What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PC Infected / Malware

318 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Achamian Thank you for your latest set of instructions. As clearly instructed I managed to successfully burn xPUD to cd and save the 'driver.sh' file to a usb pen drive. Rebooted the infected pc from the cd and the Welcome to xPUD appeared as you said it would. I followed you instructions. However, when I expanded mnt I got sda1, sda2, sda5. It apears sda1 and sda5 are my hard drives (c: and d: respectively). There is nothing under sda2 (nu sub folders or hidden files either). I exited and retried the process, this time with two pen drives containing the 'driver.sh' file but got the same results under mnt. No usb found. At this stage, I decided best to report and did nothing else. I await further instructions. With regards creating the Windows XP Set up disk with SP3, I will give it a try and advise how I did later in a separate post. Still battling on. We are not defeated yet. Thanks. Pete
Post #17
Achamian Had a go at trying to create the Windows XP Setup disk with SP3 integrated into it. Was doing quite well following the instructions you guided me too. However, using nLite tool when I got to the following step: "Select the service pack you wish to integrate. Just click Select and point nLite to the SP3 download and the rest if done for you" after I select and brows to the location where the SP3 file I downloaded is located, I receive the following error: "The specified executable is not a valid win32 application" Re-downloaded SP3 and tried from different location but got same result. So was close to completing task but did not quite make it. Await further instructions. Thanks & Regards Pete
Post #18
Hi Pete.

Don't worry about the slipstreamed XPSP3 disk for now, we can sort that out later if necessary.

Regarding getting xPUD to work, are your pen drives ordinary ones? They're not password protected ones with embedded software or anything, are they? You could try this. Using an ordinary pen drive, format it first, then copy driver.sh to it. Put the xPUD CD in the drive of the infected computer, then turn the infected computer off. Insert the pen drive with driver.sh on it, then boot from the xPUD CD. Let me know if that makes any difference.

I would also like you to try this and let me know how you get on..

On your clean computer, download a new copy of ComboFix from here. (Do not rename it this time.)

Burn ComboFix.exe to a CD and put the CD in your infected computer.

On the keyboard of the infected computer, press the Windows logo key and the letter R to open a Run box

Type the following into the Run box. (Where X: is the drive letter of your CD drive. It should be something like E: or F:)

"X:\ComboFix.exe" /killall

If it completes and produces a log, please post it.

If it doesn't complete, let me know about any error messages that it gives you.
Post #19
Achamian Thanks for latest set of instructions. Copied `driver.sh` to another ordinary pen drive and booted with xPUD cd as instructed. Got the same results. No access to usb. Formatted pen drive on laptop and used default FAT format. Copied 'driver.sh' file and had another go using xPUD cd to boot. Same results again. When I expand mnt I get: sda1 (c drive), sda2 (blank), and sda5 (d drive). However, USB is lit up while it was not before. Curious about sda2 (no hidden files), I clicked on properties and it states 'File Type: (null) (inode/directory), however date and time of last access/modification is current. Could this be usb? Also copied ComboFix.exe to cd as instructed and carried out process. Nothing happens when I press the Windows logo key but got to the Run box through Start key which is now appearing on screen. It appears to work but no report is produced. In the C: drive a file appears with Name '32788R22FWJFW' Type 'Folder' but if you click on it you get the same screen as 'My Computer'. Also still cannot copy&paste or move files on infected pc and it takes a good half hour to get to the screen with icons on when I start the computer and another 30 mns to shut down. Hope this helps. Will keep on fighting with your assistance. Regards Pete
Post #20
Hi Pete.

As this malware is giving us virtually 'Zero Access' to our tools, your CD drive and your USB drives within Windows, I would like you to have a look around your C:\ drive in the xPUD external environment and do a few things manually.

Let's try this:

Boot the infected computer with the xPUD CD.

Your C:\ drive should be /mnt/sda1/

See if you can find any of these files:

/mnt/sda1/WINDOWS/1198198231
/mnt/sda1\WINDOWS\1198198231:686986424.exe
/mnt/sda1/WINDOWS/System32/c_18336.nl_ <<– The numbers in this one may be different, but the file will be of the same general format. The size of this one should be around 43,408
/mnt/sda1/WINDOWS/$NtUninstallKB19490$ <<– The numbers in this one may also be different, but the file will be of the same general format.

If you find any of these files, rename each one with a .vir extension.

After you have renamed them, they should look like this:

/mnt/sda1/WINDOWS/1198198231.vir
/mnt/sda1\WINDOWS\1198198231:686986424.exe.vir
/mnt/sda1/WINDOWS/System32/c_18336.nl_.vir
/mnt/sda1/WINDOWS/$NtUninstallKB19490$.vir

You will not find all of them. Just rename any that you can find.

Also, have a look in this folder:

/mnt/sda1/WINDOWS\system32\drivers

and see if there are any files in there with names that are just numbers or seem to be randomly named.

Like these, for example:

75435786547.sys

or

xkirrgiopkofgjggh.dll

Don't rename any of these you find for the moment. Just make a note of them and tell me what the names are.

Then reboot the infected computer back into normal mode and see if anything has improved, particularly access to your CD drive, your USB drives and your internet browsers.

If this doesn't improve things, there are still other tools that we can try. We are not done yet. :thumbup:
Post #21
Achamian Thanks for you reply and instructions. Out of the files mentioned I found mnt/sda1/WINDOWS/1198198231 and renamed it accordingly. With regards /mnt/sda1/WINDOWS/System32/c_18336.nl I found some 43 files in this format all ending in .nls. 37 are of 66.1kb in sze. I did not rename any. Files in format: /mnt/sda1/WINDOWS/$NtUninstallKB19490$ are plentiful. There is only one 4.1kb file ending in c_17333$. Then there are 60 files ending in c_2……………, 17 ending in c_8………….., and 239 ending in c_9………….. None of these were changed to .vir. A lot of the files have 0 byte. Under the path: /mnt/sda1/WINDOWS\system32\drivers I found 1394.bus.sys (only one bginning with numbers) Other files were: SBREDrv.sys NDISTpi.sys Others look OK Will advise if the one file I did rename to .vri made any difference in due course. Thanks. Pete
Post #22
Achamian Update: Sitched on infected pc, it still takes quite some time to get to the page with desktop icons but possibly a little less than before. When I got to that stage I got the following: 1. Warning box stating "Please reinstall/update the display driver and program" 2. Another Box [Title] Microsoft Visual C + + Runtime Library Runtime Error! Program:…ommon Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe The application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information. There is still no connection to the internet (firefox returns an error while internet explorer does not even start) and you cannot copy&paste files or drag them from one area to another. USB did light up but could not be seen on "my computer" screen. However, using "save as" function on a simple word file I managed to save a word document to the usb. [Progress?] Shut down also takes long. As always thanks for all your patience, time and assistance. Regards Pete
Post #23
Hi Pete.

In the present situation, I think we can definitely count being able to save something to your flash drive as progress. :D

I have done some research on flash drives and found that some of the newer ones require XPSP3 installed in order to recognize them. Your system is SP3, but the XP setup disk you have is only SP2. When you build the disk below using your XP SP2 setup disk, if your flash drive is not recognized, try again with an older flash drive if you can find one.

(On a side note, I'm also wondering if the reason xPUD didn't recognize your flash drive is because it's too new.)

If I can get some OTLPE logs, I will be able to use OTLPE to fix some of the malware and hopefully improve the situation considerably.

Let's see if we can get those logs. :)

Please print this guide for future reference!

You will need a blank CD, your Windows XP install disc, a clean computer and a flash drive.

Please follow the steps below and let me know if you were successful. Please tell me what error messages you got and/or what steps you got hung up on.

On your clean computer..

1. Download the PE Builder to your desktop

http://www.nu2.nu/download.php?sFile=pebuilder3110a.exe
  • Double-Click on the PE Builder that you just downloaded to your desktop.
  • Follow all of the instructions/prompts that come up.

    2. Insert your XP CD with SP1/SP2/SP3 into a CD Rom drive
  • Double-Click on PE Builder.exe located on your desktop.
  • Click NO to Search for Windows Installation Files
  • Make the following selections from the Main Screen that pops up:
    • Builder
      • Source:(path to Windows installation files)
        • Enter the path to the drive where your XP CD is located.
        • You can click on the "…" button on the right to navigate to the path as well.
      • Custom: (include files and folders from this directory)
        • No information is necessary, leave blank.
      • Output:
        • Keep the default
      • Media output
        • Choose Create ISO image
        • Do not choose Burn to CD/DVD
      • Download the RunScanner plugin and save it to your desktop
        http://www.paraglidernc.com/Files/RunScanner10025.cab

        Please note: You will be prompted for the folder that it shall be saved. By default it appears as runscanner10025. It should be modified to just runscanner <— Important!!!
      • Press the Plugin button on the PE Builder interface
      • Press the Add button and navigate to the location of the RunScanner plugin to install
      • Please note: If you are using a Windows XP disc with sp2 then highlight RpsSS needs to launch DComLaunch and then press Enable
    • When you're done press Close and the PE Builder interface will re-appear

    3. Click on the "Build" button
  • You will see the Windows EULA message. Click on I Agree
  • You will now see the Build Screen. Let it run it's course
  • When the Build is finished you can click close, then exit

    4. Burn your ISO file to CD
  • Please see http://www.petri.co.il/how_to_write_iso_files_to_cd.htm on how to burn an ISO to CD.
==========

Next……..

On your clean computer..

Please download OTLPE.zip from one of the following locations and save it to a flash drive.
http://oldtimer.geekstogo.com/OTLPE.zip
http://www.itxassociates.com/OT-Tools/OTLPE.zip

Double click and unzip OTLPE.zip to its own folder on your flash drive. Name it OTLPE <– Important!!

==========

Plug your flash drive into your infected computer now and do as instructed below..

==========

1. Restart Your infected Computer Using the PE Builder ISO CD That You Have Created
  • Insert the CD in to one of your CD/DVD drives.
  • Restart your computer.
    • The computer should choose to boot from the CD automatically. If it doesn't and you are asked if you want to boot from CD, then choose that option.
  • Once the desktop appears, you will receive a message asking: Do you want to start Network support?
    • Click on No
  • After it loads press the Go button in the lower left and do this….
    • Go
    • System
    • Display
    • Screen Resolution
    • 1024x768
      Next choose….
    • Go
    • Programs
    • A43 File Management Utility

    ==========

    In A43File Management you should see your flash drive
    Navigate to the OTLPE folder that you saved to your flash drive.

    Open the OTLPE folder and double click Start.cmd.
  • When asked "Do you wish to load remote user profile(s) for scanning", select Yes
  • Ensure the box "Automatically Load All Remaining Users" is checked and press OK
  • OTLPE should now start

    Change the following settings
    • Change Services, Drivers, Standard and Extra Registry to All
    • Uncheck LOP and Purity check
    Please note: Stay with your computer during the course of the scan. If "Entry Point Errors" are encountered simply press "ok" and allow the program to continue. <– Important!!

  • Copy and Paste the following code from your flash drive into the textbox.


    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %ALLUSERSPROFILE%\Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %SYSTEMDRIVE%\*.exe
    /md5start
    userinit.exe
    explorer.exe
    winlogon.exe
    ntoskrnl.exe
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    volsnap.sys
    sptd.sys
    spch.sys
    register.sys
    /md5stop
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\system32\drivers\*.sys /90
    CREATERESTOREPOINT

  • Push Quick Scan
  • A report will open named "OTL.txt" and another will be minimized to the system tray named "Extra.txt". Save both log's to your flash drive. Copy and Paste them in your next reply.
=========

With your next post please provide:
  • OTLPE.txt
  • Extra.txt
Post #24
Achamian

Thank you for your latest set of instructions. It did take some time and perseverence but I got there in the end. I followed your instructions to the letter and below are OTLPE.txt and Extra.txt reports requested.



OTL logfile created on: 9/16/2011 9:14:44 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = G:\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 802.00 Mb Available Physical Memory | 78.00% Memory free
923.00 Mb Paging File | 883.00 Mb Available in Paging File | 96.00% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 116.87 Gb Total Space | 12.41 Gb Free Space | 10.62% Space Free | Partition Type: NTFS
Drive D: | 116.01 Gb Total Space | 15.85 Gb Free Space | 13.66% Space Free | Partition Type: NTFS
Drive G: | 1009.97 Mb Total Space | 1006.75 Mb Free Space | 99.68% Space Free | Partition Type: FAT
Drive X: | 154.29 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: MININT-JVC | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled] – – (HidServ)
SRV - File not found [On_Demand] – – (AppMgmt)
SRV - [2011/08/21 08:00:28 | 000,870,200 | —- | M] (Trusteer Ltd.) [Auto] – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe – (RapportMgmtService)
SRV - [2011/08/18 13:25:12 | 002,151,640 | —- | M] () [Auto] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2011/08/03 11:49:00 | 002,255,464 | —- | M] (NVIDIA Corporation) [Auto] – C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe – (nvUpdatusService)
SRV - [2011/05/30 09:33:54 | 001,025,352 | —- | M] () [On_Demand] – C:\Program Files\AVG\AVG8\Toolbar\ToolbarBroker.exe – (AVG Security Toolbar Service)
SRV - [2009/08/21 14:53:44 | 000,908,056 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto] – C:\Program Files\AVG\AVG8\avgemc.exe – (avg8emc)
SRV - [2009/08/21 14:53:31 | 000,297,752 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto] – C:\Program Files\AVG\AVG8\avgwdsvc.exe – (avg8wd)
SRV - [2009/02/06 11:11:05 | 000,110,592 | —- | M] () [Auto] – C:\WINDOWS\system32\services.exe – (PlugPlay)
SRV - [2009/02/06 11:11:05 | 000,110,592 | —- | M] () [Auto] – C:\WINDOWS\system32\services.exe – (Eventlog)
SRV - [2003/07/28 16:31:14 | 000,065,536 | —- | M] (Sony Corporation) [On_Demand] – C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe – (SPTISRV)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] – – (WDICA)
DRV - File not found [Kernel | On_Demand] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand] – – (PDRELI)
DRV - File not found [Kernel | On_Demand] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand] – – (PDCOMP)
DRV - File not found [Kernel | System] – – (PCIDump)
DRV - File not found [Kernel | System] – – (lbrtfdc)
DRV - File not found [Kernel | System] – – (i2omgmt)
DRV - File not found [Kernel | On_Demand] – – (ENTECH)
DRV - File not found [Kernel | On_Demand] – – (d70d6b47)
DRV - File not found [Kernel | System] – – (Changer)
DRV - [2011/08/21 08:00:36 | 000,158,904 | —- | M] (Trusteer Ltd.) [Kernel | System] – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys – (RapportPG)
DRV - [2011/08/21 08:00:36 | 000,066,360 | —- | M] (Trusteer Ltd.) [Kernel | System] – C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys – (RapportEI)
DRV - [2011/08/21 08:00:36 | 000,053,816 | —- | M] (Trusteer Ltd.) [Kernel | Boot] – C:\WINDOWS\system32\drivers\RapportKELL.sys – (RapportKELL)
DRV - [2011/08/18 13:25:12 | 000,064,512 | —- | M] (Lavasoft AB) [File_System | Boot] – C:\WINDOWS\system32\drivers\Lbd.sys – (Lbd)
DRV - [2011/08/18 13:25:12 | 000,015,232 | —- | M] () [Kernel | On_Demand] – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys – (Lavasoft Kernexplorer)
DRV - [2011/08/08 18:10:15 | 000,216,912 | —- | M] () [Kernel | System] – C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\29574\RapportCerberus32_29574.sys – (RapportCerberus_29574)
DRV - [2009/08/21 14:53:52 | 000,335,240 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] – C:\WINDOWS\System32\Drivers\avgldx86.sys – (AvgLdx86)
DRV - [2009/08/21 14:53:52 | 000,027,784 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System] – C:\WINDOWS\System32\Drivers\avgmfx86.sys – (AvgMfx86)
DRV - [2009/05/08 15:39:35 | 000,108,552 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] – C:\WINDOWS\System32\Drivers\avgtdix.sys – (AvgTdiX)
DRV - [2009/03/18 19:09:30 | 000,064,480 | —- | M] (Juniper Networks) [Kernel | System] – C:\WINDOWS\system32\drivers\NEOFLTR_620_14085.sys – (NEOFLTR_620_14085) Juniper Networks TDI Filter Driver (NEOFLTR_620_14085)
DRV - [2009/03/07 16:24:19 | 000,717,296 | —- | M] (Duplex Secure Ltd.) [Kernel | Disabled] – C:\WINDOWS\System32\Drivers\sptd.sys – (sptd)
DRV - [2008/04/13 18:56:06 | 000,088,320 | —- | M] (Microsoft Corporation) [Kernel | Auto] – C:\WINDOWS\system32\drivers\nwlnkipx.sys – (NwlnkIpx)
DRV - [2008/04/13 18:40:46 | 000,062,976 | —- | M] () [Kernel | System] – C:\WINDOWS\system32\drivers\cdrom.sys – (Cdrom)
DRV - [2007/06/15 01:47:26 | 001,127,936 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\P17.sys – (P17)
DRV - [2007/03/16 08:11:38 | 000,012,256 | —- | M] (Windows ® 2000 DDK provider) [Kernel | Auto] – C:\WINDOWS\System32\drivers\TBPanel.sys – (TBPanel)
DRV - [2007/02/11 20:19:46 | 000,005,632 | —- | M] () [File_System | System] – C:\WINDOWS\System32\drivers\StarOpen.sys – (StarOpen)
DRV - [2006/04/27 05:40:16 | 000,057,063 | —- | M] (Neoteris) [Kernel | System] – C:\WINDOWS\system32\drivers\NEOFLTR_530_10641.sys – (NEOFLTR_530_10641) Juniper Networks TDI Filter Driver (NEOFLTR_530_10641)
DRV - [2005/08/30 16:59:00 | 000,094,000 | —- | M] (MCCI) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ss_mdm.sys – (ss_mdm)
DRV - [2005/08/30 16:58:56 | 000,008,304 | —- | M] (MCCI) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ss_mdfl.sys – (ss_mdfl)
DRV - [2005/08/30 16:57:18 | 000,058,320 | —- | M] (MCCI) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ss_bus.sys – (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2005/08/11 05:49:28 | 000,393,088 | R— | M] (Sensaura) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\senfilt.sys – (SenFiltService)
DRV - [2005/02/01 05:40:44 | 002,514,560 | R— | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005/01/10 09:15:30 | 000,106,496 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ctoss2k.sys – (ossrv)
DRV - [2005/01/10 09:15:24 | 000,138,752 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ctsfm2k.sys – (ctsfm2k)
DRV - [2004/10/27 05:24:00 | 000,223,104 | —- | M] (Marvell) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\yk51x86.sys – (yukonwxp)
DRV - [2004/08/13 02:56:20 | 000,005,810 | R— | M] () [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ASACPI.sys – (MTsensor)
DRV - [2004/08/12 15:45:52 | 000,113,664 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\Hdaudio.sys – (HdAudAddService)
DRV - [2004/08/04 12:00:00 | 000,063,232 | —- | M] (Microsoft Corporation) [Kernel | Auto] – C:\WINDOWS\system32\drivers\nwlnknb.sys – (NwlnkNb)
DRV - [2004/08/04 12:00:00 | 000,055,936 | —- | M] (Microsoft Corporation) [Kernel | Auto] – C:\WINDOWS\system32\drivers\nwlnkspx.sys – (NwlnkSpx)
DRV - [2004/03/08 10:55:50 | 000,013,567 | —- | M] (B.H.A Corporation) [Kernel | System] – C:\WINDOWS\System32\drivers\CDRBSDRV.SYS – (cdrbsdrv)
DRV - [2003/11/28 15:42:38 | 000,659,065 | —- | M] (Intel Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\IntelC52.sys – (IntelC52)
DRV - [2003/11/28 15:41:52 | 001,313,509 | —- | M] (Intel Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\IntelC51.sys – (IntelC51)
DRV - [2003/11/28 15:41:12 | 000,061,541 | —- | M] (Intel Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\IntelC53.sys – (IntelC53)
DRV - [2003/11/28 15:40:54 | 000,036,984 | —- | M] (Intel Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\mohfilt.sys – (mohfilt)
DRV - [2001/11/28 01:58:18 | 000,001,950 | —- | M] () [Kernel | System] – C:\WINDOWS\system32\drivers\REGISTER.SYS – (project)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.msn.com
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank


IE - HKU\.DEFAULT\..\URLSearchHook: {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\Owner_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE - HKU\Owner_ON_C\..\URLSearchHook: {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - Reg Error: Key error. File not found
IE - HKU\Owner_ON_C\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
IE - HKU\Owner_ON_C\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
IE - HKU\Owner_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Owner_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\Owner_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:25503

IE - HKU\Peter.YOUR-OYHMBPEOOX_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\Peter.YOUR-OYHMBPEOOX_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\UpdatusUser_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.652: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.652: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2011/06/30 14:24:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/01/29 18:21:58 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/08/13 06:25:53 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.22\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/08 08:43:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.22\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/08 08:43:31 | 000,000,000 | —D | M]

[2011/09/07 15:25:35 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2008/07/13 17:00:56 | 000,000,000 | —D | M] (Search Settings Plugin) – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2011/06/30 14:24:44 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/06/30 14:24:44 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/06/30 14:24:44 | 000,000,769 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2008/05/01 13:25:23 | 000,000,368 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\search.xml
[2011/06/30 14:24:44 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/05/04 17:51:06 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - No CLSID value found.
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O2 - BHO: (Piolet Toolbar Helper) - {EDDF3383-EC5F-49DF-A8B6-CEC2D8F6164C} - C:\Program Files\Piolet Toolbar\v3.3.0.1\Piolet_Toolbar.dll ()
O2 - BHO: (no name) - Software - No CLSID value found.
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Piolet Toolbar) - {C75C8E7E-5059-4469-AC11-D7544B260382} - C:\Program Files\Piolet Toolbar\v3.3.0.1\Piolet_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKU\Owner_ON_C\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\Owner_ON_C\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\Owner_ON_C\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKU\Owner_ON_C\..\Toolbar\WebBrowser: (Piolet Toolbar) - {C75C8E7E-5059-4469-AC11-D7544B260382} - C:\Program Files\Piolet Toolbar\v3.3.0.1\Piolet_Toolbar.dll ()
O3 - HKU\Owner_ON_C\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKU\Peter.YOUR-OYHMBPEOOX_ON_C\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe ()
O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
O4 - HKLM..\Run: [Hotkey] C:\Program Files\Hotkey\Hotkey.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\Owner_ON_C..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe (Gainward Co.)
O4 - HKU\Owner_ON_C..\Run: [Uniblue RegistryBooster2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe ()
O4 - HKU\Owner_ON_C..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKU\UpdatusUser_ON_C..\Run: [AVG7_Run] File not found
O4 - HKU\Peter.YOUR-OYHMBPEOOX_ON_C..\RunOnce: [avg_spchecker] C:\Program Files\AVG\AVG8\Notification\SPChecker.exe ()
O4 - HKU\Peter.YOUR-OYHMBPEOOX_ON_C..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe (Nero AG)
O4 - HKU\UpdatusUser_ON_C..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe (Nero AG)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe (Research In Motion Limited)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Owner_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\Owner_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\Owner_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\Owner_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
O7 - HKU\Peter.YOUR-OYHMBPEOOX_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\UpdatusUser_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : PC Confidential - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe (Capital Intellect, Inc)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Program Files\Juniper Networks\Secure Application Manager\samnsp.dll (Juniper Networks)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Juniper Networks\Secure Application Manager\samnsp.dll (Juniper Networks)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - File not found
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab (SysData Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://start.hsbc.com.mt/dana-cached/setup…perSetupSP1.cab (JuniperSetupControlXP Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O28 - HKLM ShellExecuteHooks: {93994DE8-8239-4655-B1D1-5F4E91300429} - C:\Program Files\DVD Region+CSS Free\DVDShell.dll (Fengtao Software Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/08/11 10:20:31 | 000,000,100 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2004/11/02 14:04:58 | 000,000,046 | R— | M] () - X:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: LanmanWorkstation - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe - (Sony Corporation)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe - (Sony Corporation.)
MsConfig - StartUpReg: AlcWzrd - hkey= - key= - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
MsConfig - StartUpReg: ctfmon.exe - hkey= - key= - File not found
MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
MsConfig - StartUpReg: High Definition Audio Property Page Shortcut - hkey= - key= - File not found
MsConfig - StartUpReg: Hotkey - hkey= - key= - C:\Program Files\Hotkey\Hotkey.exe ()
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: MsnMsgr - hkey= - key= - C:\Program Files\MSN Messenger\MsnMsgr.Exe (Microsoft Corporation)
MsConfig - StartUpReg: NBKeyScan - hkey= - key= - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= - C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
MsConfig - StartUpReg: OrderReminder - hkey= - key= - C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe (Hewlett-Packard)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: SoundMan - hkey= - key= - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: SoundMAXPnP - hkey= - key= - C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: Ulead Photo Express Calendar Checker - hkey= - key= - C:\Program Files\Ulead Systems\Ulead Photo Express 5 SE\CalCheck.exe (Ulead Systems, Inc.)
MsConfig - StartUpReg: Uniblue RegistryBooster 2 - hkey= - key= - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe ()
MsConfig - StartUpReg: Uniblue RegistryBooster2 - hkey= - key= - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe ()
MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files\Winamp\winampa.exe ()
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: AppMgmt - File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: EventLog - C:\WINDOWS\system32\services.exe ()
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe ()
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PlugPlay - C:\WINDOWS\system32\services.exe ()
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: EventLog - C:\WINDOWS\system32\services.exe ()
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: LanmanWorkstation - Service
SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe ()
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOS - Service
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NtLmSsp - Service
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PlugPlay - C:\WINDOWS\system32\services.exe ()
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 8.5.1
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 8.5.1
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Reg Error: Value error.
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {ECD292A0-0347-4244-8C24-5DBCE990FB40} - Hotfix for Microsoft .NET Framework 3.0 (KB932471)
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: Microsoft Base Smart Card Crypto Provider Package -

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\AC3ACM.acm (fccHandler)
Drivers32: msacm.alf2cd - C:\WINDOWS\System32\alf2cd.acm (NCT Company)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.scg726 - C:\WINDOWS\System32\Scg726.acm (SHARP Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.dvsd - C:\WINDOWS\System32\mcdvd_32.dll (MainConcept)
Drivers32: vidc.ffds - - File not found
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.xvid - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: wave2 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave3 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave4 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave7 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2011/09/11 15:30:04 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware1
[2011/09/06 15:34:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\Brands
[2011/09/05 20:25:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Administrative Tools
[2011/09/05 20:24:46 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/09/05 18:04:26 | 000,064,512 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2011/09/05 18:04:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Lavasoft
[2011/08/29 17:05:01 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2011/08/28 16:58:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Garmin
[2011/08/27 11:28:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
[2011/08/27 11:28:16 | 000,000,000 | —D | C] – C:\Documents and Settings\UpdatusUser\Searches
[2011/08/27 11:28:16 | 000,000,000 | —D | C] – C:\Documents and Settings\UpdatusUser\Contacts
[2011/08/27 11:28:01 | 000,000,000 | —D | C] – C:\Documents and Settings\UpdatusUser\Application Data\Juniper Networks
[2011/08/27 11:28:01 | 000,000,000 | —D | C] – C:\Documents and Settings\UpdatusUser\Application Data\Identities
[2011/08/27 11:28:00 | 000,000,000 | –SD | C] – C:\Documents and Settings\UpdatusUser\Application Data\Microsoft
[2011/08/27 11:28:00 | 000,000,000 | RH-D | C] – C:\Documents and Settings\UpdatusUser\Application Data
[2011/08/27 11:28:00 | 000,000,000 | R–D | C] – C:\Documents and Settings\UpdatusUser\Favorites
[2011/08/27 11:28:00 | 000,000,000 | -HSD | C] – C:\Documents and Settings\UpdatusUser\Cookies
[2011/08/27 11:28:00 | 000,000,000 | —D | C] – C:\Documents and Settings\UpdatusUser\Application Data\Trusteer
[2011/08/27 11:28:00 | 000,000,000 | —D | C] – C:\Documents and Settings\UpdatusUser\Local Settings\Application Data\Microsoft
[2011/08/27 11:28:00 | 000,000,000 | —D | C] – C:\Documents and Settings\UpdatusUser\Desktop
[2011/08/27 11:28:00 | 000,000,000 | —D | C] – C:\Documents and Settings\UpdatusUser\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150020}
[2011/08/27 11:27:59 | 000,000,000 | RH-D | C] – C:\Documents and Settings\UpdatusUser\SendTo
[2011/08/27 11:27:59 | 000,000,000 | RH-D | C] – C:\Documents and Settings\UpdatusUser\Recent
[2011/08/27 11:27:59 | 000,000,000 | R–D | C] – C:\Documents and Settings\UpdatusUser\Start Menu\Programs\Startup
[2011/08/27 11:27:59 | 000,000,000 | R–D | C] – C:\Documents and Settings\UpdatusUser\Start Menu
[2011/08/27 11:27:59 | 000,000,000 | R–D | C] – C:\Documents and Settings\UpdatusUser\My Documents\My Pictures
[2011/08/27 11:27:59 | 000,000,000 | R–D | C] – C:\Documents and Settings\UpdatusUser\My Documents\My Music
[2011/08/27 11:27:59 | 000,000,000 | R–D | C] – C:\Documents and Settings\UpdatusUser\My Documents
[2011/08/27 11:27:59 | 000,000,000 | R–D | C] – C:\Documents and Settings\UpdatusUser\Start Menu\Programs\Accessories
[2011/08/27 11:27:59 | 000,000,000 | -H-D | C] – C:\Documents and Settings\UpdatusUser\Templates
[2011/08/27 11:27:59 | 000,000,000 | -H-D | C] – C:\Documents and Settings\UpdatusUser\PrintHood
[2011/08/27 11:27:59 | 000,000,000 | -H-D | C] – C:\Documents and Settings\UpdatusUser\NetHood
[2011/08/27 11:27:59 | 000,000,000 | -H-D | C] – C:\Documents and Settings\UpdatusUser\Local Settings
[2011/08/27 11:27:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NVIDIA
[2011/08/27 11:22:01 | 000,061,440 | —- | C] (Khronos Group) – C:\WINDOWS\System32\OpenCL.dll
[2011/08/27 11:19:08 | 000,000,000 | —D | C] – C:\Program Files\NVIDIA Corporation
[2011/08/27 08:56:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Serial Key Generator 3.1
[2011/08/27 08:56:33 | 000,000,000 | —D | C] – C:\Program Files\Serial Key Generator 3.1
[2011/08/27 08:11:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\UAB
[2011/08/27 08:10:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\PC_Drivers_Headquarters
[2011/08/27 08:09:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Driver Boost
[2011/08/27 08:04:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\DriverBoost
[2011/08/27 08:03:03 | 000,000,000 | —D | C] – C:\Program Files\DriverBoost
[2011/08/21 08:00:36 | 000,053,816 | —- | C] (Trusteer Ltd.) – C:\WINDOWS\System32\drivers\RapportKELL.sys
[2011/08/20 05:52:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/08/20 05:51:20 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/08/20 05:51:08 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/08/20 05:44:13 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/08/20 05:38:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2011/08/20 05:38:20 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2008/09/01 22:06:48 | 028,868,320 | —- | C] (Microsoft Corporation) – C:\Program Files\FileFormatConverters.exe
[2008/01/05 13:29:55 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Owner\Application Data\pcouffin.sys
[2002/04/11 01:41:06 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\A3d.dll
[6 C:\Documents and Settings\Owner\Desktop\*.tmp files -> C:\Documents and Settings\Owner\Desktop\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[15 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/16 17:53:49 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/09/16 17:38:37 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/09/13 18:18:28 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/09/11 15:42:19 | 000,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/09/11 15:30:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/09/08 10:01:01 | 000,000,380 | —- | M] () – C:\WINDOWS\tasks\FileCure Startup.job
[2011/09/08 09:58:01 | 000,000,256 | —- | M] () – C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
[2011/09/08 09:30:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/08 09:26:13 | 001,916,416 | —- | M] () – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/09/08 09:25:35 | 000,000,000 | -HS- | M] () – C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
[2011/09/08 09:24:35 | 000,000,256 | —- | M] () – C:\WINDOWS\System32\pool.bin
[2011/09/08 09:21:01 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/08 08:53:11 | 000,000,020 | —- | M] () – C:\Documents and Settings\Owner\defogger_reenable
[2011/09/08 08:48:01 | 000,050,477 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Defogger.exe
[2011/09/08 08:44:45 | 000,489,196 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/09/08 08:44:45 | 000,083,278 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/09/07 16:20:21 | 082,913,412 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2011/09/07 16:00:01 | 000,000,444 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Registration3.job
[2011/09/07 15:14:31 | 000,201,216 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/06 15:42:46 | 000,002,495 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Office Excel 2003.lnk
[2011/09/05 20:24:47 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/09/05 18:06:29 | 000,101,720 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/09/05 18:05:04 | 000,000,486 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/09/05 18:04:37 | 000,000,797 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2011/09/05 18:04:35 | 000,566,125 | —- | M] () – C:\WINDOWS\setupapi.old
[2011/09/05 18:04:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Start Menu\Programs\Lavasoft
[2011/09/05 16:43:06 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2011/08/27 11:40:24 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2011/08/27 11:36:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Start Menu\Programs\Trusteer Rapport
[2011/08/27 11:23:55 | 000,280,276 | —- | M] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/08/27 11:23:55 | 000,000,001 | —- | M] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/08/27 11:23:48 | 000,280,276 | —- | M] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/08/27 11:23:48 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\nvdrswr.lk
[2011/08/27 11:04:13 | 000,000,000 | R–D | M] – C:\Documents and Settings\All Users\Start Menu\Programs\Startup
[2011/08/27 08:56:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Start Menu\Programs\Serial Key Generator 3.1
[2011/08/27 08:04:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Start Menu\Programs\DriverBoost
[2011/08/27 08:04:08 | 000,001,974 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DriverBoost.lnk
[2011/08/27 06:20:10 | 000,001,791 | —- | M] () – C:\Documents and Settings\UpdatusUser\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/08/21 14:38:56 | 000,009,385 | —- | M] () – C:\Documents and Settings\All Users\Documents\Global.sw2
[2011/08/21 08:00:36 | 000,053,816 | —- | M] (Trusteer Ltd.) – C:\WINDOWS\System32\drivers\RapportKELL.sys
[2011/08/20 05:57:01 | 000,001,854 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Safari.lnk
[2011/08/20 05:57:01 | 000,001,854 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/08/20 05:52:33 | 000,001,542 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/20 05:52:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/08/20 05:38:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2011/08/18 13:25:12 | 000,064,512 | —- | M] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[6 C:\Documents and Settings\Owner\Desktop\*.tmp files -> C:\Documents and Settings\Owner\Desktop\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[15 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/08 09:26:04 | 001,916,416 | —- | C] () – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/09/08 09:25:35 | 000,000,000 | -HS- | C] () – C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
[2011/09/08 09:13:30 | 000,302,592 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.exe
[2011/09/08 08:51:12 | 000,000,020 | —- | C] () – C:\Documents and Settings\Owner\defogger_reenable
[2011/09/08 08:47:59 | 000,050,477 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Defogger.exe
[2011/09/05 18:04:37 | 000,000,797 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2011/08/27 11:28:13 | 000,001,791 | —- | C] () – C:\Documents and Settings\UpdatusUser\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/08/27 11:28:12 | 000,001,257 | —- | C] () – C:\Documents and Settings\UpdatusUser\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk
[2011/08/27 11:28:12 | 000,000,804 | —- | C] () – C:\Documents and Settings\UpdatusUser\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/08/27 11:28:12 | 000,000,779 | —- | C] () – C:\Documents and Settings\UpdatusUser\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/08/27 11:28:12 | 000,000,079 | —- | C] () – C:\Documents and Settings\UpdatusUser\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/08/27 11:28:11 | 000,000,000 | —- | C] () – C:\Documents and Settings\UpdatusUser\Application Data\sversion.ini
[2011/08/27 11:28:10 | 000,001,992 | —- | C] () – C:\Documents and Settings\UpdatusUser\Desktop\Microsoft Office Publisher 2003.lnk
[2011/08/27 11:28:09 | 002,359,350 | —- | C] () – C:\Documents and Settings\UpdatusUser\Desktop\test.bmp
[2011/08/27 11:28:09 | 000,002,036 | —- | C] () – C:\Documents and Settings\UpdatusUser\Desktop\Microsoft Office Word 2003.lnk
[2011/08/27 11:28:09 | 000,000,786 | —- | C] () – C:\Documents and Settings\UpdatusUser\Desktop\Windows Media Player.lnk
[2011/08/27 11:28:02 | 000,001,599 | —- | C] () – C:\Documents and Settings\UpdatusUser\Start Menu\Programs\Remote Assistance.lnk
[2011/08/27 11:28:02 | 000,000,792 | —- | C] () – C:\Documents and Settings\UpdatusUser\Start Menu\Programs\Windows Media Player.lnk
[2011/08/27 11:28:02 | 000,000,738 | —- | C] () – C:\Documents and Settings\UpdatusUser\Start Menu\Programs\Outlook Express.lnk
[2011/08/27 11:23:48 | 000,280,276 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/08/27 11:23:48 | 000,280,276 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/08/27 11:23:48 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/08/27 11:23:48 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\nvdrswr.lk
[2011/08/27 11:21:57 | 000,003,249 | —- | C] () – C:\WINDOWS\System32\nvinfo.pb
[2011/08/27 11:21:56 | 002,128,778 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2011/08/27 09:22:53 | 000,000,000 | —- | C] () – C:\WINDOWS\1198198231.vir
[2011/08/27 08:04:08 | 000,001,974 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DriverBoost.lnk
[2011/08/20 05:52:33 | 000,001,542 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/10/02 14:20:38 | 000,023,110 | —- | C] () – C:\WINDOWS\hpqins15.dat.temp
[2010/03/27 14:55:22 | 000,000,256 | —- | C] () – C:\WINDOWS\System32\pool.bin
[2010/01/29 18:20:15 | 000,022,741 | —- | C] () – C:\WINDOWS\hpqins15.dat
[2009/12/08 10:40:16 | 000,077,374 | —- | C] () – C:\WINDOWS\hpqins05.dat
[2009/08/05 19:27:37 | 000,019,518 | —- | C] () – C:\WINDOWS\hpqins13.dat
[2009/07/04 16:07:42 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner\Ÿ9Ÿ9
[2009/07/04 15:38:58 | 000,166,137 | —- | C] () – C:\WINDOWS\hpoins29.dat
[2009/07/04 15:38:57 | 000,000,799 | —- | C] () – C:\WINDOWS\hpomdl29.dat
[2009/05/16 08:30:19 | 000,397,379 | —- | C] () – C:\WINDOWS\System32\paqbonus.exe
[2009/03/15 12:06:49 | 000,000,000 | —- | C] () – C:\WINDOWS\webica.ini
[2009/02/19 09:26:38 | 000,007,237 | —- | C] () – C:\WINDOWS\cadx2.ini
[2008/11/01 16:29:06 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\AVERM.dll
[2008/10/03 23:07:10 | 003,754,896 | —- | C] () – C:\WINDOWS\System32\erdmpg-6.dll
[2008/09/28 17:33:01 | 000,253,952 | —- | C] () – C:\WINDOWS\System32\Manipulate.dll
[2008/09/13 10:01:01 | 000,002,539 | —- | C] () – C:\Program Files\RapidLeecher 2006.exe.lnk
[2008/09/06 08:05:41 | 000,065,878 | —- | C] () – C:\Program Files\switchproxy.xpi
[2008/09/01 22:00:39 | 000,000,102 | —- | C] () – C:\Documents and Settings\Owner\Application Data\default.pls
[2008/08/28 11:22:57 | 000,071,096 | —- | C] () – C:\WINDOWS\System32\NMSAccess.exe
[2008/08/28 11:20:38 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\comLyricGetter.dll
[2008/08/28 11:17:22 | 000,097,280 | —- | C] () – C:\WINDOWS\System32\Uncommon.dll
[2008/08/28 11:17:20 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\NormalizeDSP.dll
[2008/07/27 22:02:59 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2008/05/07 20:50:12 | 000,156,685 | —- | C] () – C:\Program Files\hosts.zip
[2008/05/06 22:11:19 | 000,106,342 | —- | C] () – C:\Program Files\Kaspersky.html
[2008/04/17 22:41:39 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2008/04/13 18:14:29 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2008/04/10 16:14:38 | 000,001,950 | —- | C] () – C:\WINDOWS\System32\drivers\REGISTER.SYS
[2008/01/16 23:01:29 | 000,524,288 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2008/01/16 23:01:29 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/01/15 21:42:52 | 000,000,067 | —- | C] () – C:\WINDOWS\DVDRegionFree.INI
[2008/01/05 13:29:55 | 000,007,887 | —- | C] () – C:\Documents and Settings\Owner\Application Data\pcouffin.cat
[2008/01/05 13:29:55 | 000,001,144 | —- | C] () – C:\Documents and Settings\Owner\Application Data\pcouffin.inf
[2008/01/05 12:39:36 | 000,000,204 | —- | C] () – C:\Documents and Settings\Owner\default.pls
[2008/01/05 11:23:10 | 000,001,024 | —- | C] () – C:\Documents and Settings\Owner\.rnd
[2007/07/12 15:32:08 | 000,003,290 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/07/08 20:27:24 | 000,001,751 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/05/27 06:42:59 | 000,038,400 | —- | C] () – C:\WINDOWS\System32\moveex.exe
[2007/04/15 18:18:17 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2007/02/11 20:20:01 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2007/02/11 17:02:34 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2007/01/16 20:31:42 | 000,001,338 | —- | C] () – C:\WINDOWS\mozver.dat
[2007/01/16 20:01:08 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/11/06 22:49:36 | 000,000,310 | —- | C] () – C:\WINDOWS\primopdf.ini
[2006/11/06 20:30:38 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2006/09/24 14:40:40 | 000,012,152 | —- | C] () – C:\Documents and Settings\Owner\Application Data\ViewerApp.dat
[2006/09/24 14:30:34 | 000,003,654 | —- | C] () – C:\WINDOWS\System32\drivers\Sonyhcp.dll
[2006/06/03 09:11:28 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\P17CPI.dll
[2006/06/03 09:11:27 | 000,064,512 | —- | C] () – C:\WINDOWS\System32\P17.dll
[2006/06/03 09:05:32 | 000,000,347 | —- | C] () – C:\WINDOWS\CTWave32.INI
[2006/04/22 07:24:57 | 000,000,000 | —- | C] () – C:\Documents and Settings\Peter.YOUR-OYHMBPEOOX\Application Data\sversion.ini
[2006/04/22 07:04:47 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/03/29 06:43:38 | 000,042,496 | —- | C] () – C:\WINDOWS\System32\ALZZip.BIN
[2006/03/29 06:43:36 | 000,062,464 | —- | C] () – C:\WINDOWS\System32\ALZALZ.BIN
[2006/03/12 22:10:51 | 000,008,192 | —- | C] () – C:\WINDOWS\msxmlfilt.dll
[2006/03/12 22:10:51 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\cme.exe
[2006/03/12 22:00:15 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/03/04 11:08:27 | 000,000,585 | —- | C] () – C:\Documents and Settings\Owner\Application Data\dm.ini
[2006/02/05 14:24:30 | 000,000,205 | —- | C] () – C:\WINDOWS\System32\di.exe
[2005/12/31 10:26:51 | 000,524,288 | —- | C] () – C:\WINDOWS\System32\TDI-SonyOMG.dll
[2005/12/29 17:11:09 | 000,053,760 | —- | C] () – C:\WINDOWS\System32\ZLIB.DLL
[2005/12/29 16:13:29 | 000,000,071 | —- | C] () – C:\WINDOWS\pex.INI
[2005/12/29 16:12:12 | 000,000,026 | —- | C] () – C:\WINDOWS\ulead32.ini
[2005/12/29 16:08:22 | 000,201,216 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/12/28 15:51:25 | 000,000,078 | —- | C] () – C:\WINDOWS\Hotkey.INI
[2005/12/28 15:32:48 | 000,442,368 | —- | C] () – C:\WINDOWS\System32\ZSHP1020.EXE
[2005/12/28 15:32:48 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\VSHP1020.DLL
[2005/12/28 15:29:06 | 000,000,000 | —- | C] () – C:\WINDOWS\system32\config\systemprofile\Application Data\sversion.ini
[2005/12/27 17:28:10 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/12/27 17:09:10 | 000,000,029 | —- | C] () – C:\WINDOWS\sfbm.INI
[2005/12/27 13:24:44 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/11/05 23:34:50 | 000,145,408 | —- | C] () – C:\WINDOWS\System32\Lame.exe
[2005/08/23 16:58:45 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/08/23 16:57:29 | 000,374,464 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/23 16:46:18 | 000,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2005/08/23 16:46:17 | 001,048,576 | —- | C] () – C:\WINDOWS\System32\SFMAN.DAT
[2005/08/23 16:45:51 | 000,000,011 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2005/08/23 16:42:13 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner\Application Data\sversion.ini
[2005/08/23 16:37:38 | 000,069,632 | —- | C] () – C:\WINDOWS\uinst001.exe
[2005/08/23 16:17:42 | 000,156,672 | R— | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2005/08/23 16:17:42 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\ChCfg.exe
[2005/08/23 16:17:18 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2005/08/23 16:17:14 | 000,014,996 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2005/08/23 16:17:12 | 000,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2005/08/23 15:12:10 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/08/23 15:07:28 | 000,022,832 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2005/07/07 09:26:56 | 000,005,627 | —- | C] () – C:\WINDOWS\System32\Ludap17.ini
[2005/05/17 20:37:10 | 000,076,800 | —- | C] () – C:\WINDOWS\System32\Faac.exe
[2005/03/08 06:17:08 | 000,000,054 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2004/08/04 12:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 12:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 12:00:00 | 000,489,196 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 12:00:00 | 000,389,120 | —- | C] () – C:\WINDOWS\System32\cmd.exe
[2004/08/04 12:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 12:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 12:00:00 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\services.exe
[2004/08/04 12:00:00 | 000,083,278 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 12:00:00 | 000,062,976 | —- | C] () – C:\WINDOWS\System32\drivers\cdrom.sys
[2004/08/04 12:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 12:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 12:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 12:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 12:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 12:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/07/19 16:48:22 | 000,157,696 | —- | C] () – C:\WINDOWS\System32\OggEnc.exe
[2002/01/01 00:16:54 | 000,082,184 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[1997/08/23 10:33:24 | 000,022,064 | —- | C] () – C:\WINDOWS\System32\tntlvr.dll

========== LOP Check ==========

[2008/11/30 22:00:27 | 000,000,000 | —D | M] – C:\WINDOWS\system32\config\systemprofile\Application Data\Juniper Networks
[2009/06/25 21:33:51 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\AVGTOOLBAR
[2008/04/10 15:31:08 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Juniper Networks
[2008/11/30 22:00:36 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\AVGTOOLBAR
[2008/04/10 15:31:08 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Juniper Networks
[2008/07/06 22:24:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVGTOOLBAR
[2008/11/02 06:58:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVSMedia
[2007/02/24 10:31:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ConvertTemp
[2009/03/07 16:30:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DAEMON Tools
[2009/03/07 16:39:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DAEMON Tools Lite
[2009/03/07 16:30:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DAEMON Tools Pro
[2011/08/28 17:05:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Garmin
[2010/12/05 20:24:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GetRightToGo
[2008/04/10 15:33:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ICAClient
[2009/05/05 18:53:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Juniper Networks
[2009/06/14 16:10:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nokia
[2009/05/16 08:47:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Passware
[2011/06/14 19:24:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\PriceGong
[2010/03/27 16:07:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Research In Motion
[2007/02/11 17:07:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Samsung
[2008/07/13 17:03:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Search Settings
[2008/01/05 13:23:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SorensonMedia
[2008/09/05 16:10:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Temporary
[2008/09/05 16:11:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TransRender
[2010/11/28 19:09:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Trusteer
[2005/12/29 16:12:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Ulead Systems
[2007/06/29 11:19:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Uniblue
[2011/09/16 17:33:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\uTorrent
[2009/07/05 11:10:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Vso
[2008/05/17 10:46:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\WinPatrol
[2008/06/12 03:40:56 | 000,000,000 | —D | M] – C:\Documents and Settings\UpdatusUser\Application Data\Juniper Networks
[2011/05/04 17:43:20 | 000,000,000 | —D | M] – C:\Documents and Settings\UpdatusUser\Application Data\Trusteer
[2011/04/25 12:12:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/05/03 18:37:29 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\BMLOP
[2009/03/07 16:29:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2011/08/27 08:09:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Driver Boost
[2001/12/31 22:02:35 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\f4f74a
[2011/08/13 06:22:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FileCure
[2008/06/08 18:31:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2009/05/05 18:53:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Juniper Networks
[2002/01/01 01:11:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010/03/27 16:07:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Research In Motion
[2011/05/04 18:01:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/11/28 19:08:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trusteer
[2011/08/27 08:11:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\UAB
[2005/12/28 15:55:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2008/01/12 10:07:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\vsosdk
[2009/03/15 21:42:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/04/10 07:59:33 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{17A03471-20EB-4604-8E72-66EF7398750D}
[2010/07/03 05:57:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/16 15:59:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/07 21:08:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/09/05 17:32:00 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\~0
[2011/09/05 18:05:04 | 000,000,486 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2011/09/08 09:58:01 | 000,000,256 | —- | M] () – C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
[2010/09/17 23:50:00 | 000,000,364 | —- | M] () – C:\WINDOWS\Tasks\FileCure Default.job
[2011/09/08 10:01:01 | 000,000,380 | —- | M] () – C:\WINDOWS\Tasks\FileCure Startup.job
[2011/09/07 16:00:01 | 000,000,444 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Registration3.job
[2001/12/31 23:08:06 | 000,000,418 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Update Version3.job

========== Purity Check ==========



========== Custom Scans ==========


Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.

Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.exe

Invalid Environment Variable: %APPDATA%\*.

Invalid Environment Variable: %APPDATA%\*.exe

< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/04/13 18:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2008/04/13 18:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 00:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008/04/14 00:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX0\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX1\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX10\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX11\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX12\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX13\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX14\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX15\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX16\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX17\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX18\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX19\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX2\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX20\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX21\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX22\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX23\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX24\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX25\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX26\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX27\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX28\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX29\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX3\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX30\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX31\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX32\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX33\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX34\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX35\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX36\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX37\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX38\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX39\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX4\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX40\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX41\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX42\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX43\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX44\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX45\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX46\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX47\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX48\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX49\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX5\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX50\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX51\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX52\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX53\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX54\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX55\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX56\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX57\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX58\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX59\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX6\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX60\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX61\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX62\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX63\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX64\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX65\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX66\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX67\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX68\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX7\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX8\procs\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX9\procs\explorer.exe
[2007/06/13 11:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2004/08/04 12:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX0\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX1\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX10\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX11\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX12\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX13\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX14\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX15\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX16\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX17\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX18\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX19\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX2\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX20\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX21\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX22\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX23\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX24\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX25\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX26\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX27\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX28\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX29\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX3\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX30\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX31\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX32\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX33\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX34\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX35\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX36\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX37\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX38\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX39\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX4\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX40\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX41\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX42\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX43\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX44\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX45\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX46\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX47\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX48\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX49\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX5\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX50\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX51\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX52\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX53\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX54\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX55\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX56\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX57\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX58\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX59\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX6\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX60\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX61\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX62\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX63\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX64\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX65\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX66\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX67\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX68\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX7\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX8\h\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX9\h\explorer.exe

< MD5 for: NETLOGON.DLL >
[2008/04/14 00:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll

< MD5 for: NTOSKRNL.EXE >
[2010/02/16 14:08:49 | 002,146,304 | —- | M] (Microsoft Corporation) MD5=048DB3459FAB4CA741DCC84E1F374D65 – C:\WINDOWS\$NtUninstallKB981852$\ntoskrnl.exe
[2009/12/08 22:52:36 | 002,189,312 | —- | M] (Microsoft Corporation) MD5=05BE3D9A71972223AFF6A3C823BA51B1 – C:\WINDOWS\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe
[2009/02/06 11:06:41 | 002,145,280 | —- | M] (Microsoft Corporation) MD5=0CBA44D0938D57F334C0862424148B70 – C:\WINDOWS\$NtUninstallKB971486$\ntoskrnl.exe
[2005/03/02 01:04:22 | 002,179,456 | —- | M] (Microsoft Corporation) MD5=28187802B7C368C0D3AEF7D4C382AABB – C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[2008/08/14 14:11:10 | 002,189,184 | —- | M] (Microsoft Corporation) MD5=31914172342BFF330063F343AC6958FE – C:\WINDOWS\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[2008/04/13 19:24:37 | 002,145,280 | —- | M] (Microsoft Corporation) MD5=40F8880122A030A7E9E1FEDEA833B33D – C:\WINDOWS\$NtUninstallKB956841$\ntoskrnl.exe
[2010/04/27 13:59:13 | 002,146,304 | —- | M] (Microsoft Corporation) MD5=466A3E1239F4A9428797730E81A7A865 – C:\WINDOWS\$NtUninstallKB2393802$\ntoskrnl.exe
[2005/03/02 00:57:44 | 002,135,552 | —- | M] (Microsoft Corporation) MD5=48B3E89AF7074CEE0314A3E0C7FAFFDB – C:\WINDOWS\$NtUninstallKB929338$\ntoskrnl.exe
[2007/02/28 09:55:14 | 002,182,144 | —- | M] (Microsoft Corporation) MD5=5A5C8DB4AA962C714C8371FBDF189FC9 – C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[2010/12/09 13:42:26 | 002,148,864 | —- | M] (Microsoft Corporation) MD5=60E16152D847D7A7B7D3DA4C4B8E2120 – C:\WINDOWS\system32\ntoskrnl.exe
[2004/08/04 12:00:00 | 002,148,352 | —- | M] (Microsoft Corporation) MD5=626309040459C3915997EF98EC1C8D40 – C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe
[2010/12/09 13:38:47 | 002,192,768 | —- | M] (Microsoft Corporation) MD5=64C1ADF6DF629F340C5A439FE0EF8ED1 – C:\WINDOWS\system32\dllcache\ntoskrnl.exe
[2009/08/04 15:13:08 | 002,145,280 | —- | M] (Microsoft Corporation) MD5=78FCC97CD878D4CF5B5D2158A5A7CF92 – C:\WINDOWS\$NtUninstallKB977165$\ntoskrnl.exe
[2006/12/19 14:15:09 | 002,136,064 | —- | M] (Microsoft Corporation) MD5=8318ED54797F3E513FD5817A1D4BBD18 – C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe
[2009/12/08 19:26:15 | 002,145,280 | —- | M] (Microsoft Corporation) MD5=9696C553F994340CD6AA5C5A724C3A19 – C:\WINDOWS\$NtUninstallKB979683$\ntoskrnl.exe
[2010/04/27 13:50:44 | 002,190,080 | —- | M] (Microsoft Corporation) MD5=A2ABBEC40CDB57454645D06B7EBD22F5 – C:\WINDOWS\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
[2010/12/09 13:43:18 | 002,192,768 | —- | M] (Microsoft Corporation) MD5=A531BBD3DE13121C1380ED7DC99082DB – C:\WINDOWS\$hf_mig$\KB2393802\SP3QFE\ntoskrnl.exe
[2006/12/19 16:51:12 | 002,182,016 | —- | M] (Microsoft Corporation) MD5=CEF243F6DEFD20BE4ADDE26C7ECACB54 – C:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe
[2010/02/16 12:52:12 | 002,190,080 | —- | M] (Microsoft Corporation) MD5=E1F653A542449D54FA2D27463D99B6B6 – C:\WINDOWS\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[2009/02/07 17:35:26 | 002,189,184 | —- | M] (Microsoft Corporation) MD5=EFE8EACE83EAAD5849A7A548FB75B584 – C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[2008/08/14 10:09:26 | 002,145,280 | —- | M] (Microsoft Corporation) MD5=F6F8245B3A2E9CA834DD318E7AE0C6D0 – C:\WINDOWS\$NtUninstallKB956572$\ntoskrnl.exe
[2009/08/04 13:56:10 | 002,189,312 | —- | M] (Microsoft Corporation) MD5=FDE779EA1A564EBFE16F4E0F82B61BAD – C:\WINDOWS\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe

< MD5 for: REGISTER.SYS >
[2001/11/28 01:58:18 | 000,001,950 | —- | M] () MD5=D2A3683F5EB91FB9C38CCC8A4C7BC273 – C:\WINDOWS\system32\drivers\REGISTER.SYS

< MD5 for: SCECLI.DLL >
[2008/04/14 00:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< MD5 for: SPTD.SYS >
[2009/03/07 16:24:19 | 000,717,296 | —- | M] (Duplex Secure Ltd.) MD5=71E276F6D189413266EA22171806597B – C:\WINDOWS\system32\drivers\sptd.sys

< MD5 for: USERINIT.EXE >
[2008/04/14 00:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX0\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX1\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX10\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX11\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX12\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX13\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX14\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX15\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX16\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX17\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX18\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX19\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX2\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX20\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX21\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX22\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX23\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX24\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX25\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX26\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX27\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX28\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX29\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX3\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX30\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX31\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX32\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX33\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX34\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX35\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX36\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX37\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX38\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX39\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX4\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX40\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX41\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX42\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX43\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX44\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX45\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX46\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX47\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX48\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX49\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX5\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX50\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX51\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX52\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX53\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX54\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX55\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX56\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX57\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX58\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX59\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX6\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX60\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX61\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX62\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX63\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX64\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX65\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX66\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX67\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX68\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX7\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX8\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX9\userinit.exe

< MD5 for: VOLSNAP.SYS >
[2008/04/13 18:41:01 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 – C:\WINDOWS\system32\drivers\volsnap.sys

< MD5 for: WINLOGON.EXE >
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX0\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX1\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX10\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX11\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX12\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX13\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX14\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX15\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX16\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX17\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX18\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX19\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX2\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX20\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX21\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX22\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX23\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX24\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX25\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX26\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX27\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX28\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX29\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX3\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX30\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX31\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX32\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX33\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX34\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX35\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX36\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX37\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX38\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX39\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX4\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX40\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX41\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX42\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX43\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX44\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX45\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX46\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX47\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX48\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX49\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX5\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX50\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX51\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX52\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX53\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX54\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX55\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX56\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX57\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX58\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX59\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX6\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX60\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX61\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX62\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX63\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX64\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX65\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX66\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX67\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX68\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX7\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX8\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Documents and Settings\Owner\Local Settings\temp\RarSFX9\winlogon.exe
[2008/04/14 00:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/04/15 12:24:35 | 000,262,144 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2006/04/15 10:17:54 | 000,262,144 | —- | M] () – C:\WINDOWS\System32\config\security.sav
[2006/04/15 12:24:35 | 018,350,080 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2006/04/15 12:24:36 | 007,340,032 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.sys /90 >
[2011/08/18 13:25:12 | 000,064,512 | —- | M] (Lavasoft AB) – C:\WINDOWS\system32\drivers\Lbd.sys
[2011/07/06 17:52:42 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2011/07/06 17:52:42 | 000,041,272 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys
[2011/07/15 13:29:31 | 000,456,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\mrxsmb.sys
[2011/07/08 14:02:00 | 000,010,496 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\ndistapi.sys
[2011/08/03 11:49:00 | 012,542,592 | —- | M] (NVIDIA Corporation) – C:\WINDOWS\system32\drivers\nv4_mini.sys
[2011/08/21 08:00:36 | 000,053,816 | —- | M] (Trusteer Ltd.) – C:\WINDOWS\system32\drivers\RapportKELL.sys
[2011/06/24 14:10:36 | 000,139,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\rdpwd.sys
[2011/09/05 18:06:29 | 000,101,720 | —- | M] (Sunbelt Software) – C:\WINDOWS\system32\drivers\SBREDrv.sys

< CREATERESTOREPOINT >

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\$NtUninstallKB17333$] -> -> Unknown point type

========== Alternate Data Streams ==========

@Alternate Data Stream - 816 bytes -> C:\WINDOWS\1198198231.vir:686986424.exe
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:825D5945
< End of report >





OTL Extras logfile created on: 9/16/2011 9:14:44 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = G:\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 802.00 Mb Available Physical Memory | 78.00% Memory free
923.00 Mb Paging File | 883.00 Mb Available in Paging File | 96.00% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 116.87 Gb Total Space | 12.41 Gb Free Space | 10.62% Space Free | Partition Type: NTFS
Drive D: | 116.01 Gb Total Space | 15.85 Gb Free Space | 13.66% Space Free | Partition Type: NTFS
Drive G: | 1009.97 Mb Total Space | 1006.75 Mb Free Space | 99.68% Space Free | Partition Type: FAT
Drive X: | 154.29 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: MININT-JVC | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Extra Registry (All) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – C:\WINDOWS\hh.exe (Microsoft Corporation)
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] – C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] – C:\WINDOWS\System32\mshta.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.inf [@ = inffile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l
.js [@ = JSFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.reg [@ = regfile] – C:\WINDOWS\regedit.exe (Microsoft Corporation)
.txt [@ = txtfile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] – "%1" %*
batfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] – "C:\WINDOWS\hh.exe" %1 (Microsoft Corporation)
cmdfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] – "%1" %*
cmdfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – winhlp32.exe %1 (Microsoft Corporation)
hlpfile [open] – %SystemRoot%\System32\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] – C:\WINDOWS\system32\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
inffile [open] – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
InternetShortcut [print] – rundll32.exe C:\WINDOWS\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
jsfile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
regfile [open] – regedit.exe "%1" (Microsoft Corporation)
regfile [merge] – Reg Error: Key error.
regfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
txtfile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] – %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
vbefile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbefile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
vbsfile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
vbsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbsfile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
wsffile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
wsffile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
wsffile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
wshfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] – C:\Program Files\ParetoLogic\FileCure\FileCure_noapp.exe %1 (ParetoLogic)
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "%programfiles%\internet explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Software Update\hpwucli.exe" = C:\Program Files\HP\HP Software Update\hpwucli.exe:*:Enabled:hpwucli.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – (Hewlett-Packard Co.)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox – (Mozilla Corporation)
"C:\Program Files\Neoteris\Secure Application Manager\dsSamProxy.exe" = C:\Program Files\Neoteris\Secure Application Manager\dsSamProxy.exe:*:Disabled:Secure Application Manager Proxy
"C:\Program Files\Real\RealPlayer\RecordingManager.exe" = C:\Program Files\Real\RealPlayer\RecordingManager.exe:*:Disabled:RealNetworks Download and Record Manager – (RealNetworks, Inc.)
"C:\Program Files\Juniper Networks\Secure Application Manager\dsSamProxy.exe" = C:\Program Files\Juniper Networks\Secure Application Manager\dsSamProxy.exe:*:Disabled:Secure Application Manager Proxy – (Juniper Networks)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe – (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Software Update\hpwucli.exe" = C:\Program Files\HP\HP Software Update\hpwucli.exe:*:Enabled:hpwucli.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – (Hewlett-Packard Co.)
"C:\Documents and Settings\Owner\Local Settings\temp\7zS1A6.tmp\SymNRT.exe" = C:\Documents and Settings\Owner\Local Settings\temp\7zS1A6.tmp\SymNRT.exe:*:Enabled:Norton Removal Tool
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Documents and Settings\All Users\Application Data\f4f74a\BMf4f_2121.exe" = C:\Documents and Settings\All Users\Application Data\f4f74a\BMf4f_2121.exe:*:Enabled:Best Malware Protection
"C:\Program Files\Piolet\Piolet.exe" = C:\Program Files\Piolet\Piolet.exe:*:Enabled:Piolet – (MP2P Technologies.)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe – (NVIDIA Corporation)
"C:\Program Files\Real\RealUpgrade\realupgrade.exe" = C:\Program Files\Real\RealUpgrade\realupgrade.exe:*:Enabled:RealUpgrade Launcher – (RealNetworks, Inc.)
"C:\Program Files\Acrobat 6.0\Reader\AcroRd32.exe" = C:\Program Files\Acrobat 6.0\Reader\AcroRd32.exe:*:Enabled:Adobe Reader 6.0 – (Adobe Systems Incorporated)
"C:\Program Files\Acrobat 6.0\Reader\AdobeUpdateManager.exe" = C:\Program Files\Acrobat 6.0\Reader\AdobeUpdateManager.exe:*:Enabled:Adobe Update Manager – (Adobe Systems Incorporated)
"D:\43dbdcab8b5729e7c74b3743\Setup.exe" = D:\43dbdcab8b5729e7c74b3743\Setup.exe:*:Enabled:Setup Installer
"C:\Documents and Settings\Owner\Local Settings\temp\7zS30D.tmp\GarminMapUpdater.exe" = C:\Documents and Settings\Owner\Local Settings\temp\7zS30D.tmp\GarminMapUpdater.exe:*:Enabled:Garmin Map Updater
"C:\Program Files\Windows Live Toolbar\msn_sl.exe" = C:\Program Files\Windows Live Toolbar\msn_sl.exe:*:Enabled:Windows Live Toolbar Helper – (Microsoft Corporation)
"C:\WINDOWS\temp\GUM358.tmp\GoogleUpdate.exe" = C:\WINDOWS\temp\GUM358.tmp\GoogleUpdate.exe:*:Enabled:Google Installer
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer – (RealNetworks, Inc.)
"C:\Program Files\Safari\Safari.exe" = C:\Program Files\Safari\Safari.exe:*:Enabled:Safari – (Apple Inc.)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer – (Microsoft Corporation)
"C:\Documents and Settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}\Ad-AwareInstall.exe" = C:\Documents and Settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}\Ad-AwareInstall.exe:*:Enabled:Ad-AwareInstall.exe
"C:\Program Files\Ad-Aware\Ad-Aware.exe" = C:\Program Files\Ad-Aware\Ad-Aware.exe:*:Enabled:Ad-Aware SE Core application – ()
"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" = C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe:*:Enabled:Malwarebytes' Anti-Malware – (Malwarebytes Corporation)
"C:\Documents and Settings\Owner\Desktop\aswMBR.exe" = C:\Documents and Settings\Owner\Desktop\aswMBR.exe:*:Enabled:avast! Antirootkit – ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0116F921-3F28-447E-B33F-248D8E65D4CD}" = 001 File Joiner and Splitter
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{055A00C0-64A6-4248-A026-9745C1E9E159}" = Microsoft Encarta Premium Suite 2005
"{0915B10F-8597-4FE7-BC4D-EA3E2FDA646A}" = PS_AIO_03_C4400_Software_Min
"{09633A5E-3089-41A8-9FF1-382171423C5D}" = PSSWCORE
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{15B8AFD9-92E9-4E86-96D9-83FAC510B82E}" = HPPhotoSmartPhotobookWebPack1
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}" = Rapport
"{1E2F8AE3-3437-44E6-BB75-E95751D6B83F}" = Picture Package
"{22F761D1-8063-4170-ADF7-2D2F47834CA9}" = VideoToolkit01
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{276E3ECB-E9E9-494E-A3F9-173BAD7D9643}" = C4400
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2AFEAA03-2DFE-4519-A629-EDAB6541ABE9}" = HPSSupply
"{2BA09774-34F7-4A06-8C7E-B69E44CB9EB0}" = DriverBoost
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{2EB44B16-05EF-42FD-9300-A85CDEF60864}" = Free Word Excel Password Wizard
"{31383A1D-FAE6-435A-9DBD-FDB61C7C8EC9}" = Ulead Photo Express 5 SE
"{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E1A8C8-6646-4101-B0AA-42D1EB2AB3AE}" = Windows Live Outlook Toolbar (Windows Live Toolbar)
"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
"{385DD1DD-65AA-408D-8E70-74601C2DB7E6}" = Ad-Aware
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3B5AFEE5-2D54-4558-AD76-CE1959EB736B}" = Passware Kit Standard Demo 9.0
"{3B6E3FC6-274C-4B6C-BC85-5C3B15DE18E2}" = Mega Manager
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40A594D0-1490-4979-9382-D2B764F949C6}" = BlackBerry® Media Sync
"{4572F220-0A56-402E-90F1-4D36DD22F108}" = TubeHunter Ultra
"{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4CC59DA1-469B-49A5-9F6B-C4D26990294A}" = PS_AIO_03_C4400_ProductContext
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{51BA0AFE-6AA5-4B8C-8BA9-FA6AE5B1EEE0}" = Roxio Media Manager
"{53B2CFE9-A508-4457-B2CA-5D253536BFB7}" = OneCare Advisor (Windows Live Toolbar)
"{548B3DC6-2300-47E1-BA7B-74AD25F8DEBF}" = Form Fill (Windows Live Toolbar)
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A3FEF2D-0E14-412E-869C-421AB373EE43}" = C4400_Help
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{5DC0DF76-3B2F-4C38-BE34-58627949BC1A}" = Mega Manager
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FA1C51C-6E35-42C1-B2EC-DC9FA1E20694}" = OpenMG Secure Module 3.3.01
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{66A7A386-6F35-41A7-A731-101F0C0153C8}" = Popup Blocker (Windows Live Toolbar)
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{68108E66-D13A-4EE8-A6F4-40E4B90C2A26}" = Windows Live Toolbar Feed Detector (Windows Live Toolbar)
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{681B698F-C997-42C3-B184-B489C6CA24C9}" = HPPhotoSmartDiscLabelContent1
"{6951AFF1-7E53-4BD7-AB1F-4DB10549A8FC}" = TubeHunter Ultra
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{734BB64A-5A3D-4624-867D-6358B7068496}" = Sound Blaster Live! 24-bit
"{735619D4-B42A-437A-958C-199BFCAEDB38}" = Safari
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7745B7A9-F323-4BB9-9811-01BF57A028DA}" = Map Button (Windows Live Toolbar)
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites for Windows Live Toolbar
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{82427977-8776-4087-90CA-9F65174D3C4D}" = Nokia Connectivity Cable Driver
"{84F1B62A-E6F6-458E-BC19-51DBB14055EA}" = BlackBerry Desktop Software 4.7
"{86732AE7-CB91-4f15-B091-FBA3D3926CD6}" = HP Photosmart C4400 All-In-One Driver Software 11.0 Rel .3
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{885744A4-1A01-44B0-858A-0AE6738CBCF7}" = PrimoPDF Redistribution Package
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACECB7C-5EB2-42B3-A2E1-B91878B6C5D7}" = PS_AIO_03_C4400_Software
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B8C7492-DD45-47F7-B456-EB0197BC5085}" = Sorenson Squeeze Trial
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{93E9D2A0-6C35-4E69-99F3-8325443EC10A}_is1" = Serial Key Generator version 3.1
"{9887D344-9F27-40BA-8D07-08ECCB96D924}" = MUSIC PLAYER
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7894110-9C15-43EF-89E9-060363290188}" = Samsung PC Studio
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.94
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.4.28
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB406CEB-6207-4512-9BB2-89950DC9D6B6}_is1" = ConvertXtoDVD 2.2.3.258h
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1C441C4-57FA-4950-BDBA-BABFBAA2AA39}" = ParetoLogic FileCure
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio
"{C73CA646-73B3-4AEF-A136-C37505745174}" = iTunes
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{C8C8387B-A98B-44E8-807A-1A9B7F51FFDA}" = Blaze Media Pro
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEB3A11A-03EA-11DA-BFBD-00065BBDC0B5}" = MSN Messenger 7.5
"{D03482C5-9AD8-496D-B388-692AE04C93AF}" = Bonjour
"{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}" = Search Settings 1.2
"{D16B4BE6-8B10-422f-8034-96D1CA9483B5}" = GPBaseService
"{D271DAE0-8D68-4C97-8356-A126D48A1D8C}" = Ulead Photo Explorer 8.0 SE Basic
"{D5A145FC-D00C-4F1A-9119-EB4D9D659750}" = Windows Live Toolbar
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D6C9AF27-9414-46C8-B9D8-D878BA041033}" = Nero 8
"{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F084395C-40FB-4DB3-981C-B51E74E1E83D}" = Smart Menus (Windows Live Toolbar)
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F8C6BABF-0837-4EA0-AD6C-8E5A392A7538}" = ImageMixer VCD2
"7-Zip" = 7-Zip 4.62
"Absolute MP3 Splitter_is1" = Absolute MP3 Splitter version 2.3.8
"Accent OFFICE Password Recovery" = Accent OFFICE Password Recovery 2.80
"Active@ Password Changer Professional" = Active@ Password Changer Professional
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AdobeESD" = Adobe Download Manager 2.0 (Remove Only)
"ALUpdate_is1" = ALTools Update
"ALZip_is1" = ALZip
"AnvSoft Flash to iPod Converter_is1" = AnvSoft Flash to iPod Converter 1.10
"AVG8Uninstall" = AVG Free 8.5
"Avi Join 0.1.0.1_is1" = Avi Join 0.1.0.1
"AVI Joiner_is1" = AVI Joiner
"AVS DVDMenu Editor_is1" = AVS DVDMenu Editor 1.2.1.19
"AVS Video Tools 5_is1" = AVS Video Tools 5.6
"BlackBerry_{84F1B62A-E6F6-458E-BC19-51DBB14055EA}" = BlackBerry Desktop Software 4.7
"Blaze Media Pro" = Blaze Media Pro
"Capture-A-ScreenShot_is1" = Capture-A-ScreenShot
"conduitEngine" = Conduit Engine
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Region+CSS Free_is1" = DVD Region+CSS Free [removed]
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDFab Platinum_is1" = DVDFab Platinum 2.9.8.1 Beta
"EXPERTool_is1" = EXPERTool 7.2
"FrameShots" = FrameShots Video Screen Capture
"Fx Joiner and Splitter" = Fx Joiner and Splitter
"Google Chrome" = Google Chrome
"HijackThis" = HijackThis 2.0.2
"Hotkey_is1" = Hotkey 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HP Photosmart Essential" = HP Photosmart Essential 3.5
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 11.0
"HP-LaserJet 1020 series" = LaserJet 1020 series
"HPOCR" = OCR Software by I.R.I.S. 11.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ifs CeFA CDT" = ifs CeFA CDT 1.0
"Intel® 537EP Modem" = Intel® 537EP Modem
"LHTTSENG" = L&H; TTS3000 British English
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"MetaFrame Presentation Server Web Client for Win32" = MetaFrame Presentation Server Web Client for Win32
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MKV TO AVI CONVERTER_is1" = MKV TO AVI CONVERTER version 3.22
"MKV To AVI With Subtitle_is1" = MKV To AVI With Subtitle version 2.0
"Mozilla Firefox (3.6.22)" = Mozilla Firefox (3.6.22)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Neoteris_Secure_Application_Manager" = Juniper Networks Secure Application Manager
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"OpenMG HotFix3.3-03-08-26-01" = OpenMG Limited Patch 3.3-03-09-03-01
"OrderReminder HP LaserJet 1020" = OrderReminder HP LaserJet 1020
"Passware Kit - 5.0.0" = Passware Kit - 5.0.0
"Password Revealer Pro_is1" = Password Revealer Pro
"PCConfidential_is1" = PC Confidential 2008
"Piolet" = Piolet 3.1.1
"Piolet Toolbar" = Piolet Toolbar
"PrimoPDF3.1" = PrimoPDF
"Prism" = Prism Video Converter
"PROSet" = Intel® PRO Network Connections Drivers
"pwupctngem" = RON Tool Offersfortoday
"Quick AVI Splitter v2.0_is1" = Quick AVI Splitter v2.0
"Quick Screen Capture 3.0_is1" = Quick Screen Capture 3.0
"Rapport_msi" = Rapport
"RAR Password Cracker" = RAR Password Cracker 4.12
"RAR Password Recovery" = RAR Password Recovery 5.0
"RealPlayer 12.0" = RealPlayer
"Recovery Toolbox for RAR_is1" = Recovery Toolbox for RAR 1.1
"RegistryBooster 2_is1" = Uniblue RegistryBooster 2
"RegPowerClean2007_is1" = Winferno Registry Power Cleaner
"SAMSUNG CDMA Modem" = SAMSUNG CDMA Modem Driver Set
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Shockwave" = Shockwave
"Shop for HP Supplies" = Shop for HP Supplies
"Super Screen Capture_is1" = Super Screen Capture 4.0
"Ultra RM Converter_is1" = Ultra RM Converter 4.0.1017
"uTorrent" = µTorrent
"uTorrentBar Toolbar" = uTorrentBar Toolbar
"V3.2_is1" = File Scavenger 3.2
"VIA Register Tool" = VIA Register Tool
"VLC media player" = VLC media player 1.0.5
"Vodafone 804SS USB driver" = SAMSUNG Mobile USB Modem ^^
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows Key Demo" = Windows Key 9.0 Demo
"Windows Live Toolbar" = Windows Live Toolbar
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\Owner_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Neoteris_Host_Checker" = Juniper Networks Host Checker

< End of report >
Post #26
Hi Pete.

Please copy and paste the following fix into Notepad - make sure wordwrap is unchecked:
Do not include the word 'CODE'

:OTL
IE - HKU\Owner_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\Owner_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:25503
@Alternate Data Stream - 816 bytes -> C:\WINDOWS\1198198231.vir:686986424.exe

:Services
d70d6b47

:Files
C:\Documents and Settings\All Users\Application Data\f4f74a
C:\Documents and Settings\All Users\Application Data\BMLOP
C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
C:\WINDOWS\1198198231.vir
C:\WINDOWS\$NtUninstallKB17333$

:Commands
[emptyflash]
[emptytemp]

Save it as Fix.txt > save as "all files" and save it to a USB stick:

Now go back to the infected PC>

Boot from the BartPE CD and start OTLPE.

  • Click the red Run Fix button.
  • You should be presented with a message "No Fix has been Provided! Do you want to load it from a file? Click Yes.
  • Browse to the Fix.txt file on your USB stick, and click Open. The fix will then appear in the Custom Scans/Fixes window.
  • Click the red Run Fix button again.
When the fix has completed, remove the CD and boot the computer into normal mode.

NEXT:

If the infected computer will let you do it, please do the following.

On your clean computer, please download a new copy of ComboFix from the link below and save to your Desktop.

ComboFix

Rename ComboFix.exe to pete.com

NEXT:

Copy pete.com to your flash drive (or CD) and transfer it to the to the root of C:\ drive on the infected computer.

NEXT:

Boot the infected computer into Safe Mode with Networking

(This will be listed in the Windows Advanced Options Menu)

NEXT:

Navigate to C:\pete.com and double click on it to run the tool.
It might display a pop up saying that "Recovery Console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this.
If it cannot download the Recovery Console, click to allow it to continue scanning without installing the Recovery Console.
When finished, it will produce a report for you. It will be saved at C:\ComboFix.txt. Please post this report in your next reply.

If you get any problems or error messages, please make a note of them and let me know what they were.
Post #27
Achamian As alwyas thanks for your help. I think we are amking some progress, however, we still have some way to go. Did as instructed and saved Fix.txt to a USB stick and went on the infected pc. Booted from the BartPE CD and started OTLPE as previously instructed. Followed your instructions: 1. Click the red Run Fix button. 2. You should be presented with a message "No Fix has been Provided! Do you want to load it from a file? Click Yes. 3. Browse to the Fix.txt file on your USB stick, and click Open. The fix will then appear in the Custom Scans/Fixes window. 4. Click the red Run Fix button again. However, when I got to step 4, the program just hanged. I would click the Red Fix button and nothing happens and even tried othe buttons. Repeated process and got same results. When I restarted the process Step 1 (Click the red Run Fix button) works fine as do steps 2 & 3. So I copied and pasted the Code you sent to the Custom Scans/Fixes window and clicked the Red Fix button and it worked OK. [With hindsight I should of asked you before doing it this way}. Removed the CD and booted the computer into normal mode. To arrive at the screen with desktop items, Start button at bootom, etc it took 31 minutes (I timed it). I also got the following again: 1. Warning box stating "Please reinstall/update the display driver and program" 2. Another Box [Title] Microsoft Visual C + + Runtime Library Runtime Error! Program:…ommon Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe The application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information. Made a new copy of ComboFix and renamed it "pete" as instructed. Copying this file to C: drived proved unsuccessful. I tried copy & paste, move, send to (all drives listed except C: & D: which are my hard drives), drag from one window to another etc and nothing worked. I tried it from USB stick and CD and got the same results. Without being able to copy the file to C: I could not carry out your further instructions. It does appear I can run the program from the USB but I did NOT try this. The good news is that when I open "My Computer" can access the USB (F: drive) it was not possible before. There is still no connection to the internet o infected pc (firefox returns an error: Server Not Found" while internet explorer does not even start). Thank you. I still haven't given up! Pete
Post #28
Hi Pete.

When I restarted the process Step 1 (Click the red Run Fix button) works fine as do steps 2 & 3. So I copied and pasted the Code you sent to the Custom Scans/Fixes window and clicked the Red Fix button and it worked OK. [With hindsight I should of asked you before doing it this way}.

That is another way of doing it. I'm not sure why the other method didn't work, but nice job getting the fix to run anyway. :thumbup:

Thank you. I still haven't given up!

No problem, Pete. I still haven't given up either. :)

Lets try the following:

(1.)
Insert your USB stick into the infected computer and boot it with the xPUD CD. Let me know whether or not xPUD now recognizes your USB stick.

(2.)
Whilst still in the xPUD environment, check if if these folders are present: on your C:\ drive: (Should be /mnt/sda1)

C:\Documents and Settings\All Users\Application Data\f4f74a
C:\Documents and Settings\All Users\Application Data\BMLOP

and also check if if these files are present on your C:\ drive:

C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
C:\WINDOWS\1198198231.vir
C:\WINDOWS\$NtUninstallKB17333$

If any of these files/folders are present, please rename all of them by adding an x to the front of the name. (Right click and choose Rename)

For example, rename C:\Documents and Settings\All Users\Application Data\f4f74a to C:\Documents and Settings\All Users\Application Data\xf4f74a

And rename C:\WINDOWS\1198198231.vir to C:\WINDOWS\x1198198231.vir

Do the same with any of the others I mentioned that are present.

(3.)
Download a new copy of ComboFix and rename it to svchost.exe, then copy it to your USB stick. Boot into Safe Mode with Networking and try to run svchost.exe directly from your USB stick. (If it cant download the Recovery Console, just click to continue scanning without downloading it.) If a miracle occurs and it produces a log, please post it.

(4.)
Download a new copy of DDS and try to run it directly from your USB stick. (If it won't run in normal mode, try Safe Mode.) If it produces any logs, please post them.

(5.)
Plug a USB stick into the infected computer.
On your clean computer, create an Avira AntiVir Rescue System Boot CD
Boot the infected computer with it and select Option 1
When the scanner has loaded, click the Configuration tab
Under Scan method check All files
Under Action when malware found check Log malware detections only
Click the Virus scanner tab
Click Start scanner
(Note: The scan may take several hours to complete)
When the scan has completed, click Save
Save the rescue-system_scan.log to the USB stick, if possible. If that is not possible, save it somewhere on the hard drive where you can easily find it, then shut down the computer.
Boot the computer with the PE Builder ISO CD you created previously, and copy/save the rescue-system_scan.log to a USB stick. (You could possibly use the A43 File Management Utility or open the log in Notepad and save it to the USB stick.)
Please post the rescue-system_scan.log in your next reply.
Post #29
Achamian First of all, thank you for your last set of instructions. Iappreciate the time, patience and effort you are taking. Secondly, conscious of the fact that we may be in different time zones, I'm on Central European time ( GMT +1), I want to tell you that I will be away on work tomorrow (Monday) and Tuesday back late Wednesday afternoon. So if you do not hear from me it is not because I have given up. Reply against your text as follows: (1.) Insert your USB stick into the infected computer and boot it with the xPUD CD. Let me know whether or not xPUD now recognizes your USB stick. ANSWER: NO. USB not recogniised (2.) Whilst still in the xPUD environment, check if if these folders are present: on your C:\ drive: (Should be /mnt/sda1) C:\Documents and Settings\All Users\Application Data\f4f74a - NOT FOUND C:\Documents and Settings\All Users\Application Data\BMLOP - NOT FOUND and also check if if these files are present on your C:\ drive: C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735} - YES renamed accordingly C:\WINDOWS\1198198231.vir - NOT FOUND C:\WINDOWS\$NtUninstallKB17333$ - Found but unable to rename "Operaion not supported" (3.) Download a new copy of ComboFix and rename it to svchost.exe, then copy it to your USB stick. Boot into Safe Mode with Networking and try to run svchost.exe directly from your USB stick. (If it cant download the Recovery Console, just click to continue scanning without downloading it.) If a miracle occurs and it produces a log, please post it. Did this but same as before. It starts to run and then stops. No report. (4.) Download a new copy of DDS and try to run it directly from your USB stick. (If it won't run in normal mode, try Safe Mode.) If it produces any logs, please post them. Tried this but DDS did not run. Various alternatives tried. Nothing works. (5.) Plug a USB stick into the infected computer. On your clean computer, create an Avira AntiVir Rescue System Boot CD Boot the infected computer with it and select Option 1 When the scanner has loaded, click the Configuration tab Under Scan method check All files Under Action when malware found check Log malware detections only Click the Virus scanner tab Click Start scanner Scanner took a good couple of hours. Could not save directly to USB so saved to C: drive. Rebooted normally, located file and did "save as" to USB. Report is below. Thank you Pete Avira / Linux Version 1.9.152.0 Copyright © 2010 by Avira GmbH All rights reserved. engine set: 8.2.6.64 VDF Version: 7.11.14.223 Scan start time: Sun Sep 18 11:54:57 2011 configuration file: /etc/avira/scancl.conf ALERT: [APPL/NirCmd.E.2.B] /media/Devices/sda1/ComboFix/nircmd.com <<< Contains signature of the application APPL/NirCmd.E.2.B WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/AzeSearch.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/FunWebProducts.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/MyWayMySearch.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/MyWayMySearch1.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/MyWayMySearch2.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/MyWayMySearch3.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/MyWayMySearch4.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/Sysbus.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/Sysbus1.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/Sysbus2.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/Sysbus3.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/Sysbus4.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/Sysbus5.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/Sysbus6.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/UnSpyPc.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/WinVBxj.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/WinVBxj1.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/WinVBxj2.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/WinVBxj3.zip WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Recovery/ZlobVideoAccessActiveXObject.zip WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Owner/Application Data/ESTsoft/ALUpdate/ALZIP/newfile/TEMP/ALZip.exe –> ProgramFilesDir/ALUpdateSetup_en-US.exe WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Owner/Application Data/ESTsoft/ALUpdate/ALZIP/newfile/TEMP/ALZip7_52.exe –> ProgramFilesDir/ALUpdateSetup_en-US.exe WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Owner/Application Data/ESTsoft/ALUpdate/ALZIP/newfile/TEMP/ALZip812.exe –> ProgramFilesDir/ALUpdateSetup_en-US.exe WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Owner/Application Data/ESTsoft/ALUpdate/ALZIP/newfile/TEMP/ALZip812.exe –> ProgramFilesDir/ALSTSSetup_en-US.exe WARNING: [Unsupported archive version] /media/Devices/sda1/Documents and Settings/Owner/Application Data/Juniper Networks/Host Checker/uninstall.exe WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Owner/Application Data/Juniper Networks/setup/uninstall.exe WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Owner/Desktop/Unused Desktop Shortcuts/registryboosteraff.exe WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Owner/Desktop/ALZip.exe WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/Decorator/Latest_Premier_Video-Landy-Sonja-m.t.b.rar WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/HH/p.m.LaSo._27.05.part1.rar WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/HH/p.m.LaSo._27.05.part2.rar WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/HH/p.m.LaSo._27.05.part3.rar WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/HH/p.m.LaSo._27.05.part4.rar WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/HH excitement/LS_High_Heels___Excitement_full.part1.rar WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/HH excitement/LS_High_Heels___Excitement_full.part2.rar WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/HH excitement/LS_High_Heels___Excitement_full.part3.rar WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/L S.B PFeti/L_S.B_PFeti.rar WARNING: [File is encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Lady Sonia/Film/p.m.L.S.13.08/p.m.L.S.13.08.rar WARNING: [Compression method not supported] /media/Devices/sda1/Documents and Settings/Owner/My Documents/My Pictures/Others/Babes/Deauxema/Celebrity/Celebs_Wearing_Miniskirt_Special_03.zip WARNING: [Bad compressed data] /media/Devices/sda1/Documents and Settings/Owner/My Documents/Soft32 Downloads/rpc412.zip –> rpc412_setup.exe WARNING: [Bad compressed data] /media/Devices/sda1/Documents and Settings/Owner/My Documents/Pen Drive/Clone Software/Any DVD V.6.1.0.2 with key/SetupAnyDVD.exe WARNING: [Bad compressed data] /media/Devices/sda1/Documents and Settings/Owner/My Documents/Pen Drive/Clone Software/CloneCD V.5.2.9.1/SetupCloneCD5291.exe WARNING: [Bad compressed data] /media/Devices/sda1/Documents and Settings/Owner/My Documents/Pen Drive/Clone Software/clonedvd v2.8.9.9/SetupCloneDVD2899Slysoft/SetupCloneDVD2899Slysoft.exe WARNING: [All files in archive are encrypted] /media/Devices/sda1/Documents and Settings/Owner/My Documents/Downloads/Bereavement (2011) DVDRip/Bereavement (2011) DVDRip.rar ALERT: [TR/Agent.722640.A] /media/Devices/sda1/Program Files/Active Data Recovery Software/Active Password Changer/SetupISO.exe <<< Is the Trojan horse TR/Agent.722640.A WARNING: [File is encrypted] /media/Devices/sda1/Program Files/Ad-Aware/Skins/Ad-Aware SE default.ask ALERT: [W32/PatchLoad.A] /media/Devices/sda1/Program Files/Nero/Nero8/Nero BackItUp/NBService.exe <<< Contains signature of the Windows virus W32/PatchLoad.A WARNING: [File is encrypted] /media/Devices/sda1/Program Files/Nero 8/Nero 8.3.6/N8.3.6.0.part1.part1.rar WARNING: [File is encrypted] /media/Devices/sda1/Program Files/Nero 8/Nero 8.3.6/N8.3.6.0.part1.part2.rar WARNING: [File is encrypted] /media/Devices/sda1/Program Files/Nero 8/Nero 8.3.6/N8.3.6.0.part1.part3.rar WARNING: [Bad compressed data] /media/Devices/sda1/Program Files/DVD Programs/Any DVD V.6.1.0.2 with key/SetupAnyDVD.exe WARNING: [Bad compressed data] /media/Devices/sda1/Program Files/DVD Programs/CloneCD V.5.2.9.1/SetupCloneCD5291.exe WARNING: [Bad compressed data] /media/Devices/sda1/Program Files/DVD Programs/clonedvd v2.8.9.9/SetupCloneDVD2899Slysoft/SetupCloneDVD2899Slysoft.exe ALERT: [DR/Drop.Delf.erq] /media/Devices/sda1/Program Files/DVD Programs/DVD CLONER IV 4.00 Build 901 set up with key/dcloner.exe <<< Contains signature of the dropper DR/Drop.Delf.erq ALERT: [TR/Drop.Delf.erq] /media/Devices/sda1/Program Files/DVD Programs/DVD CLONER IV 4.00 Build 901 set up with key/dcloner.exe –> {app}\Dvd-cloner4.exe <<< Is the Trojan horse TR/Drop.Delf.erq WARNING: [File is encrypted] /media/Devices/sda1/Program Files/RAR Password Cracker/example1.rar WARNING: [File is encrypted] /media/Devices/sda1/Program Files/RAR Password Cracker/example2.rar WARNING: [Bad compressed data] /media/Devices/sda1/Program Files/RAR Password Cracker/uninstall.exe ALERT: [APPL/Smitrem.1] /media/Devices/sda1/Program Files/smitRem/replaceIE7.cmd <<< Contains signature of the application APPL/Smitrem.1 ALERT: [APPL/Smitrem] /media/Devices/sda1/Program Files/smitRem/RunThis.bat <<< Contains signature of the application APPL/Smitrem ALERT: [APPL/Smitrem.1] /media/Devices/sda1/Program Files/smitRem/smitRem.exe <<< Contains signature of the application APPL/Smitrem.1 ALERT: [APPL/Smitrem] /media/Devices/sda1/Program Files/smitRem/smitRem.exe <<< Contains signature of the application APPL/Smitrem ALERT: [TR/Dropper.Gen] /media/Devices/sda1/Program Files/Piolet/TaskKiller.exe <<< Is the Trojan horse TR/Dropper.Gen WARNING: [Unsupported archive version] /media/Devices/sda1/Program Files/ifs Competence Development Tool/uninst.exe ALERT: [W32/PatchLoad.A] /media/Devices/sda1/Program Files/iPod/bin/iPodService.exe <<< Contains signature of the Windows virus W32/PatchLoad.A WARNING: [File is encrypted] /media/Devices/sda1/Program Files/Lavasoft/Ad-Aware SE Personal/Skins/Ad-Aware SE default.ask ALERT: [W32/PatchLoad.A] /media/Devices/sda1/Program Files/Trusteer/Rapport/bin/RapportMgmtService.exe <<< Contains signature of the Windows virus W32/PatchLoad.A WARNING: [Unexpected end of file] /media/Devices/sda1/Program Files/FrameShots3/Uninst.exe ALERT: [TR/Spy.133104.1] /media/Devices/sda1/Program Files/Google/Update/GoogleUpdate.exe <<< Is the Trojan horse TR/Spy.133104.1 ALERT: [TR/Spy.ZBot.693016] /media/Devices/sda1/Program Files/AVG/AVG8/avgcsrvx.exe <<< Is the Trojan horse TR/Spy.ZBot.693016 ALERT: [W32/PatchLoad.A] /media/Devices/sda1/Program Files/AVG/AVG8/avgemc.exe <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [TR/Spy.ZBot.486680.1] /media/Devices/sda1/Program Files/AVG/AVG8/avgrsx.exe <<< Is the Trojan horse TR/Spy.ZBot.486680.1 ALERT: [TR/Spy.ZBot.297752.1] /media/Devices/sda1/Program Files/AVG/AVG8/avgwdsvc.exe <<< Is the Trojan horse TR/Spy.ZBot.297752.1 ALERT: [TR/Spy.ZBot.595736.1] /media/Devices/sda1/Program Files/AVG/AVG8/avgnsx.exe <<< Is the Trojan horse TR/Spy.ZBot.595736.1 WARNING: [Bad compressed data] /media/Devices/sda1/Program Files/Clone Software/Any DVD V.6.1.0.2 with key/SetupAnyDVD.exe WARNING: [Bad compressed data] /media/Devices/sda1/Program Files/Clone Software/CloneCD V.5.2.9.1/SetupCloneCD5291.exe WARNING: [Bad compressed data] /media/Devices/sda1/Program Files/Clone Software/clonedvd v2.8.9.9/SetupCloneDVD2899Slysoft/SetupCloneDVD2899Slysoft.exe ALERT: [DR/Drop.Delf.erq] /media/Devices/sda1/Program Files/Clone Software/DVD CLONER IV 4.00 Build 901 set up with key/dcloner.exe <<< Contains signature of the dropper DR/Drop.Delf.erq ALERT: [TR/Drop.Delf.erq] /media/Devices/sda1/Program Files/Clone Software/DVD CLONER IV 4.00 Build 901 set up with key/dcloner.exe –> {app}\Dvd-cloner4.exe <<< Is the Trojan horse TR/Drop.Delf.erq WARNING: [Unsupported archive version] /media/Devices/sda1/Program Files/Common Files/Adobe/ESD/uninst.exe ALERT: [W32/PatchLoad.A] /media/Devices/sda1/Program Files/Common Files/Apple/Mobile Device Support/AppleMobileDeviceService.exe <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [TR/Kazy.11879.3] /media/Devices/sda1/Program Files/Common Files/Microsoft Shared/VS7DEBUG/MDM.EXE <<< Is the Trojan horse TR/Kazy.11879.3 ALERT: [W32/PatchLoad.A] /media/Devices/sda1/Program Files/Common Files/Nero/Lib/NMIndexingService.exe <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [W32/PatchLoad.A] /media/Devices/sda1/Program Files/Common Files/Roxio Shared/9.0/SharedCOM/RoxLiveShare9.exe <<< Contains signature of the Windows virus W32/PatchLoad.A WARNING: [Archive is invalid or corrupt] /media/Devices/sda1/Program Files/WinRAR/rarnew.dat ALERT: [W32/PatchLoad.A] /media/Devices/sda1/Program Files/Roxio/Digital Home 9/RoxioUpnpService9.exe <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP396/A0141102.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP396/A0141103.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [W32/PatchLoad.A] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP397/A0141435.rbf <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP397/A0141492.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP397/A0141493.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP397/A0142492.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP397/A0142493.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP397/A0142507.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP397/A0142508.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP399/A0142767.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP399/A0142768.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP400/A0143159.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP400/A0143160.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP401/A0143181.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [W32/PatchLoad.A] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP402/A0143640.exe <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP403/A0143699.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP403/A0143700.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [W32/PatchLoad.A] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP403/A0143704.rbf <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP403/A0143982.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP403/A0143983.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [W32/PatchLoad.A] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP405/A0144021.exe <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [W32/PatchLoad.A] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP405/A0144026.exe <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP407/A0144134.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP407/A0144135.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP407/A0145134.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP407/A0145135.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP407/A0147167.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP407/A0147168.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0147735.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0147694.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Spy.25600.152] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0147695.ini <<< Is the Trojan horse TR/Spy.25600.152 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0147734.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0147790.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0148790.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0148791.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0148814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0148815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0149814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0149815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0150814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0150815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0151814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0151815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0152814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0152815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0153814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0153815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0154814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0154815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0155814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0156814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0156815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0157814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0157815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0158814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0158815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0159814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0159815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0160815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0161814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0161815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0162814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0162815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0162839.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0162840.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0163839.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0163840.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0163868.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0163869.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0147791.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0155815.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0160814.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0163964.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0163965.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0164964.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0164965.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0165964.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0165965.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0166041.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0166042.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0167041.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0167042.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0168041.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0168125.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0168126.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0168146.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0168147.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0169146.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0169147.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0170146.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0170147.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0171146.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0171147.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0171161.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0171162.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0172161.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0172162.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/System Volume Information/_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}/RP408/A0168042.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 ALERT: [RKIT/ZAccess.c.1] /media/Devices/sda1/WINDOWS/system32/drivers/cdrom.sys <<< Contains signature of Rootkits RKIT/ZAccess.c.1 ALERT: [TR/Kazy.25098.10] /media/Devices/sda1/WINDOWS/system32/IoctlSvc.exe <<< Is the Trojan horse TR/Kazy.25098.10 ALERT: [TR/Spy.ZBot.46080] /media/Devices/sda1/WINDOWS/system32/CTSVCCDA.EXE <<< Is the Trojan horse TR/Spy.ZBot.46080 ALERT: [TR/Spy.53472.4] /media/Devices/sda1/WINDOWS/system32/wuauclt.exe <<< Is the Trojan horse TR/Spy.53472.4 ALERT: [W32/PatchLoad.A] /media/Devices/sda1/WINDOWS/system32/nvsvc32.exe <<< Contains signature of the Windows virus W32/PatchLoad.A ALERT: [TR/ATRAPS.Gen2] /media/Devices/sda1/WINDOWS/assembly/GAC_MSIL/Desktop.ini <<< Is the Trojan horse TR/ATRAPS.Gen2 WARNING: [Error writing file] /media/Devices/sda5/Gone With The Wind1/GONE_WITH_THE_WIND1.ISO WARNING: [Error writing file] /media/Devices/sda5/Gone With The Wind1/GONE_WITH_THE_WIND_DISC2.ISO WARNING: [File is encrypted] /media/Devices/sda5/Others/Downloads/RegCure 1 5 0 0 Serial/RegCure 1 5 0 0 Serial.rar –> serial.rar WARNING: [The files in archive are multiple volume] /media/Devices/sda5/Others/HH excitement/Spike/Mature.p ALERT: [TR/Agent.xbf.8] /media/Devices/sda5/Others/HH excitement/Winrar/freeware5.rar –> files\RapidLeecher_Setup.exe <<< Is the Trojan horse TR/Agent.xbf.8 WARNING: [Bad compressed data] /media/Devices/sda5/Others/HH excitement/Winrar/rpc412.zip –> rpc412_setup.exe
Post #30
Hi Pete.

I'm afraid that your computer is in a very bad way. Not only do you have a ZeroAccess rootkit, you also have a bad virus infection which has patched a lot of your files, including some Microsoft system files. And that's not all. You also have some Backdoor Trojans on board, so I need to give you this warning.

One or more of the identified infections was a Backdoor Trojan.

This can allow hackers to potentially remotely control your computer, steal critical system information and download and execute files.

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and killed, because of it's backdoor functionality, your PC might be compromised to a point that there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

I can still try to clean this machine. But, even if I do manage to clean it, I can't guarantee that it will be 100% secure afterwards. If after careful consideration you have decided to move forward with cleanup then please proceed as I have outlined below.

(1.)
Boot the computer with the xPUD CD, then navigate to this file:

C:WINDOWS\assembly\GAC_MSIL\Desktop.ini

rename Desktop.ini to 123.xxx

Then boot into Safe Mode with Networking and try to run ComboFix renamed to svchost.exe from your USB stick again.

If it runs please post the log that it produces.

(2.)
If ComboFix still will not run, please do this instead.

Run OTLPE.
Change Drivers to All
Change Standard Registry to All
Under the Custom Scan box paste this in

/md5start
cdrom.sys
wuauclt.exe
MDM.EXE
/md5stop

Press Run Scan to start the scan.
Please post the logs in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI