bat
c:\users\ME\AppData\Roaming\4552.bat
c:\users\ME\AppData\Roaming\1014.bat
c:\users\ME\AppData\Roaming\9011.bat
c:\users\ME\AppData\Roaming\868.bat
c:\users\ME\AppData\Roaming\8177.bat
c:\users\ME\AppData\Roaming\5094.bat
c:\users\ME\AppData\Roaming\5858.bat
c:\users\ME\AppData\Roaming\3317.bat
c:\users\ME\AppData\Roaming\2090.bat
c:\users\ME\AppData\Roaming\3230.bat
c:\users\ME\AppData\Roaming\3057.bat
c:\users\ME\AppData\Roaming\4466.bat
c:\users\ME\AppData\Roaming\972.bat
c:\users\ME\AppData\Roaming\3135.bat
c:\users\ME\AppData\Roaming\251.bat
c:\users\ME\AppData\Roaming\6484.bat
c:\users\ME\AppData\Roaming\7359.bat
c:\users\ME\AppData\Roaming\9200.bat
c:\users\ME\AppData\Roaming\3027.bat
c:\users\ME\AppData\Roaming\369.bat
c:\users\ME\AppData\Roaming\3285.bat
c:\users\ME\AppData\Roaming\3661.bat
c:\users\ME\AppData\Roaming\9295.bat
c:\users\ME\AppData\Roaming\1903.bat
c:\users\ME\AppData\Roaming\3614.bat
c:\users\ME\AppData\Roaming\7290.bat
c:\users\ME\AppData\Roaming\4230.bat
c:\users\ME\AppData\Roaming\3195.bat
c:\users\ME\AppData\Roaming\2494.bat
c:\users\ME\AppData\Roaming\969.bat
c:\users\ME\AppData\Roaming\4691.bat
c:\users\ME\AppData\Roaming\2863.bat
c:\users\ME\AppData\Roaming\7053.bat
c:\users\ME\AppData\Roaming\575.bat
c:\users\ME\AppData\Roaming\4885.bat
c:\users\ME\AppData\Roaming\5797.bat
c:\users\ME\AppData\Roaming\9723.bat
c:\users\ME\AppData\Roaming\4672.bat
c:\users\ME\AppData\Roaming\4667.bat
c:\users\ME\AppData\Roaming\4872.bat
c:\users\ME\AppData\Roaming\4851.bat
c:\users\ME\AppData\Roaming\7550.bat
c:\users\ME\AppData\Roaming\7197.bat
c:\users\ME\AppData\Roaming\6795.bat
c:\users\ME\AppData\Roaming\2361.bat
c:\users\ME\AppData\Roaming\8841.bat
c:\users\ME\AppData\Roaming\9595.bat
c:\users\ME\AppData\Roaming\1948.bat
c:\users\ME\AppData\Roaming\800.bat
c:\users\ME\AppData\Roaming\590.bat
c:\users\ME\AppData\Roaming\2794.bat
c:\users\ME\AppData\Roaming\931.bat
c:\users\ME\AppData\Roaming\7477.bat
c:\users\ME\AppData\Roaming\5215.bat
c:\users\ME\AppData\Roaming\786.bat
c:\users\ME\AppData\Roaming\9189.bat
c:\users\ME\AppData\Roaming\523.bat
c:\users\ME\AppData\Roaming\1429.bat
c:\users\ME\AppData\Roaming\292.bat
c:\users\ME\AppData\Roaming\2431.bat
c:\users\ME\AppData\Roaming\5348.bat
c:\users\ME\AppData\Roaming\5264.bat
c:\users\ME\AppData\Roaming\4265.bat
c:\users\ME\AppData\Roaming\4313.bat
c:\users\ME\AppData\Roaming\4805.bat
c:\users\ME\AppData\Roaming\1699.bat
c:\users\ME\AppData\Roaming\213.bat
c:\users\ME\AppData\Roaming\5400.bat
c:\users\ME\AppData\Roaming\9292.bat
c:\users\ME\AppData\Roaming\5736.bat
c:\users\ME\AppData\Roaming\1443.bat
c:\users\ME\AppData\Roaming\591.bat
c:\users\ME\AppData\Roaming\7117.bat
c:\users\ME\AppData\Roaming\8711.bat
c:\users\ME\AppData\Roaming\3565.bat
c:\users\ME\AppData\Roaming\1799.bat
c:\users\ME\AppData\Roaming\9213.bat
c:\users\ME\AppData\Roaming\9948.bat
c:\users\ME\AppData\Roaming\5235.bat
c:\users\ME\AppData\Roaming\9727.bat
c:\users\ME\AppData\Roaming\3001.bat
c:\users\ME\AppData\Roaming\3908.bat
c:\users\ME\AppData\Roaming\2836.bat
c:\users\ME\AppData\Roaming\8458.bat
c:\users\ME\AppData\Roaming\7507.bat
c:\users\ME\AppData\Roaming\7231.bat
c:\users\ME\AppData\Roaming\2528.bat
c:\users\ME\AppData\Roaming\7508.bat
c:\users\ME\AppData\Roaming\3221.bat
c:\users\ME\AppData\Roaming\439.bat
c:\users\ME\AppData\Roaming\4335.bat
c:\users\ME\AppData\Roaming\7970.bat
c:\users\ME\AppData\Roaming\153.bat
c:\users\ME\AppData\Roaming\1735.bat
c:\users\ME\AppData\Roaming\7656.bat
c:\users\ME\AppData\Roaming\9568.bat
c:\users\ME\AppData\Roaming\9403.bat
c:\users\ME\AppData\Roaming\6643.bat
c:\users\ME\AppData\Roaming\32.bat
c:\users\ME\AppData\Roaming\8715.bat
c:\users\ME\AppData\Roaming\4519.bat
c:\users\ME\AppData\Roaming\7364.bat
c:\users\ME\AppData\Roaming\4765.bat
c:\users\ME\AppData\Roaming\3808.bat
c:\users\ME\AppData\Roaming\7258.bat
c:\users\ME\AppData\Roaming\2059.bat
c:\users\ME\AppData\Local\Lmobabefogufage.bin

DirLook::
c:\users\ME\AppData\Roaming\QuickScan

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:18810

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Please post back with the combofix log.

Thanks
Post #7
Okay here is the log: ComboFix 11-02-09.02 - ME 02/09/2011 19:38:41.2.4 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3838.2282 [GMT -8:00] Running from: c:\users\[removed]\Desktop\jgh.exe Command switches used :: c:\users\ME\Desktop\CFScript.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FILE :: "c:\users\ME\AppData\Local\Lmobabefogufage.bin" "c:\users\ME\AppData\Roaming\1014.bat" "c:\users\ME\AppData\Roaming\1307.bat" "c:\users\ME\AppData\Roaming\133.bat" "c:\users\ME\AppData\Roaming\1429.bat" "c:\users\ME\AppData\Roaming\1443.bat" "c:\users\ME\AppData\Roaming\153.bat" "c:\users\ME\AppData\Roaming\1598.bat" "c:\users\ME\AppData\Roaming\1699.bat" "c:\users\ME\AppData\Roaming\1735.bat" "c:\users\ME\AppData\Roaming\1799.bat" "c:\users\ME\AppData\Roaming\190.bat" "c:\users\ME\AppData\Roaming\1903.bat" "c:\users\ME\AppData\Roaming\1948.bat" "c:\users\ME\AppData\Roaming\1955.bat" "c:\users\ME\AppData\Roaming\2059.bat" "c:\users\ME\AppData\Roaming\2090.bat" "c:\users\ME\AppData\Roaming\213.bat" "c:\users\ME\AppData\Roaming\2361.bat" "c:\users\ME\AppData\Roaming\2397.bat" "c:\users\ME\AppData\Roaming\2431.bat" "c:\users\ME\AppData\Roaming\2493.bat" "c:\users\ME\AppData\Roaming\2494.bat" "c:\users\ME\AppData\Roaming\251.bat" "c:\users\ME\AppData\Roaming\2528.bat" "c:\users\ME\AppData\Roaming\2794.bat" "c:\users\ME\AppData\Roaming\2836.bat" "c:\users\ME\AppData\Roaming\2863.bat" "c:\users\ME\AppData\Roaming\292.bat" "c:\users\ME\AppData\Roaming\3001.bat" "c:\users\ME\AppData\Roaming\3027.bat" "c:\users\ME\AppData\Roaming\3057.bat" "c:\users\ME\AppData\Roaming\3135.bat" "c:\users\ME\AppData\Roaming\3195.bat" "c:\users\ME\AppData\Roaming\32.bat" "c:\users\ME\AppData\Roaming\3221.bat" "c:\users\ME\AppData\Roaming\3230.bat" "c:\users\ME\AppData\Roaming\3285.bat" "c:\users\ME\AppData\Roaming\3317.bat" "c:\users\ME\AppData\Roaming\3565.bat" "c:\users\ME\AppData\Roaming\3614.bat" "c:\users\ME\AppData\Roaming\3661.bat" "c:\users\ME\AppData\Roaming\369.bat" "c:\users\ME\AppData\Roaming\377.bat" "c:\users\ME\AppData\Roaming\3808.bat" "c:\users\ME\AppData\Roaming\3908.bat" "c:\users\ME\AppData\Roaming\4230.bat" "c:\users\ME\AppData\Roaming\4265.bat" "c:\users\ME\AppData\Roaming\4267.bat" "c:\users\ME\AppData\Roaming\4313.bat" "c:\users\ME\AppData\Roaming\4335.bat" "c:\users\ME\AppData\Roaming\439.bat" "c:\users\ME\AppData\Roaming\4466.bat" "c:\users\ME\AppData\Roaming\4519.bat" "c:\users\ME\AppData\Roaming\4552.bat" "c:\users\ME\AppData\Roaming\4667.bat" "c:\users\ME\AppData\Roaming\4672.bat" "c:\users\ME\AppData\Roaming\4691.bat" "c:\users\ME\AppData\Roaming\4703.bat" "c:\users\ME\AppData\Roaming\4765.bat" "c:\users\ME\AppData\Roaming\4805.bat" "c:\users\ME\AppData\Roaming\4851.bat" "c:\users\ME\AppData\Roaming\4872.bat" "c:\users\ME\AppData\Roaming\4885.bat" "c:\users\ME\AppData\Roaming\5094.bat" "c:\users\ME\AppData\Roaming\5215.bat" "c:\users\ME\AppData\Roaming\523.bat" "c:\users\ME\AppData\Roaming\5235.bat" "c:\users\ME\AppData\Roaming\5264.bat" "c:\users\ME\AppData\Roaming\5348.bat" "c:\users\ME\AppData\Roaming\5400.bat" "c:\users\ME\AppData\Roaming\5736.bat" "c:\users\ME\AppData\Roaming\575.bat" "c:\users\ME\AppData\Roaming\5797.bat" "c:\users\ME\AppData\Roaming\5858.bat" "c:\users\ME\AppData\Roaming\590.bat" "c:\users\ME\AppData\Roaming\591.bat" "c:\users\ME\AppData\Roaming\6484.bat" "c:\users\ME\AppData\Roaming\6488.bat" "c:\users\ME\AppData\Roaming\6643.bat" "c:\users\ME\AppData\Roaming\6795.bat" "c:\users\ME\AppData\Roaming\6925.bat" "c:\users\ME\AppData\Roaming\7053.bat" "c:\users\ME\AppData\Roaming\7117.bat" "c:\users\ME\AppData\Roaming\7197.bat" "c:\users\ME\AppData\Roaming\7231.bat" "c:\users\ME\AppData\Roaming\7258.bat" "c:\users\ME\AppData\Roaming\7290.bat" "c:\users\ME\AppData\Roaming\7359.bat" "c:\users\ME\AppData\Roaming\7364.bat" "c:\users\ME\AppData\Roaming\7477.bat" "c:\users\ME\AppData\Roaming\7507.bat" "c:\users\ME\AppData\Roaming\7508.bat" "c:\users\ME\AppData\Roaming\7550.bat" "c:\users\ME\AppData\Roaming\7656.bat" "c:\users\ME\AppData\Roaming\786.bat" "c:\users\ME\AppData\Roaming\7970.bat" "c:\users\ME\AppData\Roaming\800.bat" "c:\users\ME\AppData\Roaming\8177.bat" "c:\users\ME\AppData\Roaming\8458.bat" "c:\users\ME\AppData\Roaming\8574.bat" "c:\users\ME\AppData\Roaming\8677.bat" "c:\users\ME\AppData\Roaming\868.bat" "c:\users\ME\AppData\Roaming\8711.bat" "c:\users\ME\AppData\Roaming\8715.bat" "c:\users\ME\AppData\Roaming\8807.bat" "c:\users\ME\AppData\Roaming\8841.bat" "c:\users\ME\AppData\Roaming\8987.bat" "c:\users\ME\AppData\Roaming\9011.bat" "c:\users\ME\AppData\Roaming\9189.bat" "c:\users\ME\AppData\Roaming\9200.bat" "c:\users\ME\AppData\Roaming\9213.bat" "c:\users\ME\AppData\Roaming\9292.bat" "c:\users\ME\AppData\Roaming\9295.bat" "c:\users\ME\AppData\Roaming\931.bat" "c:\users\ME\AppData\Roaming\9403.bat" "c:\users\ME\AppData\Roaming\9546.bat" "c:\users\ME\AppData\Roaming\9568.bat" "c:\users\ME\AppData\Roaming\9595.bat" "c:\users\ME\AppData\Roaming\969.bat" "c:\users\ME\AppData\Roaming\972.bat" "c:\users\ME\AppData\Roaming\9723.bat" "c:\users\ME\AppData\Roaming\9727.bat" "c:\users\ME\AppData\Roaming\9948.bat" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\ME\AppData\Local\Lmobabefogufage.bin c:\users\ME\AppData\Roaming\1014.bat c:\users\ME\AppData\Roaming\1307.bat c:\users\ME\AppData\Roaming\133.bat c:\users\ME\AppData\Roaming\1429.bat c:\users\ME\AppData\Roaming\1443.bat c:\users\ME\AppData\Roaming\153.bat c:\users\ME\AppData\Roaming\1598.bat c:\users\ME\AppData\Roaming\1699.bat c:\users\ME\AppData\Roaming\1735.bat c:\users\ME\AppData\Roaming\1799.bat c:\users\ME\AppData\Roaming\190.bat c:\users\ME\AppData\Roaming\1903.bat c:\users\ME\AppData\Roaming\1948.bat c:\users\ME\AppData\Roaming\1955.bat c:\users\ME\AppData\Roaming\2059.bat c:\users\ME\AppData\Roaming\2090.bat c:\users\ME\AppData\Roaming\213.bat c:\users\ME\AppData\Roaming\2361.bat c:\users\ME\AppData\Roaming\2397.bat c:\users\ME\AppData\Roaming\2431.bat c:\users\ME\AppData\Roaming\2493.bat c:\users\ME\AppData\Roaming\2494.bat c:\users\ME\AppData\Roaming\251.bat c:\users\ME\AppData\Roaming\2528.bat c:\users\ME\AppData\Roaming\2794.bat c:\users\ME\AppData\Roaming\2836.bat c:\users\ME\AppData\Roaming\2863.bat c:\users\ME\AppData\Roaming\292.bat c:\users\ME\AppData\Roaming\3001.bat c:\users\ME\AppData\Roaming\3027.bat c:\users\ME\AppData\Roaming\3057.bat c:\users\ME\AppData\Roaming\3135.bat c:\users\ME\AppData\Roaming\3195.bat c:\users\ME\AppData\Roaming\32.bat c:\users\ME\AppData\Roaming\3221.bat c:\users\ME\AppData\Roaming\3230.bat c:\users\ME\AppData\Roaming\3285.bat c:\users\ME\AppData\Roaming\3317.bat c:\users\ME\AppData\Roaming\3565.bat c:\users\ME\AppData\Roaming\3614.bat c:\users\ME\AppData\Roaming\3661.bat c:\users\ME\AppData\Roaming\369.bat c:\users\ME\AppData\Roaming\377.bat c:\users\ME\AppData\Roaming\3808.bat c:\users\ME\AppData\Roaming\3908.bat c:\users\ME\AppData\Roaming\4230.bat c:\users\ME\AppData\Roaming\4265.bat c:\users\ME\AppData\Roaming\4267.bat c:\users\ME\AppData\Roaming\4313.bat c:\users\ME\AppData\Roaming\4335.bat c:\users\ME\AppData\Roaming\439.bat c:\users\ME\AppData\Roaming\4466.bat c:\users\ME\AppData\Roaming\4519.bat c:\users\ME\AppData\Roaming\4552.bat c:\users\ME\AppData\Roaming\4667.bat c:\users\ME\AppData\Roaming\4672.bat c:\users\ME\AppData\Roaming\4691.bat c:\users\ME\AppData\Roaming\4703.bat c:\users\ME\AppData\Roaming\4765.bat c:\users\ME\AppData\Roaming\4805.bat c:\users\ME\AppData\Roaming\4851.bat c:\users\ME\AppData\Roaming\4872.bat c:\users\ME\AppData\Roaming\4885.bat c:\users\ME\AppData\Roaming\5094.bat c:\users\ME\AppData\Roaming\5215.bat c:\users\ME\AppData\Roaming\523.bat c:\users\ME\AppData\Roaming\5235.bat c:\users\ME\AppData\Roaming\5264.bat c:\users\ME\AppData\Roaming\5348.bat c:\users\ME\AppData\Roaming\5400.bat c:\users\ME\AppData\Roaming\5736.bat c:\users\ME\AppData\Roaming\575.bat c:\users\ME\AppData\Roaming\5797.bat c:\users\ME\AppData\Roaming\5858.bat c:\users\ME\AppData\Roaming\590.bat c:\users\ME\AppData\Roaming\591.bat c:\users\ME\AppData\Roaming\6484.bat c:\users\ME\AppData\Roaming\6488.bat c:\users\ME\AppData\Roaming\6643.bat c:\users\ME\AppData\Roaming\6795.bat c:\users\ME\AppData\Roaming\6925.bat c:\users\ME\AppData\Roaming\7053.bat c:\users\ME\AppData\Roaming\7117.bat c:\users\ME\AppData\Roaming\7197.bat c:\users\ME\AppData\Roaming\7231.bat c:\users\ME\AppData\Roaming\7258.bat c:\users\ME\AppData\Roaming\7290.bat c:\users\ME\AppData\Roaming\7359.bat c:\users\ME\AppData\Roaming\7364.bat c:\users\ME\AppData\Roaming\7477.bat c:\users\ME\AppData\Roaming\7507.bat c:\users\ME\AppData\Roaming\7508.bat c:\users\ME\AppData\Roaming\7550.bat c:\users\ME\AppData\Roaming\7656.bat c:\users\ME\AppData\Roaming\786.bat c:\users\ME\AppData\Roaming\7970.bat c:\users\ME\AppData\Roaming\800.bat c:\users\ME\AppData\Roaming\8177.bat c:\users\ME\AppData\Roaming\8458.bat c:\users\ME\AppData\Roaming\8574.bat c:\users\ME\AppData\Roaming\8677.bat c:\users\ME\AppData\Roaming\868.bat c:\users\ME\AppData\Roaming\8711.bat c:\users\ME\AppData\Roaming\8715.bat c:\users\ME\AppData\Roaming\8807.bat c:\users\ME\AppData\Roaming\8841.bat c:\users\ME\AppData\Roaming\8987.bat c:\users\ME\AppData\Roaming\9011.bat c:\users\ME\AppData\Roaming\9189.bat c:\users\ME\AppData\Roaming\9200.bat c:\users\ME\AppData\Roaming\9213.bat c:\users\ME\AppData\Roaming\9292.bat c:\users\ME\AppData\Roaming\9295.bat c:\users\ME\AppData\Roaming\931.bat c:\users\ME\AppData\Roaming\9403.bat c:\users\ME\AppData\Roaming\9546.bat c:\users\ME\AppData\Roaming\9568.bat c:\users\ME\AppData\Roaming\9595.bat c:\users\ME\AppData\Roaming\969.bat c:\users\ME\AppData\Roaming\972.bat c:\users\ME\AppData\Roaming\9723.bat c:\users\ME\AppData\Roaming\9727.bat c:\users\ME\AppData\Roaming\9948.bat . ((((((((((((((((((((((((( Files Created from 2011-01-10 to 2011-02-10 ))))))))))))))))))))))))))))))) . 2011-02-10 03:53 . 2011-02-10 03:58 ——– d—–w- c:\users\ME\AppData\Local\temp 2011-02-10 03:53 . 2011-02-10 03:53 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-02-09 22:56 . 2011-01-13 10:20 7844688 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89EAF299-DA12-48F9-A42F-7D8282006758}\mpengine.dll 2011-02-08 04:01 . 2011-02-08 04:01 ——– d—–w- c:\users\ME\AppData\Roaming\QuickScan 2011-02-07 19:28 . 2011-02-07 19:28 121 —-a-w- c:\users\ME\AppData\Roaming\3288.bat 2011-02-07 19:09 . 2011-02-07 19:09 123 —-a-w- c:\users\ME\AppData\Roaming\5583.bat 2011-02-07 18:42 . 2011-02-07 18:42 129 —-a-w- c:\users\ME\AppData\Roaming\5476.bat 2011-02-07 18:25 . 2011-02-07 18:25 121 —-a-w- c:\users\ME\AppData\Roaming\3348.bat 2011-02-07 17:17 . 2011-02-09 08:12 ——– d—–w- c:\windows\RestoreSafeDeleted 2011-02-07 17:11 . 2011-02-10 03:55 24416 —-a-w- c:\windows\SysWow64\drivers\regguard.sys 2011-02-07 17:11 . 2011-02-07 17:11 37600 —-a-w- c:\windows\SysWow64\Partizan.exe 2011-02-07 17:11 . 2011-02-07 17:11 35816 —-a-w- c:\windows\SysWow64\drivers\Partizan.sys 2011-02-07 17:05 . 2011-02-07 17:05 2 –shatr- c:\windows\winstart.bat 2011-02-07 17:05 . 2011-02-07 17:05 37600 —-a-w- c:\windows\system32\Partizan.exe 2011-02-07 17:05 . 2011-01-18 00:33 1385240 —-a-w- c:\windows\RunGuard.exe 2011-02-07 17:05 . 2011-01-18 00:33 20248 —-a-w- c:\windows\WinBait.org 2011-02-07 17:05 . 2011-01-18 00:33 20248 —-a-w- c:\windows\WinBait.exe 2011-02-07 17:05 . 2011-02-07 17:05 ——– d—–w- c:\program files (x86)\Greatis 2011-02-07 16:57 . 2011-02-09 04:49 119 —-a-w- c:\users\ME\AppData\Roaming\3269.bat 2011-02-07 16:57 . 2011-02-07 16:57 129 —-a-w- c:\users\ME\AppData\Roaming\3720.bat 2011-02-07 16:38 . 2011-02-07 16:38 127 —-a-w- c:\users\ME\AppData\Roaming\9982.bat 2011-02-07 16:37 . 2011-02-07 16:37 129 —-a-w- c:\users\ME\AppData\Roaming\7762.bat 2011-02-07 16:27 . 2011-02-07 16:27 129 —-a-w- c:\users\ME\AppData\Roaming\3151.bat 2011-02-07 16:27 . 2011-02-07 16:27 121 —-a-w- c:\users\ME\AppData\Roaming\1208.bat 2011-02-07 16:10 . 2011-02-07 16:10 119 —-a-w- c:\users\ME\AppData\Roaming\6416.bat 2011-02-07 16:10 . 2011-02-07 16:10 129 —-a-w- c:\users\ME\AppData\Roaming\7201.bat 2011-02-07 15:37 . 2011-02-07 15:37 125 —-a-w- c:\users\ME\AppData\Roaming\1007.bat 2011-02-07 15:12 . 2011-02-07 15:12 123 —-a-w- c:\users\ME\AppData\Roaming\8856.bat 2011-02-07 15:07 . 2011-02-07 15:07 123 —-a-w- c:\users\ME\AppData\Roaming\4989.bat 2011-02-07 15:07 . 2011-02-07 15:07 127 —-a-w- c:\users\ME\AppData\Roaming\3053.bat 2011-02-07 14:39 . 2011-02-07 14:39 129 —-a-w- c:\users\ME\AppData\Roaming\6553.bat 2011-02-07 14:39 . 2011-02-07 14:39 129 —-a-w- c:\users\ME\AppData\Roaming\6642.bat 2011-02-07 14:09 . 2011-02-07 14:09 125 —-a-w- c:\users\ME\AppData\Roaming\4708.bat 2011-02-07 14:09 . 2011-02-07 14:09 125 —-a-w- c:\users\ME\AppData\Roaming\689.bat 2011-02-07 13:44 . 2011-02-07 13:44 129 —-a-w- c:\users\ME\AppData\Roaming\2419.bat 2011-02-07 13:44 . 2011-02-07 13:44 125 —-a-w- c:\users\ME\AppData\Roaming\894.bat 2011-02-07 13:24 . 2011-02-07 13:24 123 —-a-w- c:\users\ME\AppData\Roaming\3249.bat 2011-02-07 12:58 . 2011-02-07 12:58 121 —-a-w- c:\users\ME\AppData\Roaming\9882.bat 2011-02-07 12:58 . 2011-02-07 12:58 121 —-a-w- c:\users\ME\AppData\Roaming\8610.bat 2011-02-07 12:42 . 2011-02-07 12:42 129 —-a-w- c:\users\ME\AppData\Roaming\4514.bat 2011-02-07 12:42 . 2011-02-07 12:42 123 —-a-w- c:\users\ME\AppData\Roaming\6238.bat 2011-02-07 12:17 . 2011-02-07 12:17 125 —-a-w- c:\users\ME\AppData\Roaming\269.bat 2011-02-07 12:17 . 2011-02-07 12:17 125 —-a-w- c:\users\ME\AppData\Roaming\9312.bat 2011-02-07 12:00 . 2011-02-07 12:00 123 —-a-w- c:\users\ME\AppData\Roaming\855.bat 2011-02-07 11:39 . 2011-02-07 11:39 125 —-a-w- c:\users\ME\AppData\Roaming\9090.bat 2011-02-07 11:39 . 2011-02-07 11:39 129 —-a-w- c:\users\ME\AppData\Roaming\4606.bat 2011-02-07 11:11 . 2011-02-07 11:11 127 —-a-w- c:\users\ME\AppData\Roaming\7807.bat 2011-02-07 11:11 . 2011-02-07 11:11 125 —-a-w- c:\users\ME\AppData\Roaming\2438.bat 2011-02-07 10:39 . 2011-02-07 10:39 127 —-a-w- c:\users\ME\AppData\Roaming\8488.bat 2011-02-07 10:39 . 2011-02-07 10:39 129 —-a-w- c:\users\ME\AppData\Roaming\960.bat 2011-02-07 10:22 . 2011-02-07 10:22 127 —-a-w- c:\users\ME\AppData\Roaming\6372.bat 2011-02-07 10:22 . 2011-02-07 10:22 121 —-a-w- c:\users\ME\AppData\Roaming\3761.bat 2011-02-07 09:54 . 2011-02-07 09:54 123 —-a-w- c:\users\ME\AppData\Roaming\2746.bat 2011-02-07 09:54 . 2011-02-07 09:54 121 —-a-w- c:\users\ME\AppData\Roaming\5266.bat 2011-02-07 09:28 . 2011-02-07 09:28 127 —-a-w- c:\users\ME\AppData\Roaming\3826.bat 2011-02-07 09:28 . 2011-02-07 09:28 123 —-a-w- c:\users\ME\AppData\Roaming\5446.bat 2011-02-07 09:06 . 2011-02-07 09:06 125 —-a-w- c:\users\ME\AppData\Roaming\7743.bat 2011-02-07 09:06 . 2011-02-07 09:06 125 —-a-w- c:\users\ME\AppData\Roaming\6559.bat 2011-02-07 08:48 . 2011-02-07 08:48 123 —-a-w- c:\users\ME\AppData\Roaming\4925.bat 2011-02-07 08:48 . 2011-02-07 08:48 129 —-a-w- c:\users\ME\AppData\Roaming\7865.bat 2011-02-07 08:16 . 2011-02-07 08:16 127 —-a-w- c:\users\ME\AppData\Roaming\6987.bat 2011-02-07 08:16 . 2011-02-07 08:16 129 —-a-w- c:\users\ME\AppData\Roaming\6775.bat 2011-02-07 07:50 . 2011-02-07 07:50 123 —-a-w- c:\users\ME\AppData\Roaming\4794.bat 2011-02-07 07:50 . 2011-02-07 07:50 119 —-a-w- c:\users\ME\AppData\Roaming\3848.bat 2011-02-07 07:34 . 2011-02-07 07:34 125 —-a-w- c:\users\ME\AppData\Roaming\4277.bat 2011-02-07 07:34 . 2011-02-07 07:34 127 —-a-w- c:\users\ME\AppData\Roaming\2498.bat 2011-02-07 07:24 . 2011-02-07 07:24 121 —-a-w- c:\users\ME\AppData\Roaming\7650.bat 2011-02-07 07:24 . 2011-02-07 07:24 123 —-a-w- c:\users\ME\AppData\Roaming\1080.bat 2011-02-07 07:17 . 2011-02-07 07:17 121 —-a-w- c:\users\ME\AppData\Roaming\6563.bat 2011-02-07 07:17 . 2011-02-07 07:17 119 —-a-w- c:\users\ME\AppData\Roaming\4769.bat 2011-02-07 06:47 . 2011-02-07 06:47 119 —-a-w- c:\users\ME\AppData\Roaming\2639.bat 2011-02-07 06:47 . 2011-02-07 06:47 119 —-a-w- c:\users\ME\AppData\Roaming\4658.bat 2011-02-07 06:32 . 2011-02-07 06:32 129 —-a-w- c:\users\ME\AppData\Roaming\5158.bat 2011-02-07 06:32 . 2011-02-07 06:32 125 —-a-w- c:\users\ME\AppData\Roaming\2305.bat 2011-02-07 06:18 . 2011-02-07 06:18 119 —-a-w- c:\users\ME\AppData\Roaming\7997.bat 2011-02-07 06:18 . 2011-02-07 06:18 125 —-a-w- c:\users\ME\AppData\Roaming\305.bat 2011-02-07 05:54 . 2011-02-07 05:54 129 —-a-w- c:\users\ME\AppData\Roaming\6066.bat 2011-02-07 05:54 . 2011-02-07 05:54 125 —-a-w- c:\users\ME\AppData\Roaming\1881.bat 2011-02-07 05:44 . 2011-02-07 05:44 125 —-a-w- c:\users\ME\AppData\Roaming\9348.bat 2011-02-07 05:44 . 2011-02-07 05:44 121 —-a-w- c:\users\ME\AppData\Roaming\726.bat 2011-02-07 05:26 . 2011-02-07 05:26 129 —-a-w- c:\users\ME\AppData\Roaming\6062.bat 2011-02-07 05:26 . 2011-02-07 05:26 125 —-a-w- c:\users\ME\AppData\Roaming\5991.bat 2011-02-07 05:14 . 2011-02-07 05:14 129 —-a-w- c:\users\ME\AppData\Roaming\6526.bat 2011-02-07 05:14 . 2011-02-07 05:14 129 —-a-w- c:\users\ME\AppData\Roaming\6435.bat 2011-02-07 04:57 . 2011-02-08 04:29 123 —-a-w- c:\users\ME\AppData\Roaming\2128.bat 2011-02-07 04:57 . 2011-02-07 04:57 123 —-a-w- c:\users\ME\AppData\Roaming\6887.bat 2011-02-07 04:27 . 2011-02-07 04:27 129 —-a-w- c:\users\ME\AppData\Roaming\9498.bat 2011-02-07 04:27 . 2011-02-07 04:27 121 —-a-w- c:\users\ME\AppData\Roaming\9491.bat 2011-02-07 04:20 . 2011-02-07 04:20 125 —-a-w- c:\users\ME\AppData\Roaming\9864.bat 2011-02-07 04:20 . 2011-02-07 04:20 125 —-a-w- c:\users\ME\AppData\Roaming\8545.bat 2011-02-07 03:54 . 2011-02-07 03:54 121 —-a-w- c:\users\ME\AppData\Roaming\3837.bat 2011-02-07 03:54 . 2011-02-07 03:54 121 —-a-w- c:\users\ME\AppData\Roaming\8408.bat 2011-02-07 03:29 . 2011-02-07 03:29 123 —-a-w- c:\users\ME\AppData\Roaming\5559.bat 2011-02-07 03:29 . 2011-02-07 03:29 125 —-a-w- c:\users\ME\AppData\Roaming\7885.bat 2011-02-07 03:13 . 2011-02-07 03:13 119 —-a-w- c:\users\ME\AppData\Roaming\2689.bat 2011-02-07 03:13 . 2011-02-07 03:13 129 —-a-w- c:\users\ME\AppData\Roaming\6040.bat 2011-02-07 03:06 . 2011-02-07 03:06 123 —-a-w- c:\users\ME\AppData\Roaming\6953.bat 2011-02-07 03:06 . 2011-02-07 03:06 127 —-a-w- c:\users\ME\AppData\Roaming\1157.bat 2011-02-07 02:57 . 2011-02-07 02:57 123 —-a-w- c:\users\ME\AppData\Roaming\2451.bat 2011-02-07 02:57 . 2011-02-07 02:57 119 —-a-w- c:\users\ME\AppData\Roaming\3519.bat 2011-02-07 02:42 . 2011-02-07 02:42 125 —-a-w- c:\users\ME\AppData\Roaming\3959.bat 2011-02-07 02:42 . 2011-02-07 02:42 123 —-a-w- c:\users\ME\AppData\Roaming\7644.bat 2011-02-07 02:36 . 2011-02-07 02:36 121 —-a-w- c:\users\ME\AppData\Roaming\2393.bat 2011-02-07 02:36 . 2011-02-07 02:36 119 —-a-w- c:\users\ME\AppData\Roaming\1135.bat 2011-02-07 02:20 . 2011-02-07 02:20 125 —-a-w- c:\users\ME\AppData\Roaming\7473.bat 2011-02-07 02:20 . 2011-02-07 02:20 123 —-a-w- c:\users\ME\AppData\Roaming\9683.bat 2011-02-07 01:57 . 2011-02-07 01:57 123 —-a-w- c:\users\ME\AppData\Roaming\162.bat 2011-02-07 01:57 . 2011-02-07 01:57 119 —-a-w- c:\users\ME\AppData\Roaming\8829.bat 2011-02-07 01:45 . 2011-02-07 01:45 129 —-a-w- c:\users\ME\AppData\Roaming\3329.bat 2011-02-07 01:45 . 2011-02-07 01:45 125 —-a-w- c:\users\ME\AppData\Roaming\8600.bat 2011-02-07 01:36 . 2011-02-07 01:36 127 —-a-w- c:\users\ME\AppData\Roaming\6376.bat 2011-02-07 01:36 . 2011-02-07 01:36 119 —-a-w- c:\users\ME\AppData\Roaming\2694.bat 2011-02-07 01:11 . 2011-02-07 01:11 127 —-a-w- c:\users\ME\AppData\Roaming\67.bat 2011-02-07 01:11 . 2011-02-07 01:11 121 —-a-w- c:\users\ME\AppData\Roaming\1372.bat 2011-02-07 00:38 . 2011-02-07 00:38 119 —-a-w- c:\users\ME\AppData\Roaming\766.bat 2011-02-07 00:38 . 2011-02-07 00:38 121 —-a-w- c:\users\ME\AppData\Roaming\9715.bat 2011-02-07 00:06 . 2011-02-07 00:06 129 —-a-w- c:\users\ME\AppData\Roaming\2156.bat 2011-02-07 00:06 . 2011-02-07 00:06 125 —-a-w- c:\users\ME\AppData\Roaming\6415.bat 2011-02-07 00:00 . 2011-02-07 00:00 127 —-a-w- c:\users\ME\AppData\Roaming\8445.bat 2011-02-07 00:00 . 2011-02-07 00:00 129 —-a-w- c:\users\ME\AppData\Roaming\8984.bat 2011-02-06 23:52 . 2011-02-06 23:52 129 —-a-w- c:\users\ME\AppData\Roaming\8427.bat 2011-02-06 23:52 . 2011-02-06 23:52 123 —-a-w- c:\users\ME\AppData\Roaming\6513.bat 2011-02-06 23:18 . 2011-02-06 23:18 121 —-a-w- c:\users\ME\AppData\Roaming\5704.bat 2011-02-06 23:18 . 2011-02-06 23:18 119 —-a-w- c:\users\ME\AppData\Roaming\3466.bat 2011-02-06 22:48 . 2011-02-06 22:48 129 —-a-w- c:\users\ME\AppData\Roaming\5484.bat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-21 02:09 . 2010-03-07 06:33 38224 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2010-12-21 02:08 . 2010-03-06 10:44 24152 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-11-30 01:38 . 2010-11-30 01:38 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2010-11-30 01:38 . 2010-11-30 01:38 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . —- Directory of c:\users\ME\AppData\Roaming\QuickScan —- 2011-02-08 04:01 . 2011-02-08 04:02 23694 —-a-w- c:\users\ME\AppData\Roaming\QuickScan\Report 2011-02-07 20.01.34.txt ((((((((((((((((((((((((((((( SnapShot@2011-02-09_20.42.00 ))))))))))))))))))))))))))))))))))))))))) . + 2009-10-11 03:54 . 2011-02-10 03:55 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-10-11 03:54 . 2011-02-09 20:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-10-11 03:54 . 2011-02-09 20:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-10-11 03:54 . 2011-02-10 03:55 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-02-10 03:55 . 2011-02-10 03:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-02-09 20:40 . 2011-02-09 20:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-02-09 20:40 . 2011-02-09 20:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-02-10 03:55 . 2011-02-10 03:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2006-11-02 12:46 . 2011-02-09 08:20 595446 c:\windows\system32\perfh009.dat + 2006-11-02 12:46 . 2011-02-09 20:46 595446 c:\windows\system32\perfh009.dat + 2006-11-02 12:46 . 2011-02-09 20:46 101144 c:\windows\system32\perfc009.dat - 2006-11-02 12:46 . 2011-02-09 08:20 101144 c:\windows\system32\perfc009.dat + 2011-02-10 03:37 . 2011-02-10 03:37 10956800 c:\windows\ERDNT\Hiv-backup\schema.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472] "ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2008-09-10 0] "Google Update"="c:\users\ME\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-04-18 136176] "ANT Agent"="c:\program files (x86)\Garmin\ANT Agent\ANT Agent.exe" [2011-01-18 12034920] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-17 61440] "LchDrvKey"="LchDrvKey.exe" [2007-03-29 36864] "LedKey"="CNYHKey.exe" [2008-04-24 339968] "Smart Copy"="c:\program files (x86)\IOI\Smart Copy\ButtonMonitor.exe" [2008-05-21 53248] "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "SunJavaUpdateSched"="c:\program files (x86)\Java\jre6\bin\jusched.exe" [2009-07-25 149280] "ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920] "Nikon Transfer Monitor"="c:\program files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe" [2008-12-16 479232] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-30 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-14 421160] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "RegRun WinBait"="c:\windows\winbait.exe" [2011-01-18 20248] "@RegRunOnSecure"="c:\progra~2\Greatis\REGRUN~1\OnSecure.exe" [2008-12-23 61664] c:\users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-25 21979992] STARTUP.del [2011-2-5 314] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-1-24 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{F552DDE6-2090-4bf4-B924-6141E87789A5}"= "c:\progra~2\Greatis\REGRUN~1\RRShell.dll" [2009-04-06 335943] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan\0 R0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [x] R2 BootlogService;BootlogService;c:\program files (x86)\Greatis\RegRunSuite\BootLogService.exe [2011-01-18 65304] R3 RegGuard;RegGuard;c:\windows\system32\Drivers\regguard.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712] S2 ETService;Empowering Technology Service;c:\program files\GATEWAY\Gateway Recovery Management\Service\ETService.exe [2008-06-11 24576] S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx64coinst,serviceStartProc [x] S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk60x64.sys [2008-08-05 392192] . Contents of the 'Scheduled Tasks' folder 2010-10-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2826380935-2021557567-2855600642-1000Core1cb6b49155bbf30.job - c:\users\ME\AppData\Local\Google\Update\GoogleUpdate.exe [2010-04-18 21:02] . ——— x86-64 ———– [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-11 689488] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-04 2114376] "RtHDVCpl"="RAVCpl64.exe" [2008-05-20 6296064] "Skytel"="Skytel.exe" [2007-11-20 1826816] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=1208&m=dx4200-09 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: {{09E90109-A9AA-4980-BCEF-76F8D924E902} FF - ProfilePath - c:\users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\ FF - prefs.js: network.proxy.type - 2 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - Ext: vShare Plugin: vshare@toolbar - %profile%\extensions\vshare@toolbar FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: Move Media Player: [removed] - c:\users\ME\AppData\Roaming\Move Networks . . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . ———————— Other Running Processes ———————— . c:\windows\MHotKey.exe c:\program files (x86)\Greatis\RegRunSuite\watchdog.exe c:\windows\ChiFuncExt.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\windows\CNYHKey.exe c:\windows\ModLedKey.exe . ************************************************************************** . Completion time: 2011-02-09 20:05:27 - machine was rebooted ComboFix-quarantined-files.txt 2011-02-10 04:05 ComboFix2.txt 2011-02-09 20:49 Pre-Run: 307,811,655,680 bytes free Post-Run: 307,973,791,744 bytes free - - End Of File - - D55B53633BC54FB720A4DA23D29E4B5A
Post #8
Hi UC_Caifan,

Let's see if we can get rid of the rest.

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\users\ME\AppData\Roaming\5583.bat
c:\users\ME\AppData\Roaming\5476.bat
c:\users\ME\AppData\Roaming\3348.bat
c:\users\ME\AppData\Roaming\3269.bat
c:\users\ME\AppData\Roaming\3720.bat
c:\users\ME\AppData\Roaming\9982.bat
c:\users\ME\AppData\Roaming\7762.bat
c:\users\ME\AppData\Roaming\3151.bat
c:\users\ME\AppData\Roaming\1208.bat
c:\users\ME\AppData\Roaming\6416.bat
c:\users\ME\AppData\Roaming\7201.bat
c:\users\ME\AppData\Roaming\1007.bat
c:\users\ME\AppData\Roaming\8856.bat
c:\users\ME\AppData\Roaming\4989.bat
c:\users\ME\AppData\Roaming\3053.bat
c:\users\ME\AppData\Roaming\6553.bat
c:\users\ME\AppData\Roaming\6642.bat
c:\users\ME\AppData\Roaming\4708.bat
c:\users\ME\AppData\Roaming\689.bat
c:\users\ME\AppData\Roaming\2419.bat
c:\users\ME\AppData\Roaming\894.bat
c:\users\ME\AppData\Roaming\3249.bat
c:\users\ME\AppData\Roaming\9882.bat
c:\users\ME\AppData\Roaming\8610.bat
c:\users\ME\AppData\Roaming\4514.bat
c:\users\ME\AppData\Roaming\6238.bat
c:\users\ME\AppData\Roaming\269.bat
c:\users\ME\AppData\Roaming\9312.bat
c:\users\ME\AppData\Roaming\855.bat
c:\users\ME\AppData\Roaming\9090.bat
c:\users\ME\AppData\Roaming\4606.bat
c:\users\ME\AppData\Roaming\7807.bat
c:\users\ME\AppData\Roaming\2438.bat
c:\users\ME\AppData\Roaming\8488.bat
c:\users\ME\AppData\Roaming\960.bat
c:\users\ME\AppData\Roaming\6372.bat
c:\users\ME\AppData\Roaming\3761.bat
c:\users\ME\AppData\Roaming\2746.bat
c:\users\ME\AppData\Roaming\5266.bat
c:\users\ME\AppData\Roaming\3826.bat
c:\users\ME\AppData\Roaming\5446.bat
c:\users\ME\AppData\Roaming\7743.bat
c:\users\ME\AppData\Roaming\6559.bat
c:\users\ME\AppData\Roaming\4925.bat
c:\users\ME\AppData\Roaming\7865.bat
c:\users\ME\AppData\Roaming\6987.bat
c:\users\ME\AppData\Roaming\6775.bat
c:\users\ME\AppData\Roaming\4794.bat
c:\users\ME\AppData\Roaming\3848.bat
c:\users\ME\AppData\Roaming\4277.bat
c:\users\ME\AppData\Roaming\2498.bat
c:\users\ME\AppData\Roaming\7650.bat
c:\users\ME\AppData\Roaming\1080.bat
c:\users\ME\AppData\Roaming\6563.bat
c:\users\ME\AppData\Roaming\4769.bat
c:\users\ME\AppData\Roaming\2639.bat
c:\users\ME\AppData\Roaming\4658.bat
c:\users\ME\AppData\Roaming\5158.bat
c:\users\ME\AppData\Roaming\2305.bat
c:\users\ME\AppData\Roaming\7997.bat
c:\users\ME\AppData\Roaming\305.bat
c:\users\ME\AppData\Roaming\6066.bat
c:\users\ME\AppData\Roaming\1881.bat
c:\users\ME\AppData\Roaming\9348.bat
c:\users\ME\AppData\Roaming\726.bat
c:\users\ME\AppData\Roaming\6062.bat
c:\users\ME\AppData\Roaming\5991.bat
c:\users\ME\AppData\Roaming\6526.bat
c:\users\ME\AppData\Roaming\6435.bat
c:\users\ME\AppData\Roaming\2128.bat
c:\users\ME\AppData\Roaming\6887.bat
c:\users\ME\AppData\Roaming\9498.bat
c:\users\ME\AppData\Roaming\9491.bat
c:\users\ME\AppData\Roaming\9864.bat
c:\users\ME\AppData\Roaming\8545.bat
c:\users\ME\AppData\Roaming\3837.bat
c:\users\ME\AppData\Roaming\8408.bat
c:\users\ME\AppData\Roaming\5559.bat
c:\users\ME\AppData\Roaming\7885.bat
c:\users\ME\AppData\Roaming\2689.bat
c:\users\ME\AppData\Roaming\6040.bat
c:\users\ME\AppData\Roaming\6953.bat
c:\users\ME\AppData\Roaming\1157.bat
c:\users\ME\AppData\Roaming\2451.bat
c:\users\ME\AppData\Roaming\3519.bat
c:\users\ME\AppData\Roaming\3959.bat
c:\users\ME\AppData\Roaming\7644.bat
c:\users\ME\AppData\Roaming\2393.bat
c:\users\ME\AppData\Roaming\1135.bat
c:\users\ME\AppData\Roaming\7473.bat
c:\users\ME\AppData\Roaming\9683.bat
c:\users\ME\AppData\Roaming\162.bat
c:\users\ME\AppData\Roaming\8829.bat
c:\users\ME\AppData\Roaming\3329.bat
c:\users\ME\AppData\Roaming\8600.bat
c:\users\ME\AppData\Roaming\6376.bat
c:\users\ME\AppData\Roaming\2694.bat
c:\users\ME\AppData\Roaming\67.bat
c:\users\ME\AppData\Roaming\1372.bat
c:\users\ME\AppData\Roaming\766.bat
c:\users\ME\AppData\Roaming\9715.bat
c:\users\ME\AppData\Roaming\2156.bat
c:\users\ME\AppData\Roaming\6415.bat
c:\users\ME\AppData\Roaming\8445.bat
c:\users\ME\AppData\Roaming\8984.bat
c:\users\ME\AppData\Roaming\8427.bat
c:\users\ME\AppData\Roaming\6513.bat
c:\users\ME\AppData\Roaming\5704.bat
c:\users\ME\AppData\Roaming\3466.bat
c:\users\ME\AppData\Roaming\5484.bat
c:\users\ME\AppData\Roaming\3288.bat

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Please post back with the combofix log.

Thanks
Post #9
Hi oldman960: here is the latest log: ComboFix 11-02-09.02 - ME 02/10/2011 0:48.3.4 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3838.2401 [GMT -8:00] Running from: c:\users\[removed]\Desktop\jgh.exe Command switches used :: c:\users\ME\Desktop\CFScript.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FILE :: "c:\users\ME\AppData\Roaming\1007.bat" "c:\users\ME\AppData\Roaming\1080.bat" "c:\users\ME\AppData\Roaming\1135.bat" "c:\users\ME\AppData\Roaming\1157.bat" "c:\users\ME\AppData\Roaming\1208.bat" "c:\users\ME\AppData\Roaming\1372.bat" "c:\users\ME\AppData\Roaming\162.bat" "c:\users\ME\AppData\Roaming\1881.bat" "c:\users\ME\AppData\Roaming\2128.bat" "c:\users\ME\AppData\Roaming\2156.bat" "c:\users\ME\AppData\Roaming\2305.bat" "c:\users\ME\AppData\Roaming\2393.bat" "c:\users\ME\AppData\Roaming\2419.bat" "c:\users\ME\AppData\Roaming\2438.bat" "c:\users\ME\AppData\Roaming\2451.bat" "c:\users\ME\AppData\Roaming\2498.bat" "c:\users\ME\AppData\Roaming\2639.bat" "c:\users\ME\AppData\Roaming\2689.bat" "c:\users\ME\AppData\Roaming\269.bat" "c:\users\ME\AppData\Roaming\2694.bat" "c:\users\ME\AppData\Roaming\2746.bat" "c:\users\ME\AppData\Roaming\305.bat" "c:\users\ME\AppData\Roaming\3053.bat" "c:\users\ME\AppData\Roaming\3151.bat" "c:\users\ME\AppData\Roaming\3249.bat" "c:\users\ME\AppData\Roaming\3269.bat" "c:\users\ME\AppData\Roaming\3288.bat" "c:\users\ME\AppData\Roaming\3329.bat" "c:\users\ME\AppData\Roaming\3348.bat" "c:\users\ME\AppData\Roaming\3466.bat" "c:\users\ME\AppData\Roaming\3519.bat" "c:\users\ME\AppData\Roaming\3720.bat" "c:\users\ME\AppData\Roaming\3761.bat" "c:\users\ME\AppData\Roaming\3826.bat" "c:\users\ME\AppData\Roaming\3837.bat" "c:\users\ME\AppData\Roaming\3848.bat" "c:\users\ME\AppData\Roaming\3959.bat" "c:\users\ME\AppData\Roaming\4277.bat" "c:\users\ME\AppData\Roaming\4514.bat" "c:\users\ME\AppData\Roaming\4606.bat" "c:\users\ME\AppData\Roaming\4658.bat" "c:\users\ME\AppData\Roaming\4708.bat" "c:\users\ME\AppData\Roaming\4769.bat" "c:\users\ME\AppData\Roaming\4794.bat" "c:\users\ME\AppData\Roaming\4925.bat" "c:\users\ME\AppData\Roaming\4989.bat" "c:\users\ME\AppData\Roaming\5158.bat" "c:\users\ME\AppData\Roaming\5266.bat" "c:\users\ME\AppData\Roaming\5446.bat" "c:\users\ME\AppData\Roaming\5476.bat" "c:\users\ME\AppData\Roaming\5484.bat" "c:\users\ME\AppData\Roaming\5559.bat" "c:\users\ME\AppData\Roaming\5583.bat" "c:\users\ME\AppData\Roaming\5704.bat" "c:\users\ME\AppData\Roaming\5991.bat" "c:\users\ME\AppData\Roaming\6040.bat" "c:\users\ME\AppData\Roaming\6062.bat" "c:\users\ME\AppData\Roaming\6066.bat" "c:\users\ME\AppData\Roaming\6238.bat" "c:\users\ME\AppData\Roaming\6372.bat" "c:\users\ME\AppData\Roaming\6376.bat" "c:\users\ME\AppData\Roaming\6415.bat" "c:\users\ME\AppData\Roaming\6416.bat" "c:\users\ME\AppData\Roaming\6435.bat" "c:\users\ME\AppData\Roaming\6513.bat" "c:\users\ME\AppData\Roaming\6526.bat" "c:\users\ME\AppData\Roaming\6553.bat" "c:\users\ME\AppData\Roaming\6559.bat" "c:\users\ME\AppData\Roaming\6563.bat" "c:\users\ME\AppData\Roaming\6642.bat" "c:\users\ME\AppData\Roaming\67.bat" "c:\users\ME\AppData\Roaming\6775.bat" "c:\users\ME\AppData\Roaming\6887.bat" "c:\users\ME\AppData\Roaming\689.bat" "c:\users\ME\AppData\Roaming\6953.bat" "c:\users\ME\AppData\Roaming\6987.bat" "c:\users\ME\AppData\Roaming\7201.bat" "c:\users\ME\AppData\Roaming\726.bat" "c:\users\ME\AppData\Roaming\7473.bat" "c:\users\ME\AppData\Roaming\7644.bat" "c:\users\ME\AppData\Roaming\7650.bat" "c:\users\ME\AppData\Roaming\766.bat" "c:\users\ME\AppData\Roaming\7743.bat" "c:\users\ME\AppData\Roaming\7762.bat" "c:\users\ME\AppData\Roaming\7807.bat" "c:\users\ME\AppData\Roaming\7865.bat" "c:\users\ME\AppData\Roaming\7885.bat" "c:\users\ME\AppData\Roaming\7997.bat" "c:\users\ME\AppData\Roaming\8408.bat" "c:\users\ME\AppData\Roaming\8427.bat" "c:\users\ME\AppData\Roaming\8445.bat" "c:\users\ME\AppData\Roaming\8488.bat" "c:\users\ME\AppData\Roaming\8545.bat" "c:\users\ME\AppData\Roaming\855.bat" "c:\users\ME\AppData\Roaming\8600.bat" "c:\users\ME\AppData\Roaming\8610.bat" "c:\users\ME\AppData\Roaming\8829.bat" "c:\users\ME\AppData\Roaming\8856.bat" "c:\users\ME\AppData\Roaming\894.bat" "c:\users\ME\AppData\Roaming\8984.bat" "c:\users\ME\AppData\Roaming\9090.bat" "c:\users\ME\AppData\Roaming\9312.bat" "c:\users\ME\AppData\Roaming\9348.bat" "c:\users\ME\AppData\Roaming\9491.bat" "c:\users\ME\AppData\Roaming\9498.bat" "c:\users\ME\AppData\Roaming\960.bat" "c:\users\ME\AppData\Roaming\9683.bat" "c:\users\ME\AppData\Roaming\9715.bat" "c:\users\ME\AppData\Roaming\9864.bat" "c:\users\ME\AppData\Roaming\9882.bat" "c:\users\ME\AppData\Roaming\9982.bat" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\ME\AppData\Roaming\1007.bat c:\users\ME\AppData\Roaming\1080.bat c:\users\ME\AppData\Roaming\1135.bat c:\users\ME\AppData\Roaming\1157.bat c:\users\ME\AppData\Roaming\1208.bat c:\users\ME\AppData\Roaming\1372.bat c:\users\ME\AppData\Roaming\162.bat c:\users\ME\AppData\Roaming\1881.bat c:\users\ME\AppData\Roaming\2128.bat c:\users\ME\AppData\Roaming\2156.bat c:\users\ME\AppData\Roaming\2305.bat c:\users\ME\AppData\Roaming\2393.bat c:\users\ME\AppData\Roaming\2419.bat c:\users\ME\AppData\Roaming\2438.bat c:\users\ME\AppData\Roaming\2451.bat c:\users\ME\AppData\Roaming\2498.bat c:\users\ME\AppData\Roaming\2639.bat c:\users\ME\AppData\Roaming\2689.bat c:\users\ME\AppData\Roaming\269.bat c:\users\ME\AppData\Roaming\2694.bat c:\users\ME\AppData\Roaming\2746.bat c:\users\ME\AppData\Roaming\305.bat c:\users\ME\AppData\Roaming\3053.bat c:\users\ME\AppData\Roaming\3151.bat c:\users\ME\AppData\Roaming\3249.bat c:\users\ME\AppData\Roaming\3269.bat c:\users\ME\AppData\Roaming\3288.bat c:\users\ME\AppData\Roaming\3329.bat c:\users\ME\AppData\Roaming\3348.bat c:\users\ME\AppData\Roaming\3466.bat c:\users\ME\AppData\Roaming\3519.bat c:\users\ME\AppData\Roaming\3720.bat c:\users\ME\AppData\Roaming\3761.bat c:\users\ME\AppData\Roaming\3826.bat c:\users\ME\AppData\Roaming\3837.bat c:\users\ME\AppData\Roaming\3848.bat c:\users\ME\AppData\Roaming\3959.bat c:\users\ME\AppData\Roaming\4277.bat c:\users\ME\AppData\Roaming\4514.bat c:\users\ME\AppData\Roaming\4606.bat c:\users\ME\AppData\Roaming\4658.bat c:\users\ME\AppData\Roaming\4708.bat c:\users\ME\AppData\Roaming\4769.bat c:\users\ME\AppData\Roaming\4794.bat c:\users\ME\AppData\Roaming\4925.bat c:\users\ME\AppData\Roaming\4989.bat c:\users\ME\AppData\Roaming\5158.bat c:\users\ME\AppData\Roaming\5266.bat c:\users\ME\AppData\Roaming\5446.bat c:\users\ME\AppData\Roaming\5476.bat c:\users\ME\AppData\Roaming\5484.bat c:\users\ME\AppData\Roaming\5559.bat c:\users\ME\AppData\Roaming\5583.bat c:\users\ME\AppData\Roaming\5704.bat c:\users\ME\AppData\Roaming\5991.bat c:\users\ME\AppData\Roaming\6040.bat c:\users\ME\AppData\Roaming\6062.bat c:\users\ME\AppData\Roaming\6066.bat c:\users\ME\AppData\Roaming\6238.bat c:\users\ME\AppData\Roaming\6372.bat c:\users\ME\AppData\Roaming\6376.bat c:\users\ME\AppData\Roaming\6415.bat c:\users\ME\AppData\Roaming\6416.bat c:\users\ME\AppData\Roaming\6435.bat c:\users\ME\AppData\Roaming\6513.bat c:\users\ME\AppData\Roaming\6526.bat c:\users\ME\AppData\Roaming\6553.bat c:\users\ME\AppData\Roaming\6559.bat c:\users\ME\AppData\Roaming\6563.bat c:\users\ME\AppData\Roaming\6642.bat c:\users\ME\AppData\Roaming\67.bat c:\users\ME\AppData\Roaming\6775.bat c:\users\ME\AppData\Roaming\6887.bat c:\users\ME\AppData\Roaming\689.bat c:\users\ME\AppData\Roaming\6953.bat c:\users\ME\AppData\Roaming\6987.bat c:\users\ME\AppData\Roaming\7201.bat c:\users\ME\AppData\Roaming\726.bat c:\users\ME\AppData\Roaming\7473.bat c:\users\ME\AppData\Roaming\7644.bat c:\users\ME\AppData\Roaming\7650.bat c:\users\ME\AppData\Roaming\766.bat c:\users\ME\AppData\Roaming\7743.bat c:\users\ME\AppData\Roaming\7762.bat c:\users\ME\AppData\Roaming\7807.bat c:\users\ME\AppData\Roaming\7865.bat c:\users\ME\AppData\Roaming\7885.bat c:\users\ME\AppData\Roaming\7997.bat c:\users\ME\AppData\Roaming\8408.bat c:\users\ME\AppData\Roaming\8427.bat c:\users\ME\AppData\Roaming\8445.bat c:\users\ME\AppData\Roaming\8488.bat c:\users\ME\AppData\Roaming\8545.bat c:\users\ME\AppData\Roaming\855.bat c:\users\ME\AppData\Roaming\8600.bat c:\users\ME\AppData\Roaming\8610.bat c:\users\ME\AppData\Roaming\8829.bat c:\users\ME\AppData\Roaming\8856.bat c:\users\ME\AppData\Roaming\894.bat c:\users\ME\AppData\Roaming\8984.bat c:\users\ME\AppData\Roaming\9090.bat c:\users\ME\AppData\Roaming\9312.bat c:\users\ME\AppData\Roaming\9348.bat c:\users\ME\AppData\Roaming\9491.bat c:\users\ME\AppData\Roaming\9498.bat c:\users\ME\AppData\Roaming\960.bat c:\users\ME\AppData\Roaming\9683.bat c:\users\ME\AppData\Roaming\9715.bat c:\users\ME\AppData\Roaming\9864.bat c:\users\ME\AppData\Roaming\9882.bat c:\users\ME\AppData\Roaming\9982.bat . ((((((((((((((((((((((((( Files Created from 2011-01-10 to 2011-02-10 ))))))))))))))))))))))))))))))) . 2011-02-10 09:03 . 2011-02-10 09:03 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-02-10 03:53 . 2011-02-10 09:06 ——– d—–w- c:\users\ME\AppData\Local\temp 2011-02-09 22:56 . 2011-01-13 10:20 7844688 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89EAF299-DA12-48F9-A42F-7D8282006758}\mpengine.dll 2011-02-08 04:01 . 2011-02-08 04:01 ——– d—–w- c:\users\ME\AppData\Roaming\QuickScan 2011-02-07 17:17 . 2011-02-09 08:12 ——– d—–w- c:\windows\RestoreSafeDeleted 2011-02-07 17:11 . 2011-02-10 09:04 24416 —-a-w- c:\windows\SysWow64\drivers\regguard.sys 2011-02-07 17:11 . 2011-02-07 17:11 37600 —-a-w- c:\windows\SysWow64\Partizan.exe 2011-02-07 17:11 . 2011-02-07 17:11 35816 —-a-w- c:\windows\SysWow64\drivers\Partizan.sys 2011-02-07 17:05 . 2011-02-07 17:05 2 –shatr- c:\windows\winstart.bat 2011-02-07 17:05 . 2011-02-07 17:05 37600 —-a-w- c:\windows\system32\Partizan.exe 2011-02-07 17:05 . 2011-01-18 00:33 1385240 —-a-w- c:\windows\RunGuard.exe 2011-02-07 17:05 . 2011-01-18 00:33 20248 —-a-w- c:\windows\WinBait.org 2011-02-07 17:05 . 2011-01-18 00:33 20248 —-a-w- c:\windows\WinBait.exe 2011-02-07 17:05 . 2011-02-07 17:05 ——– d—–w- c:\program files (x86)\Greatis 2011-02-06 22:48 . 2011-02-06 22:48 125 —-a-w- c:\users\ME\AppData\Roaming\6133.bat 2011-02-06 22:41 . 2011-02-06 22:41 129 —-a-w- c:\users\ME\AppData\Roaming\870.bat 2011-02-06 22:41 . 2011-02-06 22:41 125 —-a-w- c:\users\ME\AppData\Roaming\9201.bat 2011-02-06 22:28 . 2011-02-06 22:28 121 —-a-w- c:\users\ME\AppData\Roaming\9647.bat 2011-02-06 22:28 . 2011-02-06 22:28 129 —-a-w- c:\users\ME\AppData\Roaming\6990.bat 2011-02-06 22:07 . 2011-02-06 22:07 119 —-a-w- c:\users\ME\AppData\Roaming\6305.bat 2011-02-06 22:07 . 2011-02-06 22:07 119 —-a-w- c:\users\ME\AppData\Roaming\3684.bat 2011-02-06 21:57 . 2011-02-06 21:57 129 —-a-w- c:\users\ME\AppData\Roaming\4080.bat 2011-02-06 21:57 . 2011-02-06 21:57 125 —-a-w- c:\users\ME\AppData\Roaming\1744.bat 2011-02-06 21:43 . 2011-02-06 21:43 119 —-a-w- c:\users\ME\AppData\Roaming\5686.bat 2011-02-06 21:43 . 2011-02-06 21:43 129 —-a-w- c:\users\ME\AppData\Roaming\1550.bat 2011-02-06 21:33 . 2011-02-06 21:33 129 —-a-w- c:\users\ME\AppData\Roaming\3874.bat 2011-02-06 21:33 . 2011-02-06 21:33 123 —-a-w- c:\users\ME\AppData\Roaming\6710.bat 2011-02-06 21:27 . 2011-02-06 21:27 129 —-a-w- c:\users\ME\AppData\Roaming\5540.bat 2011-02-06 21:27 . 2011-02-06 21:27 123 —-a-w- c:\users\ME\AppData\Roaming\5595.bat 2011-02-06 21:13 . 2011-02-06 21:13 119 —-a-w- c:\users\ME\AppData\Roaming\395.bat 2011-02-06 21:13 . 2011-02-06 21:13 119 —-a-w- c:\users\ME\AppData\Roaming\1713.bat 2011-02-06 20:51 . 2011-02-06 20:51 129 —-a-w- c:\users\ME\AppData\Roaming\6472.bat 2011-02-06 20:51 . 2011-02-06 20:51 119 —-a-w- c:\users\ME\AppData\Roaming\4263.bat 2011-02-06 20:30 . 2011-02-06 20:30 125 —-a-w- c:\users\ME\AppData\Roaming\1235.bat 2011-02-06 20:30 . 2011-02-06 20:30 121 —-a-w- c:\users\ME\AppData\Roaming\2892.bat 2011-02-06 20:02 . 2011-02-06 20:02 125 —-a-w- c:\users\ME\AppData\Roaming\272.bat 2011-02-06 20:02 . 2011-02-06 20:02 121 —-a-w- c:\users\ME\AppData\Roaming\3823.bat 2011-02-06 19:30 . 2011-02-06 19:30 121 —-a-w- c:\users\ME\AppData\Roaming\3502.bat 2011-02-06 19:30 . 2011-02-06 19:30 129 —-a-w- c:\users\ME\AppData\Roaming\1385.bat 2011-02-06 19:08 . 2011-02-06 19:08 119 —-a-w- c:\users\ME\AppData\Roaming\2306.bat 2011-02-06 19:08 . 2011-02-06 19:08 125 —-a-w- c:\users\ME\AppData\Roaming\3263.bat 2011-02-06 19:02 . 2011-02-06 19:02 127 —-a-w- c:\users\ME\AppData\Roaming\9935.bat 2011-02-06 19:02 . 2011-02-06 19:02 123 —-a-w- c:\users\ME\AppData\Roaming\9766.bat 2011-02-06 18:40 . 2011-02-06 18:40 129 —-a-w- c:\users\ME\AppData\Roaming\6758.bat 2011-02-06 18:40 . 2011-02-06 18:40 127 —-a-w- c:\users\ME\AppData\Roaming\7064.bat 2011-02-06 18:10 . 2011-02-06 18:10 127 —-a-w- c:\users\ME\AppData\Roaming\998.bat 2011-02-06 18:10 . 2011-02-06 18:10 119 —-a-w- c:\users\ME\AppData\Roaming\5578.bat 2011-02-06 18:02 . 2011-02-06 18:02 119 —-a-w- c:\users\ME\AppData\Roaming\8300.bat 2011-02-06 18:02 . 2011-02-06 18:02 129 —-a-w- c:\users\ME\AppData\Roaming\607.bat 2011-02-06 17:44 . 2011-02-06 17:44 121 —-a-w- c:\users\ME\AppData\Roaming\2699.bat 2011-02-06 17:44 . 2011-02-06 17:44 129 —-a-w- c:\users\ME\AppData\Roaming\7417.bat 2011-02-06 17:12 . 2011-02-06 17:12 127 —-a-w- c:\users\ME\AppData\Roaming\9444.bat 2011-02-06 17:07 . 2011-02-06 17:07 125 —-a-w- c:\users\ME\AppData\Roaming\2551.bat 2011-02-06 17:07 . 2011-02-06 17:07 129 —-a-w- c:\users\ME\AppData\Roaming\917.bat 2011-02-06 16:39 . 2011-02-06 16:39 127 —-a-w- c:\users\ME\AppData\Roaming\831.bat 2011-02-06 16:39 . 2011-02-06 16:39 129 —-a-w- c:\users\ME\AppData\Roaming\2935.bat 2011-02-06 16:12 . 2011-02-06 16:12 123 —-a-w- c:\users\ME\AppData\Roaming\5765.bat 2011-02-06 16:12 . 2011-02-06 16:12 123 —-a-w- c:\users\ME\AppData\Roaming\6410.bat 2011-02-06 15:54 . 2011-02-07 13:24 123 —-a-w- c:\users\ME\AppData\Roaming\4766.bat 2011-02-06 15:54 . 2011-02-06 15:54 121 —-a-w- c:\users\ME\AppData\Roaming\7078.bat 2011-02-06 15:48 . 2011-02-06 17:12 125 —-a-w- c:\users\ME\AppData\Roaming\2773.bat 2011-02-06 15:48 . 2011-02-06 15:48 123 —-a-w- c:\users\ME\AppData\Roaming\5905.bat 2011-02-06 15:26 . 2011-02-06 15:26 129 —-a-w- c:\users\ME\AppData\Roaming\1167.bat 2011-02-06 15:26 . 2011-02-06 15:26 129 —-a-w- c:\users\ME\AppData\Roaming\1688.bat 2011-02-06 14:59 . 2011-02-06 14:59 127 —-a-w- c:\users\ME\AppData\Roaming\3716.bat 2011-02-06 14:27 . 2011-02-06 14:27 121 —-a-w- c:\users\ME\AppData\Roaming\4486.bat 2011-02-06 14:27 . 2011-02-06 14:27 125 —-a-w- c:\users\ME\AppData\Roaming\5997.bat 2011-02-06 14:20 . 2011-02-06 14:20 121 —-a-w- c:\users\ME\AppData\Roaming\2958.bat 2011-02-06 14:20 . 2011-02-06 14:20 123 —-a-w- c:\users\ME\AppData\Roaming\8246.bat 2011-02-06 13:57 . 2011-02-06 13:57 123 —-a-w- c:\users\ME\AppData\Roaming\9525.bat 2011-02-06 13:57 . 2011-02-06 13:57 125 —-a-w- c:\users\ME\AppData\Roaming\6088.bat 2011-02-06 13:40 . 2011-02-06 13:40 119 —-a-w- c:\users\ME\AppData\Roaming\4569.bat 2011-02-06 13:40 . 2011-02-06 13:40 119 —-a-w- c:\users\ME\AppData\Roaming\3284.bat 2011-02-06 13:13 . 2011-02-06 13:13 119 —-a-w- c:\users\ME\AppData\Roaming\891.bat 2011-02-06 13:13 . 2011-02-06 13:13 125 —-a-w- c:\users\ME\AppData\Roaming\2132.bat 2011-02-06 13:01 . 2011-02-06 13:01 125 —-a-w- c:\users\ME\AppData\Roaming\2047.bat 2011-02-06 13:01 . 2011-02-06 13:01 127 —-a-w- c:\users\ME\AppData\Roaming\9861.bat 2011-02-06 12:56 . 2011-02-06 12:56 123 —-a-w- c:\users\ME\AppData\Roaming\2508.bat 2011-02-06 12:56 . 2011-02-06 12:56 119 —-a-w- c:\users\ME\AppData\Roaming\1290.bat 2011-02-06 12:40 . 2011-02-06 12:40 129 —-a-w- c:\users\ME\AppData\Roaming\6851.bat 2011-02-06 12:40 . 2011-02-06 12:40 125 —-a-w- c:\users\ME\AppData\Roaming\1205.bat 2011-02-06 12:15 . 2011-02-06 12:15 119 —-a-w- c:\users\ME\AppData\Roaming\5557.bat 2011-02-06 12:15 . 2011-02-06 12:15 121 —-a-w- c:\users\ME\AppData\Roaming\3530.bat 2011-02-06 12:06 . 2011-02-06 12:06 127 —-a-w- c:\users\ME\AppData\Roaming\8109.bat 2011-02-06 12:06 . 2011-02-06 12:06 127 —-a-w- c:\users\ME\AppData\Roaming\4713.bat 2011-02-06 11:39 . 2011-02-06 11:39 125 —-a-w- c:\users\ME\AppData\Roaming\4040.bat 2011-02-06 11:39 . 2011-02-07 15:12 127 —-a-w- c:\users\ME\AppData\Roaming\3383.bat 2011-02-06 11:30 . 2011-02-06 11:30 127 —-a-w- c:\users\ME\AppData\Roaming\6923.bat 2011-02-06 11:30 . 2011-02-06 11:30 119 —-a-w- c:\users\ME\AppData\Roaming\3447.bat 2011-02-06 11:14 . 2011-02-06 11:14 129 —-a-w- c:\users\ME\AppData\Roaming\7603.bat 2011-02-06 11:14 . 2011-02-06 11:14 121 —-a-w- c:\users\ME\AppData\Roaming\8986.bat 2011-02-06 10:45 . 2011-02-06 10:45 127 —-a-w- c:\users\ME\AppData\Roaming\974.bat 2011-02-06 10:45 . 2011-02-06 10:45 129 —-a-w- c:\users\ME\AppData\Roaming\1063.bat 2011-02-06 10:21 . 2011-02-06 10:21 125 —-a-w- c:\users\ME\AppData\Roaming\864.bat 2011-02-06 10:21 . 2011-02-06 10:21 119 —-a-w- c:\users\ME\AppData\Roaming\1604.bat 2011-02-06 10:12 . 2011-02-06 10:12 125 —-a-w- c:\users\ME\AppData\Roaming\38.bat 2011-02-06 10:12 . 2011-02-06 10:12 125 —-a-w- c:\users\ME\AppData\Roaming\1926.bat 2011-02-06 09:40 . 2011-02-06 09:40 123 —-a-w- c:\users\ME\AppData\Roaming\1729.bat 2011-02-06 09:40 . 2011-02-06 09:40 127 —-a-w- c:\users\ME\AppData\Roaming\7174.bat 2011-02-06 09:15 . 2011-02-06 09:15 123 —-a-w- c:\users\ME\AppData\Roaming\4619.bat 2011-02-06 09:15 . 2011-02-06 09:15 119 —-a-w- c:\users\ME\AppData\Roaming\7628.bat 2011-02-06 09:09 . 2011-02-06 09:09 129 —-a-w- c:\users\ME\AppData\Roaming\9210.bat 2011-02-06 09:09 . 2011-02-06 09:09 125 —-a-w- c:\users\ME\AppData\Roaming\2139.bat 2011-02-06 08:52 . 2011-02-06 08:52 127 —-a-w- c:\users\ME\AppData\Roaming\196.bat 2011-02-06 08:52 . 2011-02-06 08:52 123 —-a-w- c:\users\ME\AppData\Roaming\6212.bat 2011-02-06 08:41 . 2011-02-06 08:41 129 —-a-w- c:\users\ME\AppData\Roaming\9063.bat 2011-02-06 08:41 . 2011-02-06 08:41 127 —-a-w- c:\users\ME\AppData\Roaming\1748.bat 2011-02-06 08:15 . 2011-02-07 12:00 127 —-a-w- c:\users\ME\AppData\Roaming\8850.bat 2011-02-06 08:15 . 2011-02-06 08:15 125 —-a-w- c:\users\ME\AppData\Roaming\1973.bat 2011-02-06 08:04 . 2011-02-06 08:04 121 —-a-w- c:\users\ME\AppData\Roaming\6539.bat 2011-02-06 08:04 . 2011-02-06 08:04 123 —-a-w- c:\users\ME\AppData\Roaming\2590.bat 2011-02-06 07:56 . 2011-02-06 07:56 127 —-a-w- c:\users\ME\AppData\Roaming\686.bat 2011-02-06 07:56 . 2011-02-06 07:56 123 —-a-w- c:\users\ME\AppData\Roaming\4641.bat 2011-02-06 07:27 . 2011-02-06 07:27 123 —-a-w- c:\users\ME\AppData\Roaming\7469.bat 2011-02-06 07:27 . 2011-02-06 07:27 121 —-a-w- c:\users\ME\AppData\Roaming\5079.bat 2011-02-06 07:05 . 2011-02-06 07:05 129 —-a-w- c:\users\ME\AppData\Roaming\6222.bat 2011-02-06 07:05 . 2011-02-06 07:05 125 —-a-w- c:\users\ME\AppData\Roaming\3434.bat 2011-02-06 07:00 . 2011-02-06 07:00 127 —-a-w- c:\users\ME\AppData\Roaming\9073.bat 2011-02-06 07:00 . 2011-02-06 07:00 125 —-a-w- c:\users\ME\AppData\Roaming\3115.bat 2011-02-06 06:27 . 2011-02-06 06:27 121 —-a-w- c:\users\ME\AppData\Roaming\8273.bat 2011-02-06 06:27 . 2011-02-06 06:27 125 —-a-w- c:\users\ME\AppData\Roaming\8004.bat 2011-02-06 05:53 . 2011-02-06 05:53 127 —-a-w- c:\users\ME\AppData\Roaming\6149.bat 2011-02-06 05:53 . 2011-02-06 05:53 121 —-a-w- c:\users\ME\AppData\Roaming\5184.bat 2011-02-06 05:36 . 2011-02-06 05:36 121 —-a-w- c:\users\ME\AppData\Roaming\4924.bat 2011-02-06 05:36 . 2011-02-06 05:36 119 —-a-w- c:\users\ME\AppData\Roaming\2951.bat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-21 02:09 . 2010-03-07 06:33 38224 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2010-12-21 02:08 . 2010-03-06 10:44 24152 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-11-30 01:38 . 2010-11-30 01:38 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2010-11-30 01:38 . 2010-11-30 01:38 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts . ((((((((((((((((((((((((((((( SnapShot@2011-02-09_20.42.00 ))))))))))))))))))))))))))))))))))))))))) . + 2008-01-21 02:23 . 2011-02-10 09:06 56970 c:\windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2006-11-02 15:45 . 2011-02-10 09:06 76206 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-01-24 23:26 . 2011-02-10 09:06 10528 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2826380935-2021557567-2855600642-1000_UserData.bin - 2010-06-14 09:23 . 2011-02-09 11:40 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-06-14 09:23 . 2011-02-10 09:06 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-06-14 09:23 . 2011-02-10 09:06 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-06-14 09:23 . 2011-02-09 11:40 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-06-14 09:23 . 2011-02-10 09:06 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-06-14 09:23 . 2011-02-09 11:40 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-10-11 03:54 . 2011-02-09 20:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-10-11 03:54 . 2011-02-10 09:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-10-11 03:54 . 2011-02-09 20:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-10-11 03:54 . 2011-02-10 09:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-02-09 20:40 . 2011-02-09 20:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-02-10 09:04 . 2011-02-10 09:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-02-10 09:04 . 2011-02-10 09:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-02-09 20:40 . 2011-02-09 20:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2006-11-02 12:46 . 2011-02-09 08:20 595446 c:\windows\system32\perfh009.dat + 2006-11-02 12:46 . 2011-02-10 04:02 595446 c:\windows\system32\perfh009.dat - 2006-11-02 12:46 . 2011-02-09 08:20 101144 c:\windows\system32\perfc009.dat + 2006-11-02 12:46 . 2011-02-10 04:02 101144 c:\windows\system32\perfc009.dat - 2006-11-02 12:33 . 2011-01-12 11:19 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat + 2006-11-02 12:33 . 2011-02-10 03:54 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472] "ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2008-09-10 0] "Google Update"="c:\users\ME\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-04-18 136176] "ANT Agent"="c:\program files (x86)\Garmin\ANT Agent\ANT Agent.exe" [2011-01-18 12034920] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-17 61440] "LchDrvKey"="LchDrvKey.exe" [2007-03-29 36864] "LedKey"="CNYHKey.exe" [2008-04-24 339968] "Smart Copy"="c:\program files (x86)\IOI\Smart Copy\ButtonMonitor.exe" [2008-05-21 53248] "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "SunJavaUpdateSched"="c:\program files (x86)\Java\jre6\bin\jusched.exe" [2009-07-25 149280] "ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920] "Nikon Transfer Monitor"="c:\program files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe" [2008-12-16 479232] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-30 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-14 421160] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "RegRun WinBait"="c:\windows\winbait.exe" [2011-01-18 20248] "@RegRunOnSecure"="c:\progra~2\Greatis\REGRUN~1\OnSecure.exe" [2008-12-23 61664] c:\users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-25 21979992] STARTUP.del [2011-2-5 314] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-1-24 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{F552DDE6-2090-4bf4-B924-6141E87789A5}"= "c:\progra~2\Greatis\REGRUN~1\RRShell.dll" [2009-04-06 335943] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan\0 R0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [x] R2 BootlogService;BootlogService;c:\program files (x86)\Greatis\RegRunSuite\BootLogService.exe [2011-01-18 65304] R3 RegGuard;RegGuard;c:\windows\system32\Drivers\regguard.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712] S2 ETService;Empowering Technology Service;c:\program files\GATEWAY\Gateway Recovery Management\Service\ETService.exe [2008-06-11 24576] S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx64coinst,serviceStartProc [x] S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk60x64.sys [2008-08-05 392192] . Contents of the 'Scheduled Tasks' folder 2010-10-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2826380935-2021557567-2855600642-1000Core1cb6b49155bbf30.job - c:\users\ME\AppData\Local\Google\Update\GoogleUpdate.exe [2010-04-18 21:02] . ——— x86-64 ———– [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\ME\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-11 689488] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-04 2114376] "RtHDVCpl"="RAVCpl64.exe" [2008-05-20 6296064] "Skytel"="Skytel.exe" [2007-11-20 1826816] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=1208&m=dx4200-09 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: {{09E90109-A9AA-4980-BCEF-76F8D924E902} FF - ProfilePath - c:\users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\ FF - prefs.js: network.proxy.type - 2 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - Ext: vShare Plugin: vshare@toolbar - %profile%\extensions\vshare@toolbar FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: Move Media Player: [removed] - c:\users\ME\AppData\Roaming\Move Networks . . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . ———————— Other Running Processes ———————— . c:\windows\MHotKey.exe c:\program files (x86)\Greatis\RegRunSuite\watchdog.exe c:\windows\ChiFuncExt.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\windows\CNYHKey.exe c:\windows\ModLedKey.exe . ************************************************************************** . Completion time: 2011-02-10 01:13:57 - machine was rebooted ComboFix-quarantined-files.txt 2011-02-10 09:13 ComboFix2.txt 2011-02-10 04:05 ComboFix3.txt 2011-02-09 20:49 Pre-Run: 308,019,855,360 bytes free Post-Run: 307,893,256,192 bytes free - - End Of File - - F2134B1C1E268A5A0451A4D6A0D3077F
Post #10
Hi UC_Caifan,

The batch files may be appearing in the log because there was so many of them that they didn't all get logged all at once. Let's try a different tool and see if we can get them all.

Download OTL to your desktop.

Next, Right click on OTL.exe and chose Run as Administrator to run it
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:Files
c:\users\ME\AppData\Roaming\*.bat

:Commands
[purity]
[emptytemp]
[createrestorepoint]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
Please post the OTL fix log.

Next

Open OTL again if it's closed after the reboot.

  • Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • In the Extra Registry section change it to None
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window. OTL.Txt.

Please post back with
  • OTL fix log
  • OTL.txt
How's the computer?

Thanks
Post #11
hi oldman 960,

okay here are the latest logs:


All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
c:\users\ME\AppData\Roaming\1044.bat moved successfully.
c:\users\ME\AppData\Roaming\1063.bat moved successfully.
c:\users\ME\AppData\Roaming\1118.bat moved successfully.
c:\users\ME\AppData\Roaming\1167.bat moved successfully.
c:\users\ME\AppData\Roaming\1205.bat moved successfully.
c:\users\ME\AppData\Roaming\1235.bat moved successfully.
c:\users\ME\AppData\Roaming\1256.bat moved successfully.
c:\users\ME\AppData\Roaming\1290.bat moved successfully.
c:\users\ME\AppData\Roaming\1293.bat moved successfully.
c:\users\ME\AppData\Roaming\1385.bat moved successfully.
c:\users\ME\AppData\Roaming\1426.bat moved successfully.
c:\users\ME\AppData\Roaming\1456.bat moved successfully.
c:\users\ME\AppData\Roaming\1501.bat moved successfully.
c:\users\ME\AppData\Roaming\1550.bat moved successfully.
c:\users\ME\AppData\Roaming\1602.bat moved successfully.
c:\users\ME\AppData\Roaming\1604.bat moved successfully.
c:\users\ME\AppData\Roaming\1630.bat moved successfully.
c:\users\ME\AppData\Roaming\1670.bat moved successfully.
c:\users\ME\AppData\Roaming\1688.bat moved successfully.
c:\users\ME\AppData\Roaming\1709.bat moved successfully.
c:\users\ME\AppData\Roaming\1713.bat moved successfully.
c:\users\ME\AppData\Roaming\1729.bat moved successfully.
c:\users\ME\AppData\Roaming\1744.bat moved successfully.
c:\users\ME\AppData\Roaming\1748.bat moved successfully.
c:\users\ME\AppData\Roaming\1793.bat moved successfully.
c:\users\ME\AppData\Roaming\1847.bat moved successfully.
c:\users\ME\AppData\Roaming\1894.bat moved successfully.
c:\users\ME\AppData\Roaming\1899.bat moved successfully.
c:\users\ME\AppData\Roaming\1926.bat moved successfully.
c:\users\ME\AppData\Roaming\1933.bat moved successfully.
c:\users\ME\AppData\Roaming\1944.bat moved successfully.
c:\users\ME\AppData\Roaming\196.bat moved successfully.
c:\users\ME\AppData\Roaming\1973.bat moved successfully.
c:\users\ME\AppData\Roaming\2047.bat moved successfully.
c:\users\ME\AppData\Roaming\2081.bat moved successfully.
c:\users\ME\AppData\Roaming\2087.bat moved successfully.
c:\users\ME\AppData\Roaming\2103.bat moved successfully.
c:\users\ME\AppData\Roaming\2132.bat moved successfully.
c:\users\ME\AppData\Roaming\2139.bat moved successfully.
c:\users\ME\AppData\Roaming\2158.bat moved successfully.
c:\users\ME\AppData\Roaming\2191.bat moved successfully.
c:\users\ME\AppData\Roaming\2193.bat moved successfully.
c:\users\ME\AppData\Roaming\2266.bat moved successfully.
c:\users\ME\AppData\Roaming\2267.bat moved successfully.
c:\users\ME\AppData\Roaming\2269.bat moved successfully.
c:\users\ME\AppData\Roaming\2306.bat moved successfully.
c:\users\ME\AppData\Roaming\2338.bat moved successfully.
c:\users\ME\AppData\Roaming\2362.bat moved successfully.
c:\users\ME\AppData\Roaming\2450.bat moved successfully.
c:\users\ME\AppData\Roaming\2487.bat moved successfully.
c:\users\ME\AppData\Roaming\2508.bat moved successfully.
c:\users\ME\AppData\Roaming\2551.bat moved successfully.
c:\users\ME\AppData\Roaming\2590.bat moved successfully.
c:\users\ME\AppData\Roaming\2608.bat moved successfully.
c:\users\ME\AppData\Roaming\2619.bat moved successfully.
c:\users\ME\AppData\Roaming\2623.bat moved successfully.
c:\users\ME\AppData\Roaming\2699.bat moved successfully.
c:\users\ME\AppData\Roaming\272.bat moved successfully.
c:\users\ME\AppData\Roaming\2773.bat moved successfully.
c:\users\ME\AppData\Roaming\2892.bat moved successfully.
c:\users\ME\AppData\Roaming\2935.bat moved successfully.
c:\users\ME\AppData\Roaming\2951.bat moved successfully.
c:\users\ME\AppData\Roaming\2958.bat moved successfully.
c:\users\ME\AppData\Roaming\3090.bat moved successfully.
c:\users\ME\AppData\Roaming\3092.bat moved successfully.
c:\users\ME\AppData\Roaming\3115.bat moved successfully.
c:\users\ME\AppData\Roaming\3116.bat moved successfully.
c:\users\ME\AppData\Roaming\3263.bat moved successfully.
c:\users\ME\AppData\Roaming\3279.bat moved successfully.
c:\users\ME\AppData\Roaming\3284.bat moved successfully.
c:\users\ME\AppData\Roaming\3383.bat moved successfully.
c:\users\ME\AppData\Roaming\3434.bat moved successfully.
c:\users\ME\AppData\Roaming\3447.bat moved successfully.
c:\users\ME\AppData\Roaming\3501.bat moved successfully.
c:\users\ME\AppData\Roaming\3502.bat moved successfully.
c:\users\ME\AppData\Roaming\3530.bat moved successfully.
c:\users\ME\AppData\Roaming\3533.bat moved successfully.
c:\users\ME\AppData\Roaming\355.bat moved successfully.
c:\users\ME\AppData\Roaming\3621.bat moved successfully.
c:\users\ME\AppData\Roaming\3647.bat moved successfully.
c:\users\ME\AppData\Roaming\3658.bat moved successfully.
c:\users\ME\AppData\Roaming\3684.bat moved successfully.
c:\users\ME\AppData\Roaming\3687.bat moved successfully.
c:\users\ME\AppData\Roaming\3716.bat moved successfully.
c:\users\ME\AppData\Roaming\3788.bat moved successfully.
c:\users\ME\AppData\Roaming\38.bat moved successfully.
c:\users\ME\AppData\Roaming\3823.bat moved successfully.
c:\users\ME\AppData\Roaming\386.bat moved successfully.
c:\users\ME\AppData\Roaming\3874.bat moved successfully.
c:\users\ME\AppData\Roaming\3900.bat moved successfully.
c:\users\ME\AppData\Roaming\3907.bat moved successfully.
c:\users\ME\AppData\Roaming\395.bat moved successfully.
c:\users\ME\AppData\Roaming\3955.bat moved successfully.
c:\users\ME\AppData\Roaming\4011.bat moved successfully.
c:\users\ME\AppData\Roaming\4038.bat moved successfully.
c:\users\ME\AppData\Roaming\4040.bat moved successfully.
c:\users\ME\AppData\Roaming\408.bat moved successfully.
c:\users\ME\AppData\Roaming\4080.bat moved successfully.
c:\users\ME\AppData\Roaming\4152.bat moved successfully.
c:\users\ME\AppData\Roaming\4191.bat moved successfully.
c:\users\ME\AppData\Roaming\4199.bat moved successfully.
c:\users\ME\AppData\Roaming\4263.bat moved successfully.
c:\users\ME\AppData\Roaming\4288.bat moved successfully.
c:\users\ME\AppData\Roaming\4300.bat moved successfully.
c:\users\ME\AppData\Roaming\4326.bat moved successfully.
c:\users\ME\AppData\Roaming\4330.bat moved successfully.
c:\users\ME\AppData\Roaming\4412.bat moved successfully.
c:\users\ME\AppData\Roaming\4419.bat moved successfully.
c:\users\ME\AppData\Roaming\4486.bat moved successfully.
c:\users\ME\AppData\Roaming\4569.bat moved successfully.
c:\users\ME\AppData\Roaming\4600.bat moved successfully.
c:\users\ME\AppData\Roaming\4619.bat moved successfully.
c:\users\ME\AppData\Roaming\4641.bat moved successfully.
c:\users\ME\AppData\Roaming\468.bat moved successfully.
c:\users\ME\AppData\Roaming\4713.bat moved successfully.
c:\users\ME\AppData\Roaming\4766.bat moved successfully.
c:\users\ME\AppData\Roaming\4924.bat moved successfully.
c:\users\ME\AppData\Roaming\5001.bat moved successfully.
c:\users\ME\AppData\Roaming\5073.bat moved successfully.
c:\users\ME\AppData\Roaming\5079.bat moved successfully.
c:\users\ME\AppData\Roaming\5184.bat moved successfully.
c:\users\ME\AppData\Roaming\529.bat moved successfully.
c:\users\ME\AppData\Roaming\5302.bat moved successfully.
c:\users\ME\AppData\Roaming\5384.bat moved successfully.
c:\users\ME\AppData\Roaming\5534.bat moved successfully.
c:\users\ME\AppData\Roaming\5540.bat moved successfully.
c:\users\ME\AppData\Roaming\5557.bat moved successfully.
c:\users\ME\AppData\Roaming\5578.bat moved successfully.
c:\users\ME\AppData\Roaming\5595.bat moved successfully.
c:\users\ME\AppData\Roaming\5677.bat moved successfully.
c:\users\ME\AppData\Roaming\5686.bat moved successfully.
c:\users\ME\AppData\Roaming\5720.bat moved successfully.
c:\users\ME\AppData\Roaming\5765.bat moved successfully.
c:\users\ME\AppData\Roaming\5803.bat moved successfully.
c:\users\ME\AppData\Roaming\5805.bat moved successfully.
c:\users\ME\AppData\Roaming\5808.bat moved successfully.
c:\users\ME\AppData\Roaming\5871.bat moved successfully.
c:\users\ME\AppData\Roaming\5905.bat moved successfully.
c:\users\ME\AppData\Roaming\5939.bat moved successfully.
c:\users\ME\AppData\Roaming\5970.bat moved successfully.
c:\users\ME\AppData\Roaming\5997.bat moved successfully.
c:\users\ME\AppData\Roaming\607.bat moved successfully.
c:\users\ME\AppData\Roaming\6073.bat moved successfully.
c:\users\ME\AppData\Roaming\6087.bat moved successfully.
c:\users\ME\AppData\Roaming\6088.bat moved successfully.
c:\users\ME\AppData\Roaming\6106.bat moved successfully.
c:\users\ME\AppData\Roaming\6133.bat moved successfully.
c:\users\ME\AppData\Roaming\6147.bat moved successfully.
c:\users\ME\AppData\Roaming\6149.bat moved successfully.
c:\users\ME\AppData\Roaming\6180.bat moved successfully.
c:\users\ME\AppData\Roaming\6212.bat moved successfully.
c:\users\ME\AppData\Roaming\6222.bat moved successfully.
c:\users\ME\AppData\Roaming\6237.bat moved successfully.
c:\users\ME\AppData\Roaming\6241.bat moved successfully.
c:\users\ME\AppData\Roaming\6254.bat moved successfully.
c:\users\ME\AppData\Roaming\6262.bat moved successfully.
c:\users\ME\AppData\Roaming\6305.bat moved successfully.
c:\users\ME\AppData\Roaming\6355.bat moved successfully.
c:\users\ME\AppData\Roaming\6410.bat moved successfully.
c:\users\ME\AppData\Roaming\6419.bat moved successfully.
c:\users\ME\AppData\Roaming\6472.bat moved successfully.
c:\users\ME\AppData\Roaming\65.bat moved successfully.
c:\users\ME\AppData\Roaming\6525.bat moved successfully.
c:\users\ME\AppData\Roaming\6539.bat moved successfully.
c:\users\ME\AppData\Roaming\6710.bat moved successfully.
c:\users\ME\AppData\Roaming\6758.bat moved successfully.
c:\users\ME\AppData\Roaming\6851.bat moved successfully.
c:\users\ME\AppData\Roaming\686.bat moved successfully.
c:\users\ME\AppData\Roaming\6906.bat moved successfully.
c:\users\ME\AppData\Roaming\6923.bat moved successfully.
c:\users\ME\AppData\Roaming\6990.bat moved successfully.
c:\users\ME\AppData\Roaming\7008.bat moved successfully.
c:\users\ME\AppData\Roaming\7064.bat moved successfully.
c:\users\ME\AppData\Roaming\7078.bat moved successfully.
c:\users\ME\AppData\Roaming\7174.bat moved successfully.
c:\users\ME\AppData\Roaming\7207.bat moved successfully.
c:\users\ME\AppData\Roaming\7209.bat moved successfully.
c:\users\ME\AppData\Roaming\7225.bat moved successfully.
c:\users\ME\AppData\Roaming\7329.bat moved successfully.
c:\users\ME\AppData\Roaming\7409.bat moved successfully.
c:\users\ME\AppData\Roaming\7417.bat moved successfully.
c:\users\ME\AppData\Roaming\745.bat moved successfully.
c:\users\ME\AppData\Roaming\7469.bat moved successfully.
c:\users\ME\AppData\Roaming\7474.bat moved successfully.
c:\users\ME\AppData\Roaming\7480.bat moved successfully.
c:\users\ME\AppData\Roaming\7603.bat moved successfully.
c:\users\ME\AppData\Roaming\7628.bat moved successfully.
c:\users\ME\AppData\Roaming\765.bat moved successfully.
c:\users\ME\AppData\Roaming\7685.bat moved successfully.
c:\users\ME\AppData\Roaming\7711.bat moved successfully.
c:\users\ME\AppData\Roaming\7713.bat moved successfully.
c:\users\ME\AppData\Roaming\7796.bat moved successfully.
c:\users\ME\AppData\Roaming\7943.bat moved successfully.
c:\users\ME\AppData\Roaming\8004.bat moved successfully.
c:\users\ME\AppData\Roaming\8016.bat moved successfully.
c:\users\ME\AppData\Roaming\8094.bat moved successfully.
c:\users\ME\AppData\Roaming\8109.bat moved successfully.
c:\users\ME\AppData\Roaming\8145.bat moved successfully.
c:\users\ME\AppData\Roaming\8147.bat moved successfully.
c:\users\ME\AppData\Roaming\8201.bat moved successfully.
c:\users\ME\AppData\Roaming\8246.bat moved successfully.
c:\users\ME\AppData\Roaming\8273.bat moved successfully.
c:\users\ME\AppData\Roaming\8300.bat moved successfully.
c:\users\ME\AppData\Roaming\831.bat moved successfully.
c:\users\ME\AppData\Roaming\8313.bat moved successfully.
c:\users\ME\AppData\Roaming\8372.bat moved successfully.
c:\users\ME\AppData\Roaming\8535.bat moved successfully.
c:\users\ME\AppData\Roaming\861.bat moved successfully.
c:\users\ME\AppData\Roaming\864.bat moved successfully.
c:\users\ME\AppData\Roaming\8648.bat moved successfully.
c:\users\ME\AppData\Roaming\8685.bat moved successfully.
c:\users\ME\AppData\Roaming\870.bat moved successfully.
c:\users\ME\AppData\Roaming\876.bat moved successfully.
c:\users\ME\AppData\Roaming\8775.bat moved successfully.
c:\users\ME\AppData\Roaming\8850.bat moved successfully.
c:\users\ME\AppData\Roaming\891.bat moved successfully.
c:\users\ME\AppData\Roaming\8959.bat moved successfully.
c:\users\ME\AppData\Roaming\8986.bat moved successfully.
c:\users\ME\AppData\Roaming\9063.bat moved successfully.
c:\users\ME\AppData\Roaming\9073.bat moved successfully.
c:\users\ME\AppData\Roaming\9109.bat moved successfully.
c:\users\ME\AppData\Roaming\9111.bat moved successfully.
c:\users\ME\AppData\Roaming\9113.bat moved successfully.
c:\users\ME\AppData\Roaming\917.bat moved successfully.
c:\users\ME\AppData\Roaming\9201.bat moved successfully.
c:\users\ME\AppData\Roaming\9210.bat moved successfully.
c:\users\ME\AppData\Roaming\9211.bat moved successfully.
c:\users\ME\AppData\Roaming\9291.bat moved successfully.
c:\users\ME\AppData\Roaming\9405.bat moved successfully.
c:\users\ME\AppData\Roaming\9444.bat moved successfully.
c:\users\ME\AppData\Roaming\9514.bat moved successfully.
c:\users\ME\AppData\Roaming\9525.bat moved successfully.
c:\users\ME\AppData\Roaming\9559.bat moved successfully.
c:\users\ME\AppData\Roaming\957.bat moved successfully.
c:\users\ME\AppData\Roaming\9577.bat moved successfully.
c:\users\ME\AppData\Roaming\9647.bat moved successfully.
c:\users\ME\AppData\Roaming\974.bat moved successfully.
c:\users\ME\AppData\Roaming\9765.bat moved successfully.
c:\users\ME\AppData\Roaming\9766.bat moved successfully.
c:\users\ME\AppData\Roaming\9801.bat moved successfully.
c:\users\ME\AppData\Roaming\9861.bat moved successfully.
c:\users\ME\AppData\Roaming\9888.bat moved successfully.
c:\users\ME\AppData\Roaming\9904.bat moved successfully.
c:\users\ME\AppData\Roaming\9935.bat moved successfully.
c:\users\ME\AppData\Roaming\9960.bat moved successfully.
c:\users\ME\AppData\Roaming\998.bat moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: ME
->Temp folder emptied: 1613836 bytes
->Temporary Internet Files folder emptied: 21089737 bytes
->Java cache emptied: 60413702 bytes
->FireFox cache emptied: 54029742 bytes
->Google Chrome cache emptied: 458333045 bytes
->Flash cache emptied: 158658 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4926854 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 573.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.20.6 log created on 02102011_132807

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…







OTL logfile created on: 2/10/2011 1:37:53 PM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\ME\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 62.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 586.40 Gb Total Space | 285.65 Gb Free Space | 48.71% Space Free | Partition Type: NTFS
Drive I: | 7.46 Gb Total Space | 2.01 Gb Free Space | 26.99% Space Free | Partition Type: FAT32

Computer Name: JOSEDESKTOP | User Name: ME | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\ME\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.)
PRC - C:\Program Files (x86)\Greatis\RegRunSuite\WatchDog.exe (Greatis Software)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
PRC - C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
PRC - C:\Windows\mHotkey.exe ()
PRC - C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe (IOI)
PRC - C:\Windows\CNYHKey.exe (Creative)
PRC - C:\Windows\ChiFuncExt.exe (Chicony)
PRC - C:\Windows\ModLEDKey.exe (Chicony)
PRC - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\ME\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\sfc_os.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\sfc.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msiltcfg.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (Ati External Event Utility) – C:\Windows\SysNative\Ati2evxx.exe (ATI Technologies Inc.)
SRV:64bit: - (ETService) – C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AgereModemAudio) – C:\Windows\SysNative\agr64svc.exe (Agere Systems)
SRV:64bit: - (yksvc) – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
SRV - (BootlogService) – C:\Program Files (x86)\Greatis\RegRunSuite\BootLogService.exe (Greatis Software ©)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (GameConsoleService) – C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe (WildTangent, Inc.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\Drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\DRIVERS\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (RTHDMIAzAudService) – C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (yukonx64) – C:\Windows\SysNative\DRIVERS\yk60x64.sys (Marvell)
DRV:64bit: - (RTSTOR) – C:\Windows\SysNative\drivers\RTSTOR64.SYS (Realtek Semiconductor Corp.)
DRV:64bit: - (AtiPcie) ATI PCI Express (3GIO) – C:\Windows\SysNative\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV:64bit: - (AgereSoftModem) – C:\Windows\SysNative\DRIVERS\agrsm64.sys (Agere Systems)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV - (RegGuard) – C:\Windows\SysWOW64\drivers\regguard.sys (Greatis Software)
DRV - (Partizan) – C:\Windows\system32\drivers\Partizan.sys (Greatis Software)
DRV - (int15) – C:\Windows\SysWOW64\drivers\int15_64.sys (Acer, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACG…amp;m=dx4200-09
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACG…amp;m=dx4200-09

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.2
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.%(version)s
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: {EC8586B6-FD1A-40BE-B6F3-1BBE89389810}:1.9.1
FF - prefs.js..extensions.enabledItems: {9C14CB18-1C29-4321-9F2E-E2841195CB52}:1.9.1
FF - prefs.js..network.proxy.autoconfig_url: "http://localhost:9000/proxy.pac"
FF - prefs.js..network.proxy.type: 2

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/01/20 00:09:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/01/27 22:49:04 | 000,000,000 | —D | M]

[2009/01/24 18:34:12 | 000,000,000 | —D | M] (No name found) – C:\Users\ME\AppData\Roaming\Mozilla\Extensions
[2011/02/09 08:42:27 | 000,000,000 | —D | M] (No name found) – C:\Users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\extensions
[2010/07/12 11:54:27 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/10 19:38:25 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/09/29 11:28:44 | 000,000,000 | —D | M] (vShare Plugin) – C:\Users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\extensions\vshare@toolbar
[2011/01/05 12:42:51 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) – C:\USERS\ME\APPDATA\LOCAL\{9C14CB18-1C29-4321-9F2E-E2841195CB52}
[2010/11/18 11:56:01 | 000,000,000 | —D | M] (No name found) – C:\USERS\ME\APPDATA\LOCAL\{EC8586B6-FD1A-40BE-B6F3-1BBE89389810}
[2010/01/06 16:01:25 | 000,000,000 | —D | M] (Move Media Player) – C:\USERS\ME\APPDATA\ROAMING\MOVE NETWORKS

O1 HOSTS File: ([2006/09/18 13:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files (x86)\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files (x86)\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files (x86)\Google\GoogleToolbar1.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [@RegRunOnSecure] C:\Program Files (x86)\Greatis\RegRunSuite\OnSecure.exe (Greatis Software)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LchDrvKey] C:\Windows\LchDrvKey.exe ()
O4 - HKLM..\Run: [LedKey] C:\Windows\CNYHKey.exe (Creative)
O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RegRun WinBait] C:\Windows\WinBait.exe ()
O4 - HKLM..\Run: [Smart Copy] C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe (IOI)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [ANT Agent] C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.)
O4 - HKCU..\Run: [ISUSPM Startup] C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe ()
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O4 - Startup: C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STARTUP.del ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\ME\Desktop\wed_beach.jpg
O24 - Desktop BackupWallPaper: C:\Users\ME\Desktop\wed_beach.jpg
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {F552DDE6-2090-4bf4-B924-6141E87789A5} - C:\Program Files (x86)\Greatis\RegRunSuite\RRShell.dll (Greatis Software, LLC)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (Partizan) - C:\Windows\SysWow64\Partizan.exe (Greatis Software)
O34 - HKLM BootExecute: (ootExecute settings…) - File not found
O34 - HKLM BootExecute: (on\E) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..comfile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…com [@ = ComFile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/02/10 13:28:07 | 000,000,000 | —D | C] – C:\_OTL
[2011/02/10 13:23:45 | 000,602,624 | —- | C] (OldTimer Tools) – C:\Users\ME\Desktop\OTL.exe
[2011/02/10 01:13:59 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/02/10 01:06:07 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/02/10 00:46:46 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2011/02/09 19:53:44 | 000,000,000 | —D | C] – C:\Users\ME\AppData\Local\temp
[2011/02/09 14:59:37 | 000,456,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\shlwapi.dll
[2011/02/09 14:59:28 | 000,710,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2011/02/09 14:59:28 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2011/02/09 14:59:27 | 001,538,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2011/02/09 14:59:27 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2011/02/09 14:59:27 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2011/02/09 14:59:27 | 000,479,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2011/02/09 14:59:27 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2011/02/09 14:59:27 | 000,252,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2011/02/09 14:59:27 | 000,219,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2011/02/09 14:59:27 | 000,206,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2011/02/09 14:59:27 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2011/02/09 14:59:27 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2011/02/09 14:59:27 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2011/02/09 14:59:27 | 000,162,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2011/02/09 14:59:27 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2011/02/09 14:59:27 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2011/02/09 14:59:27 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2011/02/09 14:59:27 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2011/02/09 14:59:27 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2011/02/09 14:59:27 | 000,072,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2011/02/09 14:59:27 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2011/02/09 14:59:27 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2011/02/09 14:59:27 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2011/02/09 14:59:27 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2011/02/09 14:59:27 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2011/02/09 14:59:27 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2011/02/09 14:59:27 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2011/02/09 14:59:27 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2011/02/09 14:59:23 | 004,699,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2011/02/09 14:59:22 | 001,585,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntdll.dll
[2011/02/09 14:59:20 | 000,367,104 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2011/02/09 14:59:20 | 000,292,352 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2011/02/09 14:59:20 | 000,048,128 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2011/02/09 14:59:19 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2011/02/09 12:18:32 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/02/09 12:18:32 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/02/09 12:18:32 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/02/09 12:18:25 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/02/09 12:17:45 | 000,000,000 | —D | C] – C:\Qoobox
[2011/02/07 23:26:14 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\ME\Desktop\HiJackThis.exe
[2011/02/07 21:02:24 | 037,403,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MRT.exe
[2011/02/07 20:01:29 | 000,000,000 | —D | C] – C:\Users\ME\AppData\Roaming\QuickScan
[2011/02/07 09:17:25 | 000,000,000 | —D | C] – C:\Windows\RestoreSafeDeleted
[2011/02/07 09:11:21 | 000,037,600 | —- | C] (Greatis Software) – C:\Windows\SysWow64\Partizan.exe
[2011/02/07 09:11:21 | 000,035,816 | —- | C] (Greatis Software) – C:\Windows\SysWow64\drivers\Partizan.sys
[2011/02/07 09:11:21 | 000,024,416 | —- | C] (Greatis Software) – C:\Windows\SysWow64\drivers\regguard.sys
[2011/02/07 09:05:34 | 000,037,600 | —- | C] (Greatis Software) – C:\Windows\SysNative\Partizan.exe
[2011/02/07 09:05:32 | 000,000,000 | -H-D | C] – C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Disabled Startup Items
[2011/02/07 09:05:32 | 000,000,000 | -H-D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Disabled Startup Items
[2011/02/07 09:05:31 | 000,000,000 | —D | C] – C:\Users\ME\Documents\RegRun2
[2011/02/07 09:05:06 | 001,385,240 | —- | C] (Greatis Software) – C:\Windows\RunGuard.exe
[2011/02/07 09:05:06 | 000,000,000 | —D | C] – C:\Users\Public\Documents\regruninfo
[2011/02/07 09:05:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegRun Security Suite
[2011/02/07 09:05:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Greatis
[2011/02/04 21:42:43 | 000,000,000 | —D | C] – C:\Users\ME\AppData\Roaming\GARMIN
[2011/02/04 21:42:43 | 000,000,000 | —D | C] – C:\ProgramData\GARMIN
[2011/02/04 21:36:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
[2011/02/04 21:35:26 | 000,000,000 | —D | C] – C:\Program Files\DIFX
[2011/02/04 21:34:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\Garmin
[2011/01/28 15:49:49 | 000,000,000 | —D | C] – C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StarCraft II
[2011/01/20 00:12:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/01/20 00:12:21 | 000,126,312 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\GEARAspi64.dll
[2011/01/20 00:12:21 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\SysWow64\GEARAspi.dll
[2011/01/20 00:12:21 | 000,034,152 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2011/01/20 00:11:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\iPod
[2011/01/20 00:11:29 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/01/20 00:11:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2011/01/20 00:11:29 | 000,000,000 | —D | C] – C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2011/01/20 00:09:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/01/20 00:09:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2011/01/20 00:04:37 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/01/20 00:04:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bonjour
[2011/01/11 19:16:30 | 000,466,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\odbc32.dll
[2011/01/11 19:16:30 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbc32.dll
[2011/01/11 19:16:19 | 001,251,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sdclt.exe

========== Files - Modified Within 30 Days ==========

[2011/02/10 13:39:38 | 000,690,960 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/02/10 13:39:38 | 000,595,446 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/02/10 13:39:38 | 000,101,144 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/02/10 13:33:35 | 000,024,416 | —- | M] (Greatis Software) – C:\Windows\SysWow64\drivers\regguard.sys
[2011/02/10 13:33:31 | 000,000,000 | —- | M] () – C:\Windows\SysNative\LogConfigTemp.xml
[2011/02/10 13:33:25 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/10 13:33:24 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/10 13:33:15 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/02/10 13:32:30 | 4025,671,680 | -HS- | M] () – C:\hiberfil.sys
[2011/02/10 13:23:37 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Users\ME\Desktop\OTL.exe
[2011/02/10 03:23:16 | 004,871,752 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2011/02/09 12:16:22 | 004,266,117 | R— | M] () – C:\Users\ME\Desktop\jgh.exe
[2011/02/09 12:13:45 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\craeKUtJYM.js
[2011/02/09 11:58:45 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\OcqzH4UKqF.js
[2011/02/09 11:38:45 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\mMrJuGMY4.js
[2011/02/09 11:08:45 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CppmF.js
[2011/02/09 10:53:45 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CXuuRcs.js
[2011/02/09 10:28:45 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\A3rsnq6.js
[2011/02/09 10:03:45 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\jGKhLdC.js
[2011/02/09 09:44:42 | 000,000,119 | —- | M] () – C:\Users\ME\webct_upload_applet.properties
[2011/02/09 09:41:45 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\H1vOQ8rCJ.js
[2011/02/09 09:11:45 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\cpgZmQg.js
[2011/02/09 08:47:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\X4ldrrnO.js
[2011/02/09 08:29:45 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\wJmb346Ko.js
[2011/02/09 08:10:45 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\RJDUFeNwp3.js
[2011/02/09 07:46:45 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\leT6CPuOtN.js
[2011/02/09 07:32:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\LRH847Bb.js
[2011/02/09 07:07:45 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\YTVoj.js
[2011/02/09 06:44:45 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\xLNzQ1gc.js
[2011/02/09 06:11:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Cb588VTFVA.js
[2011/02/09 05:56:46 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\d6ogIJPn.js
[2011/02/09 05:33:46 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\wNo5Y9ldRY.js
[2011/02/09 05:04:46 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\pVCbK6rg.js
[2011/02/09 04:31:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\yXtV3OJGD.js
[2011/02/09 03:44:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\y7PNPj3uQ.js
[2011/02/09 03:14:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\q5XkUwoy9.js
[2011/02/09 02:44:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\NJrqOY0wwe.js
[2011/02/09 02:24:46 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\dXAuXsKjN.js
[2011/02/09 01:52:46 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\uYaIu.js
[2011/02/09 01:09:46 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\M4eXMoJc.js
[2011/02/09 00:39:49 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\XUdiJyWMeu.js
[2011/02/09 00:21:23 | 000,624,128 | —- | M] () – C:\Users\ME\Desktop\dds.scr
[2011/02/09 00:19:22 | 000,080,384 | —- | M] () – C:\Users\ME\Desktop\MBRCheck.exe
[2011/02/08 23:27:07 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LQYqy2w5X.js
[2011/02/08 22:54:06 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\jB8fgdtR.js
[2011/02/08 22:29:07 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\fHwLcbBy.js
[2011/02/08 22:07:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\hE0I2uB.js
[2011/02/08 22:02:07 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\P9fxpG.js
[2011/02/08 21:57:07 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\TFjKw1YN.js
[2011/02/08 21:48:07 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\XTLMHHZb.js
[2011/02/08 21:15:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\eaIfy6ehPM.js
[2011/02/08 20:49:07 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\E98Q8Md.js
[2011/02/08 20:17:07 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\e9ubU3.js
[2011/02/08 20:09:07 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Pwyqn7QRXE.js
[2011/02/08 19:52:07 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\bw0ix.js
[2011/02/08 19:26:07 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\SV3aRUF.js
[2011/02/08 19:15:07 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\j0DyJ.js
[2011/02/08 18:47:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\w0Lw0.js
[2011/02/08 18:31:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\acqUdr5Zcv.js
[2011/02/08 18:16:07 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\OUv4hK6EN.js
[2011/02/08 17:43:07 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\w8r2iCR7Y.js
[2011/02/08 17:21:07 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\uFvuQoAWo.js
[2011/02/08 17:04:07 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\z3Dimy.js
[2011/02/08 16:49:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\pm0kxWu.js
[2011/02/08 16:16:08 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\YxuqEtI.js
[2011/02/08 15:47:08 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\nva4aaj.js
[2011/02/08 15:16:08 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\wIvDydTK.js
[2011/02/08 14:45:08 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\V2beyf.js
[2011/02/08 14:20:08 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\TDcS47.js
[2011/02/08 13:47:08 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\iLQt3lx.js
[2011/02/08 13:26:08 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\uHOubA.js
[2011/02/08 13:11:08 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\jVCkj.js
[2011/02/08 12:56:09 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Agosup.js
[2011/02/08 12:48:08 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ucVnJy7q4l.js
[2011/02/08 12:23:08 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\mqpOkZr.js
[2011/02/08 12:18:08 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\TWSir2.js
[2011/02/08 11:50:09 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\Qj8a5Z.js
[2011/02/08 11:27:09 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\wzmZh.js
[2011/02/08 11:13:09 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\GPojk3Qyx.js
[2011/02/08 10:47:09 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\pXTV4u.js
[2011/02/08 10:42:09 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\gpkP1Et.js
[2011/02/08 10:17:09 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LxGUn.js
[2011/02/08 09:46:09 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\DJENA87.js
[2011/02/08 09:28:09 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\sk0BBer.js
[2011/02/08 09:13:09 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\PEIFUkTm1O.js
[2011/02/08 08:55:09 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\UxUQmzEQz.js
[2011/02/08 08:48:09 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zHaTlM.js
[2011/02/08 08:34:13 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\fEAfhLa8B.js
[2011/02/08 08:29:09 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\c2ShT0k.js
[2011/02/08 08:17:10 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\CsyKo3.js
[2011/02/08 08:01:09 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\biZlQ7.js
[2011/02/08 07:28:09 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\PMQpOIv3rn.js
[2011/02/08 06:56:09 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\qv2b3L.js
[2011/02/08 06:22:09 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\se7hFR9L.js
[2011/02/08 06:03:09 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\eOVAVgI.js
[2011/02/08 05:34:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Zg7QMGV5.js
[2011/02/08 05:20:10 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\qsBLCJFW.js
[2011/02/08 04:53:10 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\snqXvjQ.js
[2011/02/08 04:37:10 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\Fws1d87.js
[2011/02/08 04:04:10 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\oIrGdl8.js
[2011/02/08 03:59:10 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\tV2VQsySmM.js
[2011/02/08 03:39:10 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\DYqRMk.js
[2011/02/08 03:24:10 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\g1Opa.js
[2011/02/08 02:50:10 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CIodpU496.js
[2011/02/08 02:25:10 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Ypj99D.js
[2011/02/08 01:53:10 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\CVjaaxJU.js
[2011/02/08 01:30:10 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\lZLgG7Sz3B.js
[2011/02/08 01:02:11 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\XOJQY.js
[2011/02/08 00:33:10 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\CyzcXMt.js
[2011/02/08 00:25:10 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\GqJce.js
[2011/02/07 23:55:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\STtehYnOqp.js
[2011/02/07 23:26:15 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\ME\Desktop\HiJackThis.exe
[2011/02/07 23:26:11 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ZMaP0.js
[2011/02/07 22:53:11 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\ytkn9QAidu.js
[2011/02/07 22:30:11 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\iBpUHWw.js
[2011/02/07 21:59:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\iqNrI.js
[2011/02/07 21:27:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\tQzB7v.js
[2011/02/07 21:14:11 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\StCTkvYwn.js
[2011/02/07 20:59:11 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\m3Nur4zOvw.js
[2011/02/07 20:48:12 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\djWfzNeba.js
[2011/02/07 20:29:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Gc7QY.js
[2011/02/07 20:22:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\DGsHr.js
[2011/02/07 19:54:11 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\gvsFHTls.js
[2011/02/07 19:20:11 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\zVa1Vpgaa.js
[2011/02/07 18:50:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\l5ekK0bAHE.js
[2011/02/07 18:18:11 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\srcaH.js
[2011/02/07 17:56:12 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\OknIKMgbwl.js
[2011/02/07 17:40:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\SNuB8O.js
[2011/02/07 17:22:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\taoTvreZ.js
[2011/02/07 17:13:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\aMBml.js
[2011/02/07 16:48:12 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\N2judg.js
[2011/02/07 16:29:12 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\XTOtPmuuxi.js
[2011/02/07 15:55:12 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\dayAK7iyOC.js
[2011/02/07 15:21:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\V7L46Dyv.js
[2011/02/07 15:07:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\XNcqtrp.js
[2011/02/07 14:46:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Q4xsR3.js
[2011/02/07 14:29:12 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\Bj1Nb.js
[2011/02/07 14:00:12 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\n1wnym7jJh.js
[2011/02/07 13:33:12 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\d0x7D.js
[2011/02/07 13:14:12 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ohy22.js
[2011/02/07 12:55:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\PNzMAKMWr.js
[2011/02/07 12:29:13 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\zlNMDeU.js
[2011/02/07 11:55:13 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\WZtSHj.js
[2011/02/07 11:38:14 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\AsMHkfa.js
[2011/02/07 11:28:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\JO0ZoaK.js
[2011/02/07 11:09:14 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\ofFJr.js
[2011/02/07 10:42:11 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\nTPWpNKYpt.js
[2011/02/07 10:25:14 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\K302eM.js
[2011/02/07 09:11:21 | 000,037,600 | —- | M] (Greatis Software) – C:\Windows\SysWow64\Partizan.exe
[2011/02/07 09:11:21 | 000,035,816 | —- | M] (Greatis Software) – C:\Windows\SysWow64\drivers\Partizan.sys
[2011/02/07 09:05:38 | 000,000,002 | RHS- | M] () – C:\Windows\winstart.bat
[2011/02/07 09:05:38 | 000,000,002 | RHS- | M] () – C:\Windows\SysWow64\CONFIG.NT
[2011/02/07 09:05:38 | 000,000,002 | RHS- | M] () – C:\Windows\SysWow64\AUTOEXEC.NT
[2011/02/07 09:05:34 | 000,037,600 | —- | M] (Greatis Software) – C:\Windows\SysNative\Partizan.exe
[2011/02/07 08:56:53 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LOCm0nXR.js
[2011/02/07 08:56:53 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\Bqx1ThY7z1.js
[2011/02/07 08:37:53 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\iy5vaLVv6.js
[2011/02/07 08:37:53 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\WSavE7h0tx.js
[2011/02/07 08:26:53 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\amxjTPCe.js
[2011/02/07 08:26:53 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\V5oUNa2q0.js
[2011/02/07 08:09:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\RVTjR0QU.js
[2011/02/07 08:09:54 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\IwI4mo.js
[2011/02/07 07:36:53 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\yDML6.js
[2011/02/07 07:36:53 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\qAG2ppjgD.js
[2011/02/07 07:11:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\LKnZsqk.js
[2011/02/07 07:11:53 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\CfLks8NJ.js
[2011/02/07 07:06:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\cPXfZ.js
[2011/02/07 07:06:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\r1ztAPj.js
[2011/02/07 06:38:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\yEsA5E4WH.js
[2011/02/07 06:38:53 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\tNfidb.js
[2011/02/07 06:08:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\dte2Q7Tt.js
[2011/02/07 06:08:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\btW1WZ.js
[2011/02/07 05:43:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\JXoI2.js
[2011/02/07 05:43:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\f5XhVDzaXc.js
[2011/02/07 05:23:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Wp4LZT.js
[2011/02/07 05:23:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\ctWrd.js
[2011/02/07 04:57:54 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\uSYYTZl.js
[2011/02/07 04:57:54 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\JOldF.js
[2011/02/07 04:41:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\UEJnTbSUU.js
[2011/02/07 04:41:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\AOF0DfX.js
[2011/02/07 04:16:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\xDjse2nNz.js
[2011/02/07 04:16:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\FBCzHBf1G7.js
[2011/02/07 03:59:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\LT5iX.js
[2011/02/07 03:59:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\fn3Ld.js
[2011/02/07 03:38:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ENGstp.js
[2011/02/07 03:38:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\FXVjT2G9l.js
[2011/02/07 03:10:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\nUElDpmK.js
[2011/02/07 03:10:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zBoOkX.js
[2011/02/07 02:38:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\b18PcHi.js
[2011/02/07 02:38:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\C4ZDD9iMq.js
[2011/02/07 02:21:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\OcQP1Dk.js
[2011/02/07 02:21:54 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\SYI4Re.js
[2011/02/07 01:53:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\hPe45X.js
[2011/02/07 01:53:54 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\nV6K9G2.js
[2011/02/07 01:27:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\oaMYGOwA1c.js
[2011/02/07 01:27:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\jtb433vcI.js
[2011/02/07 01:05:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\X4yLT9USvJ.js
[2011/02/07 01:05:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\W8ckTByHyM.js
[2011/02/07 00:47:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Jatrz950yW.js
[2011/02/07 00:47:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\dnlEfngP.js
[2011/02/07 00:15:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ZVUyQfw.js
[2011/02/07 00:15:55 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\UuAKaVkN6.js
[2011/02/06 23:49:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\wmNPefQHa.js
[2011/02/06 23:49:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\V2D9Ss.js
[2011/02/06 23:33:55 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\FsAVw.js
[2011/02/06 23:33:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\OhR8u.js
[2011/02/06 23:23:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\PUYsTcBAR.js
[2011/02/06 23:23:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\hmtZM9o.js
[2011/02/06 23:16:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Go28TgQ.js
[2011/02/06 23:16:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\AcwIC.js
[2011/02/06 22:46:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\rZi22S.js
[2011/02/06 22:46:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\bl4yTmFmDW.js
[2011/02/06 22:31:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\g5sJJwa.js
[2011/02/06 22:31:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\DKZ0LJ6CUr.js
[2011/02/06 22:17:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\OWKCXRh5Qa.js
[2011/02/06 22:17:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\HItuR4gz.js
[2011/02/06 21:53:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\d3aR4V.js
[2011/02/06 21:53:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\YuP8AF1C.js
[2011/02/06 21:43:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\h4PBwK2.js
[2011/02/06 21:43:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\R2SqZ9IR.js
[2011/02/06 21:25:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\w6cF7uYptm.js
[2011/02/06 21:25:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\wTDE6Mkmo.js
[2011/02/06 21:13:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\tK2eV.js
[2011/02/06 21:13:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\Q1rUE8X.js
[2011/02/06 20:56:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\MjFzvmf9.js
[2011/02/06 20:56:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\DsvR48x.js
[2011/02/06 20:26:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\bZAjrK.js
[2011/02/06 20:26:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\DWBVhohI.js
[2011/02/06 20:19:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\T1NETq.js
[2011/02/06 20:19:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\HTiCx4CDv1.js
[2011/02/06 19:53:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\drNtsto.js
[2011/02/06 19:53:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\dbr3AHYGI.js
[2011/02/06 19:28:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\UXbJS.js
[2011/02/06 19:28:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Py3jQSvlfv.js
[2011/02/06 19:12:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\yySfWWmUi.js
[2011/02/06 19:12:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\vWoD9.js
[2011/02/06 19:05:55 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\t5hjLgiOqr.js
[2011/02/06 19:05:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\z4ETJD.js
[2011/02/06 18:56:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\yMc6km.js
[2011/02/06 18:56:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ZnTXU2GR.js
[2011/02/06 18:41:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\AKDT9ulFw.js
[2011/02/06 18:41:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\HyLPVnnkE.js
[2011/02/06 18:35:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\grrHsAu19.js
[2011/02/06 18:35:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\aURp8.js
[2011/02/06 18:19:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\oJPNF7.js
[2011/02/06 18:19:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\T4661p1u.js
[2011/02/06 17:56:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\t4ul3pZJ.js
[2011/02/06 17:56:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Q4EV17eOx.js
[2011/02/06 17:44:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\MD98a6xQCn.js
[2011/02/06 17:44:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\QjFWk0OsQ0.js
[2011/02/06 17:35:56 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\OA9mjisZQY.js
[2011/02/06 17:35:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\F4dnEg.js
[2011/02/06 17:10:56 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\W6jWmxj4k.js
[2011/02/06 17:10:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\c1GlA.js
[2011/02/06 16:37:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\rk9ihb1kO.js
[2011/02/06 16:37:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\JBrSYu.js
[2011/02/06 16:05:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\u44gwAOK7Z.js
[2011/02/06 16:05:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\o8JlSYbgBR.js
[2011/02/06 15:59:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\YwE8VQz7.js
[2011/02/06 15:59:56 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\H04Vz.js
[2011/02/06 15:51:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\wZlG0xBOyy.js
[2011/02/06 15:51:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\g69x53Jl.js
[2011/02/06 15:17:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\jWyuJVH8b.js
[2011/02/06 15:17:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CSHR2qUvZ.js
[2011/02/06 14:47:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\u9nrxO83.js
[2011/02/06 14:47:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\AdeDWuoA.js
[2011/02/06 14:40:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\slqGRej.js
[2011/02/06 14:40:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\BGa6s0.js
[2011/02/06 14:27:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\evkOvv.js
[2011/02/06 14:27:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\hjNhwjI7.js
[2011/02/06 14:06:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\xRrgk.js
[2011/02/06 14:06:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ndNhN.js
[2011/02/06 13:56:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\kPKGv.js
[2011/02/06 13:56:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zLPTzdK1Ir.js
[2011/02/06 13:42:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\mhAakY.js
[2011/02/06 13:42:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\JFTGb4qqAy.js
[2011/02/06 13:32:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\MuHqorJzm.js
[2011/02/06 13:32:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\YdkR5rdZMA.js
[2011/02/06 13:26:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\PMhTW.js
[2011/02/06 13:26:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\iuHpxE.js
[2011/02/06 13:12:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\jhTzWF.js
[2011/02/06 13:12:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\hYKsQ.js
[2011/02/06 12:50:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\NzZvCTW1K8.js
[2011/02/06 12:50:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ZX63ned.js
[2011/02/06 12:29:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\H7oYd42u.js
[2011/02/06 12:29:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\FC9JzKDNu.js
[2011/02/06 12:01:57 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\Oc8E6oK21.js
[2011/02/06 12:01:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\ryuwx9oQvD.js
[2011/02/06 11:29:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\TGfy0n609.js
[2011/02/06 11:29:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\TasShn8I.js
[2011/02/06 11:07:57 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\ATIw2OOXzj.js
[2011/02/06 11:07:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\pkKXgg5.js
[2011/02/06 11:02:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\fo2fAb.js
[2011/02/06 11:01:57 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\ghFqdEHLy.js
[2011/02/06 10:39:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\xdkA40.js
[2011/02/06 10:39:57 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\d3G7H9n8.js
[2011/02/06 10:09:57 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\xkGJO.js
[2011/02/06 10:09:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\eJqLx8s.js
[2011/02/06 10:01:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\QWEa2.js
[2011/02/06 10:01:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\uQMZ3pR.js
[2011/02/06 09:43:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\PpAKTUN.js
[2011/02/06 09:43:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\CWNha68W.js
[2011/02/06 09:11:57 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\YOfsog8.js
[2011/02/06 09:11:57 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\IZvcNi7.js
[2011/02/06 09:06:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\eW1t1hHxn.js
[2011/02/06 09:06:57 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\GIwDob8nV3.js
[2011/02/06 08:38:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\eVjSbJH8.js
[2011/02/06 08:38:57 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\v1Vsb8.js
[2011/02/06 08:11:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\S1gaTb.js
[2011/02/06 08:11:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\ilNucUckI.js
[2011/02/06 07:53:57 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\wxTzLwcA.js
[2011/02/06 07:53:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\BDt2C1GzO9.js
[2011/02/06 07:47:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\FiFLSQy1.js
[2011/02/06 07:47:57 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\BUn9BWBz.js
[2011/02/06 07:26:02 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\WPHDOxIR1t.js
[2011/02/06 07:25:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LWMV42.js
[2011/02/06 06:58:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\SsZXYjr.js
[2011/02/06 06:26:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\BeVEM.js
[2011/02/06 06:26:58 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\l2XfkmDX.js
[2011/02/06 06:19:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\gxq9xY.js
[2011/02/06 06:19:58 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\cAEb2Jv.js
[2011/02/06 05:57:03 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\dKvx48ga.js
[2011/02/06 05:56:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\QW9UbDs9T.js
[2011/02/06 05:39:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\G7Z9kzjPv.js
[2011/02/06 05:39:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\xiccG345si.js
[2011/02/06 05:12:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ENfeqdIW4l.js
[2011/02/06 05:12:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\QhuieE3NXl.js
[2011/02/06 05:00:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\i52vtewad.js
[2011/02/06 05:00:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\sh0Ntlem.js
[2011/02/06 04:56:00 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\CvGn8j86.js
[2011/02/06 04:55:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Ze7KTM.js
[2011/02/06 04:39:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\PLo1F.js
[2011/02/06 04:39:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ecLC5c.js
[2011/02/06 04:14:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\GneGd2CN.js
[2011/02/06 04:14:58 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\ApiRfOxb9f.js
[2011/02/06 04:05:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\hsAgThf.js
[2011/02/06 04:05:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\HF5Vy.js
[2011/02/06 03:38:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\pPdjln.js
[2011/02/06 03:38:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\NyYdw93O.js
[2011/02/06 03:29:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\u1V0I.js
[2011/02/06 03:29:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CpOjBi.js
[2011/02/06 03:13:59 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\gQ216I.js
[2011/02/06 03:13:58 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Jgs4vB.js
[2011/02/06 02:44:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\uhfDOgHxff.js
[2011/02/06 02:44:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\mzmXgN.js
[2011/02/06 02:20:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\gDNBK.js
[2011/02/06 02:20:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CKlhxkWdT.js
[2011/02/06 02:11:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\wSX03.js
[2011/02/06 02:11:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\iLHlVZZTrQ.js
[2011/02/06 01:39:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\M2uukINtU5.js
[2011/02/06 01:39:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Ri8087AAR9.js
[2011/02/06 01:14:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\dWfvMRqs.js
[2011/02/06 01:14:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\bb1E3F6.js
[2011/02/06 01:09:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\vHA4hCNamJ.js
[2011/02/06 01:08:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\MjnQJe.js
[2011/02/06 00:51:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\prfoqH6M.js
[2011/02/06 00:51:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\hG1ECcAcC.js
[2011/02/06 00:41:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\nYgGMn.js
[2011/02/06 00:40:59 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\pfLFZqXeg.js
[2011/02/06 00:14:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\otDKyex.js
[2011/02/06 00:14:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\laWe8B79my.js
[2011/02/06 00:03:59 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\a5GNBABE.js
[2011/02/06 00:03:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\F8NZ2i.js
[2011/02/05 23:55:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\pILmrqsBNw.js
[2011/02/05 23:55:59 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\RZ8jqS.js
[2011/02/05 23:26:59 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\NLrrAEMK.js
[2011/02/05 23:26:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\R109NYk.js
[2011/02/05 23:04:59 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\lgZjHjEXQJ.js
[2011/02/05 23:04:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\ZFYFxFH.js
[2011/02/05 22:59:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\hUEutUn.js
[2011/02/05 22:59:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\UPC8zn.js
[2011/02/05 22:26:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\SIWBGrY.js
[2011/02/05 22:26:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\RcTZO.js
[2011/02/05 21:52:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\vnoxWD.js
[2011/02/05 21:52:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\fCZD2kXiR.js
[2011/02/05 21:35:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\iO3EBMRK.js
[2011/02/05 21:35:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ECQqtEps.js
[2011/02/05 21:27:59 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\VF6rnH4.js
[2011/02/05 21:27:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\rWEQDJsOP.js
[2011/02/05 21:00:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\uqBR3ht8LN.js
[2011/02/05 21:00:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\QUinNEnk3.js
[2011/02/05 20:54:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\SW0vtgF6L8.js
[2011/02/05 20:54:59 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\UkkYQ1b5.js
[2011/02/05 20:40:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\kHkBetf6q.js
[2011/02/05 20:40:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\HpiBU3MSCa.js
[2011/02/05 20:17:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\HuBBAJXu18.js
[2011/02/05 20:17:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\dCLCP.js
[2011/02/05 19:46:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\HXr1In.js
[2011/02/05 19:46:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\v5DWk.js
[2011/02/05 19:40:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\sW20LfE.js
[2011/02/05 19:40:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\y6B2VqdXF.js
[2011/02/05 19:36:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\EvZ7SlTdI.js
[2011/02/05 19:36:00 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\A7DmEwv1.js
[2011/02/05 19:11:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\Kk2Ac7.js
[2011/02/05 19:10:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\tdUO3CCf6.js
[2011/02/05 19:04:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\aqTABBc.js
[2011/02/05 19:04:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\QzHKKJ.js
[2011/02/05 18:51:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\tlgtORe8Dk.js
[2011/02/05 18:50:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\HK15ABJtv.js
[2011/02/05 18:31:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\R8Re71H9UZ.js
[2011/02/05 18:31:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\QtYCBMdB.js
[2011/02/05 18:10:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\vNCwN1.js
[2011/02/05 18:10:00 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\WGt2X.js
[2011/02/05 17:50:01 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ZJyQjl5oU.js
[2011/02/05 17:50:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\Y1jxFhiG.js
[2011/02/05 17:44:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\oguOFYGwz.js
[2011/02/05 17:44:00 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\HI9mxIx6.js
[2011/02/05 17:28:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\nJHHugIIYL.js
[2011/02/05 17:28:00 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\eOc7LAc.js
[2011/02/05 17:07:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ZEmsL5.js
[2011/02/05 17:07:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\GI01ClDy.js
[2011/02/05 16:46:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\aTmedYc.js
[2011/02/05 16:46:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\Uf6KSi4Ys.js
[2011/02/05 16:38:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\obwMYD.js
[2011/02/05 16:38:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\A9NyY.js
[2011/02/05 16:27:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\J5Kp57.js
[2011/02/05 16:27:00 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ATffG2kQf.js
[2011/02/05 16:09:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\EV3xk.js
[2011/02/05 16:09:00 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\y2yVfp.js
[2011/02/05 15:35:01 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\dr5Dwu.js
[2011/02/05 15:35:00 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\BumW36fuS.js
[2011/02/05 15:24:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\TZQzVW5l.js
[2011/02/05 15:24:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\QKvAOh6zqb.js
[2011/02/05 15:04:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\JvTSN.js
[2011/02/05 15:04:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\LLPgvXtz.js
[2011/02/05 14:54:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\oGAYMx2.js
[2011/02/05 14:54:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\NuUUN3vTI8.js
[2011/02/05 14:43:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\OVDqGHVhgN.js
[2011/02/05 14:43:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\lCrNV.js
[2011/02/05 14:17:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\NxMBf0HA.js
[2011/02/05 14:17:00 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\g1IAcY7U.js
[2011/02/05 13:52:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\FRllU9.js
[2011/02/05 13:52:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\dOjKtPd.js
[2011/02/05 13:19:01 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\eKC6Du8.js
[2011/02/05 13:19:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ATRk8yRXy3.js
[2011/02/05 13:11:04 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\Brl6qCQxp.js
[2011/02/05 13:11:01 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\awOyXeXFnl.js
[2011/02/05 12:44:01 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\pjIAj12wn.js
[2011/02/05 12:44:01 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\CFq38HB7D.js
[2011/02/05 12:36:02 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\dmeFUnj.js
[2011/02/05 12:36:01 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\LPxNhWZf.js
[2011/02/05 12:28:04 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\YuG43JQkQ.js
[2011/02/05 12:28:01 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zYTU4DuNQd.js
[2011/02/05 12:23:01 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\I0lRLDEU5W.js
[2011/02/05 12:23:01 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\GJqlgdum2.js
[2011/02/05 12:10:01 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\iIefpceE.js
[2011/02/05 12:10:01 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\aBe5mKEb.js
[2011/02/05 12:02:03 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\vQhhpO377.js
[2011/02/05 12:02:03 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Z2fjSL.js
[2011/02/05 11:56:01 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\dSC8Zpthr.js
[2011/02/05 11:56:01 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\vRA1WHvJ.js
[2011/02/05 11:38:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Y9W7Tv.js
[2011/02/05 11:38:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\qszaJ.js
[2011/02/05 11:10:01 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\F8A0HuA.js
[2011/02/05 11:10:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\oE9B58g.js
[2011/02/05 10:37:03 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\ici1wmKhAa.js
[2011/02/05 10:37:03 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\j1quOk2JF.js
[2011/02/05 10:16:01 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\J1HwV.js
[2011/02/05 10:16:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\LE8bBl.js
[2011/02/05 10:08:02 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\kRbn8ztS7.js
[2011/02/05 10:08:01 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\x2t4F.js
[2011/02/05 09:45:02 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\oVRnfiziE.js
[2011/02/05 09:45:02 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\LTU3bq.js
[2011/02/05 09:13:21 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LB1ioPW.js
[2011/02/05 09:13:21 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\RrEo6.js
[2011/02/05 09:10:30 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\lUstA37uSX.js
[2011/02/05 09:07:23 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\WUvExSSHa3.js
[2011/02/05 09:03:33 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\aQwtUkLO.js
[2011/02/05 08:33:23 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\NxChznJAcU.js
[2011/02/05 08:29:31 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\AHBIX8OXZ.js
[2011/02/05 08:08:27 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\GoZejI.js
[2011/02/05 08:00:23 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\jmjpy.js
[2011/02/05 07:58:27 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\xAtdL1y.js
[2011/02/05 07:40:28 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\KzdlnfyI.js
[2011/02/05 07:31:23 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\EKRbH.js
[2011/02/05 07:25:23 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\K78K52yIM7.js
[2011/02/05 07:24:28 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\DhHxpl85.js
[2011/02/05 07:15:23 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\pJDoivEh.js
[2011/02/05 07:13:28 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\xqAOBaK.js
[2011/02/05 07:03:25 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\D0uroyx2VB.js
[2011/02/05 07:02:33 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\pu2uKhVC7.js
[2011/02/05 06:41:23 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\vdVVgQcIWy.js
[2011/02/05 06:35:23 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\XfvTqj.js
[2011/02/05 06:30:27 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\mJpd8x0Or.js
[2011/02/05 06:18:23 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\kd7jNrDVR6.js
[2011/02/05 06:07:28 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zMgUIa.js
[2011/02/05 05:58:28 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\OPp48DA.js
[2011/02/05 05:47:23 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\vBK07zR.js
[2011/02/05 05:24:28 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\LzYJJNm.js
[2011/02/05 05:18:23 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\x8IHlcAPCu.js
[2011/02/05 05:16:28 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\yOomd.js
[2011/02/05 04:46:28 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\IDhya9CUYh.js
[2011/02/05 04:46:23 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\cO53eNTcTv.js
[2011/02/05 04:39:32 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\pOlryw.js
[2011/02/05 04:15:24 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Hoy9hOeN8H.js
[2011/02/05 04:08:28 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\WxKrW.js
[2011/02/05 04:08:23 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Sguk5K2P7.js
[2011/02/05 03:57:28 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\AmZQIixNo4.js
[2011/02/05 03:46:28 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ywRimj.js
[2011/02/05 03:41:23 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\fSb7oSq.js
[2011/02/05 03:22:28 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\MIzIk.js
[2011/02/05 03:11:25 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\LkUKPKcbL.js
[2011/02/05 02:52:29 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\cj09Tk.js
[2011/02/05 02:45:24 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\VRSefN.js
[2011/02/05 02:20:24 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\fukea.js
[2011/02/05 02:19:28 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\ZhRAX.js
[2011/02/05 02:12:28 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Ps7BkI.js
[2011/02/05 02:08:24 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\S6ysxKjIj.js
[2011/02/05 02:03:28 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ElbJs.js
[2011/02/05 01:41:25 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\ieCs3tCVE.js
[2011/02/05 01:35:28 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\YteusM.js
[2011/02/05 01:28:47 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\I8k1vbu4.js
[2011/02/05 01:28:47 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\NKxXtXHBRT.js
[2011/02/05 01:20:14 | 000,000,314 | —- | M] () – C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STARTUP.del
[2011/02/04 12:32:04 | 000,175,616 | —- | M] () – C:\Users\ME\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/01 23:25:36 | 000,006,615 | —- | M] () – C:\Users\ME\AppData\Roaming\PrimoPDFSet.xml
[2011/01/27 22:49:04 | 000,001,919 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/01/21 08:50:13 | 000,456,192 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\shlwapi.dll
[2011/01/20 00:12:26 | 000,001,696 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/01/20 00:09:20 | 000,001,758 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/01/17 16:33:32 | 001,385,240 | —- | M] (Greatis Software) – C:\Windows\RunGuard.exe
[2011/01/17 16:33:24 | 000,020,248 | —- | M] () – C:\Windows\WinBait.org
[2011/01/17 16:33:24 | 000,020,248 | —- | M] () – C:\Windows\WinBait.exe
[2011/01/12 18:07:19 | 007,785,323 | —- | M] () – C:\Users\ME\Desktop\wed_beach.jpg

========== Files Created - No Company Name ==========

[2011/02/09 12:18:32 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2011/02/09 12:18:32 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/02/09 12:18:32 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2011/02/09 12:18:32 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/02/09 12:18:32 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/02/09 12:16:19 | 004,266,117 | R— | C] () – C:\Users\ME\Desktop\jgh.exe
[2011/02/09 12:13:45 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\craeKUtJYM.js
[2011/02/09 11:58:45 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\OcqzH4UKqF.js
[2011/02/09 11:38:45 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\mMrJuGMY4.js
[2011/02/09 11:08:45 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\CppmF.js
[2011/02/09 10:53:45 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\CXuuRcs.js
[2011/02/09 10:28:45 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\A3rsnq6.js
[2011/02/09 10:03:45 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\jGKhLdC.js
[2011/02/09 09:41:45 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\H1vOQ8rCJ.js
[2011/02/09 09:11:45 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\cpgZmQg.js
[2011/02/09 08:47:46 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\X4ldrrnO.js
[2011/02/09 08:29:45 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\wJmb346Ko.js
[2011/02/09 08:10:45 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\RJDUFeNwp3.js
[2011/02/09 07:46:45 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\leT6CPuOtN.js
[2011/02/09 07:32:46 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\LRH847Bb.js
[2011/02/09 07:07:45 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\YTVoj.js
[2011/02/09 06:44:45 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\xLNzQ1gc.js
[2011/02/09 06:11:46 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\Cb588VTFVA.js
[2011/02/09 05:56:46 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\d6ogIJPn.js
[2011/02/09 05:33:46 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\wNo5Y9ldRY.js
[2011/02/09 05:04:46 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\pVCbK6rg.js
[2011/02/09 04:31:46 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\yXtV3OJGD.js
[2011/02/09 03:44:46 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\y7PNPj3uQ.js
[2011/02/09 03:14:46 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\q5XkUwoy9.js
[2011/02/09 02:44:46 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\NJrqOY0wwe.js
[2011/02/09 02:24:46 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\dXAuXsKjN.js
[2011/02/09 01:52:46 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\uYaIu.js
[2011/02/09 01:09:46 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\M4eXMoJc.js
[2011/02/09 00:39:49 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\XUdiJyWMeu.js
[2011/02/09 00:21:24 | 000,624,128 | —- | C] () – C:\Users\ME\Desktop\dds.scr
[2011/02/09 00:19:28 | 000,080,384 | —- | C] () – C:\Users\ME\Desktop\MBRCheck.exe
[2011/02/08 23:27:07 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\LQYqy2w5X.js
[2011/02/08 22:54:06 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\jB8fgdtR.js
[2011/02/08 22:29:07 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\fHwLcbBy.js
[2011/02/08 22:07:07 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\hE0I2uB.js
[2011/02/08 22:02:07 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\P9fxpG.js
[2011/02/08 21:57:07 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\TFjKw1YN.js
[2011/02/08 21:48:07 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\XTLMHHZb.js
[2011/02/08 21:15:07 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\eaIfy6ehPM.js
[2011/02/08 20:49:07 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\E98Q8Md.js
[2011/02/08 20:17:07 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\e9ubU3.js
[2011/02/08 20:09:07 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\Pwyqn7QRXE.js
[2011/02/08 19:52:07 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\bw0ix.js
[2011/02/08 19:26:07 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\SV3aRUF.js
[2011/02/08 19:15:07 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\j0DyJ.js
[2011/02/08 18:47:07 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\w0Lw0.js
[2011/02/08 18:31:07 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\acqUdr5Zcv.js
[2011/02/08 18:16:07 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\OUv4hK6EN.js
[2011/02/08 17:43:07 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\w8r2iCR7Y.js
[2011/02/08 17:21:07 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\uFvuQoAWo.js
[2011/02/08 17:04:07 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\z3Dimy.js
[2011/02/08 16:49:07 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\pm0kxWu.js
[2011/02/08 16:16:08 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\YxuqEtI.js
[2011/02/08 15:47:08 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\nva4aaj.js
[2011/02/08 15:16:08 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\wIvDydTK.js
[2011/02/08 14:45:08 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\V2beyf.js
[2011/02/08 14:20:08 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\TDcS47.js
[2011/02/08 13:47:08 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\iLQt3lx.js
[2011/02/08 13:26:08 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\uHOubA.js
[2011/02/08 13:11:08 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\jVCkj.js
[2011/02/08 12:56:09 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\Agosup.js
[2011/02/08 12:48:08 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\ucVnJy7q4l.js
[2011/02/08 12:23:08 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\mqpOkZr.js
[2011/02/08 12:18:08 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\TWSir2.js
[2011/02/08 11:50:08 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\Qj8a5Z.js
[2011/02/08 11:27:09 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\wzmZh.js
[2011/02/08 11:13:09 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\GPojk3Qyx.js
[2011/02/08 10:47:09 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\pXTV4u.js
[2011/02/08 10:42:09 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\gpkP1Et.js
[2011/02/08 10:17:09 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\LxGUn.js
[2011/02/08 09:46:09 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\DJENA87.js
[2011/02/08 09:28:09 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\sk0BBer.js
[2011/02/08 09:13:09 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\PEIFUkTm1O.js
[2011/02/08 08:55:09 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\UxUQmzEQz.js
[2011/02/08 08:48:09 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\zHaTlM.js
[2011/02/08 08:34:13 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\fEAfhLa8B.js
[2011/02/08 08:29:09 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\c2ShT0k.js
[2011/02/08 08:17:10 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\CsyKo3.js
[2011/02/08 08:01:09 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\biZlQ7.js
[2011/02/08 07:28:09 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\PMQpOIv3rn.js
[2011/02/08 06:56:09 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\qv2b3L.js
[2011/02/08 06:22:09 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\se7hFR9L.js
[2011/02/08 06:03:09 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\eOVAVgI.js
[2011/02/08 05:34:12 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\Zg7QMGV5.js
[2011/02/08 05:20:10 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\qsBLCJFW.js
[2011/02/08 04:53:10 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\snqXvjQ.js
[2011/02/08 04:37:10 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\Fws1d87.js
[2011/02/08 04:04:10 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\oIrGdl8.js
[2011/02/08 03:59:10 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\tV2VQsySmM.js
[2011/02/08 03:39:10 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\DYqRMk.js
[2011/02/08 03:24:10 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\g1Opa.js
[2011/02/08 02:50:10 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\CIodpU496.js
[2011/02/08 02:25:10 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\Ypj99D.js
[2011/02/08 01:53:10 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\CVjaaxJU.js
[2011/02/08 01:30:10 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\lZLgG7Sz3B.js
[2011/02/08 01:02:11 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\XOJQY.js
[2011/02/08 00:33:10 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\CyzcXMt.js
[2011/02/08 00:25:10 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\GqJce.js
[2011/02/07 23:55:11 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\STtehYnOqp.js
[2011/02/07 23:26:11 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\ZMaP0.js
[2011/02/07 22:53:11 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\ytkn9QAidu.js
[2011/02/07 22:30:11 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\iBpUHWw.js
[2011/02/07 21:59:11 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\iqNrI.js
[2011/02/07 21:27:11 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\tQzB7v.js
[2011/02/07 21:14:11 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\StCTkvYwn.js
[2011/02/07 20:59:11 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\m3Nur4zOvw.js
[2011/02/07 20:48:12 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\djWfzNeba.js
[2011/02/07 20:29:11 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\Gc7QY.js
[2011/02/07 20:22:12 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\DGsHr.js
[2011/02/07 19:54:11 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\gvsFHTls.js
[2011/02/07 19:20:11 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\zVa1Vpgaa.js
[2011/02/07 18:50:11 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\l5ekK0bAHE.js
[2011/02/07 18:18:11 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\srcaH.js
[2011/02/07 17:56:12 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\OknIKMgbwl.js
[2011/02/07 17:40:12 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\SNuB8O.js
[2011/02/07 17:22:12 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\taoTvreZ.js
[2011/02/07 17:13:12 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\aMBml.js
[2011/02/07 16:48:12 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\N2judg.js
[2011/02/07 16:29:12 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\XTOtPmuuxi.js
[2011/02/07 15:55:12 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\dayAK7iyOC.js
[2011/02/07 15:21:12 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\V7L46Dyv.js
[2011/02/07 15:07:12 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\XNcqtrp.js
[2011/02/07 14:46:12 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\Q4xsR3.js
[2011/02/07 14:29:12 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\Bj1Nb.js
[2011/02/07 14:00:12 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\n1wnym7jJh.js
[2011/02/07 13:33:12 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\d0x7D.js
[2011/02/07 13:14:12 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\ohy22.js
[2011/02/07 12:55:12 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\PNzMAKMWr.js
[2011/02/07 12:29:13 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\zlNMDeU.js
[2011/02/07 11:55:13 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\WZtSHj.js
[2011/02/07 11:38:14 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\AsMHkfa.js
[2011/02/07 11:28:12 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\JO0ZoaK.js
[2011/02/07 11:09:14 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\ofFJr.js
[2011/02/07 10:42:11 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\nTPWpNKYpt.js
[2011/02/07 10:25:13 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\K302eM.js
[2011/02/07 09:05:38 | 000,000,002 | RHS- | C] () – C:\Windows\winstart.bat
[2011/02/07 09:05:38 | 000,000,002 | RHS- | C] () – C:\Windows\SysWow64\CONFIG.NT
[2011/02/07 09:05:38 | 000,000,002 | RHS- | C] () – C:\Windows\SysWow64\AUTOEXEC.NT
[2011/02/07 09:05:06 | 000,057,556 | —- | C] () – C:\Windows\guard.bmp
[2011/02/07 09:05:06 | 000,020,248 | —- | C] () – C:\Windows\WinBait.org
[2011/02/07 09:05:06 | 000,020,248 | —- | C] () – C:\Windows\WinBait.exe
[2011/02/07 08:56:53 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\LOCm0nXR.js
[2011/02/07 08:56:53 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\Bqx1ThY7z1.js
[2011/02/07 08:37:53 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\iy5vaLVv6.js
[2011/02/07 08:37:53 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\WSavE7h0tx.js
[2011/02/07 08:26:53 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\amxjTPCe.js
[2011/02/07 08:26:53 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\V5oUNa2q0.js
[2011/02/07 08:09:54 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\RVTjR0QU.js
[2011/02/07 08:09:54 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\IwI4mo.js
[2011/02/07 07:36:53 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\yDML6.js
[2011/02/07 07:36:53 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\qAG2ppjgD.js
[2011/02/07 07:11:54 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\LKnZsqk.js
[2011/02/07 07:11:53 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\CfLks8NJ.js
[2011/02/07 07:06:54 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\cPXfZ.js
[2011/02/07 07:06:54 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\r1ztAPj.js
[2011/02/07 06:38:54 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\yEsA5E4WH.js
[2011/02/07 06:38:53 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\tNfidb.js
[2011/02/07 06:08:54 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\dte2Q7Tt.js
[2011/02/07 06:08:54 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\btW1WZ.js
[2011/02/07 05:43:54 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\JXoI2.js
[2011/02/07 05:43:54 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\f5XhVDzaXc.js
[2011/02/07 05:23:54 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\Wp4LZT.js
[2011/02/07 05:23:54 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\ctWrd.js
[2011/02/07 04:57:54 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\uSYYTZl.js
[2011/02/07 04:57:54 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\JOldF.js
[2011/02/07 04:41:54 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\UEJnTbSUU.js
[2011/02/07 04:41:54 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\AOF0DfX.js
[2011/02/07 04:16:54 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\xDjse2nNz.js
[2011/02/07 04:16:54 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\FBCzHBf1G7.js
[2011/02/07 03:59:54 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\LT5iX.js
[2011/02/07 03:59:54 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\fn3Ld.js
[2011/02/07 03:38:54 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\ENGstp.js
[2011/02/07 03:38:54 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\FXVjT2G9l.js
[2011/02/07 03:10:54 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\nUElDpmK.js
[2011/02/07 03:10:54 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\zBoOkX.js
[2011/02/07 02:38:55 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\b18PcHi.js
[2011/02/07 02:38:54 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\C4ZDD9iMq.js
[2011/02/07 02:21:54 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\OcQP1Dk.js
[2011/02/07 02:21:54 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\SYI4Re.js
[2011/02/07 01:53:54 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\hPe45X.js
[2011/02/07 01:53:54 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\nV6K9G2.js
[2011/02/07 01:27:54 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\oaMYGOwA1c.js
[2011/02/07 01:27:54 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\jtb433vcI.js
[2011/02/07 01:05:54 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\X4yLT9USvJ.js
[2011/02/07 01:05:54 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\W8ckTByHyM.js
[2011/02/07 00:47:55 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\Jatrz950yW.js
[2011/02/07 00:47:54 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\dnlEfngP.js
[2011/02/07 00:15:55 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\ZVUyQfw.js
[2011/02/07 00:15:55 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\UuAKaVkN6.js
[2011/02/06 23:49:55 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\wmNPefQHa.js
[2011/02/06 23:49:55 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\V2D9Ss.js
[2011/02/06 23:33:55 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\FsAVw.js
[2011/02/06 23:33:55 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\OhR8u.js
[2011/02/06 23:23:56 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\PUYsTcBAR.js
[2011/02/06 23:23:55 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\hmtZM9o.js
[2011/02/06 23:16:55 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\Go28TgQ.js
[2011/02/06 23:16:55 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\AcwIC.js
[2011/02/06 22:46:55 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\rZi22S.js
[2011/02/06 22:46:55 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\bl4yTmFmDW.js
[2011/02/06 22:31:55 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\g5sJJwa.js
[2011/02/06 22:31:55 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\DKZ0LJ6CUr.js
[2011/02/06 22:17:56 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\OWKCXRh5Qa.js
[2011/02/06 22:17:56 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\HItuR4gz.js
[2011/02/06 21:53:55 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\d3aR4V.js
[2011/02/06 21:53:55 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\YuP8AF1C.js
[2011/02/06 21:43:55 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\h4PBwK2.js
[2011/02/06 21:43:55 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\R2SqZ9IR.js
[2011/02/06 21:25:55 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\w6cF7uYptm.js
[2011/02/06 21:25:55 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\wTDE6Mkmo.js
[2011/02/06 21:13:55 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\tK2eV.js
[2011/02/06 21:13:55 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\Q1rUE8X.js
[2011/02/06 20:56:56 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\MjFzvmf9.js
[2011/02/06 20:56:55 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\DsvR48x.js
[2011/02/06 20:26:55 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\bZAjrK.js
[2011/02/06 20:26:55 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\DWBVhohI.js
[2011/02/06 20:19:55 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\T1NETq.js
[2011/02/06 20:19:55 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\HTiCx4CDv1.js
[2011/02/06 19:53:55 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\drNtsto.js
[2011/02/06 19:53:55 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\dbr3AHYGI.js
[2011/02/06 19:28:56 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\UXbJS.js
[2011/02/06 19:28:56 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\Py3jQSvlfv.js
[2011/02/06 19:12:55 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\yySfWWmUi.js
[2011/02/06 19:12:55 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\vWoD9.js
[2011/02/06 19:05:55 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\t5hjLgiOqr.js
[2011/02/06 19:05:55 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\z4ETJD.js
[2011/02/06 18:56:55 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\yMc6km.js
[2011/02/06 18:56:55 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\ZnTXU2GR.js
[2011/02/06 18:41:55 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\HyLPVnnkE.js
[2011/02/06 18:41:55 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\AKDT9ulFw.js
[2011/02/06 18:35:56 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\grrHsAu19.js
[2011/02/06 18:35:55 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\aURp8.js
[2011/02/06 18:19:56 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\oJPNF7.js
[2011/02/06 18:19:56 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\T4661p1u.js
[2011/02/06 17:56:56 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\t4ul3pZJ.js
[2011/02/06 17:56:56 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\Q4EV17eOx.js
[2011/02/06 17:44:56 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\MD98a6xQCn.js
[2011/02/06 17:44:56 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\QjFWk0OsQ0.js
[2011/02/06 17:35:56 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\OA9mjisZQY.js
[2011/02/06 17:35:56 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\F4dnEg.js
[2011/02/06 17:10:56 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\W6jWmxj4k.js
[2011/02/06 17:10:56 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\c1GlA.js
[2011/02/06 16:37:56 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\rk9ihb1kO.js
[2011/02/06 16:37:56 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\JBrSYu.js
[2011/02/06 16:05:56 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\u44gwAOK7Z.js
[2011/02/06 16:05:56 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\o8JlSYbgBR.js
[2011/02/06 15:59:56 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\YwE8VQz7.js
[2011/02/06 15:59:56 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\H04Vz.js
[2011/02/06 15:51:57 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\wZlG0xBOyy.js
[2011/02/06 15:51:56 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\g69x53Jl.js
[2011/02/06 15:17:56 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\jWyuJVH8b.js
[2011/02/06 15:17:56 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\CSHR2qUvZ.js
[2011/02/06 14:47:56 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\u9nrxO83.js
[2011/02/06 14:47:56 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\AdeDWuoA.js
[2011/02/06 14:40:56 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\slqGRej.js
[2011/02/06 14:40:56 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\BGa6s0.js
[2011/02/06 14:27:57 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\evkOvv.js
[2011/02/06 14:27:56 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\hjNhwjI7.js
[2011/02/06 14:06:56 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\xRrgk.js
[2011/02/06 14:06:56 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\ndNhN.js
[2011/02/06 13:56:58 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\kPKGv.js
[2011/02/06 13:56:56 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\zLPTzdK1Ir.js
[2011/02/06 13:42:56 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\mhAakY.js
[2011/02/06 13:42:56 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\JFTGb4qqAy.js
[2011/02/06 13:32:56 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\MuHqorJzm.js
[2011/02/06 13:32:56 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\YdkR5rdZMA.js
[2011/02/06 13:26:56 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\PMhTW.js
[2011/02/06 13:26:56 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\iuHpxE.js
[2011/02/06 13:12:57 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\jhTzWF.js
[2011/02/06 13:12:57 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\hYKsQ.js
[2011/02/06 12:50:58 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\NzZvCTW1K8.js
[2011/02/06 12:50:57 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\ZX63ned.js
[2011/02/06 12:29:57 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\H7oYd42u.js
[2011/02/06 12:29:56 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\FC9JzKDNu.js
[2011/02/06 12:01:57 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\Oc8E6oK21.js
[2011/02/06 12:01:57 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\ryuwx9oQvD.js
[2011/02/06 11:29:58 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\TGfy0n609.js
[2011/02/06 11:29:57 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\TasShn8I.js
[2011/02/06 11:07:57 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\ATIw2OOXzj.js
[2011/02/06 11:07:57 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\pkKXgg5.js
[2011/02/06 11:02:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\fo2fAb.js
[2011/02/06 11:01:57 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\ghFqdEHLy.js
[2011/02/06 10:39:57 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\xdkA40.js
[2011/02/06 10:39:57 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\d3G7H9n8.js
[2011/02/06 10:09:57 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\xkGJO.js
[2011/02/06 10:09:57 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\eJqLx8s.js
[2011/02/06 10:01:57 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\QWEa2.js
[2011/02/06 10:01:57 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\uQMZ3pR.js
[2011/02/06 09:43:57 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\PpAKTUN.js
[2011/02/06 09:43:57 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\CWNha68W.js
[2011/02/06 09:11:57 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\YOfsog8.js
[2011/02/06 09:11:57 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\IZvcNi7.js
[2011/02/06 09:06:57 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\eW1t1hHxn.js
[2011/02/06 09:06:57 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\GIwDob8nV3.js
[2011/02/06 08:38:57 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\eVjSbJH8.js
[2011/02/06 08:38:57 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\v1Vsb8.js
[2011/02/06 08:11:58 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\S1gaTb.js
[2011/02/06 08:11:58 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\ilNucUckI.js
[2011/02/06 07:53:57 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\wxTzLwcA.js
[2011/02/06 07:53:57 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\BDt2C1GzO9.js
[2011/02/06 07:47:59 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\FiFLSQy1.js
[2011/02/06 07:47:57 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\BUn9BWBz.js
[2011/02/06 07:26:02 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\WPHDOxIR1t.js
[2011/02/06 07:25:58 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\LWMV42.js
[2011/02/06 06:58:58 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\SsZXYjr.js
[2011/02/06 06:26:58 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\BeVEM.js
[2011/02/06 06:26:58 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\l2XfkmDX.js
[2011/02/06 06:19:58 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\gxq9xY.js
[2011/02/06 06:19:58 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\cAEb2Jv.js
[2011/02/06 05:57:03 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\dKvx48ga.js
[2011/02/06 05:56:58 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\QW9UbDs9T.js
[2011/02/06 05:39:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\G7Z9kzjPv.js
[2011/02/06 05:39:58 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\xiccG345si.js
[2011/02/06 05:12:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\ENfeqdIW4l.js
[2011/02/06 05:12:58 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\QhuieE3NXl.js
[2011/02/06 05:00:58 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\i52vtewad.js
[2011/02/06 05:00:58 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\sh0Ntlem.js
[2011/02/06 04:56:00 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\CvGn8j86.js
[2011/02/06 04:55:58 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\Ze7KTM.js
[2011/02/06 04:39:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\PLo1F.js
[2011/02/06 04:39:58 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\ecLC5c.js
[2011/02/06 04:14:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\GneGd2CN.js
[2011/02/06 04:14:58 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\ApiRfOxb9f.js
[2011/02/06 04:05:58 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\hsAgThf.js
[2011/02/06 04:05:58 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\HF5Vy.js
[2011/02/06 03:38:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\pPdjln.js
[2011/02/06 03:38:58 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\NyYdw93O.js
[2011/02/06 03:29:58 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\u1V0I.js
[2011/02/06 03:29:58 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\CpOjBi.js
[2011/02/06 03:13:59 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\gQ216I.js
[2011/02/06 03:13:58 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\Jgs4vB.js
[2011/02/06 02:44:59 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\uhfDOgHxff.js
[2011/02/06 02:44:58 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\mzmXgN.js
[2011/02/06 02:20:58 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\gDNBK.js
[2011/02/06 02:20:58 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\CKlhxkWdT.js
[2011/02/06 02:11:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\wSX03.js
[2011/02/06 02:11:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\iLHlVZZTrQ.js
[2011/02/06 01:39:58 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\M2uukINtU5.js
[2011/02/06 01:39:58 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\Ri8087AAR9.js
[2011/02/06 01:14:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\dWfvMRqs.js
[2011/02/06 01:14:58 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\bb1E3F6.js
[2011/02/06 01:08:59 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\vHA4hCNamJ.js
[2011/02/06 01:08:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\MjnQJe.js
[2011/02/06 00:51:58 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\prfoqH6M.js
[2011/02/06 00:51:58 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\hG1ECcAcC.js
[2011/02/06 00:41:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\nYgGMn.js
[2011/02/06 00:40:59 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\pfLFZqXeg.js
[2011/02/06 00:14:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\otDKyex.js
[2011/02/06 00:14:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\laWe8B79my.js
[2011/02/06 00:03:59 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\a5GNBABE.js
[2011/02/06 00:03:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\F8NZ2i.js
[2011/02/05 23:55:59 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\pILmrqsBNw.js
[2011/02/05 23:55:59 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\RZ8jqS.js
[2011/02/05 23:26:59 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\NLrrAEMK.js
[2011/02/05 23:26:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\R109NYk.js
[2011/02/05 23:04:59 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\lgZjHjEXQJ.js
[2011/02/05 23:04:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\ZFYFxFH.js
[2011/02/05 22:59:59 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\hUEutUn.js
[2011/02/05 22:59:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\UPC8zn.js
[2011/02/05 22:26:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\SIWBGrY.js
[2011/02/05 22:26:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\RcTZO.js
[2011/02/05 21:52:59 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\vnoxWD.js
[2011/02/05 21:52:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\fCZD2kXiR.js
[2011/02/05 21:35:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\iO3EBMRK.js
[2011/02/05 21:35:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\ECQqtEps.js
[2011/02/05 21:27:59 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\VF6rnH4.js
[2011/02/05 21:27:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\rWEQDJsOP.js
[2011/02/05 21:00:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\uqBR3ht8LN.js
[2011/02/05 21:00:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\QUinNEnk3.js
[2011/02/05 20:54:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\SW0vtgF6L8.js
[2011/02/05 20:54:59 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\UkkYQ1b5.js
[2011/02/05 20:40:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\kHkBetf6q.js
[2011/02/05 20:40:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\HpiBU3MSCa.js
[2011/02/05 20:17:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\HuBBAJXu18.js
[2011/02/05 20:17:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\dCLCP.js
[2011/02/05 19:46:59 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\HXr1In.js
[2011/02/05 19:46:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\v5DWk.js
[2011/02/05 19:40:59 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\sW20LfE.js
[2011/02/05 19:40:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\y6B2VqdXF.js
[2011/02/05 19:36:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\EvZ7SlTdI.js
[2011/02/05 19:36:00 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\A7DmEwv1.js
[2011/02/05 19:11:00 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\Kk2Ac7.js
[2011/02/05 19:10:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\tdUO3CCf6.js
[2011/02/05 19:04:59 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\aqTABBc.js
[2011/02/05 19:04:59 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\QzHKKJ.js
[2011/02/05 18:51:00 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\tlgtORe8Dk.js
[2011/02/05 18:50:59 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\HK15ABJtv.js
[2011/02/05 18:31:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\R8Re71H9UZ.js
[2011/02/05 18:31:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\QtYCBMdB.js
[2011/02/05 18:10:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\vNCwN1.js
[2011/02/05 18:10:00 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\WGt2X.js
[2011/02/05 17:50:01 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\ZJyQjl5oU.js
[2011/02/05 17:50:00 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\Y1jxFhiG.js
[2011/02/05 17:44:00 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\oguOFYGwz.js
[2011/02/05 17:44:00 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\HI9mxIx6.js
[2011/02/05 17:28:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\nJHHugIIYL.js
[2011/02/05 17:28:00 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\eOc7LAc.js
[2011/02/05 17:07:00 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\ZEmsL5.js
[2011/02/05 17:07:00 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\GI01ClDy.js
[2011/02/05 16:46:01 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\aTmedYc.js
[2011/02/05 16:46:00 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\Uf6KSi4Ys.js
[2011/02/05 16:38:00 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\obwMYD.js
[2011/02/05 16:38:00 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\A9NyY.js
[2011/02/05 16:27:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\J5Kp57.js
[2011/02/05 16:27:00 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\ATffG2kQf.js
[2011/02/05 16:09:00 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\EV3xk.js
[2011/02/05 16:09:00 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\y2yVfp.js
[2011/02/05 15:35:01 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\dr5Dwu.js
[2011/02/05 15:35:00 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\BumW36fuS.js
[2011/02/05 15:24:00 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\TZQzVW5l.js
[2011/02/05 15:24:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\QKvAOh6zqb.js
[2011/02/05 15:04:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\JvTSN.js
[2011/02/05 15:04:00 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\LLPgvXtz.js
[2011/02/05 14:54:00 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\oGAYMx2.js
[2011/02/05 14:54:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\NuUUN3vTI8.js
[2011/02/05 14:43:00 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\OVDqGHVhgN.js
[2011/02/05 14:43:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\lCrNV.js
[2011/02/05 14:17:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\NxMBf0HA.js
[2011/02/05 14:17:00 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\g1IAcY7U.js
[2011/02/05 13:52:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\FRllU9.js
[2011/02/05 13:52:00 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\dOjKtPd.js
[2011/02/05 13:19:01 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\eKC6Du8.js
[2011/02/05 13:19:00 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\ATRk8yRXy3.js
[2011/02/05 13:11:04 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\Brl6qCQxp.js
[2011/02/05 13:11:01 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\awOyXeXFnl.js
[2011/02/05 12:44:01 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\pjIAj12wn.js
[2011/02/05 12:44:01 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\CFq38HB7D.js
[2011/02/05 12:36:02 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\dmeFUnj.js
[2011/02/05 12:36:01 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\LPxNhWZf.js
[2011/02/05 12:28:04 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\YuG43JQkQ.js
[2011/02/05 12:28:01 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\zYTU4DuNQd.js
[2011/02/05 12:23:01 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\I0lRLDEU5W.js
[2011/02/05 12:23:01 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\GJqlgdum2.js
[2011/02/05 12:10:01 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\iIefpceE.js
[2011/02/05 12:10:01 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\aBe5mKEb.js
[2011/02/05 12:02:03 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\vQhhpO377.js
[2011/02/05 12:02:03 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\Z2fjSL.js
[2011/02/05 11:56:01 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\dSC8Zpthr.js
[2011/02/05 11:56:01 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\vRA1WHvJ.js
[2011/02/05 11:38:01 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\Y9W7Tv.js
[2011/02/05 11:38:01 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\qszaJ.js
[2011/02/05 11:10:01 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\F8A0HuA.js
[2011/02/05 11:10:01 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\oE9B58g.js
[2011/02/05 10:37:03 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\ici1wmKhAa.js
[2011/02/05 10:37:03 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\j1quOk2JF.js
[2011/02/05 10:16:01 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\J1HwV.js
[2011/02/05 10:16:01 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\LE8bBl.js
[2011/02/05 10:08:02 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\kRbn8ztS7.js
[2011/02/05 10:08:01 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\x2t4F.js
[2011/02/05 09:45:02 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\oVRnfiziE.js
[2011/02/05 09:45:02 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\LTU3bq.js
[2011/02/05 09:13:20 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\LB1ioPW.js
[2011/02/05 09:13:20 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\RrEo6.js
[2011/02/05 09:10:30 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\lUstA37uSX.js
[2011/02/05 09:07:23 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\WUvExSSHa3.js
[2011/02/05 09:03:33 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\aQwtUkLO.js
[2011/02/05 08:33:23 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\NxChznJAcU.js
[2011/02/05 08:29:31 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\AHBIX8OXZ.js
[2011/02/05 08:08:27 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\GoZejI.js
[2011/02/05 08:00:23 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\jmjpy.js
[2011/02/05 07:58:27 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\xAtdL1y.js
[2011/02/05 07:40:28 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\KzdlnfyI.js
[2011/02/05 07:31:23 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\EKRbH.js
[2011/02/05 07:25:23 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\K78K52yIM7.js
[2011/02/05 07:24:28 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\DhHxpl85.js
[2011/02/05 07:15:23 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\pJDoivEh.js
[2011/02/05 07:13:28 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\xqAOBaK.js
[2011/02/05 07:03:25 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\D0uroyx2VB.js
[2011/02/05 07:02:33 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\pu2uKhVC7.js
[2011/02/05 06:41:23 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\vdVVgQcIWy.js
[2011/02/05 06:35:23 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\XfvTqj.js
[2011/02/05 06:30:27 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\mJpd8x0Or.js
[2011/02/05 06:18:23 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\kd7jNrDVR6.js
[2011/02/05 06:07:28 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\zMgUIa.js
[2011/02/05 05:58:28 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\OPp48DA.js
[2011/02/05 05:47:23 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\vBK07zR.js
[2011/02/05 05:24:28 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\LzYJJNm.js
[2011/02/05 05:18:23 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\x8IHlcAPCu.js
[2011/02/05 05:16:28 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\yOomd.js
[2011/02/05 04:46:28 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\IDhya9CUYh.js
[2011/02/05 04:46:23 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\cO53eNTcTv.js
[2011/02/05 04:39:32 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\pOlryw.js
[2011/02/05 04:15:24 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\Hoy9hOeN8H.js
[2011/02/05 04:08:28 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\WxKrW.js
[2011/02/05 04:08:23 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\Sguk5K2P7.js
[2011/02/05 03:57:28 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\AmZQIixNo4.js
[2011/02/05 03:46:28 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\ywRimj.js
[2011/02/05 03:41:23 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\fSb7oSq.js
[2011/02/05 03:22:28 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\MIzIk.js
[2011/02/05 03:11:25 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\LkUKPKcbL.js
[2011/02/05 02:52:29 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\cj09Tk.js
[2011/02/05 02:45:24 | 000,010,475 | —- | C] () – C:\Users\ME\AppData\Roaming\VRSefN.js
[2011/02/05 02:20:24 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\fukea.js
[2011/02/05 02:19:28 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\ZhRAX.js
[2011/02/05 02:12:28 | 000,010,474 | —- | C] () – C:\Users\ME\AppData\Roaming\Ps7BkI.js
[2011/02/05 02:08:24 | 000,010,476 | —- | C] () – C:\Users\ME\AppData\Roaming\S6ysxKjIj.js
[2011/02/05 02:03:28 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\ElbJs.js
[2011/02/05 01:41:25 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\ieCs3tCVE.js
[2011/02/05 01:35:28 | 000,010,477 | —- | C] () – C:\Users\ME\AppData\Roaming\YteusM.js
[2011/02/05 01:28:47 | 000,010,479 | —- | C] () – C:\Users\ME\AppData\Roaming\I8k1vbu4.js
[2011/02/05 01:28:47 | 000,010,478 | —- | C] () – C:\Users\ME\AppData\Roaming\NKxXtXHBRT.js
[2011/02/05 01:20:14 | 000,000,314 | —- | C] () – C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STARTUP.del
[2011/01/27 22:49:04 | 000,001,919 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/01/27 22:49:04 | 000,001,804 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011/01/20 00:12:26 | 000,001,696 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/01/20 00:09:20 | 000,001,758 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/01/12 18:07:32 | 007,785,323 | —- | C] () – C:\Users\ME\Desktop\wed_beach.jpg
[2010/08/29 02:56:36 | 000,000,024 | —- | C] () – C:\Users\ME\AppData\Roaming\hngmfc.dat
[2010/07/02 14:17:27 | 000,000,120 | —- | C] () – C:\Users\ME\AppData\Local\Hdojofezi.dat
[2010/04/05 18:55:08 | 000,004,710 | -HS- | C] () – C:\Users\ME\AppData\Local\7VJ5
[2010/04/05 18:55:08 | 000,004,710 | -HS- | C] () – C:\ProgramData\7VJ5
[2010/03/22 03:05:49 | 000,003,716 | -HS- | C] () – C:\Users\ME\AppData\Local\OIXQ
[2010/03/22 03:05:49 | 000,003,716 | -HS- | C] () – C:\ProgramData\OIXQ
[2010/03/07 03:00:19 | 000,011,620 | -HS- | C] () – C:\Users\ME\AppData\Local\8mtxM1
[2010/03/05 16:56:45 | 000,012,268 | -HS- | C] () – C:\Users\ME\AppData\Local\g4K0LbdRf
[2009/10/30 21:35:55 | 000,000,000 | —- | C] () – C:\Windows\ViewNX.INI
[2009/10/30 21:20:27 | 000,000,268 | RH– | C] () – C:\ProgramData\Enhance Timing
[2009/10/30 21:20:27 | 000,000,268 | RH– | C] () – C:\Users\ME\AppData\Roaming\Echo
[2009/10/30 21:20:27 | 000,000,020 | -H– | C] () – C:\ProgramData\PKP_DLdw.DAT
[2009/10/30 21:20:27 | 000,000,012 | RH– | C] () – C:\ProgramData\Filesystems
[2009/10/30 21:17:52 | 000,000,268 | RH– | C] () – C:\ProgramData\Electric Clav
[2009/10/30 21:17:52 | 000,000,268 | RH– | C] () – C:\Users\ME\AppData\Roaming\Drums
[2009/10/30 21:17:52 | 000,000,020 | -H– | C] () – C:\ProgramData\PKP_DLdu.DAT
[2009/10/30 21:17:52 | 000,000,012 | RH– | C] () – C:\ProgramData\Examples
[2009/10/20 12:46:19 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/10/20 12:45:40 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/09/27 17:31:46 | 000,001,958 | —- | C] () – C:\Users\ME\AppData\Roaming\SAS7_000.DAT
[2009/08/03 20:35:12 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/05/22 11:36:34 | 000,001,024 | —- | C] () – C:\Windows\SysWow64\clauth2.dll
[2009/05/22 11:36:34 | 000,001,024 | —- | C] () – C:\Windows\SysWow64\clauth1.dll
[2009/05/22 11:36:34 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\ssprs.dll
[2009/05/22 11:36:34 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\nsprs.dll
[2009/05/22 11:34:23 | 000,001,025 | —- | C] () – C:\Windows\SysWow64\sysprs7.dll
[2009/05/22 11:34:23 | 000,000,205 | —- | C] () – C:\Windows\SysWow64\lsprst7.dll
[2009/04/28 20:54:48 | 000,000,797 | —- | C] () – C:\Windows\wininit.ini
[2009/03/07 23:31:40 | 000,006,615 | —- | C] () – C:\Users\ME\AppData\Roaming\PrimoPDFSet.xml
[2009/02/22 09:57:52 | 004,421,889 | —- | C] () – C:\Windows\SysWow64\libavcodec.dll
[2009/02/18 05:57:22 | 000,557,451 | —- | C] () – C:\Windows\SysWow64\libmplayer.dll
[2009/02/16 09:19:42 | 000,790,190 | —- | C] () – C:\Windows\SysWow64\xvidcore.dll
[2009/02/16 08:32:20 | 000,425,040 | —- | C] () – C:\Windows\SysWow64\TomsMoComp_ff.dll
[2009/02/16 08:30:30 | 000,903,703 | —- | C] () – C:\Windows\SysWow64\ff_x264.dll
[2009/02/16 08:23:50 | 000,145,081 | —- | C] () – C:\Windows\SysWow64\libmpeg2_ff.dll
[2009/02/16 06:49:30 | 000,328,334 | —- | C] () – C:\Windows\SysWow64\ff_kernelDeint.dll
[2009/02/14 07:15:42 | 000,486,400 | —- | C] () – C:\Windows\SysWow64\ff_libfaad2.dll
[2009/02/09 14:28:18 | 000,098,304 | —- | C] () – C:\Windows\SysWow64\ff_wmv9.dll
[2009/02/09 12:19:18 | 000,183,296 | —- | C] () – C:\Windows\SysWow64\ff_samplerate.dll
[2009/02/09 12:19:12 | 000,178,688 | —- | C] () – C:\Windows\SysWow64\ff_libmad.dll
[2009/02/09 12:18:52 | 000,113,152 | —- | C] () – C:\Windows\SysWow64\ff_unrar.dll
[2009/02/09 12:18:32 | 000,146,944 | —- | C] () – C:\Windows\SysWow64\ff_tremor.dll
[2009/02/09 12:18:24 | 000,257,024 | —- | C] () – C:\Windows\SysWow64\ff_libdts.dll
[2009/02/09 12:18:20 | 000,142,848 | —- | C] () – C:\Windows\SysWow64\ff_liba52.dll
[2009/02/09 11:56:22 | 000,067,584 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2009/02/01 18:08:59 | 000,020,898 | —- | C] () – C:\Users\ME\AppData\Roaming\wklnhst.dat
[2009/01/25 00:03:39 | 000,175,616 | —- | C] () – C:\Users\ME\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/01/24 18:28:47 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/01/10 14:17:32 | 000,163,840 | —- | C] () – C:\Windows\SysWow64\ts.dll
[2009/01/10 14:16:56 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\mkx.dll
[2009/01/10 14:16:50 | 000,108,032 | —- | C] () – C:\Windows\SysWow64\avi.dll
[2009/01/10 14:16:14 | 000,141,312 | —- | C] () – C:\Windows\SysWow64\mp4.dll
[2009/01/10 14:15:54 | 000,120,832 | —- | C] () – C:\Windows\SysWow64\ogm.dll
[2009/01/10 14:15:44 | 000,159,744 | —- | C] () – C:\Windows\SysWow64\mmfinfo.dll
[2009/01/10 14:15:32 | 000,102,400 | —- | C] () – C:\Windows\SysWow64\avss.dll
[2009/01/10 14:15:28 | 000,246,784 | —- | C] () – C:\Windows\SysWow64\dxr.dll
[2009/01/10 14:15:12 | 000,097,280 | —- | C] () – C:\Windows\SysWow64\avs.dll
[2009/01/10 14:14:08 | 000,079,360 | —- | C] () – C:\Windows\SysWow64\mkzlib.dll
[2009/01/10 14:14:06 | 000,023,552 | —- | C] () – C:\Windows\SysWow64\mkunicode.dll
[2008/12/24 03:06:45 | 000,000,870 | —- | C] () – C:\Windows\mhotkey_reg.ini
[2008/12/24 03:06:44 | 000,294,912 | —- | C] () – C:\Windows\PIC.dll
[2008/12/03 14:11:50 | 000,180,224 | —- | C] () – C:\Windows\SysWow64\xvidvfw.dll
[2008/11/06 08:37:32 | 003,596,288 | —- | C] () – C:\Windows\SysWow64\qt-dx331.dll
[2008/04/28 09:13:33 | 000,000,310 | —- | C] () – C:\Windows\primopdf.ini
[2008/01/20 18:50:05 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2007/10/13 01:30:20 | 000,000,137 | —- | C] () – C:\Windows\SysWow64\Registration.ini
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\Windows\SysWow64\OUTLPERF.INI

========== Alternate Data Streams ==========

@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:F35A93AD

< End of report >
Post #12
Hi UC_Caifan,

The .bat files seem to have been removed.

Next, Right click on OTL.exe and chose Run as Administrator to run it
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:OTL
FF - prefs.js..extensions.enabledItems: {9C14CB18-1C29-4321-9F2E-E2841195CB52}:1.9.1
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
[2011/02/09 12:13:45 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\craeKUtJYM.js
[2011/02/09 11:58:45 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\OcqzH4UKqF.js
[2011/02/09 11:38:45 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\mMrJuGMY4.js
[2011/02/09 11:08:45 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CppmF.js
[2011/02/09 10:53:45 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CXuuRcs.js
[2011/02/09 10:28:45 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\A3rsnq6.js
[2011/02/09 10:03:45 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\jGKhLdC.js
[2011/02/09 09:44:42 | 000,000,119 | —- | M] () – C:\Users\ME\webct_upload_applet.properties
[2011/02/09 09:41:45 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\H1vOQ8rCJ.js
[2011/02/09 09:11:45 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\cpgZmQg.js
[2011/02/09 08:47:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\X4ldrrnO.js
[2011/02/09 08:29:45 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\wJmb346Ko.js
[2011/02/09 08:10:45 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\RJDUFeNwp3.js
[2011/02/09 07:46:45 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\leT6CPuOtN.js
[2011/02/09 07:32:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\LRH847Bb.js
[2011/02/09 07:07:45 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\YTVoj.js
[2011/02/09 06:44:45 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\xLNzQ1gc.js
[2011/02/09 06:11:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Cb588VTFVA.js
[2011/02/09 05:56:46 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\d6ogIJPn.js
[2011/02/09 05:33:46 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\wNo5Y9ldRY.js
[2011/02/09 05:04:46 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\pVCbK6rg.js
[2011/02/09 04:31:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\yXtV3OJGD.js
[2011/02/09 03:44:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\y7PNPj3uQ.js
[2011/02/09 03:14:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\q5XkUwoy9.js
[2011/02/09 02:44:46 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\NJrqOY0wwe.js
[2011/02/09 02:24:46 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\dXAuXsKjN.js
[2011/02/09 01:52:46 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\uYaIu.js
[2011/02/09 01:09:46 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\M4eXMoJc.js
[2011/02/09 00:39:49 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\XUdiJyWMeu.js
[2011/02/08 23:27:07 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LQYqy2w5X.js
[2011/02/08 22:54:06 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\jB8fgdtR.js
[2011/02/08 22:29:07 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\fHwLcbBy.js
[2011/02/08 22:07:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\hE0I2uB.js
[2011/02/08 22:02:07 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\P9fxpG.js
[2011/02/08 21:57:07 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\TFjKw1YN.js
[2011/02/08 21:48:07 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\XTLMHHZb.js
[2011/02/08 21:15:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\eaIfy6ehPM.js
[2011/02/08 20:49:07 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\E98Q8Md.js
[2011/02/08 20:17:07 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\e9ubU3.js
[2011/02/08 20:09:07 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Pwyqn7QRXE.js
[2011/02/08 19:52:07 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\bw0ix.js
[2011/02/08 19:26:07 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\SV3aRUF.js
[2011/02/08 19:15:07 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\j0DyJ.js
[2011/02/08 18:47:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\w0Lw0.js
[2011/02/08 18:31:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\acqUdr5Zcv.js
[2011/02/08 18:16:07 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\OUv4hK6EN.js
[2011/02/08 17:43:07 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\w8r2iCR7Y.js
[2011/02/08 17:21:07 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\uFvuQoAWo.js
[2011/02/08 17:04:07 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\z3Dimy.js
[2011/02/08 16:49:07 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\pm0kxWu.js
[2011/02/08 16:16:08 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\YxuqEtI.js
[2011/02/08 15:47:08 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\nva4aaj.js
[2011/02/08 15:16:08 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\wIvDydTK.js
[2011/02/08 14:45:08 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\V2beyf.js
[2011/02/08 14:20:08 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\TDcS47.js
[2011/02/08 13:47:08 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\iLQt3lx.js
[2011/02/08 13:26:08 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\uHOubA.js
[2011/02/08 13:11:08 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\jVCkj.js
[2011/02/08 12:56:09 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Agosup.js
[2011/02/08 12:48:08 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ucVnJy7q4l.js
[2011/02/08 12:23:08 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\mqpOkZr.js
[2011/02/08 12:18:08 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\TWSir2.js
[2011/02/08 11:50:09 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\Qj8a5Z.js
[2011/02/08 11:27:09 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\wzmZh.js
[2011/02/08 11:13:09 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\GPojk3Qyx.js
[2011/02/08 10:47:09 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\pXTV4u.js
[2011/02/08 10:42:09 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\gpkP1Et.js
[2011/02/08 10:17:09 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LxGUn.js
[2011/02/08 09:46:09 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\DJENA87.js
[2011/02/08 09:28:09 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\sk0BBer.js
[2011/02/08 09:13:09 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\PEIFUkTm1O.js
[2011/02/08 08:55:09 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\UxUQmzEQz.js
[2011/02/08 08:48:09 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zHaTlM.js
[2011/02/08 08:34:13 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\fEAfhLa8B.js
[2011/02/08 08:29:09 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\c2ShT0k.js
[2011/02/08 08:17:10 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\CsyKo3.js
[2011/02/08 08:01:09 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\biZlQ7.js
[2011/02/08 07:28:09 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\PMQpOIv3rn.js
[2011/02/08 06:56:09 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\qv2b3L.js
[2011/02/08 06:22:09 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\se7hFR9L.js
[2011/02/08 06:03:09 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\eOVAVgI.js
[2011/02/08 05:34:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Zg7QMGV5.js
[2011/02/08 05:20:10 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\qsBLCJFW.js
[2011/02/08 04:53:10 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\snqXvjQ.js
[2011/02/08 04:37:10 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\Fws1d87.js
[2011/02/08 04:04:10 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\oIrGdl8.js
[2011/02/08 03:59:10 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\tV2VQsySmM.js
[2011/02/08 03:39:10 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\DYqRMk.js
[2011/02/08 03:24:10 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\g1Opa.js
[2011/02/08 02:50:10 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CIodpU496.js
[2011/02/08 02:25:10 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Ypj99D.js
[2011/02/08 01:53:10 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\CVjaaxJU.js
[2011/02/08 01:30:10 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\lZLgG7Sz3B.js
[2011/02/08 01:02:11 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\XOJQY.js
[2011/02/08 00:33:10 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\CyzcXMt.js
[2011/02/08 00:25:10 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\GqJce.js
[2011/02/07 23:55:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\STtehYnOqp.js
[2011/02/07 23:26:11 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ZMaP0.js
[2011/02/07 22:53:11 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\ytkn9QAidu.js
[2011/02/07 22:30:11 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\iBpUHWw.js
[2011/02/07 21:59:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\iqNrI.js
[2011/02/07 21:27:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\tQzB7v.js
[2011/02/07 21:14:11 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\StCTkvYwn.js
[2011/02/07 20:59:11 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\m3Nur4zOvw.js
[2011/02/07 20:48:12 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\djWfzNeba.js
[2011/02/07 20:29:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Gc7QY.js
[2011/02/07 20:22:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\DGsHr.js
[2011/02/07 19:54:11 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\gvsFHTls.js
[2011/02/07 19:20:11 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\zVa1Vpgaa.js
[2011/02/07 18:50:11 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\l5ekK0bAHE.js
[2011/02/07 18:18:11 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\srcaH.js
[2011/02/07 17:56:12 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\OknIKMgbwl.js
[2011/02/07 17:40:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\SNuB8O.js
[2011/02/07 17:22:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\taoTvreZ.js
[2011/02/07 17:13:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\aMBml.js
[2011/02/07 16:48:12 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\N2judg.js
[2011/02/07 16:29:12 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\XTOtPmuuxi.js
[2011/02/07 15:55:12 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\dayAK7iyOC.js
[2011/02/07 15:21:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\V7L46Dyv.js
[2011/02/07 15:07:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\XNcqtrp.js
[2011/02/07 14:46:12 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Q4xsR3.js
[2011/02/07 14:29:12 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\Bj1Nb.js
[2011/02/07 14:00:12 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\n1wnym7jJh.js
[2011/02/07 13:33:12 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\d0x7D.js
[2011/02/07 13:14:12 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ohy22.js
[2011/02/07 12:55:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\PNzMAKMWr.js
[2011/02/07 12:29:13 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\zlNMDeU.js
[2011/02/07 11:55:13 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\WZtSHj.js
[2011/02/07 11:38:14 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\AsMHkfa.js
[2011/02/07 11:28:12 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\JO0ZoaK.js
[2011/02/07 11:09:14 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\ofFJr.js
[2011/02/07 10:42:11 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\nTPWpNKYpt.js
[2011/02/07 10:25:14 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\K302eM.js
[2011/02/07 08:56:53 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LOCm0nXR.js
[2011/02/07 08:56:53 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\Bqx1ThY7z1.js
[2011/02/07 08:37:53 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\iy5vaLVv6.js
[2011/02/07 08:37:53 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\WSavE7h0tx.js
[2011/02/07 08:26:53 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\amxjTPCe.js
[2011/02/07 08:26:53 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\V5oUNa2q0.js
[2011/02/07 08:09:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\RVTjR0QU.js
[2011/02/07 08:09:54 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\IwI4mo.js
[2011/02/07 07:36:53 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\yDML6.js
[2011/02/07 07:36:53 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\qAG2ppjgD.js
[2011/02/07 07:11:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\LKnZsqk.js
[2011/02/07 07:11:53 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\CfLks8NJ.js
[2011/02/07 07:06:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\cPXfZ.js
[2011/02/07 07:06:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\r1ztAPj.js
[2011/02/07 06:38:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\yEsA5E4WH.js
[2011/02/07 06:38:53 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\tNfidb.js
[2011/02/07 06:08:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\dte2Q7Tt.js
[2011/02/07 06:08:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\btW1WZ.js
[2011/02/07 05:43:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\JXoI2.js
[2011/02/07 05:43:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\f5XhVDzaXc.js
[2011/02/07 05:23:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Wp4LZT.js
[2011/02/07 05:23:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\ctWrd.js
[2011/02/07 04:57:54 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\uSYYTZl.js
[2011/02/07 04:57:54 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\JOldF.js
[2011/02/07 04:41:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\UEJnTbSUU.js
[2011/02/07 04:41:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\AOF0DfX.js
[2011/02/07 04:16:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\xDjse2nNz.js
[2011/02/07 04:16:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\FBCzHBf1G7.js
[2011/02/07 03:59:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\LT5iX.js
[2011/02/07 03:59:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\fn3Ld.js
[2011/02/07 03:38:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ENGstp.js
[2011/02/07 03:38:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\FXVjT2G9l.js
[2011/02/07 03:10:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\nUElDpmK.js
[2011/02/07 03:10:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zBoOkX.js
[2011/02/07 02:38:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\b18PcHi.js
[2011/02/07 02:38:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\C4ZDD9iMq.js
[2011/02/07 02:21:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\OcQP1Dk.js
[2011/02/07 02:21:54 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\SYI4Re.js
[2011/02/07 01:53:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\hPe45X.js
[2011/02/07 01:53:54 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\nV6K9G2.js
[2011/02/07 01:27:54 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\oaMYGOwA1c.js
[2011/02/07 01:27:54 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\jtb433vcI.js
[2011/02/07 01:05:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\X4yLT9USvJ.js
[2011/02/07 01:05:54 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\W8ckTByHyM.js
[2011/02/07 00:47:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Jatrz950yW.js
[2011/02/07 00:47:54 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\dnlEfngP.js
[2011/02/07 00:15:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ZVUyQfw.js
[2011/02/07 00:15:55 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\UuAKaVkN6.js
[2011/02/06 23:49:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\wmNPefQHa.js
[2011/02/06 23:49:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\V2D9Ss.js
[2011/02/06 23:33:55 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\FsAVw.js
[2011/02/06 23:33:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\OhR8u.js
[2011/02/06 23:23:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\PUYsTcBAR.js
[2011/02/06 23:23:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\hmtZM9o.js
[2011/02/06 23:16:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Go28TgQ.js
[2011/02/06 23:16:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\AcwIC.js
[2011/02/06 22:46:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\rZi22S.js
[2011/02/06 22:46:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\bl4yTmFmDW.js
[2011/02/06 22:31:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\g5sJJwa.js
[2011/02/06 22:31:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\DKZ0LJ6CUr.js
[2011/02/06 22:17:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\OWKCXRh5Qa.js
[2011/02/06 22:17:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\HItuR4gz.js
[2011/02/06 21:53:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\d3aR4V.js
[2011/02/06 21:53:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\YuP8AF1C.js
[2011/02/06 21:43:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\h4PBwK2.js
[2011/02/06 21:43:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\R2SqZ9IR.js
[2011/02/06 21:25:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\w6cF7uYptm.js
[2011/02/06 21:25:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\wTDE6Mkmo.js
[2011/02/06 21:13:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\tK2eV.js
[2011/02/06 21:13:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\Q1rUE8X.js
[2011/02/06 20:56:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\MjFzvmf9.js
[2011/02/06 20:56:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\DsvR48x.js
[2011/02/06 20:26:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\bZAjrK.js
[2011/02/06 20:26:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\DWBVhohI.js
[2011/02/06 20:19:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\T1NETq.js
[2011/02/06 20:19:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\HTiCx4CDv1.js
[2011/02/06 19:53:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\drNtsto.js
[2011/02/06 19:53:55 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\dbr3AHYGI.js
[2011/02/06 19:28:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\UXbJS.js
[2011/02/06 19:28:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Py3jQSvlfv.js
[2011/02/06 19:12:55 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\yySfWWmUi.js
[2011/02/06 19:12:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\vWoD9.js
[2011/02/06 19:05:55 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\t5hjLgiOqr.js
[2011/02/06 19:05:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\z4ETJD.js
[2011/02/06 18:56:55 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\yMc6km.js
[2011/02/06 18:56:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ZnTXU2GR.js
[2011/02/06 18:41:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\AKDT9ulFw.js
[2011/02/06 18:41:55 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\HyLPVnnkE.js
[2011/02/06 18:35:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\grrHsAu19.js
[2011/02/06 18:35:55 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\aURp8.js
[2011/02/06 18:19:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\oJPNF7.js
[2011/02/06 18:19:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\T4661p1u.js
[2011/02/06 17:56:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\t4ul3pZJ.js
[2011/02/06 17:56:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Q4EV17eOx.js
[2011/02/06 17:44:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\MD98a6xQCn.js
[2011/02/06 17:44:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\QjFWk0OsQ0.js
[2011/02/06 17:35:56 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\OA9mjisZQY.js
[2011/02/06 17:35:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\F4dnEg.js
[2011/02/06 17:10:56 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\W6jWmxj4k.js
[2011/02/06 17:10:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\c1GlA.js
[2011/02/06 16:37:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\rk9ihb1kO.js
[2011/02/06 16:37:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\JBrSYu.js
[2011/02/06 16:05:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\u44gwAOK7Z.js
[2011/02/06 16:05:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\o8JlSYbgBR.js
[2011/02/06 15:59:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\YwE8VQz7.js
[2011/02/06 15:59:56 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\H04Vz.js
[2011/02/06 15:51:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\wZlG0xBOyy.js
[2011/02/06 15:51:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\g69x53Jl.js
[2011/02/06 15:17:56 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\jWyuJVH8b.js
[2011/02/06 15:17:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CSHR2qUvZ.js
[2011/02/06 14:47:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\u9nrxO83.js
[2011/02/06 14:47:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\AdeDWuoA.js
[2011/02/06 14:40:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\slqGRej.js
[2011/02/06 14:40:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\BGa6s0.js
[2011/02/06 14:27:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\evkOvv.js
[2011/02/06 14:27:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\hjNhwjI7.js
[2011/02/06 14:06:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\xRrgk.js
[2011/02/06 14:06:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ndNhN.js
[2011/02/06 13:56:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\kPKGv.js
[2011/02/06 13:56:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zLPTzdK1Ir.js
[2011/02/06 13:42:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\mhAakY.js
[2011/02/06 13:42:56 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\JFTGb4qqAy.js
[2011/02/06 13:32:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\MuHqorJzm.js
[2011/02/06 13:32:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\YdkR5rdZMA.js
[2011/02/06 13:26:56 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\PMhTW.js
[2011/02/06 13:26:56 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\iuHpxE.js
[2011/02/06 13:12:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\jhTzWF.js
[2011/02/06 13:12:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\hYKsQ.js
[2011/02/06 12:50:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\NzZvCTW1K8.js
[2011/02/06 12:50:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ZX63ned.js
[2011/02/06 12:29:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\H7oYd42u.js
[2011/02/06 12:29:56 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\FC9JzKDNu.js
[2011/02/06 12:01:57 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\Oc8E6oK21.js
[2011/02/06 12:01:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\ryuwx9oQvD.js
[2011/02/06 11:29:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\TGfy0n609.js
[2011/02/06 11:29:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\TasShn8I.js
[2011/02/06 11:07:57 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\ATIw2OOXzj.js
[2011/02/06 11:07:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\pkKXgg5.js
[2011/02/06 11:02:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\fo2fAb.js
[2011/02/06 11:01:57 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\ghFqdEHLy.js
[2011/02/06 10:39:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\xdkA40.js
[2011/02/06 10:39:57 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\d3G7H9n8.js
[2011/02/06 10:09:57 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\xkGJO.js
[2011/02/06 10:09:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\eJqLx8s.js
[2011/02/06 10:01:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\QWEa2.js
[2011/02/06 10:01:57 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\uQMZ3pR.js
[2011/02/06 09:43:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\PpAKTUN.js
[2011/02/06 09:43:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\CWNha68W.js
[2011/02/06 09:11:57 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\YOfsog8.js
[2011/02/06 09:11:57 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\IZvcNi7.js
[2011/02/06 09:06:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\eW1t1hHxn.js
[2011/02/06 09:06:57 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\GIwDob8nV3.js
[2011/02/06 08:38:57 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\eVjSbJH8.js
[2011/02/06 08:38:57 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\v1Vsb8.js
[2011/02/06 08:11:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\S1gaTb.js
[2011/02/06 08:11:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\ilNucUckI.js
[2011/02/06 07:53:57 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\wxTzLwcA.js
[2011/02/06 07:53:57 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\BDt2C1GzO9.js
[2011/02/06 07:47:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\FiFLSQy1.js
[2011/02/06 07:47:57 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\BUn9BWBz.js
[2011/02/06 07:26:02 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\WPHDOxIR1t.js
[2011/02/06 07:25:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LWMV42.js
[2011/02/06 06:58:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\SsZXYjr.js
[2011/02/06 06:26:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\BeVEM.js
[2011/02/06 06:26:58 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\l2XfkmDX.js
[2011/02/06 06:19:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\gxq9xY.js
[2011/02/06 06:19:58 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\cAEb2Jv.js
[2011/02/06 05:57:03 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\dKvx48ga.js
[2011/02/06 05:56:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\QW9UbDs9T.js
[2011/02/06 05:39:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\G7Z9kzjPv.js
[2011/02/06 05:39:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\xiccG345si.js
[2011/02/06 05:12:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ENfeqdIW4l.js
[2011/02/06 05:12:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\QhuieE3NXl.js
[2011/02/06 05:00:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\i52vtewad.js
[2011/02/06 05:00:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\sh0Ntlem.js
[2011/02/06 04:56:00 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\CvGn8j86.js
[2011/02/06 04:55:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Ze7KTM.js
[2011/02/06 04:39:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\PLo1F.js
[2011/02/06 04:39:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ecLC5c.js
[2011/02/06 04:14:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\GneGd2CN.js
[2011/02/06 04:14:58 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\ApiRfOxb9f.js
[2011/02/06 04:05:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\hsAgThf.js
[2011/02/06 04:05:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\HF5Vy.js
[2011/02/06 03:38:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\pPdjln.js
[2011/02/06 03:38:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\NyYdw93O.js
[2011/02/06 03:29:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\u1V0I.js
[2011/02/06 03:29:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CpOjBi.js
[2011/02/06 03:13:59 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\gQ216I.js
[2011/02/06 03:13:58 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Jgs4vB.js
[2011/02/06 02:44:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\uhfDOgHxff.js
[2011/02/06 02:44:58 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\mzmXgN.js
[2011/02/06 02:20:58 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\gDNBK.js
[2011/02/06 02:20:58 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\CKlhxkWdT.js
[2011/02/06 02:11:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\wSX03.js
[2011/02/06 02:11:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\iLHlVZZTrQ.js
[2011/02/06 01:39:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\M2uukINtU5.js
[2011/02/06 01:39:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Ri8087AAR9.js
[2011/02/06 01:14:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\dWfvMRqs.js
[2011/02/06 01:14:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\bb1E3F6.js
[2011/02/06 01:09:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\vHA4hCNamJ.js
[2011/02/06 01:08:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\MjnQJe.js
[2011/02/06 00:51:58 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\prfoqH6M.js
[2011/02/06 00:51:58 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\hG1ECcAcC.js
[2011/02/06 00:41:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\nYgGMn.js
[2011/02/06 00:40:59 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\pfLFZqXeg.js
[2011/02/06 00:14:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\otDKyex.js
[2011/02/06 00:14:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\laWe8B79my.js
[2011/02/06 00:03:59 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\a5GNBABE.js
[2011/02/06 00:03:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\F8NZ2i.js
[2011/02/05 23:55:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\pILmrqsBNw.js
[2011/02/05 23:55:59 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\RZ8jqS.js
[2011/02/05 23:26:59 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\NLrrAEMK.js
[2011/02/05 23:26:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\R109NYk.js
[2011/02/05 23:04:59 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\lgZjHjEXQJ.js
[2011/02/05 23:04:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\ZFYFxFH.js
[2011/02/05 22:59:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\hUEutUn.js
[2011/02/05 22:59:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\UPC8zn.js
[2011/02/05 22:26:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\SIWBGrY.js
[2011/02/05 22:26:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\RcTZO.js
[2011/02/05 21:52:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\vnoxWD.js
[2011/02/05 21:52:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\fCZD2kXiR.js
[2011/02/05 21:35:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\iO3EBMRK.js
[2011/02/05 21:35:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ECQqtEps.js
[2011/02/05 21:27:59 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\VF6rnH4.js
[2011/02/05 21:27:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\rWEQDJsOP.js
[2011/02/05 21:00:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\uqBR3ht8LN.js
[2011/02/05 21:00:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\QUinNEnk3.js
[2011/02/05 20:54:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\SW0vtgF6L8.js
[2011/02/05 20:54:59 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\UkkYQ1b5.js
[2011/02/05 20:40:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\kHkBetf6q.js
[2011/02/05 20:40:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\HpiBU3MSCa.js
[2011/02/05 20:17:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\HuBBAJXu18.js
[2011/02/05 20:17:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\dCLCP.js
[2011/02/05 19:46:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\HXr1In.js
[2011/02/05 19:46:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\v5DWk.js
[2011/02/05 19:40:59 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\sW20LfE.js
[2011/02/05 19:40:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\y6B2VqdXF.js
[2011/02/05 19:36:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\EvZ7SlTdI.js
[2011/02/05 19:36:00 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\A7DmEwv1.js
[2011/02/05 19:11:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\Kk2Ac7.js
[2011/02/05 19:10:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\tdUO3CCf6.js
[2011/02/05 19:04:59 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\aqTABBc.js
[2011/02/05 19:04:59 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\QzHKKJ.js
[2011/02/05 18:51:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\tlgtORe8Dk.js
[2011/02/05 18:50:59 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\HK15ABJtv.js
[2011/02/05 18:31:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\R8Re71H9UZ.js
[2011/02/05 18:31:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\QtYCBMdB.js
[2011/02/05 18:10:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\vNCwN1.js
[2011/02/05 18:10:00 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\WGt2X.js
[2011/02/05 17:50:01 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ZJyQjl5oU.js
[2011/02/05 17:50:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\Y1jxFhiG.js
[2011/02/05 17:44:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\oguOFYGwz.js
[2011/02/05 17:44:00 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\HI9mxIx6.js
[2011/02/05 17:28:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\nJHHugIIYL.js
[2011/02/05 17:28:00 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\eOc7LAc.js
[2011/02/05 17:07:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ZEmsL5.js
[2011/02/05 17:07:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\GI01ClDy.js
[2011/02/05 16:46:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\aTmedYc.js
[2011/02/05 16:46:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\Uf6KSi4Ys.js
[2011/02/05 16:38:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\obwMYD.js
[2011/02/05 16:38:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\A9NyY.js
[2011/02/05 16:27:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\J5Kp57.js
[2011/02/05 16:27:00 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\ATffG2kQf.js
[2011/02/05 16:09:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\EV3xk.js
[2011/02/05 16:09:00 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\y2yVfp.js
[2011/02/05 15:35:01 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\dr5Dwu.js
[2011/02/05 15:35:00 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\BumW36fuS.js
[2011/02/05 15:24:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\TZQzVW5l.js
[2011/02/05 15:24:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\QKvAOh6zqb.js
[2011/02/05 15:04:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\JvTSN.js
[2011/02/05 15:04:00 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\LLPgvXtz.js
[2011/02/05 14:54:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\oGAYMx2.js
[2011/02/05 14:54:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\NuUUN3vTI8.js
[2011/02/05 14:43:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\OVDqGHVhgN.js
[2011/02/05 14:43:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\lCrNV.js
[2011/02/05 14:17:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\NxMBf0HA.js
[2011/02/05 14:17:00 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\g1IAcY7U.js
[2011/02/05 13:52:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\FRllU9.js
[2011/02/05 13:52:00 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\dOjKtPd.js
[2011/02/05 13:19:01 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\eKC6Du8.js
[2011/02/05 13:19:00 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ATRk8yRXy3.js
[2011/02/05 13:11:04 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\Brl6qCQxp.js
[2011/02/05 13:11:01 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\awOyXeXFnl.js
[2011/02/05 12:44:01 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\pjIAj12wn.js
[2011/02/05 12:44:01 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\CFq38HB7D.js
[2011/02/05 12:36:02 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\dmeFUnj.js
[2011/02/05 12:36:01 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\LPxNhWZf.js
[2011/02/05 12:28:04 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\YuG43JQkQ.js
[2011/02/05 12:28:01 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zYTU4DuNQd.js
[2011/02/05 12:23:01 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\I0lRLDEU5W.js
[2011/02/05 12:23:01 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\GJqlgdum2.js
[2011/02/05 12:10:01 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\iIefpceE.js
[2011/02/05 12:10:01 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\aBe5mKEb.js
[2011/02/05 12:02:03 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\vQhhpO377.js
[2011/02/05 12:02:03 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Z2fjSL.js
[2011/02/05 11:56:01 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\dSC8Zpthr.js
[2011/02/05 11:56:01 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\vRA1WHvJ.js
[2011/02/05 11:38:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\Y9W7Tv.js
[2011/02/05 11:38:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\qszaJ.js
[2011/02/05 11:10:01 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\F8A0HuA.js
[2011/02/05 11:10:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\oE9B58g.js
[2011/02/05 10:37:03 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\ici1wmKhAa.js
[2011/02/05 10:37:03 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\j1quOk2JF.js
[2011/02/05 10:16:01 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\J1HwV.js
[2011/02/05 10:16:01 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\LE8bBl.js
[2011/02/05 10:08:02 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\kRbn8ztS7.js
[2011/02/05 10:08:01 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\x2t4F.js
[2011/02/05 09:45:02 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\oVRnfiziE.js
[2011/02/05 09:45:02 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\LTU3bq.js
[2011/02/05 09:13:21 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\LB1ioPW.js
[2011/02/05 09:13:21 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\RrEo6.js
[2011/02/05 09:10:30 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\lUstA37uSX.js
[2011/02/05 09:07:23 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\WUvExSSHa3.js
[2011/02/05 09:03:33 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\aQwtUkLO.js
[2011/02/05 08:33:23 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\NxChznJAcU.js
[2011/02/05 08:29:31 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\AHBIX8OXZ.js
[2011/02/05 08:08:27 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\GoZejI.js
[2011/02/05 08:00:23 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\jmjpy.js
[2011/02/05 07:58:27 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\xAtdL1y.js
[2011/02/05 07:40:28 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\KzdlnfyI.js
[2011/02/05 07:31:23 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\EKRbH.js
[2011/02/05 07:25:23 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\K78K52yIM7.js
[2011/02/05 07:24:28 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\DhHxpl85.js
[2011/02/05 07:15:23 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\pJDoivEh.js
[2011/02/05 07:13:28 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\xqAOBaK.js
[2011/02/05 07:03:25 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\D0uroyx2VB.js
[2011/02/05 07:02:33 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\pu2uKhVC7.js
[2011/02/05 06:41:23 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\vdVVgQcIWy.js
[2011/02/05 06:35:23 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\XfvTqj.js
[2011/02/05 06:30:27 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\mJpd8x0Or.js
[2011/02/05 06:18:23 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\kd7jNrDVR6.js
[2011/02/05 06:07:28 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\zMgUIa.js
[2011/02/05 05:58:28 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\OPp48DA.js
[2011/02/05 05:47:23 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\vBK07zR.js
[2011/02/05 05:24:28 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\LzYJJNm.js
[2011/02/05 05:18:23 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\x8IHlcAPCu.js
[2011/02/05 05:16:28 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\yOomd.js
[2011/02/05 04:46:28 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\IDhya9CUYh.js
[2011/02/05 04:46:23 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\cO53eNTcTv.js
[2011/02/05 04:39:32 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\pOlryw.js
[2011/02/05 04:15:24 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Hoy9hOeN8H.js
[2011/02/05 04:08:28 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\WxKrW.js
[2011/02/05 04:08:23 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\Sguk5K2P7.js
[2011/02/05 03:57:28 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\AmZQIixNo4.js
[2011/02/05 03:46:28 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ywRimj.js
[2011/02/05 03:41:23 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\fSb7oSq.js
[2011/02/05 03:22:28 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\MIzIk.js
[2011/02/05 03:11:25 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\LkUKPKcbL.js
[2011/02/05 02:52:29 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\cj09Tk.js
[2011/02/05 02:45:24 | 000,010,475 | —- | M] () – C:\Users\ME\AppData\Roaming\VRSefN.js
[2011/02/05 02:20:24 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\fukea.js
[2011/02/05 02:19:28 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\ZhRAX.js
[2011/02/05 02:12:28 | 000,010,474 | —- | M] () – C:\Users\ME\AppData\Roaming\Ps7BkI.js
[2011/02/05 02:08:24 | 000,010,476 | —- | M] () – C:\Users\ME\AppData\Roaming\S6ysxKjIj.js
[2011/02/05 02:03:28 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\ElbJs.js
[2011/02/05 01:41:25 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\ieCs3tCVE.js
[2011/02/05 01:35:28 | 000,010,477 | —- | M] () – C:\Users\ME\AppData\Roaming\YteusM.js
[2011/02/05 01:28:47 | 000,010,479 | —- | M] () – C:\Users\ME\AppData\Roaming\I8k1vbu4.js
[2011/02/05 01:28:47 | 000,010,478 | —- | M] () – C:\Users\ME\AppData\Roaming\NKxXtXHBRT.js
2010/08/29 02:56:36 | 000,000,024 | —- | C] () – C:\Users\ME\AppData\Roaming\hngmfc.dat
[2010/07/02 14:17:27 | 000,000,120 | —- | C] () – C:\Users\ME\AppData\Local\Hdojofezi.dat

:Reg

:Files
C:\Users\ME\AppData\Local\{9C14CB18-1C29-4321-9F2E-E2841195CB52}
:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered

Next

Please open OTL if it is not opened after the reboot.

  • When the window appears, underneath Output at the top change it to Minimal Output
  • UNCheck the boxes beside LOP Check and Purity Check.
  • In the window under Custom Scans/Fixes copy and paste the following


    C:\USERS\ME\APPDATA\LOCAL\{EC8586B6-FD1A-40BE-B6F3-1BBE89389810}*.* /s
    /md5start
    STARTUP.del
    wuaucldt.exe
    /md5stop


  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window, OTL.Txt. Please post this log.

Please post back with
  • OTL.txt
How is the computer?

Thanks
Post #13
Hi oldman 960,

the computer is running well. no malware symptoms present right now thanks to your help.

here is the log:


OTL logfile created on: 2/10/2011 11:53:20 PM - Run 2
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\ME\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 59.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 586.40 Gb Total Space | 285.01 Gb Free Space | 48.60% Space Free | Partition Type: NTFS

Computer Name: JOSEDESKTOP | User Name: ME | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\ME\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\ME\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.)
PRC - C:\Program Files (x86)\Greatis\RegRunSuite\WatchDog.exe (Greatis Software)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
PRC - C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
PRC - C:\Windows\mHotkey.exe ()
PRC - C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe (IOI)
PRC - C:\Windows\CNYHKey.exe (Creative)
PRC - C:\Windows\ChiFuncExt.exe (Chicony)
PRC - C:\Windows\ModLEDKey.exe (Chicony)
PRC - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\ME\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\sfc_os.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\sfc.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msiltcfg.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (Ati External Event Utility) – C:\Windows\SysNative\Ati2evxx.exe (ATI Technologies Inc.)
SRV:64bit: - (ETService) – C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AgereModemAudio) – C:\Windows\SysNative\agr64svc.exe (Agere Systems)
SRV:64bit: - (yksvc) – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
SRV - (BootlogService) – C:\Program Files (x86)\Greatis\RegRunSuite\BootLogService.exe (Greatis Software ©)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (GameConsoleService) – C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe (WildTangent, Inc.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\Drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\DRIVERS\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (RTHDMIAzAudService) – C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (yukonx64) – C:\Windows\SysNative\DRIVERS\yk60x64.sys (Marvell)
DRV:64bit: - (RTSTOR) – C:\Windows\SysNative\drivers\RTSTOR64.SYS (Realtek Semiconductor Corp.)
DRV:64bit: - (AtiPcie) ATI PCI Express (3GIO) – C:\Windows\SysNative\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV:64bit: - (AgereSoftModem) – C:\Windows\SysNative\DRIVERS\agrsm64.sys (Agere Systems)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV - (RegGuard) – C:\Windows\SysWOW64\drivers\regguard.sys (Greatis Software)
DRV - (Partizan) – C:\Windows\system32\drivers\Partizan.sys (Greatis Software)
DRV - (int15) – C:\Windows\SysWOW64\drivers\int15_64.sys (Acer, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACG…amp;m=dx4200-09
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACG…amp;m=dx4200-09

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.2
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.%(version)s
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: {EC8586B6-FD1A-40BE-B6F3-1BBE89389810}:1.9.1
FF - prefs.js..network.proxy.autoconfig_url: "http://localhost:9000/proxy.pac"
FF - prefs.js..network.proxy.type: 2

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/01/20 00:09:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/01/27 22:49:04 | 000,000,000 | —D | M]

[2009/01/24 18:34:12 | 000,000,000 | —D | M] (No name found) – C:\Users\ME\AppData\Roaming\Mozilla\Extensions
[2011/02/09 08:42:27 | 000,000,000 | —D | M] (No name found) – C:\Users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\extensions
[2010/07/12 11:54:27 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/10 19:38:25 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/09/29 11:28:44 | 000,000,000 | —D | M] (vShare Plugin) – C:\Users\ME\AppData\Roaming\Mozilla\Firefox\Profiles\sy6vyfki.default\extensions\vshare@toolbar
[2011/01/05 12:42:51 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/11/18 11:56:01 | 000,000,000 | —D | M] (No name found) – C:\USERS\ME\APPDATA\LOCAL\{EC8586B6-FD1A-40BE-B6F3-1BBE89389810}
[2010/01/06 16:01:25 | 000,000,000 | —D | M] (Move Media Player) – C:\USERS\ME\APPDATA\ROAMING\MOVE NETWORKS

O1 HOSTS File: ([2006/09/18 13:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files (x86)\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files (x86)\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files (x86)\Google\GoogleToolbar1.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [@RegRunOnSecure] C:\Program Files (x86)\Greatis\RegRunSuite\OnSecure.exe (Greatis Software)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LchDrvKey] C:\Windows\LchDrvKey.exe ()
O4 - HKLM..\Run: [LedKey] C:\Windows\CNYHKey.exe (Creative)
O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RegRun WinBait] C:\Windows\WinBait.exe ()
O4 - HKLM..\Run: [Smart Copy] C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe (IOI)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [ANT Agent] C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.)
O4 - HKCU..\Run: [ISUSPM Startup] C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe ()
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\ME\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O4 - Startup: C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STARTUP.del ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\ME\Desktop\wed_beach.jpg
O24 - Desktop BackupWallPaper: C:\Users\ME\Desktop\wed_beach.jpg
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {F552DDE6-2090-4bf4-B924-6141E87789A5} - C:\Program Files (x86)\Greatis\RegRunSuite\RRShell.dll (Greatis Software, LLC)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (Partizan) - C:\Windows\SysWow64\Partizan.exe (Greatis Software)
O34 - HKLM BootExecute: (ootExecute settings…) - File not found
O34 - HKLM BootExecute: (on\E) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..comfile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…com [@ = ComFile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/02/10 13:28:07 | 000,000,000 | —D | C] – C:\_OTL
[2011/02/10 13:23:45 | 000,602,624 | —- | C] (OldTimer Tools) – C:\Users\ME\Desktop\OTL.exe
[2011/02/10 01:13:59 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/02/10 01:06:07 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/02/10 00:46:46 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2011/02/09 19:53:44 | 000,000,000 | —D | C] – C:\Users\ME\AppData\Local\temp
[2011/02/09 14:59:37 | 000,456,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\shlwapi.dll
[2011/02/09 14:59:28 | 000,710,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2011/02/09 14:59:28 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2011/02/09 14:59:27 | 001,538,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2011/02/09 14:59:27 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2011/02/09 14:59:27 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2011/02/09 14:59:27 | 000,479,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2011/02/09 14:59:27 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2011/02/09 14:59:27 | 000,252,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2011/02/09 14:59:27 | 000,219,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2011/02/09 14:59:27 | 000,206,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2011/02/09 14:59:27 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2011/02/09 14:59:27 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2011/02/09 14:59:27 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2011/02/09 14:59:27 | 000,162,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2011/02/09 14:59:27 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2011/02/09 14:59:27 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2011/02/09 14:59:27 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2011/02/09 14:59:27 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2011/02/09 14:59:27 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2011/02/09 14:59:27 | 000,072,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2011/02/09 14:59:27 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2011/02/09 14:59:27 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2011/02/09 14:59:27 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2011/02/09 14:59:27 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2011/02/09 14:59:27 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2011/02/09 14:59:27 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2011/02/09 14:59:27 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2011/02/09 14:59:27 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2011/02/09 14:59:23 | 004,699,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2011/02/09 14:59:22 | 001,585,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntdll.dll
[2011/02/09 14:59:20 | 000,367,104 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2011/02/09 14:59:20 | 000,292,352 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2011/02/09 14:59:20 | 000,048,128 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2011/02/09 14:59:19 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2011/02/09 12:18:32 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/02/09 12:18:32 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/02/09 12:18:32 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/02/09 12:18:25 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/02/09 12:17:45 | 000,000,000 | —D | C] – C:\Qoobox
[2011/02/07 23:26:14 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\ME\Desktop\HiJackThis.exe
[2011/02/07 21:02:24 | 037,403,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MRT.exe
[2011/02/07 20:01:29 | 000,000,000 | —D | C] – C:\Users\ME\AppData\Roaming\QuickScan
[2011/02/07 09:17:25 | 000,000,000 | —D | C] – C:\Windows\RestoreSafeDeleted
[2011/02/07 09:11:21 | 000,037,600 | —- | C] (Greatis Software) – C:\Windows\SysWow64\Partizan.exe
[2011/02/07 09:11:21 | 000,035,816 | —- | C] (Greatis Software) – C:\Windows\SysWow64\drivers\Partizan.sys
[2011/02/07 09:11:21 | 000,024,416 | —- | C] (Greatis Software) – C:\Windows\SysWow64\drivers\regguard.sys
[2011/02/07 09:05:34 | 000,037,600 | —- | C] (Greatis Software) – C:\Windows\SysNative\Partizan.exe
[2011/02/07 09:05:32 | 000,000,000 | -H-D | C] – C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Disabled Startup Items
[2011/02/07 09:05:32 | 000,000,000 | -H-D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Disabled Startup Items
[2011/02/07 09:05:31 | 000,000,000 | —D | C] – C:\Users\ME\Documents\RegRun2
[2011/02/07 09:05:06 | 001,385,240 | —- | C] (Greatis Software) – C:\Windows\RunGuard.exe
[2011/02/07 09:05:06 | 000,000,000 | —D | C] – C:\Users\Public\Documents\regruninfo
[2011/02/07 09:05:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegRun Security Suite
[2011/02/07 09:05:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Greatis
[2011/02/04 21:42:43 | 000,000,000 | —D | C] – C:\Users\ME\AppData\Roaming\GARMIN
[2011/02/04 21:42:43 | 000,000,000 | —D | C] – C:\ProgramData\GARMIN
[2011/02/04 21:36:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
[2011/02/04 21:35:26 | 000,000,000 | —D | C] – C:\Program Files\DIFX
[2011/02/04 21:34:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\Garmin
[2011/01/28 15:49:49 | 000,000,000 | —D | C] – C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StarCraft II
[2011/01/20 00:12:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/01/20 00:12:21 | 000,126,312 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\GEARAspi64.dll
[2011/01/20 00:12:21 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\SysWow64\GEARAspi.dll
[2011/01/20 00:12:21 | 000,034,152 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2011/01/20 00:11:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\iPod
[2011/01/20 00:11:29 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/01/20 00:11:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2011/01/20 00:11:29 | 000,000,000 | —D | C] – C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2011/01/20 00:09:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/01/20 00:09:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2011/01/20 00:04:37 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/01/20 00:04:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bonjour

========== Files - Modified Within 30 Days ==========

[2011/02/10 23:54:04 | 000,690,960 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/02/10 23:54:04 | 000,595,446 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/02/10 23:54:04 | 000,101,144 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/02/10 23:47:53 | 000,024,416 | —- | M] (Greatis Software) – C:\Windows\SysWow64\drivers\regguard.sys
[2011/02/10 23:47:49 | 000,000,000 | —- | M] () – C:\Windows\SysNative\LogConfigTemp.xml
[2011/02/10 23:47:43 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/10 23:47:43 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/10 23:47:37 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/02/10 23:47:30 | 4025,671,680 | -HS- | M] () – C:\hiberfil.sys
[2011/02/10 13:23:37 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Users\ME\Desktop\OTL.exe
[2011/02/10 03:23:16 | 004,871,752 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2011/02/09 12:16:22 | 004,266,117 | R— | M] () – C:\Users\ME\Desktop\jgh.exe
[2011/02/09 00:21:23 | 000,624,128 | —- | M] () – C:\Users\ME\Desktop\dds.scr
[2011/02/09 00:19:22 | 000,080,384 | —- | M] () – C:\Users\ME\Desktop\MBRCheck.exe
[2011/02/07 23:26:15 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\ME\Desktop\HiJackThis.exe
[2011/02/07 09:11:21 | 000,037,600 | —- | M] (Greatis Software) – C:\Windows\SysWow64\Partizan.exe
[2011/02/07 09:11:21 | 000,035,816 | —- | M] (Greatis Software) – C:\Windows\SysWow64\drivers\Partizan.sys
[2011/02/07 09:05:38 | 000,000,002 | RHS- | M] () – C:\Windows\winstart.bat
[2011/02/07 09:05:38 | 000,000,002 | RHS- | M] () – C:\Windows\SysWow64\CONFIG.NT
[2011/02/07 09:05:38 | 000,000,002 | RHS- | M] () – C:\Windows\SysWow64\AUTOEXEC.NT
[2011/02/07 09:05:34 | 000,037,600 | —- | M] (Greatis Software) – C:\Windows\SysNative\Partizan.exe
[2011/02/05 01:20:14 | 000,000,314 | —- | M] () – C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STARTUP.del
[2011/02/04 12:32:04 | 000,175,616 | —- | M] () – C:\Users\ME\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/01 23:25:36 | 000,006,615 | —- | M] () – C:\Users\ME\AppData\Roaming\PrimoPDFSet.xml
[2011/01/27 22:49:04 | 000,001,919 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/01/21 08:50:13 | 000,456,192 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\shlwapi.dll
[2011/01/20 00:12:26 | 000,001,696 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/01/20 00:09:20 | 000,001,758 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/01/17 16:33:32 | 001,385,240 | —- | M] (Greatis Software) – C:\Windows\RunGuard.exe
[2011/01/17 16:33:24 | 000,020,248 | —- | M] () – C:\Windows\WinBait.org
[2011/01/17 16:33:24 | 000,020,248 | —- | M] () – C:\Windows\WinBait.exe
[2011/01/12 18:07:19 | 007,785,323 | —- | M] () – C:\Users\ME\Desktop\wed_beach.jpg

========== Files Created - No Company Name ==========

[2011/02/09 12:18:32 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2011/02/09 12:18:32 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/02/09 12:18:32 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2011/02/09 12:18:32 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/02/09 12:18:32 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/02/09 12:16:19 | 004,266,117 | R— | C] () – C:\Users\ME\Desktop\jgh.exe
[2011/02/09 00:21:24 | 000,624,128 | —- | C] () – C:\Users\ME\Desktop\dds.scr
[2011/02/09 00:19:28 | 000,080,384 | —- | C] () – C:\Users\ME\Desktop\MBRCheck.exe
[2011/02/07 09:05:38 | 000,000,002 | RHS- | C] () – C:\Windows\winstart.bat
[2011/02/07 09:05:38 | 000,000,002 | RHS- | C] () – C:\Windows\SysWow64\CONFIG.NT
[2011/02/07 09:05:38 | 000,000,002 | RHS- | C] () – C:\Windows\SysWow64\AUTOEXEC.NT
[2011/02/07 09:05:06 | 000,057,556 | —- | C] () – C:\Windows\guard.bmp
[2011/02/07 09:05:06 | 000,020,248 | —- | C] () – C:\Windows\WinBait.org
[2011/02/07 09:05:06 | 000,020,248 | —- | C] () – C:\Windows\WinBait.exe
[2011/02/05 01:20:14 | 000,000,314 | —- | C] () – C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STARTUP.del
[2011/01/27 22:49:04 | 000,001,919 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/01/27 22:49:04 | 000,001,804 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011/01/20 00:12:26 | 000,001,696 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/01/20 00:09:20 | 000,001,758 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/01/12 18:07:32 | 007,785,323 | —- | C] () – C:\Users\ME\Desktop\wed_beach.jpg
[2010/08/29 02:56:36 | 000,000,024 | —- | C] () – C:\Users\ME\AppData\Roaming\hngmfc.dat
[2010/04/05 18:55:08 | 000,004,710 | -HS- | C] () – C:\Users\ME\AppData\Local\7VJ5
[2010/04/05 18:55:08 | 000,004,710 | -HS- | C] () – C:\ProgramData\7VJ5
[2010/03/22 03:05:49 | 000,003,716 | -HS- | C] () – C:\Users\ME\AppData\Local\OIXQ
[2010/03/22 03:05:49 | 000,003,716 | -HS- | C] () – C:\ProgramData\OIXQ
[2010/03/07 03:00:19 | 000,011,620 | -HS- | C] () – C:\Users\ME\AppData\Local\8mtxM1
[2010/03/05 16:56:45 | 000,012,268 | -HS- | C] () – C:\Users\ME\AppData\Local\g4K0LbdRf
[2009/10/30 21:35:55 | 000,000,000 | —- | C] () – C:\Windows\ViewNX.INI
[2009/10/30 21:20:27 | 000,000,268 | RH– | C] () – C:\ProgramData\Enhance Timing
[2009/10/30 21:20:27 | 000,000,268 | RH– | C] () – C:\Users\ME\AppData\Roaming\Echo
[2009/10/30 21:20:27 | 000,000,020 | -H– | C] () – C:\ProgramData\PKP_DLdw.DAT
[2009/10/30 21:20:27 | 000,000,012 | RH– | C] () – C:\ProgramData\Filesystems
[2009/10/30 21:17:52 | 000,000,268 | RH– | C] () – C:\ProgramData\Electric Clav
[2009/10/30 21:17:52 | 000,000,268 | RH– | C] () – C:\Users\ME\AppData\Roaming\Drums
[2009/10/30 21:17:52 | 000,000,020 | -H– | C] () – C:\ProgramData\PKP_DLdu.DAT
[2009/10/30 21:17:52 | 000,000,012 | RH– | C] () – C:\ProgramData\Examples
[2009/10/20 12:46:19 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/10/20 12:45:40 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/09/27 17:31:46 | 000,001,958 | —- | C] () – C:\Users\ME\AppData\Roaming\SAS7_000.DAT
[2009/08/03 20:35:12 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/05/22 11:36:34 | 000,001,024 | —- | C] () – C:\Windows\SysWow64\clauth2.dll
[2009/05/22 11:36:34 | 000,001,024 | —- | C] () – C:\Windows\SysWow64\clauth1.dll
[2009/05/22 11:36:34 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\ssprs.dll
[2009/05/22 11:36:34 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\nsprs.dll
[2009/05/22 11:34:23 | 000,001,025 | —- | C] () – C:\Windows\SysWow64\sysprs7.dll
[2009/05/22 11:34:23 | 000,000,205 | —- | C] () – C:\Windows\SysWow64\lsprst7.dll
[2009/04/28 20:54:48 | 000,000,797 | —- | C] () – C:\Windows\wininit.ini
[2009/03/07 23:31:40 | 000,006,615 | —- | C] () – C:\Users\ME\AppData\Roaming\PrimoPDFSet.xml
[2009/02/22 09:57:52 | 004,421,889 | —- | C] () – C:\Windows\SysWow64\libavcodec.dll
[2009/02/18 05:57:22 | 000,557,451 | —- | C] () – C:\Windows\SysWow64\libmplayer.dll
[2009/02/16 09:19:42 | 000,790,190 | —- | C] () – C:\Windows\SysWow64\xvidcore.dll
[2009/02/16 08:32:20 | 000,425,040 | —- | C] () – C:\Windows\SysWow64\TomsMoComp_ff.dll
[2009/02/16 08:30:30 | 000,903,703 | —- | C] () – C:\Windows\SysWow64\ff_x264.dll
[2009/02/16 08:23:50 | 000,145,081 | —- | C] () – C:\Windows\SysWow64\libmpeg2_ff.dll
[2009/02/16 06:49:30 | 000,328,334 | —- | C] () – C:\Windows\SysWow64\ff_kernelDeint.dll
[2009/02/14 07:15:42 | 000,486,400 | —- | C] () – C:\Windows\SysWow64\ff_libfaad2.dll
[2009/02/09 14:28:18 | 000,098,304 | —- | C] () – C:\Windows\SysWow64\ff_wmv9.dll
[2009/02/09 12:19:18 | 000,183,296 | —- | C] () – C:\Windows\SysWow64\ff_samplerate.dll
[2009/02/09 12:19:12 | 000,178,688 | —- | C] () – C:\Windows\SysWow64\ff_libmad.dll
[2009/02/09 12:18:52 | 000,113,152 | —- | C] () – C:\Windows\SysWow64\ff_unrar.dll
[2009/02/09 12:18:32 | 000,146,944 | —- | C] () – C:\Windows\SysWow64\ff_tremor.dll
[2009/02/09 12:18:24 | 000,257,024 | —- | C] () – C:\Windows\SysWow64\ff_libdts.dll
[2009/02/09 12:18:20 | 000,142,848 | —- | C] () – C:\Windows\SysWow64\ff_liba52.dll
[2009/02/09 11:56:22 | 000,067,584 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2009/02/01 18:08:59 | 000,020,898 | —- | C] () – C:\Users\ME\AppData\Roaming\wklnhst.dat
[2009/01/25 00:03:39 | 000,175,616 | —- | C] () – C:\Users\ME\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/01/24 18:28:47 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/01/10 14:17:32 | 000,163,840 | —- | C] () – C:\Windows\SysWow64\ts.dll
[2009/01/10 14:16:56 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\mkx.dll
[2009/01/10 14:16:50 | 000,108,032 | —- | C] () – C:\Windows\SysWow64\avi.dll
[2009/01/10 14:16:14 | 000,141,312 | —- | C] () – C:\Windows\SysWow64\mp4.dll
[2009/01/10 14:15:54 | 000,120,832 | —- | C] () – C:\Windows\SysWow64\ogm.dll
[2009/01/10 14:15:44 | 000,159,744 | —- | C] () – C:\Windows\SysWow64\mmfinfo.dll
[2009/01/10 14:15:32 | 000,102,400 | —- | C] () – C:\Windows\SysWow64\avss.dll
[2009/01/10 14:15:28 | 000,246,784 | —- | C] () – C:\Windows\SysWow64\dxr.dll
[2009/01/10 14:15:12 | 000,097,280 | —- | C] () – C:\Windows\SysWow64\avs.dll
[2009/01/10 14:14:08 | 000,079,360 | —- | C] () – C:\Windows\SysWow64\mkzlib.dll
[2009/01/10 14:14:06 | 000,023,552 | —- | C] () – C:\Windows\SysWow64\mkunicode.dll
[2008/12/24 03:06:45 | 000,000,870 | —- | C] () – C:\Windows\mhotkey_reg.ini
[2008/12/24 03:06:44 | 000,294,912 | —- | C] () – C:\Windows\PIC.dll
[2008/12/03 14:11:50 | 000,180,224 | —- | C] () – C:\Windows\SysWow64\xvidvfw.dll
[2008/11/06 08:37:32 | 003,596,288 | —- | C] () – C:\Windows\SysWow64\qt-dx331.dll
[2008/04/28 09:13:33 | 000,000,310 | —- | C] () – C:\Windows\primopdf.ini
[2008/01/20 18:50:05 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2007/10/13 01:30:20 | 000,000,137 | —- | C] () – C:\Windows\SysWow64\Registration.ini
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\Windows\SysWow64\OUTLPERF.INI

========== Custom Scans ==========


< C:\USERS\ME\APPDATA\LOCAL\{EC8586B6-FD1A-40BE-B6F3-1BBE89389810}*.* /s >


< MD5 for: STARTUP.DEL >
[2011/02/05 01:20:14 | 000,000,314 | —- | M] () MD5=6070B0077EB47B62B9642663580E4A17 – C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STARTUP.del

========== Alternate Data Streams ==========

@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:F35A93AD

< End of report >
Post #14 last edited
Hi UC_Caifan,

Now that we've cleaned up most of it we can see what looks like remnants of an old infection.

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click on this link

Http://www.virustotal.com

copy and paste the following into the upload a file box (one at a time if more than one file is listed)


C:\Users\ME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STARTUP.del

C:\ProgramData\OIXQ


scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.



You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Please post back with
  • VirusTotal results
  • MBAM log
Thanks
Post #15
hi oldman 960,

here is the first file



0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: STARTUP.del
Submission date: 2011-02-11 20:01:30 (UTC)
Current status: finished
Result: 4/ 42 (9.5%)
VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.02.06.00 2011.02.06 -
AntiVir 7.11.3.50 2011.02.11 -
Antiy-AVL 2.0.3.7 2011.02.11 -
Avast 4.8.1351.0 2011.02.11 -
Avast5 5.0.677.0 2011.02.11 -
AVG 10.0.0.1190 2011.02.11 -
BitDefender 7.2 2011.02.11 -
CAT-QuickHeal 11.00 2011.02.11 -
ClamAV 0.96.4.0 2011.02.11 -
Commtouch 5.2.11.5 2011.02.11 -
Comodo 7655 2011.02.11 -
DrWeb 5.0.2.03300 2011.02.11 -
Emsisoft 5.1.0.2 2011.02.11 -
eTrust-Vet 36.1.8153 2011.02.11 -
F-Prot 4.6.2.117 2011.02.04 -
F-Secure 9.0.16160.0 2011.02.11 -
Fortinet 4.2.254.0 2011.02.11 -
GData 21 2011.02.11 -
Ikarus T3.1.1.97.0 2011.02.11 -
Jiangmin 13.0.900 2011.02.11 -
K7AntiVirus 9.83.3828 2011.02.11 -
Kaspersky 7.0.0.125 2011.02.11 -
McAfee 5.400.0.1158 2011.02.11 -
McAfee-GW-Edition 2010.1C 2011.02.11 Heuristic.LooksLike.JS.Suspicious.B
Microsoft 1.6502 2011.02.11 Rogue:JS/FakePAV
NOD32 5866 2011.02.11 -
Norman 6.07.03 2011.02.11 -
nProtect 2011-01-27.01 2011.02.02 -
Panda 10.0.3.5 2011.02.11 -
PCTools 7.0.3.5 2011.02.11 Downloader.Generic
Prevx 3.0 2011.02.11 -
Rising 23.44.04.07 2011.02.11 -
Sophos 4.61.0 2011.02.11 -
SUPERAntiSpyware 4.40.0.1006 2011.02.11 -
Symantec 20101.3.0.103 2011.02.11 Downloader
TheHacker 6.7.0.1.126 2011.02.10 -
TrendMicro 9.200.0.1012 2011.02.11 -
TrendMicro-HouseCall 9.200.0.1012 2011.02.11 -
VBA32 3.12.14.3 2011.02.11 -
VIPRE 8385 2011.02.11 -
ViRobot 2011.2.11.4305 2011.02.11 -
VirusBuster 13.6.195.0 2011.02.11 -
Additional informationShow all
MD5 : 6070b0077eb47b62b9642663580e4a17
SHA1 : 53a55db0abadd4a12c876373aa0656dbbc60e666
SHA256: b1245be6914cf9eb8d2971f2e9fdf11f033b73c08cedac5fa8fd5bec66680fdc
VT Community





here is the second file


0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: OIXQ
Submission date: 2011-02-11 19:56:35 (UTC)
Current status: finished
Result: 0/ 43 (0.0%)
VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.02.06.00 2011.02.06 -
AntiVir 7.11.3.50 2011.02.11 -
Antiy-AVL 2.0.3.7 2011.02.11 -
Avast 4.8.1351.0 2011.02.11 -
Avast5 5.0.677.0 2011.02.11 -
AVG 10.0.0.1190 2011.02.11 -
BitDefender 7.2 2011.02.11 -
CAT-QuickHeal 11.00 2011.02.11 -
ClamAV 0.96.4.0 2011.02.11 -
Commtouch 5.2.11.5 2011.02.11 -
Comodo 7655 2011.02.11 -
DrWeb 5.0.2.03300 2011.02.11 -
Emsisoft 5.1.0.2 2011.02.11 -
eSafe 7.0.17.0 2011.02.10 -
eTrust-Vet 36.1.8153 2011.02.11 -
F-Prot 4.6.2.117 2011.02.04 -
F-Secure 9.0.16160.0 2011.02.11 -
Fortinet 4.2.254.0 2011.02.11 -
GData 21 2011.02.11 -
Ikarus T3.1.1.97.0 2011.02.11 -
Jiangmin 13.0.900 2011.02.11 -
K7AntiVirus 9.83.3828 2011.02.11 -
Kaspersky 7.0.0.125 2011.02.11 -
McAfee 5.400.0.1158 2011.02.11 -
McAfee-GW-Edition 2010.1C 2011.02.11 -
Microsoft 1.6502 2011.02.11 -
NOD32 5866 2011.02.11 -
Norman 6.07.03 2011.02.11 -
nProtect 2011-01-27.01 2011.02.02 -
Panda 10.0.3.5 2011.02.11 -
PCTools 7.0.3.5 2011.02.11 -
Prevx 3.0 2011.02.11 -
Rising 23.44.04.07 2011.02.11 -
Sophos 4.61.0 2011.02.11 -
SUPERAntiSpyware 4.40.0.1006 2011.02.11 -
Symantec 20101.3.0.103 2011.02.11 -
TheHacker 6.7.0.1.126 2011.02.10 -
TrendMicro 9.200.0.1012 2011.02.11 -
TrendMicro-HouseCall 9.200.0.1012 2011.02.11 -
VBA32 3.12.14.3 2011.02.11 -
VIPRE 8385 2011.02.11 -
ViRobot 2011.2.11.4305 2011.02.11 -
VirusBuster 13.6.195.0 2011.02.11 -
Additional informationShow all
MD5 : 7ea2484815b58151b82468a35de7aa16
SHA1 : 4f4d72bcab722ef416f08e23e41d3335912e09cb
SHA256: 21508ffa15c8996f4d53f8a0d053b76436a471f956f2800031db084f546e28e6




Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5742

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

2/11/2011 12:09:26 PM
mbam-log-2011-02-11 (12-09-26).txt

Scan type: Quick scan
Objects scanned: 164224
Time elapsed: 2 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI