Spyware / Malware / Virus Removal

Infected with W32.Morto

12 min read

Looking for the outcome? Ask AI

AllenM Topic Starter

Post #1September 9, 2011, 11:44 PM UTC

Hello there,

First some background on me. I am a software engineer and a computer expert and also a Guru on the Norton Community Forum. It appears that I have been hit for only the second time in over 21 years with a virus.

I have Windows 7 Ultimate 32 bit with 4GB of RAM.

My saga is as follows. On Aug 30th I woke up one morning to find NIS (Norton Internet Security) alerting on a file called “cache.txt” located in C”\Windows\Offline Web Pages. Upon investigation it appears to be the W32.Morto WORM. The Symantec security response article is:
http://www.symantec.com/security_response/…-99&tabid=2
Upon checking the NIS logs I found that the alerts started about 1:30AM while I was sound asleep. Between that time and about 7AM when I woke up, NIS had alerted 49 additional times on this file showing that it was blocked. The first alert at 1:30AM showed that it was quarantined. I started monitoring this directory and as I watched it I could see this file appearing and disappearing over and over again about every 10-15 seconds!
I rebooted the computer and NIS alerted one last time and this time showed TWO things infected, the file + a registry key. It removed both and since then things appeared normal on the surface.

NIS scans were clean at this point as was MBAM. But I also wanted to scan with the NBRT (Norton Bootable Recovery Tool). Much to my dismay I found that the BIOS would no longer recognize the USB flash drive as being a bootable media. I tried TWO different flash drives and neither would boot if it was burned as an NBRT but both DID boot from the very same flash if it was burned as a Norton Ghost recovery disk! Long story short I ended up downloading the very same version of BIOS from the MB manufacturer which I already had and reflashed the BIOS. I rebooted the computer and all of a sudden both flashes started being recognized.
Though W32.Morto is not to my knowledge known to infect the BIOS, either it or some other malware which came after that actually did infect my BIOS.
I was still somewhat leery so I started browsing through my Norton Ghost Image backups and found that the file “cache.txt” had been present in my backup images since Aug 21st. Yet NIS never alerted until Aug 30th. Clearly I had been hit with a Zero day virus which apparently laid dormant (and hence unnoticed by NIS) for about 9 days.

So I ended up restoring my Norton Ghost image from Aug 18th which predated the first appearance of that file. I chose to also restore the MBR.
Everything was fine after this, until this morning.

This morning I woke up and hit Ctrl+Alt+Delete to log into my computer and instead of coming up with the password entry it went to the screen to select my username instead. I know from experience this only happens when a user is logged into the computer remotely. DANGER SIGN!

So I logged in and find that the “cache.txt” file is once again back! I ran a scan with MBAM and it now detects a TROJAN in “svchst.exe” which I recognize as a core Windows executable. I am attaching the logs from both MBAM and HijackThis.

NIS is also now alerting saying such and such IP address is trying to access my computer. It refers to the infection (not surprisingly) as W32.Morto. Please let me know if you want a screenshot attached of this attempted attack.

Some other information:

The indications from the Symantec Security response article is that someone likely hacked into my computer via the default Administrator account. I never have this account enabled – my normal account does have Admin but I never use the default Administrator account for security reasons. And yes I know using an account with Admin rights it not recommended but I do have my reasons for doing so. Much to my dismay I checked and sure enough the default Administrator account was active. Then I remembered that a couple of months ago I did use this account briefly when working on a minor problem which could have been due to a corrupted user account. Apparently I forgot to disable the default Administrator account when I was done. Argh, how stupid of me!

Of course I disabled it again after restoring the Norton Ghost image.

The fact that I was hit again today tells me that one of two things seems likely:

1. Someone managed to hack into my primary user account via RDP even though I had changed the password to what I believe is a strong password.

2. This infection somehow survived a Ghost Image restoral even though I also restored the MBR.

Both are scary but #2 is even more scary.

For number 1 I will not be enabling RDP again until I get it secured through an encrypted VPN and most likely will change the default RDP port as well. I am also considering installing a program called "Radmin” which was recommended by a friend which has built-in encryption.

Please help. At this point I am no longer comfortable just restoring a Ghost image given that I was hit again, or it was never truly gone in the first place.

Also, I pulled up "cache.txt" in Notepad. It is clearly an executable and not a text file. Again, please let me know if you want that file uploaded as well.

Thanks very much
Allen

Attachments:

mowman

Post #2September 10, 2011, 8:55 PM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

The MBAM log shows no action taken,run it again and remove that entry plus anything else it finds.

Download aswMBR.exe ( 511KB ) to your desktop.
Double click the aswMBR.exe to run it
Click the Scan button to start scan
On completion of the scan click Save Log, save it to your Desktop and post in your next reply

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

AllenM

Post #3September 10, 2011, 9:49 PM UTC

Hi mowman,

Thanks very much for takikng the time to help out.

I am rerunning the full scan with MBAM now but I have 3 drives and I know this will take at least 2 hours and probably closer to 3 hours. So I wanted to just post a reply first that I am running through your instructions now.

I purposely did not remove the two threats that MBAM found just in case you all wanted a copy of the file first for any reason.

Given that the "svchost.exe" instance MBAM found was in the Windows\temp directory and not the "real" one in the Windows\System32 directory I am sure it is safe to remove.

I know you are just getting started on looking at this but I am curious on a couple of things while the scans are running.

1. As I mentioned I restored a Norton Ghost Image backup to include restoral of the MBR from Aug 18th. This backup pre-dated the first appearance of that "cache.txt" file that NIS alerted on numerous times and identified as W32.Morto. Given that my system "seemed" clean for a full week after that Ghost image restoral would you be inclined to think I was actually targeted a second time as a fresh attack on a clean system, or that something was still left on the computer which allowed them in through the "back door"? If you feel something might have still been on the system do you feel that perhaps my Norton Ghost backup did still contain a threat or that somehow the malware actually managed to survive a Ghost restoral and still be intact? I'm asking because it would seem that a Ghost restoral, especially when also restoring the MBR should take care of it - as I undertsand it is rare even for a rootkit to survive something like this, though I know I've been told some rootkits can. FYI, before restoring this Ghost image I had also mounted the backup image to allow full access via Windows Explorer to all the files and scanned it with NIS. This scan had also been clean. I scanned it on my laptop and not the computer which had the infection.

2. Does the W32.Morto infect the MBR.

3. Given that in the original infection back on Aug 30th my BIOS had also been infected it would seem to imply that W32.Morto was not the only infection. At least from documentation I've read on this one it is not known to infect the BIOS. Note that this latest infection did NOT infect the BIOS or I should say did not affect the ability to boot from USB flash drives to get to the NBRT.

Thanks much and I'll post all the logs back ASAP.
Allen

AllenM

Post #4September 10, 2011, 10:56 PM UTC

Hi mowman, A couple of other questions if I may: 1. c:\Windows\Offlne Web Pages\cache.txt was identified as a threat related to W32.Morto. MBAM is not finding that so just wanted you to be aware of it. 2. WHen I woke up yesterday morning to find that I had been infected again (or perhaps still) NIS alerted me to an intrusion attempt from an IP address originating from Hong Kong. NIS said it blocked it. In the details of the security history it said the threat was utilizing c:\windows\system32\svchost.exe. Yet MBAM is alerting on c:\windows\temp\svchost.exe which should not even exist on a non-infected system. Do you think this difference is important? Concern is that perhaps the svchost.exe in the system32 directory might also be infected. 3. In the "Resolved" security risks section of NIS history there is another "Blocked" entry for c:\windows\system32\ntshrui.dll. Note that the status shows that it was "blocked" and not removed or anything. In the details it also referred to this file as being infected with W32.Morto. Yet current scans with MBAM and NIS is not showing this file as containing a threat. The MBAM scan is still running and still on the but has now moved on to the D drive. This time MBAM has NOT alerted on c:\windows\Temp\svchost.exe. This seems odd, and the file is still present. Should I manually remove this file myself? There are also lots of other files in the Windows\Temp directory. Thanks much Allen

AllenM

Post #5September 11, 2011, 12:32 AM UTC

Hi mowman,

I've got the requested logs. First the following notes:

1. MBAM did finally come back and find the previous "svchost.exe" in Windows\temp. Odd that it went to the E drive with no threats yet detected then apparently went back to the C drive.

2. MBAM Version - since I use this solely as an on-demand scanner I don't run it that often. However I wanted to make note of the fact that when I ran it, it said that it was 175 days out of date so I reconnected to the Internet and told it to check for updates. It immediately came back and said I had the latest database! Made me curious so I disconnected from the INternet again and it STILL said I had the latest database. When I go into the Update tab, the database and program versions are both blank. This could be some problem with MBAM or related to malware, don't know at this point. But I thought it wise to mention this. Please let me know if you want me to uninstall MBAM, run the MBAM clean tool and reinstall.

3. When I ran OTL it only brought up ONE Notepad with OTL.txt. The Extras.txt did not open. It is interesting because I also posted to the Emisoft forum yesterday (not knowing who would respond first

) and they also use the OTL tool and when I ran the one I downloaded from their website I did get both of these files.

Anyway, here are the logs:

MBAM
_____

Malwarebytes' Anti-Malware
www.malwarebytes.org

Database version:

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

9/10/2011 4:24:58 PM
mbam-log-2011-09-10 (16-24-58).txt

Scan type: Full scan (C:\|D:\|E:\|)
Objects scanned: 570607
Time elapsed: 1 hour(s), 56 minute(s), 29 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
c:\Windows\Temp\svchost.exe (Trojan.Agent) -> 1584 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
e:\windows games\microsoft games\FS2002\gmax\gmax_setup.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Windows\Temp\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

________________________________________________________________________________
__________________________________________________

ansMBR.txt

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-09-10 16:43:12
—————————–
16:43:12.670 OS Version: Windows 6.1.7601 Service Pack 1
16:43:12.670 Number of processors: 4 586 0x1707
16:43:12.670 ComputerName: ALLEN-SAMUEL UserName: allenm
16:43:16.336 Initialize success
16:44:13.428 AVAST engine defs: 11091002
16:44:38.965 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3
16:44:38.965 Disk 0 Vendor: ST3500630AS 3.AAK Size: 476938MB BusType: 3
16:44:38.981 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-5
16:44:38.981 Disk 1 Vendor: ST3500630AS 3.AAK Size: 476940MB BusType: 3
16:44:38.981 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T0L0-4
16:44:38.981 Disk 2 Vendor: ST3500630AS 3.AAK Size: 476938MB BusType: 3
16:44:38.981 Disk 3 \Device\Harddisk3\DR3 -> \Device\Scsi\JRAID1Port6Path0Target0Lun0
16:44:38.996 Disk 3 Vendor: Backup__ Size: 953856MB BusType: 1
16:44:41.024 Disk 0 MBR read successfully
16:44:41.040 Disk 0 MBR scan
16:44:41.040 Disk 0 Windows 7 default MBR code
16:44:41.040 Disk 0 scanning sectors +976768065
16:44:41.102 Disk 0 scanning C:\Windows\system32\drivers
16:44:53.863 Service scanning
16:44:55.517 Modules scanning
16:45:02.786 Disk 0 trace - called modules:
16:45:02.802 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
16:45:02.802 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86b3b388]
16:45:02.802 3 CLASSPNP.SYS[8d3c359e] -> nt!IofCallDriver -> [0x86531918]
16:45:02.802 5 ACPI.sys[8ca5e3d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-3[0x865b0030]
16:45:05.828 AVAST engine scan C:\Windows
16:45:15.313 AVAST engine scan C:\Windows\system32
16:47:10.816 AVAST engine scan C:\Windows\system32\drivers
16:47:24.700 AVAST engine scan C:\Users\allenm
17:02:08.285 AVAST engine scan C:\ProgramData
17:08:39.565 Scan finished successfully
17:08:57.817 Disk 0 MBR has been saved successfully to "G:\WhatTheTech\MBR.dat"
17:08:57.833 The log file has been saved successfully to "G:\WhatTheTech\aswMBR.txt"

________________________________________________________________________________
______________________________

OTL.txt

OTL logfile created on: 9/10/2011 5:10:48 PM - Run 2
OTL by OldTimer - Version 3.2.27.0 Folder = G:\WhatTheTech
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 61.51% Memory free
12.99 Gb Paging File | 11.56 Gb Available in Paging File | 88.95% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.76 Gb Total Space | 417.55 Gb Free Space | 89.65% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 409.28 Gb Free Space | 87.87% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 405.57 Gb Free Space | 87.08% Space Free | Partition Type: NTFS
Drive G: | 3.72 Gb Total Space | 2.99 Gb Free Space | 80.47% Space Free | Partition Type: FAT32
Drive Y: | 931.50 Gb Total Space | 145.26 Gb Free Space | 15.59% Space Free | Partition Type: NTFS

Computer Name: ALLEN-SAMUEL | User Name: allenm | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Windows\Temp\svchost.exe ()
PRC - G:\WhatTheTech\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe (Symantec Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - D:\Program Files\Norton Utilities 14\nu.exe (Symantec Corporation)
PRC - D:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - D:\Program Files\Logitech\SetPointP\LBTWiz.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\CryptoExpert Professional\cexpert_tray.exe (InterCrypto Ltd)
PRC - C:\Program Files\CryptoExpert Professional\cexpertcoreclient.exe (InterCrypto Ltd)
PRC - C:\Program Files\CryptoExpert Professional\cexpertcoreserver.exe (InterCrypto Ltd)
PRC - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
PRC - C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
PRC - D:\Program Files\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
PRC - D:\Program Files\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
PRC - D:\Program Files\RAXCO\PerfectDisk10\PDAgentS1.exe (Raxco Software, Inc.)
PRC - D:\Program Files\RAXCO\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
PRC - D:\Program Files\RAXCO\PerfectDisk10\PDEngine.exe (Raxco Software, Inc.)
PRC - D:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - D:\Program Files\Norton Ghost\Agent\SymDB.exe (Symantec Corporation)
PRC - D:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe (Symantec)
PRC - C:\Program Files\GIGABYTE\GEST\gest.exe ()
PRC - C:\Program Files\CyberLink\Shared Files\brs.exe (cyberlink)
PRC - C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\CtHelper.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Program Files\GIGABYTE\ET5Pro\GUI.exe ()
PRC - D:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
PRC - D:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe (American Power Conversion Corporation)
PRC - C:\Users\allenm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Snsicon.exe (Second Nature Software, Inc.)
PRC - C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
PRC - D:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\GIGABYTE\GEST\etiv.dll ()
MOD - C:\Program Files\GIGABYTE\GEST\ycc.dll ()
MOD - C:\Program Files\GIGABYTE\GEST\gest.exe ()
MOD - C:\Windows\CTXFIRES.DLL ()
MOD - C:\Program Files\GIGABYTE\ET5Pro\Normal.dll ()
MOD - C:\Program Files\GIGABYTE\ET5Pro\GVTunner.dll ()
MOD - C:\Program Files\GIGABYTE\ET5Pro\GUI.exe ()
MOD - C:\Program Files\GIGABYTE\ET5Pro\work.dll ()
MOD - C:\Program Files\GIGABYTE\ET5Pro\etiv.dll ()
MOD - C:\Windows\System32\APOMngr.DLL ()
MOD - C:\Program Files\GIGABYTE\ET5Pro\MarkFunDrv.dll ()
MOD - C:\Windows\System32\ctmmactl.dll ()
MOD - C:\Program Files\GIGABYTE\ET5Pro\W83781D.DLL ()
MOD - D:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe ()
MOD - D:\Program Files\Logitech\Easy Synchronization\msbluetooth.dll ()
MOD - D:\Program Files\Logitech\Easy Synchronization\pybluetooth.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\libbluetooth.dll ()
MOD - D:\Program Files\Logitech\Easy Synchronization\pywidcommc.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\libwidcommc.dll ()
MOD - D:\Program Files\Logitech\Easy Synchronization\pyvspdxp.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\pythoncom23.dll ()
MOD - D:\Program Files\Logitech\Easy Synchronization\pywintypes23.dll ()
MOD - D:\Program Files\Logitech\Easy Synchronization\dde.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\win32ui.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\shell.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\win32gui.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\win32security.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\win32process.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\win32pdh.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\win32pipe.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\win32file.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\win32event.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\win32api.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\_winreg.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\pyexpat.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\_sre.pyd ()
MOD - C:\Program Files\GIGABYTE\ET5Pro\mibdata.dll ()
MOD - D:\Program Files\Logitech\Easy Synchronization\htmlc.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\wxc.pyd ()
MOD - D:\Program Files\Logitech\Easy Synchronization\wxmsw24uh.dll ()
MOD - C:\Program Files\GIGABYTE\ET5Pro\Sound.dll ()

========== Win32 Services (SafeList) ==========

SRV - (WPFFontCache_v0400) – File not found
SRV - (GEARSecurity) – File not found
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (NIS) – C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe (Symantec Corporation)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (DriveShareSvc) – C:\Program Files\CryptoExpert Professional\drivesharessvc.exe (InterCrypto Ltd)
SRV - (NAUpdate) – C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
SRV - (Norton Ghost) – D:\Program Files\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
SRV - (PDAgent) – D:\Program Files\Raxco\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
SRV - (PDEngine) – D:\Program Files\Raxco\PerfectDisk10\PDEngine.exe (Raxco Software, Inc.)
SRV - (GenericMount Helper Service) – D:\Program Files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe (Symantec)
SRV - (TomTomHOMEService) – D:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (SymSnapService) – D:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe (Symantec)
SRV - (SENS) – C:\Windows\System32\sens32.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (GEST Service) – C:\Program Files\GIGABYTE\GEST\GSvr.exe ()
SRV - (CTAudSvcService) – C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (Symantec RemoteAssist) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (APC UPS Service) – D:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
SRV - (Logitech Easy Synchronization) – D:\Program Files\Logitech\Easy Synchronization\servicestub.exe ()
SRV - (XWNTSERV) – C:\Windows\System32\XWNTSERV.EXE ()
SRV - (C-DillaSrv) – C:\Windows\System32\drivers\CDANTSRV.EXE (C-Dilla Ltd)

========== Driver Services (SafeList) ==========

DRV - (GVTDrv) – C:\Windows\System32\drivers\GVTDrv.sys ()
DRV - (gdrv) – C:\Windows\gdrv.sys (Windows ® 2000 DDK provider)
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110901.001\BHDrvx86.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110909.016\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110909.016\NAVENG.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110909.030\IDSvix86.sys (Symantec Corporation)
DRV - (SymNetS) – C:\Windows\System32\Drivers\NIS\1206000.01D\SYMNETS.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SymIM) – C:\Windows\System32\drivers\SymIMV.sys (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\NIS\1206000.01D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\NIS\1206000.01D\SRTSPX.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\NIS\1206000.01D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\NIS\1206000.01D\SYMDS.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\NIS\1206000.01D\Ironx86.SYS (Symantec Corporation)
DRV - (MBAMSwissArmy) – C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (vpcvmm) – C:\Windows\System32\drivers\vpcvmm.sys (Microsoft Corporation)
DRV - (vpcbus) – C:\Windows\System32\drivers\vpchbus.sys (Microsoft Corporation)
DRV - (vmbus) – C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (vpcusb) – C:\Windows\System32\drivers\vpcusb.sys (Microsoft Corporation)
DRV - (vpcnfltr) – C:\Windows\System32\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (DVDHlp) – C:\Windows\System32\drivers\dvdhlp.sys (SlySoft, Inc.)
DRV - (LMouFilt) – C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LHidEqd) – C:\Windows\System32\drivers\LHidEqd.sys (Logitech, Inc.)
DRV - (LEqdUsb) – C:\Windows\System32\drivers\LEqdUsb.sys (Logitech, Inc.)
DRV - (cc_4g) – C:\Windows\system32\Drivers\cc_4g.sys (SecureAction Research, LLC)
DRV - (GenericMount) – C:\Windows\System32\drivers\GenericMount.sys (Symantec Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (ElbyCDI0) – C:\Windows\System32\drivers\ElbyCDI0.sys (Elaborate Bytes AG)
DRV - (DefragFS) – C:\Windows\System32\drivers\DefragFs.sys (Raxco Software, Inc.)
DRV - (MagicTune) – C:\Windows\system32\drivers\MTiCtwl.sys (Samsung Electronics, Inc. )
DRV - (WimFltr) – C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (VProEventMonitor) – C:\Windows\System32\drivers\vproeventmonitor.sys (Symantec Corporation)
DRV - (symsnap) – C:\Windows\system32\DRIVERS\symsnap.sys (StorageCraft)
DRV - (MarkFun_NT) – C:\Program Files\GIGABYTE\ET5Pro\MARKFUN.W32 (Windows ® 2000 DDK provider)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (SIUSBXP) – C:\Windows\System32\drivers\SiUSBXp.sys (Silicon Laboratories)
DRV - ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) – D:\Program Files\CyberLink\PowerDVD\000.fcl (Cyberlink Corp.)
DRV - (ha20x2k) – C:\Windows\System32\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\Windows\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\Windows\System32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\Windows\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\Windows\System32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctdvda2k) – C:\Windows\System32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\System32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\Windows\System32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTHWIUT.DLL) – C:\Windows\System32\CTHWIUT.DLL (Creative Technology Ltd.)
DRV - (CT20XUT.DLL) – C:\Windows\System32\CT20XUT.DLL (Creative Technology Ltd.)
DRV - (CTEXFIFX.DLL) – C:\Windows\System32\CTEXFIFX.DLL (Creative Technology Ltd.)
DRV - (CTEDSPSY.DLL) – C:\Windows\System32\CTEDSPSY.DLL (Creative Technology Ltd)
DRV - (CTEDSPIO.DLL) – C:\Windows\System32\CTEDSPIO.DLL (Creative Technology Ltd)
DRV - (CTERFXFX.DLL) – C:\Windows\System32\CTERFXFX.DLL (Creative Technology Ltd)
DRV - (CTEDSPFX.DLL) – C:\Windows\System32\CTEDSPFX.DLL (Creative Technology Ltd)
DRV - (CTEAPSFX.DLL) – C:\Windows\System32\CTEAPSFX.DLL (Creative Technology Ltd)
DRV - (CTSBLFX.DLL) – C:\Windows\System32\CTSBLFX.DLL (Creative Technology Ltd)
DRV - (CTAUDFX.DLL) – C:\Windows\System32\CTAUDFX.DLL (Creative Technology Ltd)
DRV - (COMMONFX.DLL) – C:\Windows\System32\COMMONFX.DLL (Creative Technology Ltd)
DRV - (SaiH0255) – C:\Windows\System32\drivers\SaiH0255.sys (Saitek)
DRV - (ET5Drv) – C:\Windows\System32\drivers\ET5Drv.sys (Windows ® 2000 DDK provider)
DRV - (JRAID) – C:\Windows\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV - (BVRPMPR5) – C:\Windows\System32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (cc_firewall) – C:\Windows\System32\drivers\cc_firewall.sys (SecureAction Research, LLC)
DRV - (DFUBTUSB) – C:\Windows\System32\drivers\frmupgr.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\Windows\System32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (CLBStor) – C:\Windows\System32\drivers\CLBStor.sys (Cyberlink Co.,Ltd.)
DRV - (MYFAULT) – C:\Windows\System32\drivers\myfault.sys (Sysinternals)
DRV - (ASPI32) – C:\Windows\System32\drivers\aspi32.sys (Adaptec)
DRV - (Pronto2G) – C:\Windows\System32\drivers\PRONTO2G.sys (Philips Electronics)
DRV - (cvintdrv) – C:\Windows\System32\drivers\cvintdrv.sys ()
DRV - (imhidusb) – C:\Windows\System32\drivers\imhidusb.sys (Immersion Corporation)
DRV - (prohlp02) – C:\Windows\System32\drivers\prohlp02.sys (Protection Technology)
DRV - (prodrv06) – C:\Windows\System32\drivers\prodrv06.sys (Protection Technology)
DRV - (Cinemsup) – C:\Windows\System32\drivers\cinemsup.sys (Sonic Solutions)
DRV - (sfhlp01) – C:\Windows\System32\drivers\sfhlp01.sys (Protection Technology)
DRV - (CDRPDACC) – D:\Program Files\321Studios\Shared\CDRPDACC.SYS (Arrowkey)
DRV - (prosync1) – C:\Windows\System32\drivers\prosync1.sys (Protection Technology)
DRV - (XwpNTrdr) – C:\Windows\System32\drivers\XWPFSW2K.SYS ()
DRV - (pfc) – C:\Windows\System32\drivers\pfc.sys (Padus, Inc.)
DRV - (WFsys) – C:\Windows\System32\drivers\wfsys.sys (Leadtek Research Inc.)
DRV - (C-Dilla) – C:\Windows\System32\drivers\CDANT.SYS (Macrovision)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://community.norton.com/t5/user/viewpr…ge/user-id/8710
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.5
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_1_3 [2011/09/10 16:27:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2011/09/01 20:11:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2011/07/23 18:16:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2011/07/02 18:17:33 | 000,000,000 | —D | M]

[2010/07/03 19:56:17 | 000,000,000 | —D | M] (No name found) – C:\Users\allenm\AppData\Roaming\Mozilla\Extensions
[2009/12/24 21:32:30 | 000,000,000 | —D | M] (No name found) – C:\Users\allenm\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/02/13 11:33:37 | 000,000,000 | —D | M] (No name found) – C:\Users\allenm\AppData\Roaming\Mozilla\Firefox\Profiles\m4j4hu7i.default\extensions
[2010/07/03 19:56:17 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\allenm\AppData\Roaming\Mozilla\Firefox\Profiles\m4j4hu7i.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/28 17:45:33 | 000,002,470 | —- | M] () – C:\Users\allenm\AppData\Roaming\Mozilla\Firefox\Profiles\m4j4hu7i.default\searchplugins\safesearch.xml
[2011/09/10 16:27:22 | 000,000,000 | —D | M] (Norton Toolbar) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\COFFPLGN_2011_7_1_3
[2011/09/01 20:11:46 | 000,000,000 | —D | M] (Symantec IPS) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPLGN
[2008/12/14 19:05:39 | 000,000,000 | —D | M] (Java Console) – D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2009/01/15 21:56:58 | 000,000,000 | —D | M] (Java Console) – D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2010/05/02 20:03:38 | 000,000,000 | —D | M] (Java Console) – D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

O1 HOSTS File: ([2006/09/18 14:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (PDF-XChange Viewer IE-Plugin) - {C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F} - D:\Program Files\Tracker Software\PDF-XChange 4 Pro\PDF-XChange PDF Viewer\pdf-viewer\PDFXCviewIEPlugin.dll (Tracker Software Products Ltd.)
O2 - BHO: (Ask Toolbar BHO) - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\5.bin\ASKTBAR.DLL (Ask.com)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\5.bin\ASKTBAR.DLL (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\CyberLink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [Bluetooth Connection Assistant] File not found
O4 - HKLM..\Run: [CTHelper] C:\Windows\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTXFIREG] C:\Windows\System32\Ctxfireg.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Easy Synchronization] D:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe ()
O4 - HKLM..\Run: [EasyTuneVPro] C:\Program Files\GIGABYTE\ET5Pro\ETcall.exe ()
O4 - HKLM..\Run: [EvtMgr6] D:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\run.exe ()
O4 - HKLM..\Run: [LanguageShortcut] D:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [NBAgent] D:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [Norton Ghost 15.0] D:\Program Files\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [vws] File not found
O4 - HKCU..\Run: [cryptoexpert] C:\Program Files\CryptoExpert Professional\cexpert_tray.exe (InterCrypto Ltd)
O4 - HKCU..\Run: [NortonUtilities] D:\Program Files\Norton Utilities 14\rmtray.exe (Symantec Corporation)
O4 - HKLM..\RunOnce: [Easy Synchronization] D:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe ()
O4 - Startup: C:\Users\allenm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Snsicon.exe (Second Nature Software, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\InfoDelivery present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Security present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\ZOOM present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF 03 [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = _ [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O8 - Extra context menu item: E&xport; to Microsoft Excel - D:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O8 - Extra context menu item: Se&nd; to OneNote - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: ([]msn in Computer)
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKCU\..Trusted Domains: att.com ([www.wireless] https in Trusted sites)
O15 - HKCU\..Trusted Domains: comcast.net ([login] https in Trusted sites)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: lithium.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: norton.com ([community] http in Trusted sites)
O15 - HKCU\..Trusted Domains: samuelhairstylist.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: symantec.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: weather.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: youtube.com ([www] http in Trusted sites)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab (Reg Error: Key error.)
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…8090.0296064815 (Reg Error: Key error.)
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab (ActiveDataInfo Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D27CDB70-AE6D-11cf-96B8-444553540000} (Macromedia Flash Factory Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.30.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{751D870F-03E9-487D-BE13-A2257B5B6E4F}: DhcpNameServer = 192.168.30.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Users\allenm\Pictures\Second Nature.bmp
O24 - Desktop BackupWallPaper: C:\Users\allenm\Pictures\Second Nature.bmp
O28 - HKLM ShellExecuteHooks: {FE24CD78-7C63-465D-8787-4EDF7FC79895} - D:\Program Files\Logitech\Easy Synchronization\shellexecutehook.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/04/08 19:46:55 | 000,000,659 | —- | M] () - C:\autoAlbum.log – [ NTFS ]
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/12/30 19:30:34 | 000,000,129 | R— | M] () - G:\Autorun.inf – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SENS - C:\Windows\System32\sens32.dll (Microsoft Corporation)
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.clmp3enc - D:\Program Files\CyberLink\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\Windows\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/09/10 16:27:39 | 000,000,000 | —D | C] – C:\Users\allenm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2011/09/09 20:38:22 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/09/09 07:33:20 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\allenm\Desktop\HijackThis.exe
[2011/09/01 21:00:39 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/09/01 21:00:39 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/09/01 21:00:38 | 001,797,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/09/01 21:00:38 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/09/01 21:00:37 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/09/01 20:20:46 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/08/13 11:06:06 | 000,000,000 | —D | C] – C:\Users\allenm\AppData\Roaming\Mael
[2011/08/13 10:53:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HxD Hex Editor
[2008/02/20 20:59:14 | 000,034,816 | —- | C] ( ) – C:\Windows\System32\a3d.dll
[2008/02/20 20:44:02 | 000,010,240 | —- | C] ( ) – C:\Windows\System32\killapps.exe
[2007/09/21 19:42:42 | 000,019,008 | —- | C] (Windows ® Server 2003 DDK provider) – C:\Program Files\markfun.a64
[2007/08/21 19:49:28 | 000,017,912 | —- | C] (Windows ® 2000 DDK provider) – C:\Program Files\markfun.w32
[2007/03/10 15:16:21 | 000,774,144 | —- | C] (RealNetworks, Inc.) – C:\Program Files\RngInterstitial.dll
[2005/03/03 14:36:47 | 000,014,976 | —- | C] ( ) – C:\Windows\System32\drivers\winddx.sys
[2003/11/13 15:44:00 | 000,319,488 | —- | C] (Polar [removed] www.polarsoftware.com) – C:\Program Files\PolarZIPLight.dll
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[26 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\allenm\Documents\*.tmp files -> C:\Users\allenm\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/10 17:08:06 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/10 16:39:48 | 000,631,524 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/09/10 16:39:48 | 000,107,976 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/09/10 16:35:55 | 000,009,728 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/10 16:35:55 | 000,009,728 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/10 16:29:10 | 000,024,944 | —- | M] () – C:\Windows\System32\drivers\GVTDrv.sys
[2011/09/10 16:29:10 | 000,000,004 | —- | M] () – C:\Windows\System32\GVTunner.ref
[2011/09/10 16:27:40 | 000,016,608 | —- | M] (Windows ® 2000 DDK provider) – C:\Windows\gdrv.sys
[2011/09/10 16:27:29 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/10 16:27:19 | 000,001,024 | —- | M] () – C:\XWP2KFSD.TRC
[2011/09/10 16:27:19 | 000,001,024 | —- | M] () – C:\XWP2KFSD.TR_
[2011/09/10 16:27:02 | 2616,057,856 | -HS- | M] () – C:\hiberfil.sys
[2011/09/10 16:25:51 | 000,054,928 | —- | M] () – C:\Windows\System32\BMXStateBkp-{00000005-00000000-00000001-00001102-00000005-002C1102}.rfx
[2011/09/10 16:25:51 | 000,054,928 | —- | M] () – C:\Windows\System32\BMXState-{00000005-00000000-00000001-00001102-00000005-002C1102}.rfx
[2011/09/10 16:25:51 | 000,000,788 | —- | M] () – C:\Windows\System32\DVCState-{00000005-00000000-00000001-00001102-00000005-002C1102}.rfx
[2011/09/09 20:38:14 | 526,167,130 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/09/09 11:52:13 | 005,350,400 | —- | M] () – C:\backup.pst
[2011/09/09 08:57:40 | 000,004,096 | -HS- | M] () – C:\VSNAP.IDX
[2011/09/09 07:58:11 | 000,002,240 | -H– | M] () – C:\Users\allenm\Documents\Default.rdp
[2011/09/09 07:33:22 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\allenm\Desktop\HijackThis.exe
[2011/09/04 10:15:39 | 000,000,035 | —- | M] () – C:\Windows\iltwain.ini
[2011/09/04 02:25:00 | 000,000,454 | —- | M] () – C:\Windows\tasks\Driver Robot.job
[2011/08/13 10:53:57 | 000,000,598 | —- | M] () – C:\Users\Public\Desktop\HxD.lnk
[2011/08/12 12:49:54 | 000,001,080 | —- | M] () – C:\Windows\System32\settingsbkup.sfm
[2011/08/12 12:49:54 | 000,001,080 | —- | M] () – C:\Windows\System32\settings.sfm
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[26 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\allenm\Documents\*.tmp files -> C:\Users\allenm\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/09 20:38:14 | 526,167,130 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/09/09 08:57:40 | 000,004,096 | -HS- | C] () – C:\VSNAP.IDX
[2011/08/13 10:53:57 | 000,000,598 | —- | C] () – C:\Users\Public\Desktop\HxD.lnk
[2011/06/17 16:17:09 | 000,080,896 | —- | C] () – C:\Windows\System32\RDVGHelper.exe
[2011/06/17 16:16:15 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2010/08/28 14:46:43 | 001,064,896 | —- | C] () – C:\Windows\System32\BDHDCopyHelper.dll
[2010/08/28 14:46:43 | 000,135,168 | —- | C] () – C:\Windows\System32\VERSI0N.dll
[2010/07/12 15:08:04 | 000,000,760 | —- | C] () – C:\Users\allenm\AppData\Roaming\setup_ldm.iss
[2010/07/03 22:15:24 | 000,002,655 | —- | C] () – C:\ProgramData\LUUnInstall.LiveUpdate
[2010/07/03 14:15:23 | 000,000,000 | —- | C] () – C:\Users\allenm\AppData\Roaming\.NANotifyHere
[2010/02/27 17:37:07 | 000,000,608 | -HS- | C] () – C:\Windows\System32\winzvprt5.sys
[2010/02/27 17:37:07 | 000,000,160 | —- | C] () – C:\Windows\System32\zvprt5.ini
[2010/02/14 19:55:21 | 000,295,536 | -H– | C] () – C:\Windows\System32\mlfcache.dat
[2010/02/06 20:56:36 | 000,000,080 | —- | C] () – C:\Windows\SiteSpiderforms.ini
[2010/02/06 20:38:59 | 000,000,081 | —- | C] () – C:\Windows\mapforms.ini
[2010/02/06 17:54:40 | 000,000,108 | -HS- | C] () – C:\Windows\WSYS049.SYS
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/13 21:33:53 | 000,694,456 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 19:05:48 | 000,631,524 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 19:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 19:05:48 | 000,107,976 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 19:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 19:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 19:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 16:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 16:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/10 14:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2009/06/06 19:22:38 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/05/24 11:00:12 | 000,000,510 | —- | C] () – C:\Windows\WORDPAD.INI
[2009/03/15 20:43:04 | 000,020,605 | —- | C] () – C:\Windows\HL-4070CDW.INI
[2009/03/05 06:54:58 | 000,073,728 | —- | C] () – C:\Windows\System32\RtNicProp32.dll
[2009/02/08 22:07:03 | 000,000,745 | —- | C] () – C:\Windows\COD.INI
[2009/02/08 21:42:31 | 000,043,520 | —- | C] () – C:\Windows\System32\CmdLineExt03.dll
[2009/01/01 19:16:04 | 000,019,500 | —- | C] () – C:\Windows\hpqins13.dat.temp
[2009/01/01 18:44:33 | 000,019,500 | —- | C] () – C:\Windows\hpqins13.dat
[2008/12/21 15:14:12 | 000,000,148 | —- | C] () – C:\Windows\BRVIDEO.INI
[2008/12/21 15:14:12 | 000,000,023 | —- | C] () – C:\Windows\Brownie.ini
[2008/12/21 15:14:12 | 000,000,000 | —- | C] () – C:\Windows\brmx2001.ini
[2008/12/21 15:14:10 | 000,000,564 | —- | C] () – C:\Windows\BRWMARK.INI
[2008/12/21 15:14:10 | 000,000,034 | —- | C] () – C:\Windows\System32\bd407cdw.dat
[2008/12/21 15:14:10 | 000,000,026 | —- | C] () – C:\Windows\BRPP2KA.INI
[2008/12/21 15:13:18 | 000,045,056 | —- | C] () – C:\Windows\System32\BRTCPCON.DLL
[2008/12/21 15:13:17 | 000,000,114 | —- | C] () – C:\Windows\System32\BRLMW03A.INI
[2008/12/21 15:13:15 | 000,000,050 | —- | C] () – C:\Windows\System32\BAOCH06A.DAT
[2008/08/10 18:06:38 | 000,148,895 | —- | C] () – C:\Windows\hpoins19.dat
[2008/08/10 18:06:23 | 000,026,952 | —- | C] () – C:\Windows\hpomdl19.dat
[2008/06/07 17:34:30 | 000,018,790 | —- | C] () – C:\Windows\System32\ddmon.dll
[2008/06/04 12:38:39 | 000,000,012 | —- | C] () – C:\Windows\bthservsdp.dat
[2008/06/02 16:09:02 | 000,000,000 | —- | C] () – C:\Windows\Irremote.ini
[2008/06/02 15:34:58 | 000,108,544 | —- | C] () – C:\Windows\System32\APOMngr.DLL
[2008/06/02 15:34:58 | 000,069,120 | —- | C] () – C:\Windows\System32\CmdRtr.DLL
[2008/06/02 14:52:53 | 000,023,340 | —- | C] () – C:\Windows\System32\emptyregdb.dat
[2008/05/31 10:39:03 | 000,024,944 | —- | C] () – C:\Windows\System32\drivers\GVTDrv.sys
[2008/05/30 12:37:45 | 001,048,576 | —- | C] () – C:\Program Files\6a89og0p.0
[2008/05/30 12:35:15 | 000,071,703 | —- | C] () – C:\Program Files\bios.ini
[2008/05/30 12:34:45 | 000,000,029 | —- | C] () – C:\Program Files\new_ver.ini
[2008/05/28 14:05:32 | 000,000,047 | —- | C] () – C:\Windows\hwm.ini
[2008/02/25 14:55:32 | 000,101,603 | —- | C] () – C:\Windows\System32\instwdm.ini
[2008/02/20 21:24:36 | 000,000,054 | —- | C] () – C:\Windows\System32\ctzapxx.ini
[2008/02/20 21:00:12 | 000,043,520 | —- | C] () – C:\Windows\System32\CTBurst.dll
[2008/02/20 20:58:46 | 000,037,888 | —- | C] () – C:\Windows\System32\psconv.exe
[2008/02/20 20:49:46 | 000,321,512 | —- | C] () – C:\Windows\System32\ctdlang.dat
[2008/02/20 20:49:46 | 000,056,509 | —- | C] () – C:\Windows\System32\ctdnlstr.dat
[2008/02/20 20:46:46 | 000,013,312 | —- | C] () – C:\Windows\System32\regplib.exe
[2008/02/20 20:46:20 | 000,149,838 | —- | C] () – C:\Windows\System32\CTBAS2W.DAT
[2008/02/20 20:44:34 | 000,274,587 | —- | C] () – C:\Windows\System32\CTSBAS2W.DAT
[2008/02/20 20:44:26 | 000,241,084 | —- | C] () – C:\Windows\System32\CTSBASW.DAT
[2008/02/20 20:44:26 | 000,115,166 | —- | C] () – C:\Windows\System32\CTBASICW.DAT
[2008/02/20 20:44:10 | 000,313,207 | —- | C] () – C:\Windows\System32\ctstatic.dat
[2008/02/20 20:44:10 | 000,053,932 | —- | C] () – C:\Windows\System32\ctdaught.dat
[2008/02/20 20:44:08 | 000,005,120 | —- | C] () – C:\Windows\System32\enlocstr.exe
[2008/02/15 19:25:46 | 000,847,872 | —- | C] () – C:\Windows\System32\SaiC0255.Dll
[2008/02/15 19:25:46 | 000,008,704 | —- | C] () – C:\Windows\System32\SaiC0255_0C.dll
[2008/02/15 19:25:46 | 000,008,192 | —- | C] () – C:\Windows\System32\SaiC0255_10.dll
[2008/02/15 19:25:46 | 000,008,192 | —- | C] () – C:\Windows\System32\SaiC0255_0A.dll
[2008/02/15 19:25:46 | 000,008,192 | —- | C] () – C:\Windows\System32\SaiC0255_07.dll
[2008/02/15 19:25:46 | 000,007,680 | —- | C] () – C:\Windows\System32\SaiC0255_09.dll
[2008/02/15 19:25:46 | 000,007,168 | —- | C] () – C:\Windows\System32\SaiC0255_0402.dll
[2008/02/15 19:25:46 | 000,005,632 | —- | C] () – C:\Windows\System32\SaiC0255_11.dll
[2008/02/14 14:28:56 | 000,000,029 | —- | C] () – C:\Program Files\version.ini
[2008/02/14 14:23:12 | 000,231,944 | —- | C] () – C:\Program Files\gwflash.exe
[2007/11/25 15:19:21 | 000,215,144 | R— | C] () – C:\Windows\patchw32.A449.dll
[2007/11/25 15:18:38 | 000,215,144 | R— | C] () – C:\Windows\pw32a0.dll
[2007/09/03 13:25:25 | 000,003,072 | —- | C] () – C:\Windows\CTXFIRES.DLL
[2007/08/13 20:45:02 | 000,077,824 | —- | C] () – C:\Windows\System32\ctmmactl.dll
[2007/08/12 13:39:56 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2007/06/02 14:40:04 | 000,000,087 | —- | C] () – C:\Windows\encore_launcher.ini
[2007/05/18 14:55:38 | 000,012,288 | —- | C] () – C:\Windows\System32\DivXWMPExtType.dll
[2007/05/18 14:48:50 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2007/04/05 04:31:22 | 000,248,640 | —- | C] () – C:\Program Files\update.exe
[2007/03/30 04:36:28 | 000,000,301 | —- | C] () – C:\Program Files\update.ini
[2007/03/02 04:48:50 | 000,240,448 | —- | C] () – C:\Program Files\gwf32.exe
[2006/11/23 23:47:50 | 000,207,680 | —- | C] () – C:\Program Files\BIOS_Run.exe
[2006/11/03 18:09:40 | 000,000,528 | —- | C] () – C:\Program Files\CONFIG.INI
[2006/10/02 17:25:18 | 000,000,307 | —- | C] () – C:\Windows\System32\kill.ini
[2006/05/23 21:20:42 | 000,034,304 | —- | C] () – C:\Windows\PSCONV.EXE
[2006/03/02 19:24:14 | 000,000,012 | —- | C] () – C:\Windows\clocked.ini
[2006/01/21 16:01:45 | 000,000,000 | —- | C] () – C:\Windows\QuickInstall.INI
[2005/12/12 23:28:23 | 000,000,031 | —- | C] () – C:\Windows\sbewin32.INI
[2005/11/07 22:28:37 | 000,000,083 | —- | C] () – C:\Windows\usrwiz.ini
[2005/05/13 20:58:03 | 000,000,058 | —- | C] () – C:\Windows\CTACD.INI
[2005/04/27 19:40:26 | 000,006,800 | —- | C] () – C:\Program Files\W95_HUA.vxd
[2005/04/10 23:22:12 | 000,069,632 | R— | C] () – C:\Windows\System32\xmltok.dll
[2005/04/10 23:22:12 | 000,036,864 | R— | C] () – C:\Windows\System32\xmlparse.dll
[2005/04/10 21:11:57 | 000,056,320 | —- | C] () – C:\Windows\System32\iyvu9_32.dll
[2005/03/24 08:50:42 | 000,000,000 | —- | C] () – C:\Windows\PhotoNow.INI
[2005/03/19 13:18:29 | 000,000,056 | RHS- | C] () – C:\Windows\System32\9FA9EED978.sys
[2005/03/19 13:18:28 | 000,005,642 | -HS- | C] () – C:\Windows\System32\KGyGaAvL.sys
[2005/03/03 14:36:47 | 000,466,944 | —- | C] () – C:\Windows\System32\SLLights.dll
[2005/03/03 14:36:47 | 000,376,832 | —- | C] () – C:\Windows\System32\slmh.exe
[2005/03/03 14:36:47 | 000,167,936 | —- | C] () – C:\Windows\System32\minirec.exe
[2005/03/03 14:36:47 | 000,061,440 | —- | C] () – C:\Windows\SmCfg.exe
[2005/03/03 10:17:45 | 000,000,296 | —- | C] () – C:\Windows\EReg206.dat
[2005/01/30 06:03:13 | 001,626,112 | —- | C] () – C:\Windows\System32\nwiz.exe
[2005/01/30 06:03:13 | 001,019,904 | —- | C] () – C:\Windows\System32\nvwimg.dll
[2005/01/30 06:03:12 | 001,703,936 | —- | C] () – C:\Windows\System32\nvwdmcpl.dll
[2005/01/30 06:03:10 | 000,466,944 | —- | C] () – C:\Windows\System32\nvshell.dll
[2005/01/30 06:03:09 | 001,339,392 | —- | C] () – C:\Windows\System32\nvdspsch.exe
[2005/01/30 06:03:09 | 000,442,368 | —- | C] () – C:\Windows\System32\nvappbar.exe
[2005/01/30 06:03:07 | 001,474,560 | —- | C] () – C:\Windows\System32\nview.dll
[2005/01/30 06:03:07 | 000,425,984 | —- | C] () – C:\Windows\System32\keystone.exe
[2005/01/07 01:40:02 | 000,205,312 | R— | C] () – C:\Windows\patchw32.dll
[2005/01/07 01:39:07 | 000,205,312 | R— | C] () – C:\Windows\pw32a.dll
[2004/12/23 21:01:36 | 000,004,133 | —- | C] () – C:\Windows\entrust.ini
[2004/12/21 00:21:55 | 000,001,345 | —- | C] () – C:\Windows\checkip.dat
[2004/12/21 00:20:46 | 000,001,341 | —- | C] () – C:\Windows\ipconfig.dat
[2004/12/19 17:01:33 | 000,000,031 | —- | C] () – C:\Windows\bewin32.INI
[2004/12/19 15:40:37 | 000,001,024 | RH– | C] () – C:\Windows\System32\ntiembed.dll
[2004/12/18 09:59:47 | 000,000,000 | —- | C] () – C:\Windows\WinPM.INI
[2004/12/18 09:20:57 | 003,870,720 | —- | C] () – C:\Windows\System32\qt-mt323.dll
[2004/12/14 14:44:04 | 000,000,000 | —- | C] () – C:\Windows\WinDB.INI
[2004/12/13 22:01:39 | 000,000,273 | —- | C] () – C:\Windows\hpqgrcpy.INI
[2004/11/29 00:47:53 | 000,000,145 | —- | C] () – C:\Windows\hpgmdl01.dat.temp
[2004/11/29 00:17:36 | 000,085,312 | —- | C] () – C:\Windows\hpgins01.dat.temp
[2004/11/25 21:47:41 | 000,085,312 | —- | C] () – C:\Windows\hpgins01.dat
[2004/10/11 21:35:00 | 000,057,344 | —- | C] () – C:\Windows\System32\tmimlaun.dll
[2004/10/07 10:25:00 | 000,002,516 | —- | C] () – C:\Windows\System32\drivers\default.bin.old
[2004/10/07 10:25:00 | 000,002,516 | —- | C] () – C:\Windows\System32\default.bin.old
[2004/10/07 10:18:13 | 000,069,632 | —- | C] () – C:\Windows\erase_SR.exe
[2004/09/29 10:37:13 | 000,051,304 | —- | C] () – C:\Windows\System32\drivers\atnt40k.sys
[2004/09/16 13:24:26 | 003,375,104 | —- | C] () – C:\Windows\System32\qt-mt331.dll
[2004/09/15 20:19:59 | 000,000,000 | —- | C] () – C:\Windows\500A121a.INI
[2004/07/26 18:40:30 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2004/07/26 11:00:00 | 000,007,140 | —- | C] () – C:\Windows\System32\drivers\cvintdrv.sys
[2004/06/16 20:38:54 | 000,002,516 | —- | C] () – C:\Windows\System32\drivers\default.bin
[2004/06/16 20:38:54 | 000,002,516 | —- | C] () – C:\Windows\System32\default.bin
[2004/05/27 09:53:41 | 000,051,200 | —- | C] () – C:\Windows\tbat_del.exe
[2004/05/22 20:08:45 | 000,102,520 | —- | C] () – C:\Windows\TrueInstall.exe
[2004/05/22 18:31:54 | 000,000,000 | —- | C] () – C:\Windows\netscape.INI
[2004/05/22 18:27:29 | 000,634,065 | —- | C] () – C:\Windows\cd32.exe
[2004/04/14 10:20:40 | 000,000,000 | —- | C] () – C:\Windows\500A_20h.INI
[2004/03/31 00:04:20 | 000,121,470 | —- | C] () – C:\Windows\System32\drivers\XWPFSW2K.SYS
[2004/03/31 00:04:20 | 000,055,296 | —- | C] () – C:\Windows\System32\XWPSHELL.DLL
[2004/03/31 00:04:19 | 000,185,052 | —- | C] () – C:\Windows\System32\XWNTSERV.EXE
[2004/03/31 00:04:19 | 000,058,475 | —- | C] () – C:\Windows\System32\XWNTFS32.DLL
[2004/03/09 20:32:14 | 000,000,000 | —- | C] () – C:\Windows\PROTOCOL.INI
[2004/03/06 12:25:11 | 000,000,104 | —- | C] () – C:\Windows\CTRec.INI
[2004/03/02 15:05:09 | 000,000,020 | —- | C] () – C:\Windows\GaxFMRg.dat
[2004/03/02 10:28:53 | 000,000,502 | —- | C] () – C:\Windows\MTU.INI
[2004/03/02 10:28:17 | 000,000,064 | —- | C] () – C:\Windows\winhelp.ini
[2004/03/01 22:32:34 | 000,389,120 | —- | C] () – C:\Windows\deinss20.exe
[2004/03/01 22:28:11 | 000,028,672 | —- | C] () – C:\Windows\SETUPIBM.EXE
[2004/02/22 03:04:13 | 000,000,815 | —- | C] () – C:\Windows\BZII.INI
[2004/02/21 15:49:03 | 000,000,746 | —- | C] () – C:\Windows\SIERRA.INI
[2004/02/21 00:09:24 | 000,000,285 | —- | C] () – C:\Windows\EReg072.dat
[2004/02/20 22:07:48 | 000,003,327 | —- | C] () – C:\Windows\wininit.ini
[2004/02/20 21:47:26 | 000,021,840 | —- | C] () – C:\Windows\System32\SIntfNT.dll
[2004/02/20 21:47:26 | 000,017,212 | —- | C] () – C:\Windows\System32\SIntf32.dll
[2004/02/20 21:47:26 | 000,012,067 | —- | C] () – C:\Windows\System32\SIntf16.dll
[2004/02/20 15:36:50 | 000,001,609 | —- | C] () – C:\Windows\yahtzee.ini
[2004/02/20 00:39:55 | 000,000,195 | —- | C] () – C:\Windows\LODERUNN.INI
[2004/02/19 14:41:06 | 000,000,271 | —- | C] () – C:\Windows\PowerReg.dat
[2004/02/18 23:00:17 | 000,019,968 | —- | C] () – C:\Windows\System32\cpuinf32.dll
[2004/02/18 21:07:41 | 000,010,240 | —- | C] () – C:\Windows\System32\vidx16.dll
[2004/02/17 21:52:16 | 000,000,048 | —- | C] () – C:\Windows\PerWin.ini
[2004/02/13 20:23:17 | 000,000,541 | —- | C] () – C:\Windows\label.ini
[2004/02/13 15:53:34 | 000,000,035 | —- | C] () – C:\Windows\iltwain.ini
[2004/02/11 21:48:32 | 000,000,850 | —- | C] () – C:\Windows\ODBC.INI
[2004/02/11 21:13:35 | 000,001,675 | —- | C] () – C:\Windows\Slideshw.ini
[2004/02/11 00:22:31 | 000,000,030 | —- | C] () – C:\Windows\INTURS.DAT
[2004/02/10 11:39:17 | 000,000,121 | —- | C] () – C:\Windows\Winamp.ini
[2004/02/10 10:30:34 | 000,000,071 | —- | C] () – C:\Windows\qwimp.ini
[2004/02/10 10:15:17 | 000,000,165 | —- | C] () – C:\Windows\Quicken.ini
[2004/02/10 00:55:09 | 001,048,576 | —- | C] () – C:\Windows\System32\sfman.dat
[2004/02/09 23:55:08 | 000,000,231 | —- | C] () – C:\Windows\ac3api.ini
[2004/02/09 22:42:15 | 000,000,317 | —- | C] () – C:\Windows\SBWIN.INI
[2004/02/09 09:54:04 | 000,037,220 | —- | C] () – C:\Windows\nsreg.dat
[2004/02/09 09:51:38 | 000,009,663 | —- | C] () – C:\Windows\mozver.dat
[2004/02/08 11:05:06 | 000,000,051 | —- | C] () – C:\Windows\iTouch.ini
[2004/02/08 11:01:41 | 000,081,920 | R— | C] () – C:\Windows\bwUnin-6.1.4.36-8876480L.exe
[2004/02/08 10:31:01 | 000,000,000 | —- | C] () – C:\Windows\fwenc.INI
[2004/02/07 17:53:10 | 000,004,161 | —- | C] () – C:\Windows\ODBCINST.INI
[2003/12/19 03:00:00 | 000,013,387 | —- | C] () – C:\Windows\System32\CinemSup.sys
[2003/05/31 18:43:38 | 000,005,632 | —- | C] () – C:\Windows\TrueProcess.exe
[2003/01/17 02:09:52 | 000,049,152 | —- | C] () – C:\Windows\System32\coinst.dll
[2001/10/28 19:42:30 | 000,116,224 | —- | C] () – C:\Windows\System32\redmonnt.dll
[1998/09/17 00:25:24 | 000,004,096 | —- | C] () – C:\Windows\delttsul.exe

========== LOP Check ==========

[2010/07/03 19:56:02 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\AquaNox
[2010/07/03 19:56:02 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Backup MyPC
[2010/07/03 19:56:02 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Blitware
[2010/07/03 19:56:03 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\CheckPoint
[2010/07/03 19:56:03 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\CoffeeCup Software
[2010/07/03 19:56:05 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Genie-Soft
[2010/08/13 19:22:39 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\GetRightToGo
[2010/07/03 19:56:05 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\HotSync
[2010/07/03 19:56:05 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Hummingbird
[2010/07/03 19:56:07 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Image Zone Express
[2010/07/03 19:56:07 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Individual Software
[2010/07/03 19:56:07 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\InterVideo
[2010/07/03 19:56:09 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\IsolatedStorage
[2010/07/03 19:56:09 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Leadertech
[2008/06/17 19:32:17 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Local
[2011/08/13 11:06:06 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Mael
[2011/06/17 18:49:52 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\NCH Swift Sound
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\NET6
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\NovaStor
[2007/10/07 18:32:18 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Novosoft
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\PDFCreator
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Printer Info Cache
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Qualcomm
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Quicken WillMaker
[2011/06/17 18:39:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Recordpad
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\RingCentral
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Second Nature
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\SoftLogica
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Stardock
[2010/07/03 19:56:41 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\SupportSoft
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Tific
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\TomTom
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\ubi.com
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\VERITAS
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Viewpoint
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\WinBatch
[2011/09/04 02:25:00 | 000,000,454 | —- | M] () – C:\Windows\Tasks\Driver Robot.job
[2009/07/13 21:53:46 | 000,000,364 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/01/22 20:29:01 | 000,002,821 | —- | M] () – C:\additdiag.txt
[2009/05/30 17:20:03 | 000,000,000 | —- | M] () – C:\AdobeDebug.txt
[2005/04/08 19:46:55 | 000,000,659 | —- | M] () – C:\autoAlbum.log
[2009/06/10 14:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2011/09/09 11:52:13 | 005,350,400 | —- | M] () – C:\backup.pst
[2010/07/03 22:35:25 | 010,532,120 | —- | M] () – C:\BESR2010PatchLog.txt
[2008/06/02 14:06:54 | 000,000,355 | -HS- | M] () – C:\Boot.BAK
[2008/06/02 15:22:23 | 000,000,355 | RHS- | M] () – C:\Boot.ini.saved
[2010/11/20 05:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2010/07/03 20:33:03 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2005/11/11 10:05:36 | 000,001,571 | —- | M] () – C:\cclog.txt
[2009/06/10 14:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2008/05/27 22:24:17 | 000,000,186 | —- | M] () – C:\csb.log
[2008/11/29 21:10:14 | 000,262,144 | —- | M] () – C:\DEFAULT
[2007/12/08 00:51:23 | 000,000,000 | —- | M] () – C:\Diagnostics.txt
[2010/07/03 21:43:53 | 000,000,063 | -H– | M] () – C:\DocScan.ind
[2007/03/10 16:36:35 | 000,000,109 | —- | M] () – C:\DownloadLog.txt
[2005/02/08 01:08:42 | 000,000,055 | —- | M] () – C:\DVDPATH.TXT
[2011/09/10 16:27:02 | 2616,057,856 | -HS- | M] () – C:\hiberfil.sys
[2004/02/08 02:09:48 | 000,000,000 | —- | M] () – C:\IO.SYS
[2007/09/15 16:56:27 | 000,000,177 | —- | M] () – C:\ITB.log
[2010/05/22 19:43:57 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2004/02/08 02:09:48 | 000,000,000 | —- | M] () – C:\MSDOS.SYS
[2005/11/08 21:38:41 | 000,001,261 | —- | M] () – C:\net_save.dna
[2005/01/30 09:36:38 | 000,047,564 | —- | M] () – C:\NTDETECT.COM
[2005/01/30 09:36:38 | 000,250,032 | —- | M] () – C:\ntldr
[2011/09/10 16:27:09 | 3488,079,872 | -HS- | M] () – C:\pagefile.sys
[2008/11/29 21:10:59 | 000,262,144 | —- | M] () – C:\SAM
[2008/06/08 23:38:05 | 000,262,144 | —- | M] () – C:\SAM.0608
[2008/11/29 21:09:04 | 000,262,144 | —- | M] () – C:\SECURITY
[2008/06/08 09:03:20 | 000,262,144 | —- | M] () – C:\SECURITY.0608
[2008/06/02 13:43:59 | 000,000,122 | —- | M] () – C:\service.log
[2008/11/29 21:16:42 | 046,923,776 | —- | M] () – C:\SOFTWARE
[2008/06/08 23:49:26 | 045,088,768 | —- | M] () – C:\SOFTWARE.0608
[2008/11/29 21:16:42 | 024,117,248 | —- | M] () – C:\SYSTEM
[2008/06/08 23:49:26 | 017,563,648 | —- | M] () – C:\SYSTEM.0608
[2007/09/30 11:54:21 | 000,000,211 | —- | M] () – C:\temp.ini
[2004/06/17 11:42:32 | 000,507,904 | —- | M] () – C:\Test.mdb
[2010/07/03 21:43:53 | 000,050,296 | —- | M] () – C:\Test.tif
[2004/10/11 21:43:00 | 000,000,019 | —- | M] () – C:\TMIMLAUN.TXT
[2004/03/04 01:18:39 | 000,000,144 | —- | M] () – C:\tmpRegInfo.txt
[2009/01/09 21:56:39 | 000,000,594 | —- | M] () – C:\updatedatfix.log
[2011/09/09 08:57:40 | 000,004,096 | -HS- | M] () – C:\VSNAP.IDX
[2008/06/02 14:07:44 | 000,001,760 | —- | M] () – C:\XWNTFS32.TRC
[2008/06/02 13:42:41 | 000,001,202 | —- | M] () – C:\XWNTFS32.TR_
[2011/09/10 16:27:19 | 000,001,024 | —- | M] () – C:\XWP2KFSD.TRC
[2011/09/10 16:27:19 | 000,001,024 | —- | M] () – C:\XWP2KFSD.TR_
[2007/03/28 21:19:48 | 000,004,668 | —- | M] () – C:\_Sid.txt

< %systemroot%\Fonts\*.com >
[2009/07/13 21:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/18 23:34:30 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2009/07/13 18:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2004/03/22 15:17:06 | 000,025,840 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/04/08 16:50:06 | 000,012,800 | —- | M] (ReaSoft Development) – C:\Windows\system32\spool\prtprocs\w32x86\reaproc.dll
[2010/11/20 05:21:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2006/01/30 11:11:50 | 000,135,168 | —- | M] (Second Nature Software) – C:\Windows\SNSVR.scr
[26 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2007/12/13 22:32:15 | 000,001,530 | -H– | M] () – C:\Users\allenm\AppData\Roaming\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2008/05/30 12:37:46 | 001,048,576 | —- | M] () – C:\Program Files\6a89og0p.0
[2008/05/30 12:35:31 | 000,071,703 | —- | M] () – C:\Program Files\bios.ini
[2006/11/23 23:47:50 | 000,207,680 | —- | M] () – C:\Program Files\BIOS_Run.exe
[2008/05/30 12:35:14 | 000,000,528 | —- | M] () – C:\Program Files\CONFIG.INI
[2009/07/13 21:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini
[2007/03/02 04:48:50 | 000,240,448 | —- | M] () – C:\Program Files\gwf32.exe
[2008/02/14 14:23:12 | 000,231,944 | —- | M] () – C:\Program Files\gwflash.exe
[2007/09/21 19:42:42 | 000,019,008 | —- | M] (Windows ® Server 2003 DDK provider) – C:\Program Files\markfun.a64
[2007/08/21 19:49:28 | 000,017,912 | —- | M] (Windows ® 2000 DDK provider) – C:\Program Files\markfun.w32
[2008/05/30 12:34:46 | 000,000,029 | —- | M] () – C:\Program Files\new_ver.ini
[2003/11/13 15:44:00 | 000,319,488 | —- | M] (Polar [removed] www.polarsoftware.com) – C:\Program Files\PolarZIPLight.dll
[2007/03/10 15:16:17 | 000,774,144 | —- | M] (RealNetworks, Inc.) – C:\Program Files\RngInterstitial.dll
[2007/04/05 04:31:22 | 000,248,640 | —- | M] () – C:\Program Files\update.exe
[2007/03/30 04:36:28 | 000,000,301 | —- | M] () – C:\Program Files\update.ini
[2008/02/14 14:28:56 | 000,000,029 | —- | M] () – C:\Program Files\version.ini
[2005/04/27 19:40:26 | 000,006,800 | —- | M] () – C:\Program Files\W95_HUA.vxd

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >
[2011/03/24 20:50:35 | 000,003,072 | —- | M] () – C:\Windows\system32\Cache.db
[7 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2004/09/02 21:06:06 | 000,000,177 | -HS- | M] () – C:\Users\allenm\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2009/03/29 11:37:13 | 000,000,277 | -HS- | M] () – C:\Users\allenm\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (2).ini
[2011/06/17 15:44:57 | 000,000,221 | -HS- | M] () – C:\Users\allenm\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/09/09 07:33:22 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\allenm\Desktop\HijackThis.exe
[2010/10/23 12:20:27 | 009,578,056 | —- | M] (SUPERAntiSpyware.com) – C:\Users\allenm\Desktop\SUPERAntiSpyware.exe
[2009/03/02 09:41:34 | 003,493,888 | —- | M] (SanDisk Corporation) – C:\Users\allenm\Desktop\U3Uninstall.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 14:20:04 | 000,000,802 | —- | M] () – C:\Windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/06/17 16:41:11 | 000,000,402 | -HS- | M] () – C:\Users\allenm\Favorites\desktop.ini
[2011/06/17 18:51:54 | 000,000,276 | —- | M] () – C:\Users\allenm\Favorites\NCH Software Download Site.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/07/03 22:15:24 | 000,002,655 | —- | M] () – C:\ProgramData\LUUnInstall.LiveUpdate

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >
[2002/07/16 07:12:04 | 000,019,994 | —- | M] () – C:\Windows\system32\fonts\ACADEMY_.PFB
[2002/07/16 07:12:04 | 000,000,932 | —- | M] () – C:\Windows\system32\fonts\ACADEMY_.PFM
[2002/07/16 07:12:04 | 000,032,300 | —- | M] () – C:\Windows\system32\fonts\ACADEMY_.TTF

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-09-02 04:01:53

========== Alternate Data Streams ==========

@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:D287FACF

< End of report >

mowman

Post #6September 11, 2011, 12:48 AM UTC

This is quite a new infection and my first time coming across it so I don't really know much about it at this time,doesn't see to be a really bad one though.

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
  If suspicious objects are found select skip
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

AllenM

Post #7September 11, 2011, 1:41 AM UTC

Hi mowman,

The TDSSKiller found no problems. The Combofix made some changes.

Of the things the Combofix deleted I am wondering about "ndisapi.dll". This file appears to be related to packet filtering. I think at one time I might have installed Wireshark. Perhaps it came from this? Also the deletion of the Logitech item seems a bit confusing. This has been around for a long time and wouldn't seem to represent any sort of threat.

Are the only items Combofix deleted the ones mentioned at the top where it says "Other Deletions"? Were any registry keys removed or modified? It lists a whole host of registry keys but it is not clear to me if any of those were modified or deleted.

Sorry, being a software engineer I need to know what the tools have done and what changes were made to my system.

Here are the logs:

TDSSKiller:

2011/09/10 17:56:06.0490 2288 TDSS rootkit removing tool 2.5.20.0 Sep 7 2011 16:44:34
2011/09/10 17:56:08.0456 2288 ================================================================================
2011/09/10 17:56:08.0456 2288 SystemInfo:
2011/09/10 17:56:08.0456 2288
2011/09/10 17:56:08.0456 2288 OS Version: 6.1.7601 ServicePack: 1.0
2011/09/10 17:56:08.0456 2288 Product type: Workstation
2011/09/10 17:56:08.0456 2288 ComputerName: ALLEN-SAMUEL
2011/09/10 17:56:08.0456 2288 UserName: allenm
2011/09/10 17:56:08.0456 2288 Windows directory: C:\Windows
2011/09/10 17:56:08.0456 2288 System windows directory: C:\Windows
2011/09/10 17:56:08.0456 2288 Processor architecture: Intel x86
2011/09/10 17:56:08.0456 2288 Number of processors: 4
2011/09/10 17:56:08.0456 2288 Page size: 0x1000
2011/09/10 17:56:08.0456 2288 Boot type: Normal boot
2011/09/10 17:56:08.0456 2288 ================================================================================
2011/09/10 17:56:09.0595 2288 Initialize success
2011/09/10 17:56:40.0124 1912 ================================================================================
2011/09/10 17:56:40.0124 1912 Scan started
2011/09/10 17:56:40.0124 1912 Mode: Manual;
2011/09/10 17:56:40.0124 1912 ================================================================================
2011/09/10 17:56:40.0545 1912 1394ohci (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
2011/09/10 17:56:40.0607 1912 ACPI (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
2011/09/10 17:56:40.0654 1912 AcpiPmi (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
2011/09/10 17:56:40.0732 1912 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/09/10 17:56:40.0779 1912 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
2011/09/10 17:56:40.0810 1912 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
2011/09/10 17:56:40.0873 1912 AFD (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
2011/09/10 17:56:40.0935 1912 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
2011/09/10 17:56:40.0982 1912 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
2011/09/10 17:56:41.0029 1912 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
2011/09/10 17:56:41.0044 1912 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
2011/09/10 17:56:41.0091 1912 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
2011/09/10 17:56:41.0122 1912 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
2011/09/10 17:56:41.0138 1912 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
2011/09/10 17:56:41.0185 1912 amdsata (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys
2011/09/10 17:56:41.0216 1912 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/09/10 17:56:41.0247 1912 amdxata (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys
2011/09/10 17:56:41.0294 1912 AppID (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
2011/09/10 17:56:41.0372 1912 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
2011/09/10 17:56:41.0387 1912 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
2011/09/10 17:56:41.0434 1912 ASPI32 (b979979ab8027f7f53fb16ec4229b7db) C:\Windows\system32\drivers\ASPI32.sys
2011/09/10 17:56:41.0465 1912 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/09/10 17:56:41.0497 1912 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
2011/09/10 17:56:41.0559 1912 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
2011/09/10 17:56:41.0606 1912 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/09/10 17:56:41.0653 1912 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
2011/09/10 17:56:41.0824 1912 BHDrvx86 (378a5e067c170dc6046226ba61ff205f) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110901.001\BHDrvx86.sys
2011/09/10 17:56:41.0918 1912 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/09/10 17:56:41.0965 1912 bowser (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
2011/09/10 17:56:42.0011 1912 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/09/10 17:56:42.0043 1912 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/09/10 17:56:42.0074 1912 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
2011/09/10 17:56:42.0105 1912 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/09/10 17:56:42.0121 1912 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/09/10 17:56:42.0136 1912 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/09/10 17:56:42.0167 1912 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/09/10 17:56:42.0214 1912 BTWUSB (a01fd9851406de0870c23759e2f7b6ea) C:\Windows\system32\Drivers\btwusb.sys
2011/09/10 17:56:42.0245 1912 BVRPMPR5 (6598d078d5446197aed6b46c6a2a3431) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
2011/09/10 17:56:42.0277 1912 C-Dilla (4ff76600b4ca68376b80af1683799c60) C:\WINDOWS\System32\drivers\CDANT.SYS
2011/09/10 17:56:42.0339 1912 cc_4g (46f4c21581ab2e674bdbfd4a9c649ea4) C:\Windows\system32\Drivers\cc_4g.sys
2011/09/10 17:56:42.0370 1912 cc_firewall (4240d861d7dad397290baede460dc188) C:\Windows\system32\Drivers\cc_firewall.sys
2011/09/10 17:56:42.0417 1912 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
2011/09/10 17:56:42.0464 1912 cdrom (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\drivers\cdrom.sys
2011/09/10 17:56:42.0526 1912 CDRPDACC (30b37c18e1725eb9f25039e9a1fb9b7e) D:\Program Files\321Studios\Shared\CDRPDACC.SYS
2011/09/10 17:56:42.0573 1912 Cinemsup (f6a0f51706cb4b0d5b8718ff69f831ba) C:\Windows\system32\drivers\Cinemsup.sys
2011/09/10 17:56:42.0604 1912 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
2011/09/10 17:56:42.0635 1912 CLBStor (e75f20a406a62c75a8058790c38ea4e6) C:\Windows\system32\drivers\CLBStor.sys
2011/09/10 17:56:42.0682 1912 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
2011/09/10 17:56:42.0713 1912 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/09/10 17:56:42.0745 1912 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
2011/09/10 17:56:42.0791 1912 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
2011/09/10 17:56:42.0854 1912 COMMONFX.DLL (ecd78c93a8ca1e280e10e24188e6568e) C:\Windows\system32\COMMONFX.DLL
2011/09/10 17:56:42.0885 1912 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
2011/09/10 17:56:42.0932 1912 CompositeBus (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
2011/09/10 17:56:42.0963 1912 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/09/10 17:56:43.0010 1912 CSC (3c2177a897b4ca2788c6fb0c3fd81d4b) C:\Windows\system32\drivers\csc.sys
2011/09/10 17:56:43.0072 1912 CT20XUT.DLL (1f62f2f4392f721025b79a0222ded357) C:\Windows\system32\CT20XUT.DLL
2011/09/10 17:56:43.0103 1912 ctac32k (89ee116ae83058dd028d13cd53f668c8) C:\Windows\system32\drivers\ctac32k.sys
2011/09/10 17:56:43.0166 1912 ctaud2k (55935f873db712d62a0d9c9bcd002de1) C:\Windows\system32\drivers\ctaud2k.sys
2011/09/10 17:56:43.0197 1912 CTAUDFX.DLL (ccbcdd95116b993dfa523b3ecc88f73d) C:\Windows\system32\CTAUDFX.DLL
2011/09/10 17:56:43.0259 1912 ctdvda2k (6f423d0b5288d131795a05d712181ec4) C:\Windows\system32\drivers\ctdvda2k.sys
2011/09/10 17:56:43.0291 1912 CTEAPSFX.DLL (3d411b5df969c0f1dd062aa147bed524) C:\Windows\system32\CTEAPSFX.DLL
2011/09/10 17:56:43.0306 1912 CTEDSPFX.DLL (fe0823d8280a51a5575ae2fd9a3732e2) C:\Windows\system32\CTEDSPFX.DLL
2011/09/10 17:56:43.0337 1912 CTEDSPIO.DLL (eaf112535481ab76a022a274f1a8f924) C:\Windows\system32\CTEDSPIO.DLL
2011/09/10 17:56:43.0369 1912 CTEDSPSY.DLL (db50923f48b8a8fd80329dae21ad316c) C:\Windows\system32\CTEDSPSY.DLL
2011/09/10 17:56:43.0400 1912 CTERFXFX.DLL (c7f3e238871c8a0473430f8f87921ec5) C:\Windows\system32\CTERFXFX.DLL
2011/09/10 17:56:43.0447 1912 CTEXFIFX.DLL (699eb23684695e169f6db2dd4a7a901a) C:\Windows\system32\CTEXFIFX.DLL
2011/09/10 17:56:43.0493 1912 CTHWIUT.DLL (d371e3c43d628be73dccf33c9e5b1d0b) C:\Windows\system32\CTHWIUT.DLL
2011/09/10 17:56:43.0525 1912 ctprxy2k (5d591099766ee0d468a45341f1bd4df9) C:\Windows\system32\drivers\ctprxy2k.sys
2011/09/10 17:56:43.0556 1912 CTSBLFX.DLL (48184677fac84ada4b20b1fbbacea95d) C:\Windows\system32\CTSBLFX.DLL
2011/09/10 17:56:43.0587 1912 ctsfm2k (c250dd53c4d7aa0da3c587a9e4652c75) C:\Windows\system32\drivers\ctsfm2k.sys
2011/09/10 17:56:43.0618 1912 cvintdrv (310c5ec0b4278211089f0a5e915d025f) C:\Windows\system32\drivers\cvintdrv.sys
2011/09/10 17:56:43.0665 1912 DefragFS (4bb22f61e7257ed353a39130b3ed2461) C:\Windows\system32\drivers\DefragFS.sys
2011/09/10 17:56:43.0712 1912 DfsC (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
2011/09/10 17:56:43.0743 1912 DFUBTUSB (31273c758c6df7fc27b00be78c7220e9) C:\Windows\system32\Drivers\frmupgr.sys
2011/09/10 17:56:43.0774 1912 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
2011/09/10 17:56:43.0821 1912 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
2011/09/10 17:56:43.0883 1912 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
2011/09/10 17:56:43.0915 1912 DVDHlp (82ce157ff3701ab50769b2654d0b0215) C:\Windows\system32\drivers\DVDHlp.sys
2011/09/10 17:56:43.0961 1912 DXGKrnl (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
2011/09/10 17:56:44.0055 1912 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
2011/09/10 17:56:44.0180 1912 eeCtrl (8f7dbc4be48f5388a6fe1f285e7948ef) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/09/10 17:56:44.0242 1912 ElbyCDI0 (309ac30471a0f1c3a89dee1c81230576) C:\Windows\system32\drivers\ElbyCDI0.sys
2011/09/10 17:56:44.0273 1912 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
2011/09/10 17:56:44.0320 1912 emupia (6d26f3ff7af137cf0408d0fb594f0d33) C:\Windows\system32\drivers\emupia2k.sys
2011/09/10 17:56:44.0383 1912 EraserUtilRebootDrv (3ee14d400e0fdd0d214275a4a20b7022) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
2011/09/10 17:56:44.0414 1912 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
2011/09/10 17:56:44.0461 1912 ET5Drv (e5030e34de21a6818e8586bfb7dd4b60) C:\Windows\system32\Drivers\ET5Drv.sys
2011/09/10 17:56:44.0507 1912 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
2011/09/10 17:56:44.0539 1912 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
2011/09/10 17:56:44.0570 1912 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
2011/09/10 17:56:44.0601 1912 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
2011/09/10 17:56:44.0617 1912 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
2011/09/10 17:56:44.0632 1912 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/09/10 17:56:44.0695 1912 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
2011/09/10 17:56:44.0741 1912 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
2011/09/10 17:56:44.0757 1912 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
2011/09/10 17:56:44.0788 1912 fvevol (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
2011/09/10 17:56:44.0835 1912 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/09/10 17:56:44.0851 1912 gdrv (5c230948dd6652228f88ca7ae6cb276c) C:\WINDOWS\gdrv.sys
2011/09/10 17:56:44.0897 1912 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\drivers\GEARAspiWDM.sys
2011/09/10 17:56:44.0960 1912 GenericMount (69f8f310654d699c7e5bd5c67279980f) C:\Windows\system32\DRIVERS\GenericMount.sys
2011/09/10 17:56:45.0069 1912 GVTDrv (689a8eef2a2d62b28a0a578a6196531c) C:\Windows\system32\Drivers\GVTDrv.sys
2011/09/10 17:56:45.0116 1912 ha20x2k (7865a559281e7969af48b562b4641971) C:\Windows\system32\drivers\ha20x2k.sys
2011/09/10 17:56:45.0178 1912 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
2011/09/10 17:56:45.0225 1912 HDAudBus (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
2011/09/10 17:56:45.0241 1912 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/09/10 17:56:45.0272 1912 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
2011/09/10 17:56:45.0319 1912 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
2011/09/10 17:56:45.0381 1912 HidUsb (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\DRIVERS\hidusb.sys
2011/09/10 17:56:45.0428 1912 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
2011/09/10 17:56:45.0475 1912 HTTP (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
2011/09/10 17:56:45.0537 1912 hwpolicy (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
2011/09/10 17:56:45.0568 1912 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
2011/09/10 17:56:45.0599 1912 iaStorV (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys
2011/09/10 17:56:45.0740 1912 IDSVix86 (9bc8840de4140e8e2a6fc3192e054a8c) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110909.030\IDSvix86.sys
2011/09/10 17:56:45.0849 1912 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
2011/09/10 17:56:45.0896 1912 imhidusb (dfff4397c19338ee24b09cdd9955a5ac) C:\Windows\system32\DRIVERS\imhidusb.sys
2011/09/10 17:56:45.0943 1912 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
2011/09/10 17:56:45.0974 1912 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
2011/09/10 17:56:46.0021 1912 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/09/10 17:56:46.0052 1912 IPMIDRV (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
2011/09/10 17:56:46.0083 1912 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
2011/09/10 17:56:46.0114 1912 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
2011/09/10 17:56:46.0145 1912 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
2011/09/10 17:56:46.0177 1912 iScsiPrt (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
2011/09/10 17:56:46.0208 1912 JRAID (ab95b2ddb49f6b6cf52625e56c1f1f71) C:\Windows\system32\DRIVERS\jraid.sys
2011/09/10 17:56:46.0239 1912 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
2011/09/10 17:56:46.0270 1912 kbdhid (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
2011/09/10 17:56:46.0317 1912 KSecDD (412cea1aa78cc02a447f5c9e62b32ff1) C:\Windows\system32\Drivers\ksecdd.sys
2011/09/10 17:56:46.0348 1912 KSecPkg (26c046977e85b95036453d7b88ba1820) C:\Windows\system32\Drivers\ksecpkg.sys
2011/09/10 17:56:46.0395 1912 LEqdUsb (ed8f9311cae12c41a58dae2ea6d6c849) C:\Windows\system32\Drivers\LEqdUsb.Sys
2011/09/10 17:56:46.0442 1912 LHidEqd (9943f10c60eaf714c7010b37025a5ac5) C:\Windows\system32\Drivers\LHidEqd.Sys
2011/09/10 17:56:46.0473 1912 LHidFilt (b68309f25c5787385da842eb5b496958) C:\Windows\system32\DRIVERS\LHidFilt.Sys
2011/09/10 17:56:46.0504 1912 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/09/10 17:56:46.0551 1912 LMouFilt (63d3b1d3cd267fcc186a0146b80d453b) C:\Windows\system32\DRIVERS\LMouFilt.Sys
2011/09/10 17:56:46.0598 1912 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/09/10 17:56:46.0629 1912 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/09/10 17:56:46.0660 1912 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/09/10 17:56:46.0707 1912 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/09/10 17:56:46.0738 1912 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
2011/09/10 17:56:46.0769 1912 MagicTune (15099ab6600bbadb951b7b9ac5c3f45f) C:\Windows\system32\drivers\MTiCtwl.sys
2011/09/10 17:56:46.0847 1912 MarkFun_NT (34ca6d7580aef0fa2cb58adbbe542f29) C:\Program Files\GIGABYTE\ET5Pro\markfun.w32
2011/09/10 17:56:46.0894 1912 MBAMSwissArmy (d68e165c3123aba3b1282eddb4213bd8) C:\Windows\system32\drivers\mbamswissarmy.sys
2011/09/10 17:56:46.0941 1912 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
2011/09/10 17:56:46.0988 1912 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/09/10 17:56:47.0019 1912 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
2011/09/10 17:56:47.0050 1912 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
2011/09/10 17:56:47.0081 1912 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\drivers\mouclass.sys
2011/09/10 17:56:47.0128 1912 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
2011/09/10 17:56:47.0159 1912 mountmgr (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
2011/09/10 17:56:47.0191 1912 mpio (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
2011/09/10 17:56:47.0222 1912 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
2011/09/10 17:56:47.0253 1912 MRxDAV (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
2011/09/10 17:56:47.0300 1912 mrxsmb (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/09/10 17:56:47.0331 1912 mrxsmb10 (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/09/10 17:56:47.0347 1912 mrxsmb20 (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/09/10 17:56:47.0393 1912 msahci (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
2011/09/10 17:56:47.0425 1912 msdsm (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
2011/09/10 17:56:47.0471 1912 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
2011/09/10 17:56:47.0503 1912 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
2011/09/10 17:56:47.0518 1912 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
2011/09/10 17:56:47.0565 1912 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
2011/09/10 17:56:47.0596 1912 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/09/10 17:56:47.0612 1912 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
2011/09/10 17:56:47.0643 1912 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
2011/09/10 17:56:47.0690 1912 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
2011/09/10 17:56:47.0705 1912 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
2011/09/10 17:56:47.0737 1912 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/09/10 17:56:47.0768 1912 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
2011/09/10 17:56:47.0799 1912 MYFAULT (2df09521d25e67c5c6335e9a54da3ad2) C:\Windows\system32\drivers\myfault.sys
2011/09/10 17:56:47.0846 1912 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
2011/09/10 17:56:47.0955 1912 NAVENG (862f55824ac81295837b0ab63f91071f) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110909.016\NAVENG.SYS
2011/09/10 17:56:48.0017 1912 NAVEX15 (529d571b551cb9da44237389b936f1ae) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110909.016\NAVEX15.SYS
2011/09/10 17:56:48.0173 1912 NDIS (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
2011/09/10 17:56:48.0220 1912 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/09/10 17:56:48.0267 1912 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/09/10 17:56:48.0298 1912 Ndisuio (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/09/10 17:56:48.0329 1912 NdisWan (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/09/10 17:56:48.0376 1912 NDProxy (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
2011/09/10 17:56:48.0439 1912 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
2011/09/10 17:56:48.0485 1912 NetBT (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
2011/09/10 17:56:48.0563 1912 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/09/10 17:56:48.0626 1912 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
2011/09/10 17:56:48.0657 1912 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
2011/09/10 17:56:48.0735 1912 Ntfs (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys
2011/09/10 17:56:48.0813 1912 NTIDrvr (15a72d5b8f0b6a718207f14bd5ebb8ff) C:\Windows\system32\DRIVERS\NTIDrvr.sys
2011/09/10 17:56:48.0844 1912 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
2011/09/10 17:56:49.0141 1912 nvlddmkm (712d98d35e68d0006b121f4a3b8ee814) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/09/10 17:56:49.0437 1912 nvraid (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys
2011/09/10 17:56:49.0484 1912 nvstor (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys
2011/09/10 17:56:49.0546 1912 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
2011/09/10 17:56:49.0593 1912 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
2011/09/10 17:56:49.0655 1912 ossrv (edade835fc1ae61f8020bce483719d31) C:\Windows\system32\drivers\ctoss2k.sys
2011/09/10 17:56:49.0702 1912 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
2011/09/10 17:56:49.0733 1912 partmgr (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys
2011/09/10 17:56:49.0765 1912 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
2011/09/10 17:56:49.0811 1912 pci (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
2011/09/10 17:56:49.0843 1912 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
2011/09/10 17:56:49.0889 1912 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/09/10 17:56:49.0921 1912 Pcouffin (c3224a794b4fe2f6d0d5434a9fcad26d) C:\Windows\system32\Drivers\Pcouffin.sys
2011/09/10 17:56:49.0952 1912 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
2011/09/10 17:56:49.0999 1912 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
2011/09/10 17:56:50.0139 1912 pfc (c4aa89518e8a2934eaf503c9587ff157) C:\Windows\system32\drivers\pfc.sys
2011/09/10 17:56:50.0217 1912 Point32 (08b11f5c60edca255b18cedef8efba2a) C:\Windows\system32\DRIVERS\point32.sys
2011/09/10 17:56:50.0248 1912 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
2011/09/10 17:56:50.0279 1912 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
2011/09/10 17:56:50.0342 1912 prodrv06 (bc91060f244722a5d1c0e8016d9b0173) C:\Windows\System32\drivers\prodrv06.sys
2011/09/10 17:56:50.0373 1912 prohlp02 (880dc7832fd1dd7411e608cad45cf4a1) C:\Windows\system32\drivers\prohlp02.sys
2011/09/10 17:56:50.0420 1912 Pronto2G (6cd3f11dae504aef74d057168e3c6556) C:\Windows\system32\Drivers\PRONTO2G.sys
2011/09/10 17:56:50.0451 1912 prosync1 (f3471e7971ee62420451d958da635064) C:\Windows\system32\drivers\prosync1.sys
2011/09/10 17:56:50.0482 1912 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
2011/09/10 17:56:50.0545 1912 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
2011/09/10 17:56:50.0638 1912 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/09/10 17:56:50.0669 1912 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
2011/09/10 17:56:50.0701 1912 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
2011/09/10 17:56:50.0747 1912 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/09/10 17:56:50.0810 1912 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/09/10 17:56:50.0841 1912 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/09/10 17:56:50.0872 1912 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
2011/09/10 17:56:50.0919 1912 rdbss (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
2011/09/10 17:56:50.0950 1912 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/09/10 17:56:50.0997 1912 RDPCDD (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/09/10 17:56:51.0028 1912 RDPDR (b973fcfc50dc1434e1970a146f7e3885) C:\Windows\system32\drivers\rdpdr.sys
2011/09/10 17:56:51.0059 1912 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
2011/09/10 17:56:51.0091 1912 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
2011/09/10 17:56:51.0122 1912 RdpVideoMiniport (68a0387f58e226deee23d9715955572a) C:\Windows\system32\drivers\rdpvideominiport.sys
2011/09/10 17:56:51.0153 1912 RDPWD (288b06960d78428ff89e811632684e20) C:\Windows\system32\drivers\RDPWD.sys
2011/09/10 17:56:51.0200 1912 rdyboost (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
2011/09/10 17:56:51.0278 1912 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
2011/09/10 17:56:51.0325 1912 RTL8167 (bcebd5d1aabce4efb7597635e347c44b) C:\Windows\system32\DRIVERS\Rt86win7.sys
2011/09/10 17:56:51.0371 1912 RTL8169 (5163f804256deb8cf1ef64b780a18caa) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/09/10 17:56:51.0418 1912 s3cap (7fa7f2e249a5dcbb7970630e15e1f482) C:\Windows\system32\drivers\vms3cap.sys
2011/09/10 17:56:51.0449 1912 SaiH0255 (c427eec18fbdf6d69de0c8b974eb450a) C:\Windows\system32\DRIVERS\SaiH0255.sys
2011/09/10 17:56:51.0496 1912 sbp2port (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
2011/09/10 17:56:51.0527 1912 scfilter (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
2011/09/10 17:56:51.0590 1912 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/09/10 17:56:51.0637 1912 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
2011/09/10 17:56:51.0652 1912 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
2011/09/10 17:56:51.0715 1912 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
2011/09/10 17:56:51.0761 1912 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
2011/09/10 17:56:51.0777 1912 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
2011/09/10 17:56:51.0808 1912 sffp_sd (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
2011/09/10 17:56:51.0855 1912 sfhlp01 (462aee0ea0481ea8bd45cac876a4ccc4) C:\Windows\system32\drivers\sfhlp01.sys
2011/09/10 17:56:51.0902 1912 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/09/10 17:56:51.0949 1912 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
2011/09/10 17:56:51.0980 1912 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/09/10 17:56:51.0995 1912 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/09/10 17:56:52.0042 1912 SIUSBXP (bc9c2ef22ee0320c079e3ff9b4d29951) C:\Windows\system32\drivers\SiUSBXp.sys
2011/09/10 17:56:52.0058 1912 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
2011/09/10 17:56:52.0105 1912 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
2011/09/10 17:56:52.0183 1912 SRTSP (83726cf02eced69138948083e06b6eac) C:\Windows\System32\Drivers\NIS\1206000.01D\SRTSP.SYS
2011/09/10 17:56:52.0245 1912 SRTSPX (4e7eab2e5615d39cf1f1df9c71e5e225) C:\Windows\system32\drivers\NIS\1206000.01D\SRTSPX.SYS
2011/09/10 17:56:52.0276 1912 srv (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
2011/09/10 17:56:52.0307 1912 srv2 (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
2011/09/10 17:56:52.0339 1912 srvnet (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
2011/09/10 17:56:52.0370 1912 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
2011/09/10 17:56:52.0417 1912 storflt (472af0311073dceceaa8fa18ba2bdf89) C:\Windows\system32\drivers\vmstorfl.sys
2011/09/10 17:56:52.0448 1912 storvsc (dcaffd62259e0bdb433dd67b5bb37619) C:\Windows\system32\drivers\storvsc.sys
2011/09/10 17:56:52.0463 1912 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
2011/09/10 17:56:52.0557 1912 SymDS (9bbeb8c6258e72d62e7560e6667aad39) C:\Windows\system32\drivers\NIS\1206000.01D\SYMDS.SYS
2011/09/10 17:56:52.0619 1912 SymEFA (d5c02629c02a820a7e71bca3d44294a3) C:\Windows\system32\drivers\NIS\1206000.01D\SYMEFA.SYS
2011/09/10 17:56:52.0682 1912 SymEvent (ab33c3b196197ca467cbdda717860dba) C:\Windows\system32\Drivers\SYMEVENT.SYS
2011/09/10 17:56:52.0729 1912 SymIM (8d49cdbb93c3e58e1bfc39fb29444c0a) C:\Windows\system32\DRIVERS\SymIMv.sys
2011/09/10 17:56:52.0760 1912 SymIRON (a73399804d5d4a8b20ba60fcf70c9f1f) C:\Windows\system32\drivers\NIS\1206000.01D\Ironx86.SYS
2011/09/10 17:56:52.0807 1912 SymNetS (2c688094650d23b62b0a809decd0b12f) C:\Windows\System32\Drivers\NIS\1206000.01D\SYMNETS.SYS
2011/09/10 17:56:52.0838 1912 symsnap (a5cf31080e99718949bcc38c83f13452) C:\Windows\system32\DRIVERS\symsnap.sys
2011/09/10 17:56:52.0978 1912 Tcpip (04e4a7d53a7ace02e8c55b17a498f631) C:\Windows\system32\drivers\tcpip.sys
2011/09/10 17:56:53.0056 1912 TCPIP6 (04e4a7d53a7ace02e8c55b17a498f631) C:\Windows\system32\DRIVERS\tcpip.sys
2011/09/10 17:56:53.0119 1912 tcpipreg (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
2011/09/10 17:56:53.0150 1912 TDPIPE (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
2011/09/10 17:56:53.0181 1912 TDTCP (2c10395baa4847f83042813c515cc289) C:\Windows\system32\drivers\tdtcp.sys
2011/09/10 17:56:53.0212 1912 tdx (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
2011/09/10 17:56:53.0259 1912 TermDD (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
2011/09/10 17:56:53.0321 1912 tssecsrv (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/09/10 17:56:53.0368 1912 TsUsbFlt (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
2011/09/10 17:56:53.0446 1912 tunnel (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
2011/09/10 17:56:53.0477 1912 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
2011/09/10 17:56:53.0524 1912 udfs (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
2011/09/10 17:56:53.0571 1912 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
2011/09/10 17:56:53.0618 1912 umbus (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys
2011/09/10 17:56:53.0649 1912 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
2011/09/10 17:56:53.0711 1912 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\Windows\system32\Drivers\usbaapl.sys
2011/09/10 17:56:53.0774 1912 usbaudio (1d9f2bd026e8e2d45033a4df3f16b78c) C:\Windows\system32\drivers\usbaudio.sys
2011/09/10 17:56:53.0821 1912 usbccgp (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/09/10 17:56:53.0867 1912 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
2011/09/10 17:56:53.0883 1912 usbehci (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/09/10 17:56:53.0930 1912 usbhub (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys
2011/09/10 17:56:53.0961 1912 usbohci (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys
2011/09/10 17:56:54.0008 1912 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
2011/09/10 17:56:54.0039 1912 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
2011/09/10 17:56:54.0070 1912 USBSTOR (f991ab9cc6b908db552166768176896a) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/09/10 17:56:54.0101 1912 usbuhci (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/09/10 17:56:54.0148 1912 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
2011/09/10 17:56:54.0164 1912 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/09/10 17:56:54.0195 1912 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
2011/09/10 17:56:54.0273 1912 vhdmp (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
2011/09/10 17:56:54.0304 1912 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
2011/09/10 17:56:54.0335 1912 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
2011/09/10 17:56:54.0351 1912 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
2011/09/10 17:56:54.0382 1912 vmbus (c2f2911156fdc7817c52829c86da494e) C:\Windows\system32\drivers\vmbus.sys
2011/09/10 17:56:54.0413 1912 VMBusHID (d4d77455211e204f370d08f4963063ce) C:\Windows\system32\drivers\VMBusHID.sys
2011/09/10 17:56:54.0429 1912 volmgr (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
2011/09/10 17:56:54.0460 1912 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
2011/09/10 17:56:54.0491 1912 volsnap (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
2011/09/10 17:56:54.0538 1912 vpcbus (b26536add1d748cda104d856c979ae79) C:\Windows\system32\DRIVERS\vpchbus.sys
2011/09/10 17:56:54.0585 1912 vpcnfltr (a0f7e923a6261760130f22b85df9040e) C:\Windows\system32\DRIVERS\vpcnfltr.sys
2011/09/10 17:56:54.0616 1912 vpcusb (5f4b55e91ce7e2523c9e1e0ece858869) C:\Windows\system32\DRIVERS\vpcusb.sys
2011/09/10 17:56:54.0663 1912 vpcvmm (b487191fe18d6863381a1ac55482469a) C:\Windows\system32\drivers\vpcvmm.sys
2011/09/10 17:56:54.0710 1912 VProEventMonitor (ef3506b04eb9124240b35148eaacbaa5) C:\Windows\system32\DRIVERS\vproeventmonitor.sys
2011/09/10 17:56:54.0757 1912 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/09/10 17:56:54.0803 1912 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
2011/09/10 17:56:54.0835 1912 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
2011/09/10 17:56:54.0881 1912 WANARP (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/10 17:56:54.0897 1912 Wanarpv6 (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/10 17:56:54.0944 1912 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
2011/09/10 17:56:54.0975 1912 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2011/09/10 17:56:55.0037 1912 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/09/10 17:56:55.0069 1912 WFsys (ee7ebee3b601ed6d4bfd97e4e20bca12) C:\Windows\system32\DRIVERS\wfsys.sys
2011/09/10 17:56:55.0115 1912 WimFltr (090a2b8f055343815556a01f725f6c35) C:\Windows\system32\DRIVERS\wimfltr.sys
2011/09/10 17:56:55.0147 1912 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
2011/09/10 17:56:55.0225 1912 WinUsb (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/09/10 17:56:55.0271 1912 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
2011/09/10 17:56:55.0334 1912 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/09/10 17:56:55.0396 1912 WudfPf (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
2011/09/10 17:56:55.0427 1912 WUDFRd (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/09/10 17:56:55.0474 1912 XwpNTrdr (9e70e7e5ff1a28e3f9b4ecdfcaf8cc24) C:\Windows\system32\Drivers\xwpfsw2k.sys
2011/09/10 17:56:55.0552 1912 {95808DC4-FA4A-4C74-92FE-5B863F82066B} (4d840c6af3c020ed3a35efba9025cf4a) D:\Program Files\CyberLink\PowerDVD\000.fcl
2011/09/10 17:56:55.0552 1912 MBR (0x1B8) (671b81004fdd1588fa9ed1331c9ceca9) \Device\Harddisk3\DR3
2011/09/10 17:56:55.0568 1912 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
2011/09/10 17:56:55.0583 1912 MBR (0x1B8) (35c6b2fcde68facbefe0a4a7200bae58) \Device\Harddisk1\DR1
2011/09/10 17:56:56.0114 1912 MBR (0x1B8) (35c6b2fcde68facbefe0a4a7200bae58) \Device\Harddisk2\DR2
2011/09/10 17:56:56.0629 1912 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk4\DR6
2011/09/10 17:56:56.0629 1912 Boot (0x1200) (e64700248054234a588af7206166d13e) \Device\Harddisk3\DR3\Partition0
2011/09/10 17:56:56.0660 1912 Boot (0x1200) (c0cd238cb68ddee419dc7af1a043bc90) \Device\Harddisk0\DR0\Partition0
2011/09/10 17:56:56.0660 1912 Boot (0x1200) (81f412c3d1755f245f9a73b1c6bdf8ba) \Device\Harddisk1\DR1\Partition0
2011/09/10 17:56:56.0675 1912 Boot (0x1200) (a0c39b9cedc365de21704a168d54c15a) \Device\Harddisk2\DR2\Partition0
2011/09/10 17:56:56.0691 1912 Boot (0x1200) (bb7945e6bfcd958cb230bdac16a3470d) \Device\Harddisk4\DR6\Partition0
2011/09/10 17:56:56.0707 1912 ================================================================================
2011/09/10 17:56:56.0707 1912 Scan finished
2011/09/10 17:56:56.0707 1912 ================================================================================
2011/09/10 17:56:56.0707 5504 Detected object count: 0
2011/09/10 17:56:56.0707 5504 Actual detected object count: 0
2011/09/10 17:58:38.0040 2488 Deinitialize success
________________________________________________________________________________

ComboFix 11-09-10.03 - allenm 09/10/2011 18:03:29.1.4 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3326.1985 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\EZULA
c:\program files\EZULA\basis.dst
c:\program files\EZULA\basis.kwd
c:\program files\EZULA\basis.pu
c:\program files\EZULA\basis.rst
c:\program files\EZULA\genun.ez
c:\program files\EZULA\Images\arrow1.gif
c:\program files\EZULA\Images\arrow2.gif
c:\program files\EZULA\Images\button_small.gif
c:\program files\EZULA\Images\icon.gif
c:\program files\EZULA\Images\Layer_Bottom.gif
c:\program files\EZULA\Images\Layer_Center.gif
c:\program files\EZULA\Images\Layer_Top.gif
c:\program files\EZULA\Images\new.gif
c:\program files\EZULA\Images\PopUp_Follow_divider.gif
c:\program files\EZULA\Images\PopUp_Follow_Left.gif
c:\program files\EZULA\Images\PopUp_Follow_Off.gif
c:\program files\EZULA\Images\PopUp_Follow_On.gif
c:\program files\EZULA\Images\PopUp_Follow_Right.gif
c:\program files\EZULA\Images\PopUp_Top.gif
c:\program files\EZULA\Images\PopUp_Top_Bottom.gif
c:\program files\EZULA\Images\Side_B.gif
c:\program files\EZULA\Images\Side_L.gif
c:\program files\EZULA\Images\Side_R.gif
c:\program files\EZULA\Images\Side_Top.gif
c:\program files\EZULA\Images\spacer.gif
c:\program files\EZULA\INSTALL.LOG
c:\program files\EZULA\legend.lgn
c:\program files\EZULA\param.ez
c:\program files\EZULA\rwds.rst
c:\program files\EZULA\upgrade.vrn
c:\program files\EZULA\version.vrn
c:\users\allenm\AppData\Roaming\Local
c:\users\allenm\Documents\ZDL11165.TMP
c:\users\allenm\WINDOWS
c:\users\allenmcw\AppData\Roaming\Local
c:\windows\bwUnin-6.1.4.36-8876480L.exe
c:\windows\Downloaded Program Files\ODCTOOLS
c:\windows\system32\ndisapi.dll
D:\install.exe
d:\program files\Logitech\Easy Synchronization\LogitechEasySync.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-08-11 to 2011-09-11 )))))))))))))))))))))))))))))))
.
.
2011-09-11 01:16 . 2011-09-11 01:16 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-09-11 01:16 . 2011-09-11 01:16 ——– d—–w- c:\users\allenmcw\AppData\Local\temp
2011-09-11 01:16 . 2011-09-11 01:16 ——– d—–w- c:\users\Temp.ALLEN-SAMUEL\AppData\Local\temp
2011-09-11 01:16 . 2011-09-11 01:16 ——– d—–w- c:\users\allenmcw.ALLEN-SAMUEL\AppData\Local\temp
2011-09-11 01:16 . 2011-09-11 01:16 ——– d—–w- c:\users\Allen\AppData\Local\temp
2011-09-11 01:16 . 2011-09-11 01:16 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2011-09-09 07:35 . 2011-09-09 07:36 ——– d—–w- c:\users\Guest
2011-09-02 03:20 . 2011-07-09 04:29 2048 —-a-w- c:\windows\system32\tzres.dll
2011-08-13 18:06 . 2011-08-13 18:06 ——– d—–w- c:\users\allenm\AppData\Roaming\Mael
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-10 23:29 . 2008-05-31 17:39 24944 —-a-w- c:\windows\system32\drivers\GVTDrv.sys
2011-09-10 23:27 . 2008-05-28 05:23 16608 —-a-w- c:\windows\gdrv.sys
2011-07-16 04:27 . 2011-08-11 03:11 290816 —-a-w- c:\windows\system32\KernelBase.dll
2011-07-16 04:15 . 2011-08-11 03:11 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 4096 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3584 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 04:15 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-07-16 02:17 . 2011-08-11 03:11 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:17 . 2011-08-11 03:11 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:17 . 2011-08-11 03:11 3584 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:17 . 2011-08-11 03:11 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-07-09 02:30 . 2011-08-11 03:11 223744 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-07-09 00:44 . 2011-06-17 17:40 299640 —-a-w- c:\windows\system32\drivers\NIS\1206000.01D\symnets.sys
2011-06-24 04:27 . 2011-08-11 03:11 169984 —-a-w- c:\windows\system32\winsrv.dll
2011-06-24 04:22 . 2011-08-11 03:11 271360 —-a-w- c:\windows\system32\conhost.exe
2011-06-23 04:33 . 2011-08-11 03:11 3912576 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-06-23 04:33 . 2011-08-11 03:11 3967872 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-06-21 05:34 . 2011-08-11 03:11 1290624 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-17 23:26 . 2009-07-14 02:05 152576 —-a-w- c:\windows\system32\msclmd.dll
2011-06-17 22:39 . 2011-06-17 22:39 86528 —-a-w- c:\windows\system32\iesysprep.dll
2011-06-17 22:39 . 2011-06-17 22:39 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-06-17 22:39 . 2011-06-17 22:39 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-06-17 22:39 . 2011-06-17 22:39 74752 —-a-w- c:\windows\system32\iesetup.dll
2011-06-17 22:39 . 2011-06-17 22:39 63488 —-a-w- c:\windows\system32\tdc.ocx
2011-06-17 22:39 . 2011-06-17 22:39 48640 —-a-w- c:\windows\system32\mshtmler.dll
2011-06-17 22:39 . 2011-06-17 22:39 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-06-17 22:39 . 2011-06-17 22:39 367104 —-a-w- c:\windows\system32\html.iec
2011-06-17 22:39 . 2011-06-17 22:39 35840 —-a-w- c:\windows\system32\imgutil.dll
2011-06-17 22:39 . 2011-06-17 22:39 23552 —-a-w- c:\windows\system32\licmgr10.dll
2011-06-17 22:39 . 2011-06-17 22:39 161792 —-a-w- c:\windows\system32\msls31.dll
2011-06-17 22:39 . 2011-06-17 22:39 152064 —-a-w- c:\windows\system32\wextract.exe
2011-06-17 22:39 . 2011-06-17 22:39 150528 —-a-w- c:\windows\system32\iexpress.exe
2011-06-17 22:39 . 2011-06-17 22:39 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2011-06-17 22:39 . 2011-06-17 22:39 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2011-06-17 22:39 . 2011-06-17 22:39 11776 —-a-w- c:\windows\system32\mshta.exe
2011-06-17 22:39 . 2011-06-17 22:39 110592 —-a-w- c:\windows\system32\IEAdvpack.dll
2011-06-17 22:39 . 2011-06-17 22:39 101888 —-a-w- c:\windows\system32\admparse.dll
2011-06-17 17:40 . 2009-11-22 07:50 126584 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-06-15 08:55 . 2011-08-11 03:11 86016 —-a-w- c:\windows\system32\odbccu32.dll
2011-06-15 08:55 . 2011-08-11 03:11 81920 —-a-w- c:\windows\system32\odbccr32.dll
2011-06-15 08:55 . 2011-08-11 03:11 319488 —-a-w- c:\windows\system32\odbcjt32.dll
2011-06-15 08:55 . 2011-08-11 03:11 163840 —-a-w- c:\windows\system32\odbctrac.dll
2011-06-15 08:55 . 2011-08-11 03:11 122880 —-a-w- c:\windows\system32\odbccp32.dll
2008-02-14 21:23 . 2008-02-14 21:23 231944 —-a-w- c:\program files\gwflash.exe
2007-09-22 02:42 . 2007-09-22 02:42 19008 —-a-w- c:\program files\markfun.a64
2007-08-22 02:49 . 2007-08-22 02:49 17912 —-a-w- c:\program files\markfun.w32
2007-04-05 11:31 . 2007-04-05 11:31 248640 —-a-w- c:\program files\update.exe
2007-03-10 22:16 . 2007-03-10 22:16 774144 —-a-w- c:\program files\RngInterstitial.dll
2007-03-02 11:48 . 2007-03-02 11:48 240448 —-a-w- c:\program files\gwf32.exe
2006-11-24 06:47 . 2006-11-24 06:47 207680 —-a-w- c:\program files\BIOS_Run.exe
2005-04-28 02:40 . 2005-04-28 02:40 6800 —-a-w- c:\program files\W95_HUA.vxd
2003-11-13 22:44 . 2003-11-13 22:44 319488 —-a-w- c:\program files\PolarZIPLight.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2009-07-14 65024]
"NortonUtilities"="d:\program files\Norton Utilities 14\rmtray.exe" [2009-09-14 279912]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2010-11-20 144384]
"cryptoexpert"="c:\program files\CryptoExpert Professional\cexpert_tray.exe" [2010-05-23 711680]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-09 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bluetooth Connection Assistant"="LBTWIZ.EXE -silent" [X]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2010-03-19 421888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-12 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-12 13679720]
"Norton Ghost 15.0"="d:\program files\Norton Ghost\Agent\VProTray.exe" [2010-03-04 2598760]
"NBAgent"="d:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2010-03-26 1234216]
"LanguageShortcut"="d:\program files\CyberLink\PowerDVD\Language\Language.exe" [2008-02-22 62760]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"GEST"="c:\program files\GIGABYTE\GEST\RUN.exe" [2008-06-24 236040]
"EasyTuneVPro"="c:\program files\Gigabyte\ET5Pro\ETcall.exe" [2007-07-26 20480]
"CTXFIREG"="CTxfiReg.exe" [2008-02-21 43520]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-02-21 19968]
"CTHelper"="CTHELPER.EXE" [2008-02-21 19456]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-05-08 91432]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-05 49152]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"EvtMgr6"="d:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DevconDefaultDB"="c:\windows\system32\READREG" [X]
"CtxfiReg"="CTXFIREG.exe" [2008-02-21 43520]
.
c:\users\allenm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Snsicon.exe [2006-1-30 86016]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Display.exe - Shortcut.lnk - d:\program files\APC\APC PowerChute Personal Edition\Display.exe [2008-9-3 267520]
EasyTune5 Pro.lnk - c:\program files\GIGABYTE\ET5Pro\ET5SC.exe [2008-5-31 28672]
GammaTray.lnk - d:\program files\MagicTune Premium\GammaTray.exe [2010-4-10 36864]
hpqtra08.exe - Shortcut.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FE24CD78-7C63-465D-8787-4EDF7FC79895}"= "d:\program files\Logitech\Easy Synchronization\shellexecutehook.dll" [2005-10-05 69632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 09:29 64592 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BD Icon.lnk]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Snsicon.lnk]
.
[HKLM\~\startupfolder\C:^Documents and Settings^allenm^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"APC UPS Service"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"btwdins"=2 (0x2)
"C-DillaSrv"=2 (0x2)
"ccEvtMgr"=2 (0x2)
"ccSetMgr"=2 (0x2)
"CLTNetCnService"=2 (0x2)
"CTAudSvcService"=2 (0x2)
"GEARSecurity"=2 (0x2)
"GEST Service"=3 (0x3)
"gusvc"=3 (0x3)
"IDriverT"=3 (0x3)
"InCDsrv"=2 (0x2)
"iPodService"=3 (0x3)
"LiveUpdate"=3 (0x3)
"LiveUpdate Notice"=2 (0x2)
"Logitech Easy Synchronization"=2 (0x2)
"NBService"=3 (0x3)
"NMIndexingService"=3 (0x3)
"NMSAccessU"=2 (0x2)
"Norton Save and Restore"=2 (0x2)
"NProtectService"=2 (0x2)
"NVSvc"=2 (0x2)
"odserv"=3 (0x3)
"ose"=3 (0x3)
"PDEngine"=3 (0x3)
"PDSched"=2 (0x2)
"Pml Driver HPZ12"=3 (0x3)
"RichVideo"=2 (0x2)
"Speed Disk service"=2 (0x2)
"Symantec Core LC"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"XWNTSERV"=2 (0x2)
.
R0 GVTDrv;GVTDrv; [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-29 136176]
R3 DriveShareSvc;DriveShareSvc;c:\program files\CryptoExpert Professional\drivesharessvc.exe [2010-04-11 161168]
R3 GenericMount Helper Service;GenericMount Helper Service;d:\program files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [2010-02-12 1574408]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-29 136176]
R4 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\GEST\GSvr.exe [2008-06-24 55816]
S0 cc_4g;cc_4g;c:\windows\system32\Drivers\cc_4g.sys [2010-03-11 196608]
S0 CLBStor;InstantBurn Storage Helper Driver; [x]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110901.001\BHDrvx86.sys [2011-09-02 815736]
S1 ElbyCDI0;ElbyCDI0 Driver;c:\windows\system32\drivers\ElbyCDI0.sys [2010-01-02 26024]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 cc_firewall;cc_firewall;c:\windows\system32\Drivers\cc_firewall.sys [2007-04-11 7680]
S3 DVDHlp;DVDHlp Driver;c:\windows\system32\drivers\DVDHlp.sys [2010-06-10 106432]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-07-28 105592]
S3 GenericMount;Generic Mount Driver;c:\windows\system32\DRIVERS\GenericMount.sys [2010-02-12 57840]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 99841339
*NewlyCreated* - ASWMBR
*Deregistered* - 99841339
*Deregistered* - aswMBR
*Deregistered* - ccHP
*Deregistered* - MarkFun_NT
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-29 22:48]
.
2011-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-29 22:48]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://community.norton.com/t5/user/viewprofilepage/user-id/8710
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - d:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: Se&nd; to OneNote - d:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: aol.com\free
Trusted Zone: att.com\www.wireless
Trusted Zone: comcast.net\login
Trusted Zone: intuit.com\ttlc
Trusted Zone: lithium.com
Trusted Zone: norton.com\community
Trusted Zone: samuelhairstylist.com\www
Trusted Zone: symantec.com\www
Trusted Zone: turbotax.com
Trusted Zone: weather.com\www
Trusted Zone: youtube.com\www
TCP: DhcpNameServer = 192.168.30.1
Handler: ms-its50 - {F8606A00-F5CF-11D1-B6BB-0000F80149F6} - c:\program files\Common Files\microsoft shared\Information Retrieval\itss50.dll
DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} -
FF - ProfilePath - c:\users\allenm\AppData\Roaming\Mozilla\Firefox\Profiles\m4j4hu7i.default\
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-vws - (no file)
HKLM-Run-Easy Synchronization - d:\program files\Logitech\Easy Synchronization\LogitechEasySync.exe
HKLM-RunOnce-Easy Synchronization - d:\program files\Logitech\Easy Synchronization\LogitechEasySync.exe
AddRemove-Creative News - c:\program files\Creative\News\CTNews.isu
AddRemove-Diagnostics2 - e:\program files\Creative\SBAudigy\Diagnose2.isu
AddRemove-Midi Samples - e:\program files\Creative\SBAudigy\Midi.isu
AddRemove-Oozic Player - d:\program files\Creative\Oozic Player\OZPLAY30.isu
AddRemove-SIUSBXP&10C4&EA61; - c:\windows\system32\Silabs\DriverUninstaller.exe USBXpress\SIUSBXP&10C4&EA61;
AddRemove-SLABCOMM&10C4&EA60; - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60;
AddRemove-SoundFont Banks - e:\program files\Creative\SBAudigy\SoundFont.isu
AddRemove-{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D} - d:\program files\PDFCreator\unins000.exe
.
.
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7601 Disk: ST3500630AS rev.3.AAK -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-4
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
copy of MBR has been found in sector 8 !
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\d:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1085031214-436374069-854245398-1006\Software\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Common Client\ccIPC]
@Denied: (C D) (Everyone)
.
[HKEY_USERS\S-1-5-21-1085031214-436374069-854245398-1006\Software\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Common Client\ccIPC\Endpoints]
@Denied: (C D) (Everyone)
"{F197DD1E-368B-4D67-A77C-C0B6BE36305A}"=""
"{4E2C3396-05A1-4230-9471-56945A50275C}"=""
"{FDA548A2-07DA-4E45-9710-180ED4066513}"=""
"{717E8F05-2413-4451-B2B9-49EE5522F5A3}"=""
"{2BFFF91B-4D5A-4A42-937D-90119622B0CF}"=""
"{D5E9EB2F-1300-4DB3-853C-646CAF4D6E59}"=""
"{C995CD05-308B-4D88-A01D-FBA6854E6F9D}"=""
"{4F6608FF-D6C6-4D5B-AA60-59FF839E5E4A}"=""
"{22C95C1A-34FF-4EAD-ACDF-B545A33273AD}"=""
"{7EBAA523-6BE8-42A7-A03B-2E3FC1799561}"=""
"{A148A9CA-2FB3-4C42-B5CA-D4B129774DE2}"=""
"{15E6CEB1-9AF7-4E27-817D-FEAB518440D7}"=""
"{6857EB96-E796-4AEF-91D5-D78FE668A75E}"=""
"{5A974613-4974-4BD6-9B16-B1E2DF2E564B}"=""
"{59296699-4889-4537-9675-5CD94832E175}"=""
"{BA92F13B-2A29-4755-838E-E9DF0CC0BE23}"=""
"{52D3804A-DF3F-4F0E-BB06-3A76A7F4DB9F}"=""
"{7D632FB4-06E9-474B-B71D-B193B4AD5414}"=""
"{4665F4D8-55A0-4D7B-BF2F-389653B4CD30}"=""
"{D1DC0FF7-E36E-452A-BB1F-2845DDF8D57E}"=""
"{9FC65B8A-73D7-4689-A3B7-471874DE4AD1}"=""
"{7EFE4B7C-C1DD-40AC-8A44-208506B74032}"=""
"{26DA826C-FB06-4911-839C-246FD7FDB053}"=""
"{22A0D4EE-3CE3-4C16-908F-AEF7AAE56FA9}"=""
"{3A285A7D-EA59-4611-AF9C-1BEE54623F83}"=""
"{D9FCD1C7-4E34-4309-B796-9707BB594AD3}"=""
"{FAAE465A-5032-4EC2-96F3-882613284445}"=""
"{AEDA0885-C9E9-4DDC-818A-3820E2D952C0}"=""
"{B4B2A361-89EB-4982-9919-A96D0CECBBC4}"=""
"{79661375-2082-4AD1-884B-CA76EF2886FC}"=""
"{9DA33D2E-1501-4488-94C2-A73C8D4652EB}"=""
"{8D4CE00E-013D-4E84-876C-84A8644E9B37}"=""
"{34ED8A08-53A3-4DCE-8FA4-CDD435141B50}"=""
"{48A2248C-5B0A-453D-B318-8E4A5A33E825}"=""
"{11515255-866A-428E-85AC-F72DBF9D7B2C}"=""
"{D20FD5D8-EFF1-472B-A026-CE2770680091}"=""
"{19609F69-F67A-4DB1-810F-48472238B6F5}"=""
"{F8DDA9BA-B1CE-477D-9047-C8ACAB34E933}"=""
"{188F929A-4AD3-4039-85EF-F23716EF8CDC}"=""
"{B16EA034-5F2B-4A10-8DF4-565408E0D1B9}"=""
"{C6066DC5-D6E6-41E7-9073-EDC328ED201D}"=""
"{944FA6C0-99DE-4AE8-BD0C-EB447C57ECC2}"=""
"{BEC7BA14-A955-4A07-B3E0-5E146530F38B}"=""
"{728C7B45-DF26-49ED-961A-BF21080829E6}"=""
"{4E173D8A-DD20-4445-9BAD-FEE1F5DAED02}"=""
"{74AA4049-2D27-4947-88AD-248E3C5551A7}"=""
"{8FE36D34-0DCC-45A1-9AB5-C0553135A19A}"=""
"{EA56C126-FA1A-4B21-B6E5-F6E5EE88ACF9}"=""
"{4BC7A905-71C2-4B04-BAFE-55A302A1130C}"=""
"{9B94A064-1555-4A2B-BA77-BFD389E71C69}"=""
"{AA63BCF1-101F-4576-AB2D-510652914734}"=""
"{4CCBDAB9-DAE2-446E-A3ED-D2F8D6E389E3}"=""
"{995BD2DA-58E2-455E-B44A-C3C326E0EDCE}"=""
"{E2514CD2-2AA4-4C5C-9F4C-6F9096DAFE09}"=""
"{DFCB06CC-94AD-442A-A044-8379B0388054}"=""
"{4EB0A95A-0B1E-4D69-A71F-051F7657BEE5}"=""
"{BF32927D-984E-4579-8B9C-0760668AB439}"=""
"{8E946577-A6A0-4390-9F7A-75FDC80BFD4D}"=""
"{C87A10B4-1071-45AF-8E6A-42121E9CC4FA}"=""
"{2499B062-D503-4077-81CD-7A38F2BA8473}"=""
"{09251049-6926-4284-BE70-5F5CA3F93BE3}"=""
"{5115C48E-5527-43B0-95C2-A7B4B661F221}"=""
"{6DC0707E-8774-4D36-B72A-B03A0467CC10}"=""
"{EDD1D819-D36E-4821-B799-2F12B69044D4}"=""
"{F0D01F4D-7D09-4839-9AFA-D8406A70918A}"=""
"{31253D6A-764F-4DB9-80E4-25BF11E05FFF}"=""
"{F31E17D9-2640-4B13-BC76-D73678BD2A3D}"=""
"{CEC7206F-911B-4C9D-9714-8E976D0B64F9}"=""
"{37EEC7B3-4A22-4768-94EA-631461E8118A}"=""
"{05E0B12D-27D9-46C2-B7DB-6319BEF6F8E7}"=""
"{BAD36A39-1F79-4898-AD1C-186CF2F00712}"=""
"{187C15C0-98CA-420F-9AA3-ED3F8A47B11A}"=""
"{CD8A5B4E-D391-4352-9FCA-676EC8063D99}"=""
"{E0831D85-1E9A-4C72-8A10-51D7570C6CF2}"=""
"{1213761C-A100-4C6D-9888-FE490FFA3CE6}"=""
"{DAED1C5A-D851-4A4C-AA31-F592F64B9640}"=""
"{0A8756FB-A437-4163-855E-754462694FEF}"=""
"{4842813D-EC0D-40C7-9C1D-28ED24E6A178}"=""
"{131B4807-9D08-49D6-BD28-2320040F1E00}"=""
"{79C802B1-1F15-4EC9-897C-296AE73BA14B}"=""
"{87FD1989-0814-451A-9D18-6CF56C3937CF}"=""
"{080B3FB5-37D2-4D5E-AC89-021FD6AA35DF}"=""
"{9436DA85-D959-4F94-81E6-94D751E7A57A}"=""
"{42823773-4D92-424A-B4C8-AA3D96BBBD4D}"=""
"{D44B5CDE-3C7C-44D1-98A0-FB94D5FA724A}"=""
"{9B0A9D1D-ED46-4505-8615-139F5378523E}"=""
"{B7CD4FA4-C74F-473F-837F-3102953C9DBC}"=""
"{CAD6ADE3-D1B5-4E8F-AC59-96DA525FEBC1}"=""
"{56AF2F79-CEE2-4650-8675-3BBE3EE610B9}"=""
"{647DA471-66CE-417D-9B1A-60F037232833}"=""
"{1CDAC2DA-DB04-4A6E-9DF4-9705F2DC0A85}"=""
"{F9F0CFAD-6A86-459A-9357-939867AD7073}"=""
"{22E66A37-4D1D-4F48-8B76-AA984ABEEED9}"=""
"{7327EAA6-C022-4D54-AFA2-2CBD32A4686A}"=""
"{682056CC-D908-4A60-8C74-AD421DF8942D}"=""
"{9C4851DB-CC52-4A4D-963E-CFCAAE472A38}"=""
"{CDD14DC7-B0DB-458B-A498-4BA2FBE76515}"=""
"{3EFBDFC5-EB11-449A-8A72-F763889DA5B4}"=""
"{682CFB04-0496-42CB-84DA-2C23C95D501D}"=""
"{7252436E-80C8-4CA0-9D8E-B5D8A4ED985E}"=""
"{16D4D523-78AA-45F7-836A-171F3EC1443D}"=""
"{58940F1E-89B1-4647-93DC-FF0B3BB3F954}"=""
"{E01D535E-74B4-4793-9A4E-51940EF7FE2F}"=""
"{00DBC42B-59C0-4FF9-8D57-1DC5C5BED67D}"=""
"{2641ECAF-A312-4A69-A30F-64F6C0EA6ACB}"=""
"{A1A780E3-BE64-44FD-AE7D-CB654B9D27DC}"=""
"{797E61A4-CDD3-437A-8F07-7F57F0C15F49}"=""
"{0C6D4CCC-3CC0-4151-851E-DCED47F4827D}"=""
"{8AB2055F-5B2B-45C8-914F-9ADF32B2F147}"=""
"{12C6D653-6562-47F5-A901-413AF7418605}"=""
"{568BDA6C-407C-4013-871B-85DF5E6B8855}"=""
"{7630FAA6-4FDB-4C45-B242-7D9132F5A9FD}"=""
"{9B09932C-D66C-4DC4-B3B6-A6E6ACC20B35}"=""
"{7EB66FA2-3D87-4E36-96C8-EA3E9A1531AD}"=""
"{66EF67F7-37BF-48E0-BC05-48EC00988ACB}"=""
"{B76BCE03-2D4A-407A-BD47-6B187D8466AE}"=""
"{4E1CA408-19D1-477E-BABD-28293651A395}"=""
"{9DF74FD9-32CA-451F-A286-6BBDFB2937F7}"=""
"{27A1F84F-B8D0-48EC-840A-9B7BC14AA405}"=""
"{AF724B2E-7CAA-42AE-AD73-2B7398D93194}"=""
"{53BAA8DA-B390-4DCA-B3DC-263BADD81BC2}"=""
"{75851DF1-D10B-4698-B3AD-DCAD48D0F3A0}"=""
"{9ADD013F-7864-4D26-86D3-98A255EE2C29}"=""
"{DF42B01F-B68D-4322-AB25-500EFDADB7B2}"=""
"{7A021464-0043-43D0-9B73-7305E93E79A5}"=""
"{0BF7C47F-7BE3-4ADE-A4CF-F44C470DA2C1}"=""
"{12D60A97-FD1A-4EB9-976D-C4D84786E581}"=""
"{528D9ACF-4288-4DC2-8A15-1212C074B03E}"=""
"{E5ADD97B-B09B-411B-AAEA-8CECEA0ABE3D}"=""
"{8CBD9A26-3211-4619-98AF-CF49B84519BC}"=""
"{E04B0059-4120-4A7E-8881-D8CCBF93D1D3}"=""
"{AF0E1EA4-0822-444C-814E-C3EBDD798755}"=""
"{B5FB1F5A-B347-46C4-98BA-F4B32688BAB9}"=""
"{CAD0460A-F7D7-4AF1-9430-C055A0E42309}"=""
"{3758C814-964C-4063-8970-D934D6AF5883}"=""
"{5EF982EF-A7D7-4670-87CB-EA5CA4CD3978}"=""
"{47B1DF43-833A-4EA9-9AA9-91DC656D60DB}"=""
"{CA20E430-1429-47F6-9480-7DDCBE566E94}"=""
"{F826C1EA-B05D-4377-ACF2-A509CC1ABC08}"=""
"{90ABC014-81CD-49AD-83DD-0330CB33827A}"=""
"{334C7C79-1904-46EC-8C21-B769B71B198C}"=""
"{0CF4FC2F-5117-4E9C-8CF6-213FD836EEB4}"=""
"{BCEB6D27-C8AB-472B-BB92-62FAAA9FF7D1}"=""
"{FA161FC5-FFD1-4B11-B554-4F6D22E2FF73}"=""
"{9FB9F3B3-2AD2-4440-B7B4-3D559F5835AF}"=""
"{5FAC0C59-255C-4499-B449-DFD4761ACC4F}"=""
"{D6DF5120-BEBF-4EC5-8818-3F4C01627F4A}"=""
"{70055AA1-5E44-42CC-9DE6-187A85C60B0B}"=""
"{9502143D-CA2C-4DAD-9CB8-486DB33AABDE}"=""
"{15359D51-F6AF-4E48-90BF-52045EBB1107}"=""
"{4F0DCF7E-0BB4-497E-9C29-7B17854D4E82}"=""
"{E8AD0956-BB7A-41A9-827F-5A090DCBEEEC}"=""
"{D68FB7EA-EAA7-42D8-96CC-F3CD461DB85A}"=""
"{C10E3675-F811-43E3-84F9-99F3033976EF}"=""
"{25F94601-1212-46FB-A3FB-9F411F35F538}"=""
"{CAE023CA-9E4A-4BAB-B923-8AF221AADDD0}"=""
"{277695A8-27E2-4CB4-A520-A7401E4F9732}"=""
"{5B2DAFD9-7EDA-402C-8A4F-594DA9C2BC4C}"=""
"{D228EC2A-33AB-4D1E-B812-47CD9702B1F2}"=""
"{2832C1AA-FD70-423F-A945-3F17E4B1D878}"=""
"{F728A5EB-E644-4113-A0CC-CE21C5A52A50}"=""
"{3FD457F1-3B68-47B6-B80E-53E690E1E3A6}"=""
"{243909BA-CBDF-4360-A98C-0CFAE25B4322}"=""
"{7307A433-2D4B-4847-B209-CCAC8AF0B874}"=""
"{4E1C6284-32CF-43A6-B73C-C247B88C322E}"=""
"{418446E7-C3B6-47AB-B9EE-B9301E9FFB5A}"=""
"{274E470B-7A10-4EA7-A171-0F4F4226D31D}"=""
"{7CC9104F-4B26-4D75-BDA9-FE6568A84674}"=""
"{C6E182EA-AA59-40CD-AE7E-7BC1E550843D}"=""
"{19C95882-1738-47D1-A356-E1F51C6FF113}"=""
"{973145E5-FBC2-4583-A3A7-771463F7A989}"=""
"{D14B2B11-5A52-4928-B10D-CA2A8DB2CC48}"=""
"{D858E9E6-9816-4ABE-A6AA-D47C3C914547}"=""
"{A2FAD790-5CE9-4FFC-B559-B4EC04F4A15F}"=""
"{A85B4CAC-2093-4CF9-A22A-047AB25385B4}"=""
"{03494A69-B289-4F09-BF59-1B43A2C9F4E2}"=""
"{CC96A4D0-D73D-4D8C-AC28-440C92ED1B81}"=""
"{6C1CB638-EBBA-4574-BC00-CADC1D4605A8}"=""
"{7595928F-55A9-4BDA-BEE3-D40FC7182E78}"=""
"{C801B133-5EAA-4DE1-8674-963D2C15FBE7}"=""
"{F626C9FE-0550-4D1F-AE38-14AE28AD3A2A}"=""
"{280874D7-C42F-482F-85CF-B4AC454F8238}"=""
"{6F238BE3-F8E3-4261-93D9-1BDF06E20386}"=""
"{22700A06-1CE8-4868-87D0-8B8C8AA593A7}"=""
"{E87BC6FD-E0FF-41B0-A241-C58F9812256F}"=""
"{65E61562-B030-4AAF-BC44-FEF61CD74CCE}"=""
"{6399488D-74D0-4FF7-8425-43DF73C209A2}"=""
"{35DE5552-AC25-46FA-A24C-687ABCC7B68F}"=""
"{99ADB69C-49DC-44BA-AC7B-3BD6A5E0F8C3}"=""
"{C881F5CA-5B2D-498D-B008-260D1D1E959A}"=""
"{13103617-5044-4CDA-BFD0-45141765C3A2}"=""
"{E6D8C1E5-3346-4187-A3D2-3A68143F0C05}"=""
"{9AF619AD-BC7A-4CE9-824F-F6C61CA231D1}"=""
"{EA57B2D8-C0A9-40BC-A6CB-D6AA28B4B55A}"=""
"{EB4823D6-C8AC-4652-B8BF-C79D4512E989}"=""
"{0C124CD8-1D19-4B80-A2BB-B10FA6A43CCD}"=""
"{CDB88116-ECCF-407D-B3AF-00A70946C9D4}"=""
"{61AFDFEE-A655-4950-A4C1-3D46B49E5E76}"=""
"{FA62D261-6C6F-42E6-8620-3656EAEEA497}"=""
"{79E45C61-9898-4E43-8CBC-F567CAFD828C}"=""
"{8136A614-357C-49AA-9DFB-8F0433AA5985}"=""
"{AB34FB33-7B0D-486F-9B7A-278B2017DFE8}"=""
"{185F0148-E086-45F7-9C03-FE5E0215F103}"=""
"{4D7AB9B1-9722-4EB4-9E20-F15A67EE42E7}"=""
"{72DA994F-6333-4C54-9F49-0E4D528EB7A2}"=""
"{3FFDC54F-5585-4621-8606-5E8EEDA616D2}"=""
"{882CB7DB-8832-43A3-A536-14DEC061BECE}"=""
"{57270752-505D-4E4F-A7C8-75B6E9BB1676}"=""
"{55ACC562-D822-4624-A60C-77DACFB4CB5E}"=""
"{EC9F04BE-301B-4F4F-9308-F467C5D9B9E9}"=""
"{82133E2F-F570-4DAF-AF0E-E104206FBDD4}"=""
"{00D438DE-DFA1-4B9D-8F95-CAE9DA4DF772}"=""
"{56387369-A23B-4A1D-B529-50489CFF8C49}"=""
"{31137C77-19D3-405E-A156-A8403DF0CB64}"=""
"{0DB2823A-6CE2-4CCA-8D20-3C91DB98597B}"=""
"{E2A54F3D-1521-4FEF-AC9A-C145383444DD}"=""
"{1D2AC929-A09C-4EBE-9439-186AECC752B4}"=""
"{E5B63D0F-17FF-4BFF-B998-7890B1794679}"=""
"{D01314BE-0CCC-40BC-9F41-2CE5EA3A686C}"=""
"{C08FF42A-4D47-4725-9848-5623CEF88324}"=""
"{464EAD7B-2856-4892-BCCA-FEF9FEBD7BF2}"=""
"{69C46B14-5A9D-472B-906F-9A217D770572}"=""
"{892DE327-83D9-4DAE-BA63-F4EE2DE53ACE}"=""
"{44F65502-D13D-4D14-AA7F-342758AA14E7}"=""
"{1EF8FB08-109E-45F9-AC3B-2580ABF89EE8}"=""
"{525E89F5-CFE2-4ACB-9F41-01213DB2562A}"=""
"{ED54BC90-AE0E-488D-9E2A-B0DC206E6FBE}"=""
"{9E7198C0-3E29-4ADF-A7A1-0741A8E62BE2}"=""
"{6C5B754E-2734-4DF0-B455-D246644969B6}"=""
"{9B21A2D2-62FF-468A-918A-C9EE946888BE}"=""
"{F7403FD5-A63C-406A-8567-944AE1247CEA}"=""
"{647F0333-E733-45DF-BDBA-780A4591A9BE}"=""
"{79F9BD2A-17F8-4381-9EE1-4DD014C5FF9D}"=""
"{42892E39-4F43-4EBB-B5C8-F54AE057B6B1}"=""
"{E3BC8E54-0FEE-4E21-AF38-0388D420C404}"=""
"{8FF47ACF-24B2-4C91-A814-9E27DF8A43CB}"=""
"{418A4FCF-22BD-49C8-B43C-5E5AAA63A244}"=""
"{0DE1D9AD-0908-4838-A098-E7AB1B204AAC}"=""
"{C810FA78-0873-4A82-ABB5-A023F2F64C16}"=""
"{4EAD5A1A-92B5-458E-84B3-D7E545EDBF95}"=""
"{19F87904-9707-4F33-8CB7-2D4F5196D964}"=""
"{9764E783-3B2A-4C93-9445-FF74B0CFCE66}"=""
"{C12954A4-539D-46B0-9009-F2746E89436B}"=""
"{D4D9113D-4B33-4650-8849-F082054F140C}"=""
"{F4A49BF0-FF56-4931-B00D-75E6DCA85D3D}"=""
"{234306E9-6081-48AF-9F93-1663476B557F}"=""
"{ABB601B0-25A3-4005-B745-448958217E59}"=""
"{BAC4E1A8-8739-4C4F-9015-03CA22512547}"=""
"{CBB3DAB8-B048-437D-A5DC-E1AA393255B4}"=""
"{B2BC5C5E-EE1F-4FA0-A7B8-53A5FB893D23}"=""
"{D28546AA-BB32-442E-9A96-3A0656038568}"=""
"{41C8F8AA-1F47-44A7-8A8F-E24A0D483EED}"=""
"{36DC6189-3340-485B-86D1-947C9B253CEB}"=""
"{20701A3E-BFFF-44BC-AFB5-1893E7D65F04}"=""
"{7C090DD0-C17A-4B36-920E-52A9AB2E4408}"=""
"{9D6F2F73-0294-48D0-9E96-DA4707237BAD}"=""
"{8B96B26E-B581-4C17-93F5-58A0B97E3CCF}"=""
"{D36E02E4-C072-4ED4-AD84-F9EACA0E7EE9}"=""
"{B9D950BC-7161-4EAD-9A84-211606648B3A}"=""
"{5FDEF8EC-D474-4317-9E8B-D97FA5DF5BF9}"=""
"{DD946F97-AD85-4BAB-80CA-DA1769F8F24B}"=""
"{C6B5BA37-8C8E-4F3D-8402-1B6DED1712D4}"=""
"{D3A49821-4330-49DE-B6DA-5420C0724339}"=""
"{C47FA5BD-858E-4A8A-9463-9034D20B0536}"=""
"{290ACCAB-E10F-4B48-B5AF-B3C727999C17}"=""
"{14C0C360-80AF-4499-A90E-7DAA443E49B8}"=""
"{F9FE0207-C77B-4A47-9AE8-5D39EBEDA630}"=""
"{B1348F56-5C41-40D3-AAEF-78DC08355867}"=""
"{D04BF810-96E0-4571-A6C2-DF6AE2E9223D}"=""
"{53A8CF39-A41E-4AA3-A7C6-7ADEE6E6730A}"=""
"{552B8518-D112-4D88-8B8F-8CE700BC5A00}"=""
"{51484C93-F38E-4CB1-BC0F-172FB947BD06}"=""
"{9958BDB9-B5E7-455D-AA71-7D7211220834}"=""
"{990E99CC-2254-4A1D-87E3-58AF6B3F61AD}"=""
"{E873BFD7-7762-4E4A-9556-DCAADAE9144F}"=""
"{CCA5B096-6B7C-4E57-AC78-27764E8A1714}"=""
"{5228AF1B-DECA-4096-8C29-1A4C1FD790CF}"=""
"{B3C2CF5F-583C-44DB-A48F-529B66E29154}"=""
"{8BA9EDDB-1E50-4179-A33E-AA615D8140AC}"=""
"{3935D9AD-DA5D-48A6-8B43-959A0792D0C4}"=""
"{3AF2FEA9-C9BB-4D14-BE89-A75EEEA16685}"=""
"{0B6A3B85-AA4E-4752-AF6E-82C13BEA571B}"=""
"{0EF97C3C-D540-4E12-B803-A0A79F3033D2}"=""
"{59122049-9324-4014-8803-7C2771E42B19}"=""
"{5EE06E9E-1EBE-49E8-9A98-9BA88AB928D5}"=""
"{EF9B9205-14B1-4176-B69A-8A69E97BDC46}"=""
"{EB56EC2E-1C8E-4593-BD84-FCFBFBCC20C4}"=""
"{345D4D77-72CE-4FBA-AC63-07B75B21317A}"=""
"{F8A23EC5-CB05-4703-B7BF-83D6DD03357C}"=""
"{F847D344-0C8F-41B9-B41E-62AEFFB98EE4}"=""
"{E5A09936-B52A-4FA5-A0E7-A8195943D2A4}"=""
"{1F5594BC-9370-4847-B109-A89F46556230}"=""
"{7ECED5C4-EF3D-4D4F-B32D-5781E3401A0E}"=""
"{D634DE63-5DD2-4FDB-AC49-02BED3BD35E3}"=""
"{224C3AA8-988D-47B0-8DD8-35B956A7CD8C}"=""
"{8A15F6D2-9C99-4DFA-B481-AADA5108FE3F}"=""
"{2C9D4476-B1AB-4A1A-8286-03DA2E3B3638}"=""
"{1FEA4964-EBB3-49FA-BA84-08A8C8656E09}"=""
"{2DD0DD86-C7D3-4B94-962B-7FB07700BDA2}"=""
"{3364BB51-6FA5-4BB0-8DCB-2F5A0712B6EF}"=""
"{4EB20065-84E8-4152-A321-73917E496630}"=""
"{83BA636A-B4B4-40AA-8E31-7A9ECE91E9E2}"=""
"{EAB0A31C-B08F-4FFF-BCCB-E006830FA2E2}"=""
"{EDA1CAC1-B228-4F6A-9684-A797E015BF52}"=""
"{DF7BB423-BA26-41EB-94A9-7027991BBFAD}"=""
"{57824FE9-39EA-482D-ABDB-CE1E49538C82}"=""
"{3DE065B8-7FE5-4ECC-BBDC-23BEE822D41E}"=""
"{2FB31577-05B5-43C1-A67D-D271D25E89C7}"=""
"{F23BD6A4-7506-4C43-B049-5852B4F7E216}"=""
"{1D6B647F-3834-4980-A087-E1A74502DDAF}"=""
"{141F687D-9188-4756-88A9-5CFD8099ED7C}"=""
"{AFEF28BD-924C-441F-AD5A-9339D90C8EFD}"=""
"{7EA4E340-4C6C-436F-8CC2-6C7DE8C0FFBF}"=""
"{EA71796C-23DB-4DED-B3DB-18A92E4A996C}"=""
"{9BDC057C-416F-49D0-864B-73B485D7E8CC}"=""
"{6CCAAB03-4277-43DC-BD5B-9C967B3EA016}"=""
"{71EF07C0-C848-47AB-BC42-01298BD4314C}"=""
"{BA459E14-17E7-49A3-872D-83CDC058E85C}"=""
"{59EE127F-450D-40D6-B640-B84B65BF97E6}"=""
"{EA5C4294-7831-4F53-A929-7727BE18AE4C}"=""
"{32E283F5-C74A-427D-9418-FBA2BA1D5C0B}"=""
"{587CF99E-6AC4-49AF-8B3F-CEF033618BE9}"=""
"{B78916AE-67EE-45E9-A4E5-24ECB53329E7}"=""
"{EDAA7B12-A4D7-4C75-AF67-5F6E516A19E6}"=""
"{3B03CABD-FE44-4DF9-8308-99915FCCB66A}"=""
"{A8A51671-988A-4BA7-997B-0AD126ACC015}"=""
"{00E7CBDF-34A7-4D5F-8365-930D93499FCA}"=""
"{E49C3512-6085-40BF-976B-65E197F9F2FE}"=""
"{03A87304-F0F3-4636-9D9D-1CABA0D1F40B}"=""
"{1BAFAED5-BA98-4C88-AE58-98C0E8E076FD}"=""
"{62775250-17F4-4C7C-85E8-293BF8262368}"=""
"{B7DC5C7A-19D9-48EF-9F03-1208AA9839FA}"=""
"{61362C7F-3C15-4E11-B382-F0F993CCC5EF}"=""
"{8D1A1C3B-1E80-4A4A-B761-EEEF9A8DF371}"=""
"{7ACBFEE0-C4BD-4C3C-8FA9-0E12BB86CCCD}"=""
"{AC7D945D-C2E1-4AD5-951C-89998CF58000}"=""
"{9B1E5DBD-22EA-414F-9DD8-AB75667150CD}"=""
"{C5664C8F-AEEE-4478-9444-DDCB47409383}"=""
"{6A0779AC-44ED-4AB6-96B6-00326912E2CA}"=""
"{813A1DD9-1398-4806-86ED-288B0D3BAC8D}"=""
"{82D46E86-4E38-46B2-88A0-94E28FE568CD}"=""
"{B19101A9-BF21-488B-82AE-195806C16914}"=""
"{4D2A880D-39D5-4474-827C-493A090636B5}"=""
"{74D1263F-A6E0-470F-B1D9-20BD346393EE}"=""
"{9B6CE826-1E09-4755-B759-1C39BA77D37C}"=""
"{AA3F133F-36C5-44DE-9037-AEBC90B0788C}"=""
"{677EBEDF-DB19-49BC-AA51-9F15411F0993}"=""
"{74C440AF-AB79-49DE-A5DE-520BC3E80828}"=""
"{D9446C13-822D-4DBD-84B4-9F60FE0976FB}"=""
"{EFB41CCB-AFD0-444A-B134-CB476A572AA9}"=""
"{E042CC23-7924-43B3-9BF3-D417970C8A01}"=""
"{0C5E5E02-C81C-46F7-B3C4-BBF1650D891F}"=""
"{09C3D305-6974-4129-AF91-826F09691C76}"=""
"{F90BFAC3-94CE-4E84-A7A6-2E2C6822D06D}"=""
"{BAAEA3FC-46C5-41DE-82AA-E0B272CC5C81}"=""
"{20DBBD50-4F78-4D25-ABCD-CB3E2DFAE344}"=""
"{7A386689-49C4-4C4E-B5BF-6FDB3CDED216}"=""
"{880F16B6-84EC-4B7A-A503-C11CA7A5158B}"=""
"{AD3A8570-538D-400A-943E-A671AF82FBBA}"=""
"{9440F7B0-C829-4277-B898-D0343298A0C6}"=""
"{9A19EF5C-10AB-4283-9B13-9DDAAA97DFA2}"=""
"{F3884D65-8BE6-49E8-8FEA-6346986DD473}"=""
"{D86A7597-002A-449A-8052-32C11F7829AC}"=""
"{4AE6317E-132E-4E89-86FF-DD01DFD82183}"=""
"{FF0505A0-E4CD-4447-8967-CF7E22708CE8}"=""
"{E890EBD1-2BBF-45B8-9233-5F9A16DB485B}"=""
"{B667C9D4-EE3A-4DF1-A51E-DAE3667EF0F0}"=""
"{FB6603A6-6245-4BD8-AC4B-9800900683B9}"=""
"{2FD54A23-AD95-4CC7-961E-B2FC67B3FB73}"=""
"{6CE9203C-4686-49AB-9D54-FD4C378A6232}"=""
"{20195D98-1E7B-4C4E-AF07-7057A3FC0812}"=""
"{CCA1523C-AE11-4DE4-AD67-338656D0AD1D}"=""
"{02F98E6A-19E8-43D1-B268-E3919024745C}"=""
"{EDBC37D5-D7A3-48AB-99A8-E7917717DFFE}"=""
"{2E16AA87-7647-413C-B659-BDA8F541A1A1}"=""
"{23F26591-4FFB-4D03-AD24-06D6F8DF5447}"=""
"{EC6C7E46-A479-4713-ABFD-BA3A20767B77}"=""
"{F7ABB968-69C6-4BEC-B3E9-546298E8A7AE}"=""
"{10BD9369-7489-4C3B-BCD8-B3C674E5A029}"=""
"{22CC9BF4-2AA2-403E-AB27-AEE22F0CC0C9}"=""
"{649C7218-AE8F-4C5D-BEC0-7E10C048649A}"=""
"{47AF02A7-6B66-4D85-A380-0C9222BA9AA8}"=""
"{F56C4F45-D326-4EAB-BC28-C05FB5FF7C15}"=""
"{42C04BCA-4729-4742-A1B0-04989E69BAEE}"=""
"{15205921-E934-4AA6-B1F7-89D7F9ECBF8C}"=""
"{E0BCD730-15F5-48B2-A980-A343A47B60C4}"=""
"{13859C08-6072-46BD-912F-96ABFEA12F26}"=""
"{25643E3C-70A3-4B03-9680-73685BD678BC}"=""
"{99E5BEB0-2F7B-4F10-8CB3-47F79D42CE38}"=""
"{A14C6BBD-D26B-48D1-BB11-1DB58C34C212}"=""
"{0CBECDD8-7CAC-483F-87D8-885C5E1602A3}"=""
"{A2876724-C4E7-46D7-99C6-1A9DFED6F3B3}"=""
"{7FD2BB2A-91CC-47E6-8DF0-ECBC82F39E2E}"=""
"{6D3EE5D7-4C15-499B-9035-A2CA046746C0}"=""
"{3118DAB1-4F15-4A48-9724-26B70666A9E7}"=""
"{13C5D5FE-DE19-4517-84B3-36F3BB0225A5}"=""
"{4CBEAA87-2061-4043-AEB0-C6E868E78F2B}"=""
"{AA3E113D-A9AA-4339-924E-BB6CC156E216}"=""
"{581F3125-8FD6-4BA4-A398-31070B38D0B6}"=""
"{639A8BA9-5CF8-4B4B-B7C3-DD1C5B3D1334}"=""
"{1C81FBF8-CFB7-4203-B9B8-CFF1BEA048E8}"=""
"{EAA3B9A8-75C3-4BD7-BDDB-50234C9CB96A}"=""
"{04E9D891-C7D5-4273-A5BC-C5F6267BB0FC}"=""
"{D315ED5F-49B6-4A7A-8516-257C498A7BB5}"=""
"{F1679F9C-0687-422C-8FFA-32E3EACD9891}"=""
"{E120AAF5-FEE3-45DC-B6BD-C98C5EBCD98A}"=""
"{3BDF21D3-4D20-40D2-996C-4222080FF675}"=""
"{66966EE8-4A15-49C9-A694-C4EC5A6C4BD4}"=""
"{28836244-9758-4456-A1EF-3FE39AA256E1}"=""
"{7F29D1C6-1A1B-4B51-A4B6-04D8D584D6E9}"=""
"{3A854ADE-AD0C-4334-9F5A-71105274B1F5}"=""
"{6A1FCCA5-6553-436D-9C00-F2667DAAC870}"=""
"{D2912439-D077-498E-83D9-307148A05C6A}"=""
"{33D76BCA-BEC0-4C9C-829E-EC1E1BADACC7}"=""
"{EF873895-B482-4ACE-9F6A-0D29A2AE0898}"=""
"{DB9B86D9-5111-4BF8-AC2D-F5F1F5165392}"=""
"{88FD9A03-44D4-4FBD-ACAE-5F2807E54EE3}"=""
"{FC7922F0-8595-490C-A303-0D6032CEC947}"=""
"{02BBDF76-484D-40A2-80BF-06B09244D2EC}"=""
"{AA9083C2-D372-4D03-BCD4-46667186ACA1}"=""
"{0C7DBB2D-84A6-4C21-9AD5-93F68376D5E1}"=""
"{F8DF2498-5A8A-4B00-A64B-B6786DE60969}"=""
"{886509BB-379F-4202-87F7-5C1B8F7F52F6}"=""
"{5A48DEE9-32CE-4C7D-9DC7-43480E64046A}"=""
"{5B22EEAA-32BE-4F41-AA12-E019FED8F4C1}"=""
"{0380A863-660A-44A9-85B9-1160DDA21D02}"=""
"{8BBC7968-C89C-4E31-AB42-DFFD3A3BD16F}"=""
"{56563114-3F4E-41F3-AAD1-659B3D7DF782}"=""
"{6ACC070D-2CB4-49B9-8A3A-E6420D7656CC}"=""
"{3FD5EAD7-8C7D-44E0-8A38-37ECC903D196}"=""
"{0D97F5A4-BEB6-45CC-839A-7F49432447FF}"=""
"{7403E04D-3EB8-4F6A-8451-A037ADB200CB}"=""
"{44072A5B-8565-44D8-8888-B6CBCF7F67D8}"=""
"{896686D4-6BE1-4B31-ABF9-BC494A83C0B7}"=""
"{BB281602-B35A-4CDB-8A7A-181BBE4D9831}"=""
"{A6F70738-BBCC-4C2F-BD77-3B42F53F3A3F}"=""
"{34AF053F-8D01-428B-8B57-178E1E839088}"=""
"{54EF5006-D0A1-4415-AD56-24B8CF4D00AB}"=""
"{DA2B2BCF-6309-4F44-8593-F51D71AE64D3}"=""
"{3A6F03DB-44D2-45F8-94DE-9921FF7963D1}"=""
"{B1BE44D6-6277-437B-98AE-96B9F3950014}"=""
"{B3C91FD9-5C71-47F6-8002-235953D88960}"=""
"{F9E1E8B7-7BF6-4264-968A-8E8BD1DCF611}"=""
"{8554B426-9429-485A-885E-4364806082EB}"=""
"{79A6636B-172F-4C54-B293-E29BA65BA913}"=""
"{544AF4CD-0C31-492A-84EF-9EA32D2B1606}"=""
"{934684B2-6C0C-4AF2-BCAA-734FCCFFAEC3}"=""
"{9FD7C398-E099-483B-AC39-27FDE1ED1176}"=""
"{2BC0A095-7920-4D4F-9E5F-CDF42D730D3C}"=""
"{3B1D5367-DE10-4CF6-9D09-60335D173E9D}"=""
"{15FD32B2-0240-4F51-92DD-FB6339A594B8}"=""
"{2F1F19E3-82D5-40C6-A7B7-815CDDD137ED}"=""
"{26A287BE-457B-4DBD-80E9-8B722B271C36}"=""
"{7866A971-BB01-4B82-B411-C9F27DC2CF63}"=""
"{FE53275D-599B-4CEC-B9E8-F7091F97D64D}"=""
"{400A5BD4-B4FE-45BB-A784-4D5D9BC6FD14}"=""
"{75ACA179-844F-4BBF-B71E-5B53038DE7A3}"=""
"{4328481C-945A-47A1-83A9-1B3E32F164BB}"=""
"{B9648851-9F4C-45C3-98F7-E8ED1370A57B}"=""
"{BA3BD97A-D73B-41ED-8E7C-228ACF1D5C0C}"=""
"{9E1083B6-E4D2-406B-AE03-267AEA259885}"=""
"{C9A63BBA-7A69-4099-8822-C2F0D7909A3D}"=""
"{A0B33ED6-A2F0-4BBC-AB37-B87A7AF3A965}"=""
"{88777007-5E61-46CD-8E9D-EF694B217C17}"=""
"{0596556B-D299-47A3-997C-E006A4B01553}"=""
"{2252452A-B16F-4F56-BA66-FB0DCFB7A76E}"=""
"{1D1DA7D4-0EA9-4837-8062-2F6B2D802E51}"=""
"{23E1960D-11BB-4A4D-9D7F-94A0DC4B77F3}"=""
"{F4516EDE-B5CB-479A-8594-ADAD9482E8B0}"=""
"{BF62118F-06BC-428D-A18F-579B5C13BCEF}"=""
"{B01AAA65-FC89-4A05-AB9D-A2E7FA83ABDE}"=""
"{C6E86507-7AA5-4A10-9EA0-12579AB7E897}"=""
"{8F164C26-E33C-424A-9C61-96B5BD0CA3BA}"=""
"{A0EBB2F7-320D-4D76-A791-F862FA6B7705}"=""
"{F40DCEA6-6100-4253-BA14-76C40AD21B51}"=""
"{6E7C9CF4-A7FD-400B-8226-AAF769B2BB55}"=""
"{8F9693B8-4EB0-4F1E-B0FC-00A9222BBA4B}"=""
"{30815D30-EEB0-443F-A68F-4EE04E1F809E}"=""
"{464AB1E5-FEFA-4F6E-9895-E6680A964561}"=""
"{276518C9-6E04-4B47-852C-4C09E21FB7EB}"=""
"{CB360424-9687-4643-AA75-382912E82896}"=""
"{75A4A19E-F2EF-459F-89F0-3BA6D393FAE0}"=""
"{591302DD-626E-4BE8-BB4D-6AB7B352ECA0}"=""
"{CF0AA755-8BCC-40C7-B53F-7E14BE10026A}"=""
"{0DAF0CE2-D159-44B2-82C6-FFC02EC544B5}"=""
"{90B05A37-46C9-47C0-A6FD-56626C4B4067}"=""
"{57E7B7B9-BA2B-4766-AA56-5ABFAB786EA1}"=""
"{9BE21894-96D4-4BAD-B3EA-97C5B1A5DC51}"=""
"{00B2B320-DBFD-4B85-BBBE-9D1D08A02F45}"=""
"{9FE32AA9-7A08-4161-895E-DDBC17B0BC35}"=""
"{C8FD6817-0AAC-423D-A5A4-D43182479C67}"=""
"{7485738E-8C21-415D-A608-5709F0ADDE78}"=""
"{B3347B46-3D05-4708-A278-23E5DD41FCE5}"=""
"{C0FC0752-14C2-4F34-B7CF-138922D35805}"=""
"{14C48CF4-636C-4388-A412-B62ADFC5E2EA}"=""
"{4DF297A9-D133-46B4-BD94-5BA7B8F016E8}"=""
"{E70E3E9C-1727-4C08-97D3-CF5B03BF99AC}"=""
"{83B97EC6-2CF2-4711-92CA-95A00DD066D3}"=""
"{293235F9-E208-403A-9335-9E062554FD93}"=""
"{54ABA52E-8BF4-4EA2-ADE9-96DA3CA74592}"=""
"{2D7C88BA-1D1C-4042-8A21-D098B07FC519}"=""
"{CCABDF6E-AE74-4CD0-8166-F1E1C93C84C9}"=""
"{6D0016B2-5A9C-4155-8569-5599D59BB01E}"=""
"{1F7CC8A1-3659-4A98-98FA-67B557A00B26}"=""
"{50B33491-CFA5-4841-B1D0-F400009A7BBD}"=""
"{31BC8C20-CB69-4504-B601-8556D1791092}"=""
"{BC3C4A98-C22C-4573-B3E0-056B897CAE6E}"=""
"{82E183B4-733D-4975-88AB-70DF70A8C138}"=""
"{EE55150A-0B92-4DEB-8894-6E845996D1AD}"=""
"{79A3E254-DC56-41D7-8E8F-DE9E25668CB9}"=""
"{697570CC-0CFB-403C-9655-B3B2AF725855}"=""
"{A5419BBD-523E-4001-BEC4-C34E636CDDD4}"=""
"{334735CF-67A9-4593-BAA7-EFC21B95719A}"=""
"{F5FF01AE-0C9E-4BE4-BAB5-57423FDDC17D}"=""
"{B126DFE5-276F-4810-BF90-983322969C38}"=""
"{9EEFFB2E-0B34-49D2-B481-8B80CDB48677}"=""
"{72FCF910-5740-481A-BF6F-87310111FED8}"=""
"{832542E4-AB6A-4725-B473-2EF412996F37}"=""
"{B23E68CD-E756-4D8A-BFCA-3241F2003BC3}"=""
"{F8B777F0-060F-45C1-80A9-06033BE24CC7}"=""
"{22DE7DAC-9F41-4C9E-BAF0-C494666E1496}"=""
"{B06EB8E1-AE1B-4EDE-A10B-89E30B27534C}"=""
"{2EF83CB9-9B5E-47F0-BD48-99B5506E44B7}"=""
"{F5E72D1F-C03E-415B-AD41-61E83E61644D}"=""
"{CC5C3582-7560-4BED-B2C6-505BB1260D5B}"=""
"{6B15C6A3-91D2-487F-BFE1-E463321F0C76}"=""
"{D6DD83D7-4E51-46EA-90E3-0F33D2BEFE8F}"=""
"{ECCEABD9-5014-4768-8C8B-E6E3BD04B5B8}"=""
"{50545A16-62DA-4D14-A59D-2F35F82BB304}"=""
"{391C6965-7ADA-480B-B641-D3988F3B22D9}"=""
"{CA394815-2636-4B59-9E6B-F174528CFAD4}"=""
"{42DD2DD9-E8C6-42F6-84F4-08B93DCC6EEE}"=""
"{A76B8D81-B48C-4F2A-9374-447EE0127F9D}"=""
"{E6B0E968-0608-4822-A445-6047FDDBCBC4}"=""
"{279958FD-9F50-425E-A0BC-91BDCB010456}"=""
"{F67AD677-30E8-4286-B72E-E6EAE7D08F74}"=""
"{B777BA79-7A57-4669-AB76-EE5EE32B381E}"=""
"{105194E7-B2FF-417C-96C1-D658A8E74734}"=""
"{328D44FA-7D4D-42EC-9C94-1D4C1D08245F}"=""
"{1FFB9F76-B1B8-47C3-9CDD-D23C37AEFDF2}"=""
"{2BD47355-B944-42C5-8085-DD4075AED709}"=""
"{69AC0A79-4A51-4A21-A509-A8947E2E891E}"=""
"{EE01B13C-FAB2-4217-81C2-58EDF33C8B5A}"=""
"{1720F47A-517B-4ECC-89AE-7C394DD665DC}"=""
"{B7549BAF-F29C-4021-8E9C-1B76AA1AD3CA}"=""
"{A95A28F1-5C68-4CCF-835F-270E8B44D589}"=""
"{6241D445-FF88-4FC7-A779-A114A99B9E75}"=""
"{83FACFEE-0745-444B-9493-6199B7B1350B}"=""
"{E8EEFE6C-652E-4D45-A442-F4C84929708C}"=""
"{9E2200DA-44FD-4617-9887-1DE496C6FD03}"=""
"{472588EC-A623-4A01-AE9C-BC5B9D0A52DE}"=""
"{F0B4F749-3A43-480A-B343-C8C3610BCC9B}"=""
"{1DDED07D-277F-4CC5-AB5D-616EEAB44711}"=""
"{2A1CE0A1-B4A6-4E71-933E-5D5FEA871B5E}"=""
"{31282C7F-7DF0-491F-AA67-51C8EC7887DE}"=""
"{8E1D8B2B-867C-4C4F-862D-11CAEC2D57C2}"=""
"{83CFCD37-21BF-4022-8873-78E9CAE0536E}"=""
"{693E5B1B-6203-410A-A5CB-17F71BE98BF6}"=""
"{8C3DC262-4ED2-4308-A987-13E2994745B6}"=""
"{B9C3B7FB-B536-4BEE-9CA0-C7945D4ABB48}"=""
"{E1B697EF-078A-4B78-AFC0-A31A9E981643}"=""
"{1C071908-DC87-4F9F-9649-D478E66678D6}"=""
"{31CED9FB-D04E-4946-9009-4637992C2393}"=""
"{9A81EB79-3790-4126-BE28-2DD8194B0DE9}"=""
"{7688B582-24BD-4865-B0BF-E9E9D4328270}"=""
"{666EBECB-013B-43CC-925C-4B6FDE6936CF}"=""
"{3CAAAC3A-F6FE-4AD8-9720-F13DF301C81F}"=""
"{9D32648F-7D44-45EB-9C83-98343B9557F4}"=""
"{31DF1D69-E2C1-451B-AA9B-EC595DEA2428}"=""
"{2F4A66DB-45F0-40B3-92F9-247E9AF16972}"=""
"{C62EE46A-DCE8-414A-895F-97EC85FF7619}"=""
"{98F824FA-44AF-4561-A375-B7C88EA892DF}"=""
"{6693BDE5-0AC9-46E0-AE53-B06497F521F8}"=""
"{B0D4D023-5174-4166-83E5-C330E4C6BB49}"=""
"{4D9F26E6-FA9A-457F-9EDC-98C636F92CB3}"=""
"{5BF8B1F9-A03A-4081-8BE7-8A2565DBC781}"=""
"{B139CE23-4DF3-4793-9A77-42ED10CEF2F8}"=""
"{F651330F-D427-4A78-918F-03F9FE17EBCD}"=""
"{EF486110-209B-4ED6-9315-758481FF7120}"=""
"{387331EB-9E38-461F-921C-F6559DD2351B}"=""
"{2CB23A60-F459-49E6-BD57-6B8844728B9C}"=""
"{E705B748-2661-46EC-A396-DF49D73DF1FE}"=""
"{72CD1842-E83D-4009-85A2-D678E4E77FF0}"=""
"{A29AB084-B175-403F-A479-861A21D7011C}"=""
"{A0D43AE2-AEC8-460B-B163-EBB0A1AB7BFA}"=""
"{45226A73-BBF5-4DA5-A025-054CDB781431}"=""
"{2C087069-15AF-49B9-9B4E-22EAE6DE5D0C}"=""
"{32F5532D-222A-43FD-8E4B-2A75945ACD8E}"=""
"{E7987729-7736-432D-A763-0E8F3C318EAA}"=""
"{E574EB79-A4FB-4130-8F36-8C280D6747A3}"=""
"{B59CEF10-6D7F-4EB9-B55E-8099E662C955}"=""
"{9A103E86-6EE3-4EF9-9869-E3972024BED4}"=""
"{DA530599-1F55-486A-AC1F-201204F9BABC}"=""
"{14CD53C6-30FD-4C8E-9BD2-994AC3B86C3D}"=""
"{C8099882-3968-4C0E-B08F-9DAD36196CEC}"=""
"{854AB662-C7DA-44A2-AD26-4922BD05E7F6}"=""
"{2769736E-90FE-463E-9A84-254557A486D4}"=""
"{A948B123-B090-4BE4-A646-7A34B9223F83}"=""
"{09FE4613-A799-48E6-9A30-3A8491EC3FEE}"=""
"{7EFE77FE-29CD-4914-B749-F1EBAD09182D}"=""
"{072E9542-A9D0-431F-89A8-735B3712DC77}"=""
"{9A32BCC8-D71F-4F98-A7AD-D93154B43970}"=""
"{B87F62DE-A85B-4F0C-AB88-BCB3382F2C51}"=""
"{90001D3E-D357-48B4-964C-4EB6FFA9386D}"=""
"{C66B927E-C376-40FE-95F9-B2D5788E07C6}"=""
"{7E529A0F-4348-4E4C-849F-31B67E47EE40}"=""
"{0DB2CA2E-E7A1-40D1-9C55-324925400DE0}"=""
"{56CB178B-DC53-4CEC-ADC3-85D663A759DD}"=""
"{B553083B-D320-4455-88B9-79723E4C5541}"=""
"{4132F98E-E8C7-42F7-9F8A-542E6063008B}"=""
"{524E18FE-63A2-4C27-9B7F-6E19F2FEF1BD}"=""
"{7209498F-EB81-4D9F-A22A-4375E5063201}"=""
"{68AC3AAB-D2E7-4A30-A1FF-CE59957A67F0}"=""
"{5E508F77-CDBB-4E05-A25E-553980B2D542}"=""
"{1CEACA5A-F289-4F86-BABC-2FF19A4EF6A4}"=""
"{197D848F-CBCE-48D4-B2F8-F37F9FC16F5E}"=""
"{64C162C2-EC54-4D80-8EC3-1D1B5CD968D2}"=""
"{AC2ECE66-BCFC-4183-AA96-32ECDA72951D}"=""
"{B96E41CC-D775-40BB-B880-016327C3E0F7}"=""
"{213958FD-84FE-457C-8968-42A99B38A41A}"=""
"{651C00EE-FDD0-424E-AFCA-F859D3D4F1DE}"=""
"{75E789AF-C99A-443F-A495-F554E7D6D7CC}"=""
"{A0A1E9D0-F367-4D4E-8E67-47E8ABE2C0D2}"=""
"{A1AFEA5A-CE6F-4457-8B5E-F08C69E95056}"=""
"{4F87BAF1-7DA1-4FA1-A993-861FFB162AB1}"=""
"{66B9FDA3-0C99-4A85-B8FA-2517C2732C00}"=""
"{FC64C743-0687-421A-A63F-D36A264E60C1}"=""
"{6450E932-3043-406C-BD32-8E2E83765A07}"=""
"{0063986D-69B7-429B-B8FD-0FC3D3B2EB0F}"=""
"{4B4633AD-A404-4162-A9C8-AE9DFE56C7ED}"=""
"{0289217E-E88C-4F9C-9139-105E5C3A6BFC}"=""
"{DAAFB50C-18A6-4B8C-A6F8-A5AE67F0E6E5}"=""
"{4A287B9E-7BFA-438C-931B-3FE53DAFA2EA}"=""
"{36166692-CEE1-4128-9C10-2BDA4C281AE9}"=""
"{20E0E5F0-DE04-453E-88FC-21FCE2567BA3}"=""
"{E62BFFFC-C3E1-4671-884F-C1EA0FDB2A5F}"=""
"{B5FA42A0-DCFE-4E03-883E-196191DDE06F}"=""
"{F53F7CC6-31F2-4795-AE2C-E25815FE05FE}"=""
"{0CDD0FF9-28C6-498D-9FDA-C06E38DA0B4E}"=""
"{C3F463D1-F606-407D-BDB5-38CB9D1956A1}"=""
"{B7E45B0A-E3C0-41E7-8BC9-E24D8006DF15}"=""
"{D8333C6A-03E0-4720-BB6A-DB263ED6E5C0}"=""
"{9AAFD447-0382-4782-88F5-B13710244110}"=""
"{21482A52-90C5-4D09-B363-0DD9E9B12B3C}"=""
"{62B7D8A9-D2AE-461A-9780-350FE5480627}"=""
"{B5C7E9CA-57E7-4577-9737-8A8D0C5B164D}"=""
"{791BEA0A-8BDC-4980-BA98-6059B19149AC}"=""
"{4B50BDE1-7740-43F7-98DC-23E680F0F07C}"=""
"{B54D99F8-A2B7-47B1-ACD2-CDF1374E14F5}"=""
"{98022805-C1C0-47AD-A4B8-63A0E94F6D5D}"=""
"{8C84D15F-B0EB-4B18-B87E-8EE80AC45D6C}"=""
"{EC25EE2E-8D01-4AD1-B7BC-AFB7D5FA238F}"=""
"{71DD013D-9DB9-433E-AF4D-C001D544AD99}"=""
"{E89B1B3E-3F81-4CB0-85BB-A6068039F6E7}"=""
"{D9A0320F-6F7E-447B-8D6E-F70E7B62DC8D}"=""
"{FECA472F-37C1-4DDF-8042-502DB7480869}"=""
"{653BA6F8-A609-476E-BE6D-C135D02A2AF6}"=""
"{BB098E10-2CFD-4D3D-A60E-EF610EA55D1D}"=""
"{5EC91E07-5110-4701-8C85-449A298E11F9}"=""
"{88EBA200-8B6F-4A0E-BB6F-C0B0D533F4AD}"=""
"{A85C709C-FE5F-47ED-BFA7-D0719FBB35E0}"=""
"{504B0A5F-5274-4DA1-81C0-0BAA8344E4AD}"=""
"{6D91673A-D9FD-41B4-9C5E-4E6B46D25E21}"=""
"{D8D3739D-BFFC-4F31-8585-B767469BEC1D}"=""
"{4AD2C005-1BA2-4C29-A40D-F54DEBB242E1}"=""
"{FB9F26CD-CF33-44CE-AFD8-B7555328E426}"=""
"{1A0F004D-3000-4976-A065-0F8181CA021E}"=""
"{74527476-C741-4C1B-B838-303FE8600108}"=""
"{A10F7A68-A3EB-4493-83B3-76DB62D92A97}"=""
"{4E83DF32-DEFE-454F-968B-1F24E94AAE65}"=""
"{2F21CF9A-3322-4FDA-8439-C53079870BBD}"=""
"{57A1E81B-70BF-4A53-9176-C92C99B9CA8F}"=""
"{91E8E855-A301-4743-9F02-BC877464F2CE}"=""
"{5ACAB073-5FB3-45D9-8AC7-3D51FA67941A}"=""
"{F2EE5559-AE8E-436F-846B-0C483FF7A460}"=""
"{15492480-7F6C-415B-A7A0-0C7B05BCFB73}"=""
"{2A755E5E-9F31-47E9-BCA5-CFB472F5150B}"=""
"{303A0F04-C09C-46E1-96C1-717D81DAB9E5}"=""
"{AD1EE05F-D6C7-4BF8-ABA9-6442F3EB9ED0}"=""
"{6B07415C-F45B-44F7-9EEA-EA5452597BA3}"=""
"{61AAE30F-30B0-4963-9666-2842AAFE2D5D}"=""
"{2822D266-9E21-4E1F-9AA7-79BC06605161}"=""
"{9E47DDBC-232C-4714-95EE-67769837E759}"=""
"{EFD61BAB-1DB5-426D-A117-11763186771E}"=""
"{1237730A-4560-45EB-AEAF-1C777B99D01D}"=""
"{208B6A69-4831-42AD-9F75-82B5F0EB9488}"=""
"{D0B348F1-CEE4-42A8-AF99-361E0B839150}"=""
"{96710C42-0DD1-431F-97C5-768C98BB630E}"=""
"{8CDD8605-B867-4E67-99B1-40533B05F233}"=""
"{318CE923-D2F1-4A2D-BD40-3219F896FE24}"=""
"{7B38A55B-E337-47AA-BE75-8A83DAD0B389}"=""
"{D5AD1D87-3319-48E6-B139-2E4B396AE837}"=""
"{97BAA74C-19D7-47E5-9E99-FBC33AFED42E}"=""
"{BE0BF049-B1BB-435C-B89F-CC3B502E38FA}"=""
"{07933A0C-8EE9-434F-B066-C9439DE86E59}"=""
"{8272CB86-9D94-4EC0-8281-B6323C7D8A36}"=""
"{ED594799-41CE-46FC-A2E5-EB8C302F9C95}"=""
"{2D84EEB7-559A-42BD-9D5A-391C0E0BE54F}"=""
"{D1F89110-6540-44C4-9A66-76D0B236E457}"=""
"{DEC1BCC1-C1A6-4508-B16B-0EF6D23105B2}"=""
"{D5238D61-B67D-4FC0-AB09-304C4F031182}"=""
"{F64EBFEA-45F1-432A-9527-146DECFE52A3}"=""
"{38FE14DD-6D35-49B5-A0B0-974F6A638CF2}"=""
"{6C6269B1-E8F2-4B5D-A5D1-654612B97F5C}"=""
"{B2A9BFAD-338A-4EDE-A7DE-CFB35B9DA344}"=""
"{7ABFCD46-25AA-4E62-95F1-22ECACFB1465}"=""
"{DAC42830-0C89-4DB3-82A1-DE24B226EF75}"=""
"{6FB8A702-4B77-4621-8811-9502C8B4F07E}"=""
"{60A273E3-6218-41F0-8AA9-D17D585AE4CF}"=""
"{454A7EF6-7C5B-4A24-B03E-89843CAAF27B}"=""
"{A554C856-443D-4AC7-B6E9-1740F527486B}"=""
"{23EFEF5A-18B6-4E5D-B25C-741D1082619C}"=""
"{0DFE271F-CCD4-47FD-B81C-E7DF4053B7E4}"=""
"{F965FEF2-AFF2-49DD-969A-1F9071EDED99}"=""
"{A8DD8DBE-5BAF-43DB-8614-7579EDE11A6C}"=""
"{FB4D63A5-3E4A-4FAE-BDBD-79F792844ABD}"=""
"{FC918E21-3E67-4E42-89C3-43E5D23FA63A}"=""
"{80F420E4-60CD-44AC-A91D-A1A8E8B9790A}"=""
"{C177A912-8AE9-45E1-AF7F-DE83D56D4E19}"=""
"{A5A47C03-0374-4B96-83E9-BED76D1839D1}"=""
"{0050112E-757D-4E8B-9190-7B97CF83CA86}"=""
"{F5F57C46-CDB8-40F6-AFD1-FED77D30BB72}"=""
"{B6D33520-5F01-4353-AE6B-C83B507F0515}"=""
"{3F8A2002-2317-4DD8-A51C-ABFBC90B59FC}"=""
"{1BD742AA-CC82-41E3-B0DA-3A5BD110839E}"=""
"{C21405B1-34B3-47E8-BD8F-D0E3B8083CE7}"=""
"{E8C6B3C5-F9E2-4B27-ADEF-325D8BD927CD}"=""
"{05BA9660-9964-412B-93E4-91C251D55F74}"=""
"{6715FB1B-55A4-4D8E-A777-94D48CFED528}"=""
"{8E171A40-7E3F-42F0-A481-8A5ED05B69C3}"=""
"{D1EA949B-2E8A-4266-ADD7-8A022B699901}"=""
"{8B40D5C7-D48C-4E8B-B357-E2A3F6356398}"=""
"{77D7FB01-74ED-443D-BACB-751D4C19FE13}"=""
"{193B033D-4E2C-465E-BAAF-D05CC718BFBD}"=""
"{DC82A485-8146-41F3-9580-BC3A9CBEA50A}"=""
"{01E96C95-179E-46A9-A62E-3A7381CB7154}"=""
"{F62B69E2-F9F0-44C8-B57B-07EEED76DF13}"=""
"{CF18914B-7EBB-4554-AC15-8D029726FD15}"=""
"{51BA7A02-195B-4F78-A5B5-38E80935CEEA}"=""
"{EF313835-920D-4A61-AADD-76DD50223BCE}"=""
"{B4052667-1851-4BF1-B4DF-D51BD374EF56}"=""
"{E17370B5-784C-4EE8-8D97-40A1DD581FD6}"=""
"{3F8A1DF7-E851-4418-939C-23180A1DE46E}"=""
"{38A9F184-40CB-4BFD-BEC0-E19FB7CB72A9}"=""
"{6374B33F-C4C9-46E6-B93F-6F00EB6703B4}"=""
"{1F82BFB3-BF2A-4CF8-8441-131655F3B8FC}"=""
"{BEB5A30B-DE97-4FB4-A6CA-4299A8BF6B9F}"=""
"{024BFC21-B0A0-42BE-AA63-134D41B8494F}"=""
"{09FC3BF8-3EF8-4B54-9B0F-08C750116A09}"=""
"{7CD2C2F7-F9EF-47A5-9640-FD28DB44F35B}"=""
"{DEBA16EB-F66B-4364-BD21-2C086685080C}"=""
"{AE8CB7F9-2BB3-4C04-8163-A7F4A99C9BAB}"=""
"{4CB36723-F8DC-4BA5-A61C-D8B01C5D27EF}"=""
"{D63F9108-731A-4767-B1A7-B7E5A1B400DB}"=""
"{85D77B6B-D31F-47F5-A34B-3087D5234856}"=""
"{E66CCE3F-D5B4-4B49-AC05-78CA87FB5077}"=""
"{B5905B5C-CF49-44F1-89D0-763CD60B71D6}"=""
"{256C84B0-5DA3-4598-9530-FD4EFDB6625E}"=""
"{C0F2BDEC-051F-4BA3-9198-AE0BF0A8D78B}"=""
"{323AF127-C446-4957-A3C1-A619CB2375DC}"=""
"{525F1964-8FA5-49EC-991C-CDE89BAA095F}"=""
"{2DCEC33B-60B7-4DDA-B54A-9A1D864CEBFB}"=""
"{340DC79E-43E7-476C-8ACA-64C680F7A79D}"=""
"{06DDFA38-ADB0-49AE-8E79-4C5FA89D3CA9}"=""
"{CB2E9E97-B001-4521-9A31-5A57834E4E17}"=""
"{C280891C-9BE9-4E5E-B40E-A90DFC09847C}"=""
"{3F6FFF8A-8311-4876-95EE-B24088481D6B}"=""
"{8FC183DD-5F42-47BC-9BB6-B941A3089E77}"=""
"{F589B719-11EB-469E-B576-2873BDAD281E}"=""
"{7C305848-2547-4462-8BDF-2EBBB1A10B97}"=""
"{A01EADB7-79ED-48BC-87F6-AAABAE1A0C00}"=""
"{9DB927DE-7B4E-4B90-8E06-208416352550}"=""
"{F526DBE8-10A4-4C12-BAD7-9AEC9856DB4E}"=""
"{3F287E92-439E-4879-8F14-5BC88CAACA9F}"=""
"{0079EEF0-6EB6-4F4D-AB52-2BF67F069B2A}"=""
"{C53821D1-42F3-4249-8D2A-943567A8A646}"=""
"{015CAFDE-37F1-49B4-B0F1-3F115040CCBF}"=""
"{1A610A62-7063-4C22-82F9-6E37F6DB1F24}"=""
"{D778374F-25FC-4635-9727-3296FE295C18}"=""
"{5D60A6F1-2262-4FA9-A081-49E32E5B2780}"=""
"{5197657A-8E6C-462C-BDCA-612640832F5B}"=""
"{34E83D85-B72B-48AC-A472-9C770194C154}"=""
"{90FF1ED0-F46A-47C9-8091-B782BCFD6992}"=""
"{741E4C8E-4CA5-4455-81E1-C2EF1299FD58}"=""
"{73041C7F-2BFE-4DA0-B56D-F100F891D746}"=""
"{03640DD0-D9B1-481B-B236-D0795E128EEB}"=""
"{8DB9F0FD-1A4D-44FD-AE43-00421B015681}"=""
"{8BC4010E-0B57-40B9-8A47-89F0EA6085CC}"=""
"{9552699A-C8E6-4C06-B937-FB7AAE41C70B}"=""
"{0A1EBDA4-B7D3-4ABA-92B3-EAC0C896B909}"=""
"{9863EAFA-264C-4090-A14E-EA989B64ADF3}"=""
"{03070663-7BD4-409A-A221-BD0FF6DF20C1}"=""
"{8E600CB2-AC26-4746-826F-6E744CBE5FB4}"=""
"{EA125418-E7EF-4715-A758-A243E760B1D3}"=""
"{7BAB4439-D835-4069-872D-4E5821919C1B}"=""
"{C0F4E552-A0E6-4C56-B62C-82C0DEC07619}"=""
"{D865A62D-B78A-4605-B7DD-E3539AD688E7}"=""
"{5AA68F08-80AD-4D83-B250-A84DBA869295}"=""
"{E91E210C-B5FD-492B-9AA7-9078DDC149CB}"=""
"{FDCE218B-58D8-4653-942D-0F070EBCD21A}"=""
"{4B41DD47-5A1A-416D-AF53-53BD6508F59E}"=""
"{3F575F38-86E0-409F-9A59-533836FC161B}"=""
"{E36A6918-01DB-45CD-8259-C8035958A735}"=""
"{256551AE-AADE-4587-9D72-8113DAEDFE1E}"=""
"{2832A631-A578-4C03-8DF1-FBF68E2E12E2}"=""
"{FEB0FF13-EBCB-48D5-A442-3B0F8DF55AD4}"=""
"{9A104D68-975A-4621-BF3A-3C08D0B21F13}"=""
"{24539CC4-97E1-4AA8-8B7F-62BD007DAFDE}"=""
"{CB95BA2B-1ADE-49F0-8253-F40DDFEC9C42}"=""
"{AEC99A30-5167-4E32-ACB4-1800A09BC90A}"=""
"{1CE01BA8-AB19-4DA4-B0DB-90D57134141D}"=""
"{0F558B94-E501-43F0-97A8-CB0D4EBD0B2D}"=""
"{E9CC50B0-8DB4-4E2E-A9DC-536AEFA0F459}"=""
"{133CC52B-2D91-4414-A4D8-436FD07D54AF}"=""
"{60190934-4F08-469B-9079-822FD016068F}"=""
"{448760AA-2DF2-4F46-AE22-F285D2B743F8}"=""
"{19A7BA76-CC4C-42D1-8C60-318BD8B7C1EE}"=""
"{58AF2175-02BB-4A76-B0FD-DE936B5D7891}"=""
"{F73FF468-4CCC-42CB-911C-DED9C0E53901}"=""
"{81304CF0-6B6F-411C-98C0-B5FE43C53023}"=""
"{E4193972-DCBA-4D38-B701-450C6F6F6C3E}"=""
"{91AF7854-34FB-43C7-A5F0-E012451743C8}"=""
"{16186F96-7DC7-4A80-82E8-7DC0E928EE79}"=""
"{08CB3D3A-A19F-4C9B-A7E3-2F58BBCBD2DC}"=""
"{707225E8-4E5E-448D-905B-7ECE60794A45}"=""
.
[HKEY_USERS\S-1-5-21-1085031214-436374069-854245398-500\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=hex:51,66,7a,6c,4c,1d,3b,1b,f3,f0,f9,
6e,2b,38,25,0f,86,d8,b9,f0,99,0b,0a,d5
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,3b,1b,22,a2,8b,
fe,c9,92,be,5d,97,25,46,d0,23,5d,0c,97
"{FE063DB9-4EC0-403E-8DD8-394C54984B2C}"=hex:51,66,7a,6c,4c,1d,3b,1b,a9,22,14,
ef,f2,1d,52,0c,93,d2,7f,0c,50,d8,08,33
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,3b,1b,a1,dd,0a,
32,57,1a,b8,5d,85,12,46,d0,23,e5,8e,50
"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,3b,1b,28,92,55,
13,cb,90,97,02,85,5b,30,d5,e8,e0,15,6f
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,3b,1b,0c,17,cd,
09,9f,bb,ef,0e,bb,9c,bc,17,88,6e,fe,dc
"{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}"=hex:51,66,7a,6c,4c,1d,3b,1b,1e,c4,38,
71,cd,19,7b,0e,94,ab,d3,9a,c0,9f,e7,17
"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,3b,1b,94,f3,41,
7c,9c,39,eb,0b,b0,e4,b2,22,8b,41,42,13
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,3b,1b,48,f2,4a,
bb,ef,52,fd,01,9d,39,89,50,53,34,30,e8
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,3b,1b,25,b7,e1,
a5,13,5d,35,05,a4,28,04,f3,04,ce,41,e0
"{C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F}"=hex:51,66,7a,6c,4c,1d,3b,1b,a6,61,c2,
d4,fc,e8,c2,01,b2,b1,97,7a,89,68,88,00
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,54,1f,da,
ca,77,f7,37,0f,a2,7e,da,65,c5,85,cb,b6
"{FE063DB1-4EC0-403E-8DD8-394C54984B2C}"=hex:51,66,7a,6c,4c,1d,3b,1b,a1,22,14,
ef,f2,1d,52,0c,93,d2,7f,0c,50,d8,08,33
"{32004B8A-44A9-43E7-84E9-808838809519}"=hex:51,66,7a,6c,4c,1d,3b,1b,9a,54,12,
23,9b,17,8b,0f,9a,e3,c6,c8,3c,c0,d6,06
.
[HKEY_USERS\S-1-5-21-1085031214-436374069-854245398-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (Administrator)"Timestamp"=hex:66,ff,3b,86,ae,39,cc,01
.
[HKEY_USERS\S-1-5-21-1085031214-436374069-854245398-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8a,8c,3c,aa,d3,e4,69,4d,a8,38,bd,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8a,8c,3c,aa,d3,e4,69,4d,a8,38,bd,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8a,8c,3c,aa,d3,e4,69,4d,a8,38,bd,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Common Client\ccIPC]
@Denied: (C D) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Common Client\ccIPC\Channels]
@Denied: (C D) (Everyone)
"ccSvcHst_UserSession_1036"="{FA5137A0-1DB4-4107-A01D-8155BD7DDE46}"
"ccSvcHst_UserSession_3976"="{A3F3D5F2-D879-4326-AE62-223ED9D799BC}"
"ccSvcHst_UserSession_2616"="{4AF50CFA-6C75-4C7A-A8C2-8CCB7964F6D5}"
"ccSvcHst_UserSession_2036"="{3C688F8F-A938-425D-AE97-10817070C09C}"
"ccSvcHst_UserSession_4912"="{021968BC-D466-4C99-9F6B-F9C0C924F462}"
"ccSvcHst_UserSession_3332"="{DCA97691-4405-4755-8416-B7CD26045D80}"
"ccSvcHst_UserSession_3040"="{59F55D05-2C38-4420-B6A6-7FB8694E5B0E}"
"ccSvcHst_UserSession_2764"="{7AD73939-3122-4A01-85BA-B464B893D043}"
"ccSvcHst_UserSession_2868"="{DC5ACD03-FDBB-4714-8C14-9ECBACFA6944}"
"ccSvcHst_UserSession_2804"="{D64A6E86-441E-40C4-9619-B12938097EB1}"
"g_coUserCommandChannel"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"ccSvcHst_UserSession_3048"="{794D8046-9170-42FC-B794-8FE125810D3B}"
"ccSvcHst_UserSession_5844"="{AC25E6E0-3ECA-4CAD-9298-E31823FA6C45}"
"ccSvcHst_UserSession_2856"="{E1B0C5E7-9F56-462D-A6A7-68CBEB52FB25}"
"ccSvcHst_UserSession_2776"="{B79C65A1-8001-4CFE-8B40-F4E69567563E}"
"ccSvcHst_UserSession_3072"="{CACC76BF-7D2E-43B4-AA29-FB50DA062450}"
"ccSvcHst_UserSession_2780"="{2C1B0592-0667-458F-ACA5-2933808D5ED9}"
"ccSvcHst_UserSession_2928"="{A770827F-8785-44B4-84DE-9A553BCDB304}"
"ccSvcHst_NIS"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"g_coVistaProxyChannel"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ncw_reputation_scan_server_IPC"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ccSvcHst_UserSession_3920"="{421D1C3D-1033-4F41-8981-08903098DF8E}"
"ccSvcHst_UserSession_5976"="{69FA5E18-FE0E-41CB-A385-2C546B6DD317}"
"ccSvcHst_UserSession_2964"="{63ABADC8-43C4-4EAE-A85E-368DD33FACE8}"
"ccSvcHst_UserSession_2196"="{E935A96B-8556-41DA-BF08-7D90CC317714}"
"ccSvcHst_UserSession_3904"="{92AAA98B-6AB2-433B-A08D-31AC2FC4DD8A}"
"ccSvcHst_UserSession_3016"="{7E9BF4E0-B04C-4883-932B-CF15462C83EB}"
"ccSvcHst_UserSession_3844"="{C34123BC-8472-446D-9761-2D62F51BCCEB}"
"DING_{4467AB8F-68C8-4ab5-9B48-B3E6EB65F6A1}"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ccSettingsService"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ccGenericEvent_Global_EM"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ccGenericEvent_Global_LM"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ccGenericLog_Manager"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ccJobMgr_general_{ABD582DE-8F75-412d-81CF-6A180F1203DD}"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ccJobMgr_session_{ABD582DE-8F75-412d-81CF-6A180F1203DD}"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"{3F11C6A7-CEA8-40c9-88EE-E5461341AE97}_ccSubmissionEngineIPC"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"SNDServiceRequestChannel"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"{A2DE0E79-877C-485b-B604-78B170313E9E}_IronIPC"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"SymRedirSvcRequestChannel"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"NortonNetServiceIPC"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"SNDLocationChannel"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"NetMapServiceIPC"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"_isDataPrComm_"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ncw_performance_IPC"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"_NCWSvcComm_NortonCommunityWatchConfiguration"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"_ProcessDetection_"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"isError_Service_IPC"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"BashIPCChannel"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"_HSPlayerCommand_"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"{C4A09495-F6BC-4166-B717-F3F3250462BB}"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"FWAlert"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"_AvProdSvcComm_"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ipcChannel_ShastaServer"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"IPS_COMMAND_CHANNEL"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"_ReputationSvcComm_ReputationPublisher"="{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"
"ccSvcHst_UserSession_3924"="{69DD5D3D-0FD0-4C78-9ACD-C9785614C5BD}"
"ccSvcHst_UserSession_2820"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"{B44E7D73-F081-414B-ADD2-CD66675A190D}1"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"{9BBA000F-092F-432f-B9DF-9D64FD1C2978}"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"AvProdSession_01"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"AvProdSession_Options_01"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"clt::AlertChannel2_01"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"AvProdSession_MessageCenter_01"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"AvProdSession_Scanless_01"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"AvProdSession_IPUA_01"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"AvProdSession_CanIRun_01"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"TRUSTCHANNEL"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"SDKCHANNEL1"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"ToasterNotify\\SessionID_1"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"AccountServices_1"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"FormHandler_1"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
"{436E95FE-192E-469f-8F34-5038FBA89BF4}1"="{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Common Client\ccIPC\Endpoints]
@Denied: (C D) (Everyone)
"{A7B5E91D-BC6E-4580-958F-D8C248B2CDF6}"=""
"{FA5137A0-1DB4-4107-A01D-8155BD7DDE46}"=""
"{8F70614C-36DC-400F-9293-A7DC6D477241}"=""
"{AEBAC34C-F62A-45CA-98B8-771B7CEAE1B5}"=""
"{F72D95BD-8008-4980-8184-03D0369D39D4}"=""
"{4E6BBE6F-9329-4DD5-8D03-9E5E884FFA91}"=""
"{A1AE5EC0-CCF2-46C3-B20C-984B72E8CEDE}"=""
"{2A2E1427-89D4-4B8F-B589-27ADF3392084}"=""
"{3870B3F8-254C-4F65-BC9B-3491128F6C1C}"=""
"{07D61698-4ED0-4602-A255-89046C1E756A}"=""
"{B8F14D3F-0596-453F-B441-3EAE6F9937F5}"=""
"{1AAA0AF5-9EFF-41AF-A734-18D3BDB7A2A7}"=""
"{4B231E96-83CF-4B9E-93F8-284F1B4401BB}"=""
"{736D72B1-B389-42E0-94F3-E91732AB2172}"=""
"{5CFF9D1B-3D6D-4BC4-A9F9-67B8C7D6A471}"=""
"{A2E58CD5-8617-420E-AC19-0EBCD2A5A32C}"=""
"{0A61F0CA-E8A4-439D-A4B5-81908C817C44}"=""
"{39851D92-7FAD-4FDF-9ADC-77B7E9C9F9FC}"=""
"{4DA96C04-7E18-4454-8EA3-B52681DF925A}"=""
"{02EC3909-D9D2-49B2-8F10-C28818B0BF37}"=""
"{FDA5626C-E075-43B3-B507-2215F5B4298E}"=""
"{303910EC-8102-4BE2-BF17-00B60D1C4870}"=""
"{1A612465-8417-4A44-916B-30AF5866A0E7}"=""
"{4B1008AB-6170-4806-97F3-B7AEDF0313CE}"=""
"{2C06EF18-B200-43EA-9071-9ECDD58A8556}"=""
"{FFE762B7-69FD-4CE0-91B5-1B1473BC998E}"=""
"{9CF60CDB-CDFC-4FCC-9516-057FE7A10AAE}"=""
"{CAAB41EF-51B7-44E0-AB95-327D1A792B8F}"=""
"{4612FB68-B403-44DA-A429-BB4A8A2D6DF9}"=""
"{19E7707F-266D-446D-8F37-3361E6F46522}"=""
"{E1EB7EFA-E25F-4D59-A6F1-BE72386FA02A}"=""
"{362775E1-A9D2-4C27-842F-F18E390AED0F}"=""
"{5D4C20FC-2FFA-4D8E-9530-550B40D0F14B}"=""
"{62719EED-177E-48C8-B0EE-8B88D99CBC6B}"=""
"{9C8EFDCC-F873-4254-95D7-885174DCF447}"=""
"{312E96E9-F6C0-48F4-B3D4-C3155EB6AE0F}"=""
"{515CE175-D004-4527-94F3-629007E68170}"=""
"{6AD9F93D-9EC1-41B3-975B-52387887CC60}"=""
"{A788C480-C9F5-4C41-9793-B04BE8A7DDC8}"=""
"{A3F3D5F2-D879-4326-AE62-223ED9D799BC}"=""
"{7395A378-A0B1-4C41-B69B-8FDB8BF54DDC}"=""
"{4AF50CFA-6C75-4C7A-A8C2-8CCB7964F6D5}"=""
"{F0907AC5-9147-4C7C-ABCE-D63E2E719641}"=""
"{2F80EA03-21B7-491D-A221-D073DFB048A8}"=""
"{EB66FA39-8B36-4F14-A582-78066D30F113}"=""
"{ECE81F80-C97D-464F-8AAA-9A9D7EE6659B}"=""
"{C76C1FC5-75FC-42AB-BC23-6929F3D69A59}"=""
"{D5B2F8FC-FDDD-484D-B997-3F0D0D17F8D1}"=""
"{29ADEA7E-D140-4156-8376-1822CD9EEF8B}"=""
"{014610D8-CCB2-406D-96E7-7BE25FAECA7E}"=""
"{3C688F8F-A938-425D-AE97-10817070C09C}"=""
"{D94E344E-5614-46C3-B639-9D12333C332E}"=""
"{3587A6CC-4F92-4F7A-9A2A-CE7576567940}"=""
"{DEDBE303-02C8-4306-B91C-9D13B36F9CAD}"=""
"{25462EF1-9271-4844-A9FE-503C1B3056C5}"=""
"{1B2AA23E-E30A-41E4-9A04-AE4E00A8EDDB}"=""
"{8894D3E8-920A-4A53-B5D3-F5AB4041CFD2}"=""
"{90533D81-0586-41ED-87B5-EB919B26D2AD}"=""
"{616F7A39-752E-483F-88DA-353EE470A5AB}"=""
"{60B6D6A0-43D3-479C-855C-5FBBDE1D1B6A}"=""
"{13A65961-0D6E-4B81-85E8-ABD2B06346C5}"=""
"{8E06AD6F-CE29-4557-BDE5-F9783862F5E7}"=""
"{5DFF9BD6-C8FC-42A1-9D49-AFCD5530F7E5}"=""
"{1F723590-D7BE-4233-B77A-58FA3EF665EB}"=""
"{021968BC-D466-4C99-9F6B-F9C0C924F462}"=""
"{2EA75250-EE22-458A-B44B-C32122B43122}"=""
"{4C4A9C66-9247-41F1-B753-FB8F0DFA1CEA}"=""
"{DD8323E4-262D-4270-8372-16D2D90F3AC6}"=""
"{BC5E4634-990E-4A23-ADB6-1C6C2F3F107E}"=""
"{EEB19C5E-5591-4D25-B20B-A085CF952737}"=""
"{AA94506C-4657-4C8D-AECF-15DFC3FD0ECC}"=""
"{9B7ADE36-AA45-48EB-A34C-AB3AEB61B851}"=""
"{0F18ACCE-31B2-4E99-BAA1-433902E1B1E1}"=""
"{DCA97691-4405-4755-8416-B7CD26045D80}"=""
"{B5F283D5-4957-4BBF-BFFB-04DD9C66B4EA}"=""
"{59F55D05-2C38-4420-B6A6-7FB8694E5B0E}"=""
"{9BE7BA85-9E48-43C7-9A95-7924FFCCF682}"=""
"{44043215-6836-4EC2-9210-41ED7449744A}"=""
"{E7E1265F-D7B2-4E68-85B0-45E0CD6D1ECA}"=""
"{E705D2BF-86C5-4E43-85F1-4FA4A3B9BAE4}"=""
"{89B3E23D-17B1-4649-BDDC-6B0456F463AE}"=""
"{7AD73939-3122-4A01-85BA-B464B893D043}"=""
"{A3218911-7FEC-49CC-A29F-E350CF06FE84}"=""
"{9A51F579-E074-457A-A72C-6421A7350C0C}"=""
"{EF9F8918-31BC-4D2B-ADD6-1E20867D9C5F}"=""
"{DC5ACD03-FDBB-4714-8C14-9ECBACFA6944}"=""
"{E641805F-9C23-4B0A-B09D-E687B337E9B5}"=""
"{D64A6E86-441E-40C4-9619-B12938097EB1}"=""
"{DC0C90A3-6E26-4C2A-B5B5-8F720B22E769}"=""
"{2C069ED4-3CF5-4469-9CCA-3642E92CD87B}"=""
"{D45BEA52-B4B9-494D-81CC-68573513F7B5}"=""
"{EFE2C7BB-7D59-4F88-92AE-E13444E25977}"=""
"{1A989CAB-70FA-48AD-824C-AD1C5D13261F}"=""
"{4DDF7F4A-E281-4169-806F-4B5249B0B4D7}"=""
"{FE58D1AF-671A-4EDB-96EA-D1D1D39DE186}"=""
"{898625CF-3FAB-47F1-B322-46F7EEF7A4E9}"=""
"{11F85602-B427-4588-9BBA-CC6B514C08CF}"=""
"{53EEF50D-657E-49DC-806A-CB51EB544DA1}"=""
"{0183532B-B8A6-43EB-96C3-89C2FA8B83AE}"=""
"{9E70587D-A2DB-4F2D-851C-A018D6CBFA64}"=""
"{794D8046-9170-42FC-B794-8FE125810D3B}"=""
"{E5B0114F-F2A8-4877-A616-44879C83FDBA}"=""
"{36BC4384-8EFC-4741-A0CE-2C1447EE7A75}"=""
"{E593FD2C-D1ED-45EA-A159-EF1E3E929808}"=""
"{AC25E6E0-3ECA-4CAD-9298-E31823FA6C45}"=""
"{47C2085C-75BC-4C48-8169-73AC4F4EC42A}"=""
"{E1B0C5E7-9F56-462D-A6A7-68CBEB52FB25}"=""
"{D6054818-F7F3-4079-B7C8-A6FF4B051260}"=""
"{CF4777B1-68F1-41D3-BC6F-C6A92BC23BE2}"=""
"{E29D875D-FF78-4ED5-BC03-40333D360CF3}"=""
"{D14167DF-EB2E-4CF1-B987-77DCB11D89FE}"=""
"{97F66A82-FD9C-40EA-91B6-95052EBDBB63}"=""
"{B79C65A1-8001-4CFE-8B40-F4E69567563E}"=""
"{34BC744A-7B66-44C3-B999-24FD7BA6709A}"=""
"{F47BFF6F-506F-4455-B341-FF5C9503B69E}"=""
"{095009F8-36F6-40F7-AD14-EDDCD3D4C0C3}"=""
"{91C35ED2-C133-4059-9176-8C78873E03FC}"=""
"{5926B2EA-1E0C-4322-9AEC-40117BA12F6B}"=""
"{5E0C117F-4F1B-433B-8A9D-2A69C7CCD6DC}"=""
"{CF8D22A4-F2D1-4E15-A155-4AC4B447906B}"=""
"{0F6592F8-56F5-40B1-BC2B-DD4E810DA377}"=""
"{C5189C05-513B-4F12-AD24-AE7AF5DB64E0}"=""
"{74B9ECB9-12F5-45A6-BF9C-C72F889B5823}"=""
"{CACC76BF-7D2E-43B4-AA29-FB50DA062450}"=""
"{079B4577-9455-4B97-BEE6-9FE92F53003C}"=""
"{DD8757D3-6843-4835-8CB2-095C5CF67682}"=""
"{3E4A0C7C-2BC0-46AB-87FC-5B447BA424D6}"=""
"{09C164F4-15DE-411C-98CC-29FEAEB14052}"=""
"{1A5821D4-CE08-430D-9082-6FFFDABE2165}"=""
"{9872F204-448D-44B3-982E-D7313C7C65C5}"=""
"{3D459388-1095-4956-A1A5-6D5C800EAD4E}"=""
"{AB0F436F-D05E-45AD-BEE5-2B2C23C312E4}"=""
"{7B88E5A2-99CC-45D4-B7AB-83840FCCBFCF}"=""
"{95066EF4-5E13-4273-B895-6588ECC244C1}"=""
"{8274C585-9239-495A-A903-131A5CC6A44A}"=""
"{86423C17-B46A-47FB-935D-E79329D06A32}"=""
"{C3D641F2-9E57-4567-8880-3342384E732D}"=""
"{BA70FF8E-F6E2-40CF-85F6-2321E65D6A46}"=""
"{B762E20D-A8FC-41EB-B947-BA1B6419BB8D}"=""
"{1C530E5F-0414-468F-BA95-DC888A058A2E}"=""
"{EB1127C7-DEDE-4262-8B74-EB9BB18EC06C}"=""
"{98C13CB2-1E69-43A0-AE73-6EF094460F03}"=""
"{3A623077-5564-4D95-BC00-F85235D01E8E}"=""
"{9A2D8D7B-544C-4BBE-8AD4-868C881356D8}"=""
"{A76BCDBD-8FB2-422F-A6C8-DBB17DC7D77F}"=""
"{2C8340B0-22D2-44BC-9457-407D9310B571}"=""
"{CF53D629-9BE8-4DB9-AC88-BB8FE47E7094}"=""
"{631CD65C-BC6E-47A8-8D3B-B37522858E82}"=""
"{1E11D7F4-A192-4E6F-9040-1E0432D50290}"=""
"{2918DE86-94CE-43B5-89B8-F9AA490C13AE}"=""
"{0CA146E1-A74A-4880-8F70-C57D1300B09F}"=""
"{F86564E2-9C3A-4085-BE68-DE822F8B5E49}"=""
"{DC40049E-02C1-4C91-99CF-7623B861BEAF}"=""
"{A7DE8BF5-37D1-4579-971E-6CA86F6C0465}"=""
"{ACB67525-F069-4576-9E62-C78E02269DB0}"=""
"{7A641C5B-9CAF-4DD5-B32D-10E81DDBF120}"=""
"{F7038C6D-D63F-4795-9905-A29D456B822C}"=""
"{2C1B0592-0667-458F-ACA5-2933808D5ED9}"=""
"{6D257691-E875-45C9-BA4E-EB0C1C0DFDDA}"=""
"{A770827F-8785-44B4-84DE-9A553BCDB304}"=""
"{27BBE748-4C2C-40C2-B7CB-25018B12B804}"=""
"{69FBC385-F360-4D0A-B7B1-C7F49C35CBC2}"=""
"{CBDAF5BA-BBBA-44AF-9F4F-26D5BA5AF690}"=""
"{6B2D2F92-FD46-4D37-A928-034AB580B069}"=""
"{66DB1F81-9954-41DA-A1EC-E925343FF2D8}"=""
"{ECE7D32E-1CB6-4F73-B872-5A91989431BF}"=""
"{A0DD5E9E-C852-4EC1-8689-67370D491569}"=""
"{421D1C3D-1033-4F41-8981-08903098DF8E}"=""
"{A89D947C-809A-4B85-ACE3-328A7723CE48}"=""
"{14BAB91C-EF05-496A-AF6F-B7EB2BABDBFE}"=""
"{4288B4DE-243A-4A1C-A04A-E12B7209962A}"=""
"{83CF2CC2-E5FF-43FC-B46E-E95B1E587AA0}"=""
"{FB3A2EEA-4DDD-44B7-AD6E-5E08270974CE}"=""
"{4093F220-6B48-499C-B91E-D327C8A2BC9E}"=""
"{0A95FDEA-E700-4C76-B286-DD6396CEC157}"=""
"{E2359BC4-A255-49CE-A0AD-BBF1F0F90F14}"=""
"{2F4B391C-9937-4870-A553-5FC62521E7B2}"=""
"{B4677C3E-4A2E-48AC-AA16-88510A44B793}"=""
"{840D35AC-D6CB-486B-98F8-18C974511F53}"=""
"{BD205C66-C4F7-4E61-8FF2-BF5F32036B82}"=""
"{CB02CAAC-0EC8-4154-93A7-473C01C656D6}"=""
"{0A4BB8A6-7568-4226-BE32-CD038B76DE2F}"=""
"{44EA24A0-5EF7-4BBB-A52D-169706E1E768}"=""
"{21EA0597-E463-444A-9C69-1800A41D5EC4}"=""
"{E6AAC205-B20B-498B-8B16-BBC944841397}"=""
"{3ACA3840-564C-4929-8D44-7FA3F3083903}"=""
"{02EFC24B-BEC3-4669-8932-6D9278D406E1}"=""
"{EF1F4CBE-451B-4597-A2F7-43FECD60070E}"=""
"{B1F57EC7-B9B0-496B-9C76-7626ECD77977}"=""
"{846E7A6D-9319-4979-B51C-648A4427F488}"=""
"{8AA2729D-E923-48BD-8DEA-E71E07E095E1}"=""
"{B3993DF5-5EC2-4DCF-86D0-1F07E3509411}"=""
"{FD61C7C7-950B-411E-8790-05D73FFC53DE}"=""
"{148347AD-CD47-4540-8FF7-A333EE49F775}"=""
"{16FC52F7-2AA8-4647-813F-2EEBBD802042}"=""
"{F87D13BD-A4F3-41D2-8594-B2276A70DED5}"=""
"{ABD222E0-9078-474C-8176-9257F7D89F12}"=""
"{DFFC7761-2B55-41D6-8D87-79E41143584C}"=""
"{6005822F-638A-4EB8-A7B0-C5CC1656E4ED}"=""
"{867E89F7-F999-4D5C-B343-5CBE0139F587}"=""
"{69FA5E18-FE0E-41CB-A385-2C546B6DD317}"=""
"{DEC0FA22-0942-4741-9BFF-6A0955246D1A}"=""
"{85356242-52FF-42C3-9D1A-10E52F0E3408}"=""
"{D020C4C7-868F-4EEA-AC60-A52DD2C0DCC2}"=""
"{AE406AD2-3CC0-4C8E-B9CD-13D47BFC6EA2}"=""
"{683A7CDE-F4C4-4ADE-A82A-17601C8B48C0}"=""
"{120E4153-33D4-425B-B1C1-9DCCF16C2975}"=""
"{4A8894BE-8828-4B22-A743-DE9F7B6FB393}"=""
"{7E366802-0076-42B4-97CF-43278F44BD1B}"=""
"{34A89E03-C6FF-4897-A5A2-19F0C89C32B9}"=""
"{07173D0B-E3CC-4FFA-B39D-73D05F3C7E19}"=""
"{AC82659A-1636-4C28-A7FA-B99D186CD9C6}"=""
"{84378F0E-4540-4BEC-8271-BFA1779B263F}"=""
"{C6B6031E-F116-49F2-89BB-DDB5197394CA}"=""
"{D0FB44FD-1D86-4B81-BC92-98E6D499EC95}"=""
"{8A04C1FF-00EE-49FC-ACF3-6B67014CEB17}"=""
"{2940EEDD-4DAB-4D75-8E2F-BB09023F031D}"=""
"{650FBA8C-1879-4B67-A76B-E3199DF1CFCC}"=""
"{E83C78B1-E5B3-4FCA-95BD-AD6685601772}"=""
"{F35613D8-9378-42AB-990B-00953CF4B2CB}"=""
"{83050CA4-8509-40B9-A253-24BFDE7F92EE}"=""
"{4714B8D9-0CDB-40D5-B341-952390F4F71B}"=""
"{91BE5E2E-0AEA-4958-AD54-6B55DB5AED3B}"=""
"{4809D2FB-47A2-4258-AA39-2FBC65B83F4C}"=""
"{BF59710A-8851-42F7-ABA4-98B29A6C4C40}"=""
"{670B3392-19D3-4EA3-977F-BE8E28602518}"=""
"{00C2CF80-551B-429E-A6B1-31AE87BF6E6B}"=""
"{873B55E7-6C34-4FFD-BE7C-6732ABD6E019}"=""
"{A1E1B741-484C-4902-907B-49643BABD9CC}"=""
"{1D5FF088-A1D7-42C5-9CC7-6289370764EF}"=""
"{9E6A5898-542F-456C-9AF2-208DACEA82CB}"=""
"{08FE7A28-C586-4C9F-AC3E-9586E7CFE338}"=""
"{9937EB57-D61E-4BAF-A400-D05FDF0423FB}"=""
"{BD5100BA-1087-43A4-BF3F-D6E9FFAF7231}"=""
"{DB3145FA-98C5-41C4-9557-2BC8CF36B575}"=""
"{B0D5A20A-D0A2-4FB7-91C6-27B428509AF1}"=""
"{71709087-F875-4E73-B7EA-09A1CA4A418C}"=""
"{47AE7CEF-2E20-4D4F-B7C1-97F80675F8D7}"=""
"{7C3C3188-1CE2-441D-B64F-3A66543A4DEB}"=""
"{A982F049-DA61-4079-9355-027EA210A5E7}"=""
"{24C83BB0-8C30-42F2-8B40-98193054299F}"=""
"{BF83014F-26EB-4DE6-954D-01125F5DF906}"=""
"{E6AC6A9A-B0DA-462D-B25D-ACB72A11B5B0}"=""
"{4DDCFDE1-7054-42B4-8394-52889E71A83B}"=""
"{3E08736B-8566-40C1-8CDC-CE837D59FDAB}"=""
"{D64A3FDB-535E-4586-A0CC-389519AB379F}"=""
"{B73B3594-EB4D-4B52-AA18-77E1D57CF4AA}"=""
"{B99C7B3C-256F-4537-9A4B-FA38E7D98E9C}"=""
"{5FE34978-D6CA-4888-B086-46F9BCB1E324}"=""
"{C8B5BAD8-F5C9-461F-8734-DF9176F19C13}"=""
"{A9253C4C-0D33-46B3-AA2B-B3955C477D65}"=""
"{5C9E97F4-F50B-44F1-9C76-8959688B0A2E}"=""
"{8EF1C331-68C2-4701-B731-5725CD1E352F}"=""
"{63ABADC8-43C4-4EAE-A85E-368DD33FACE8}"=""
"{351B699D-6AB8-4615-880F-9AC788A53835}"=""
"{0870B6D1-1DBD-4430-B6BC-6BC21CBC0A2D}"=""
"{74B332C9-5C3D-4131-8E09-DF9C74D65C93}"=""
"{2AA026A4-717A-445D-97EF-5CDE799B7440}"=""
"{E935A96B-8556-41DA-BF08-7D90CC317714}"=""
"{9C72E8FA-5A99-4E05-BA9E-4632894B3BA0}"=""
"{F85D181C-A6C8-4D3F-86C3-811F81A78F1B}"=""
"{2DBDA620-0922-4D0B-8F0E-D3316DE7ACEA}"=""
"{A950A65E-5AA7-4663-B95E-9085AD836B7D}"=""
"{46A2A8C4-F92A-4523-897C-7A50400D99C4}"=""
"{6C3547C3-4C72-4702-A866-F8B306663368}"=""
"{D026D658-1169-4C32-A6B4-31EC251637D4}"=""
"{92AAA98B-6AB2-433B-A08D-31AC2FC4DD8A}"=""
"{64EB217B-F294-4883-92E4-68F40D0876CB}"=""
"{7E9BF4E0-B04C-4883-932B-CF15462C83EB}"=""
"{00CDEF06-21F6-41D9-9360-37D2D67FED98}"=""
"{BCD66454-DA06-4E98-ABF3-FDA010AC4073}"=""
"{50E6C2B3-0D0B-4032-A4CA-C7401186B829}"=""
"{C34123BC-8472-446D-9761-2D62F51BCCEB}"=""
"{97F91937-674B-4F73-97C4-2BD084221D66}"=""
"{B40F0E87-052B-40FE-9213-6EDC00ED315C}"=""
"{69DD5D3D-0FD0-4C78-9ACD-C9785614C5BD}"=""
"{E378E990-E3F1-45D7-9E17-B99DA318A7B3}"=""
"{4735EADC-89C9-4E49-AA28-0A0C803CE7EB}"=""
"{CB22DA1B-AE6D-4579-B21C-09EB8680966D}"=""
"{76002D3C-E683-4BB1-B311-E2428D642BCE}"=""
"{EC3F4B36-974D-4FF4-9797-26AEC9D37706}"=""
"{AC7D70D8-DBC3-40A7-9972-FEB8DDECFE06}"=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-09-10 18:20:19
ComboFix-quarantined-files.txt 2011-09-11 01:20
.
Pre-Run: 446,037,606,400 bytes free
Post-Run: 450,722,545,664 bytes free
.
- - End Of File - - 1A0CC7C9D2A15F74D1FCE266123EF596

mowman

Post #8September 11, 2011, 8:27 AM UTC

Those two files deleted can be restored if you wish but I wouldn't personally,the only registry keys removed are the ones under orphaned entries.

MBAM being so outdated was the reason it would not update so can you uninstall it and download a fresh copy from the links below and run a quick scan

Here or Here

Next

Run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

AllenM

Post #9September 11, 2011, 4:35 PM UTC

Hi mowman, Updated MBAM Ok. MBAM found two of the same detections as before for svchost.exe in the Windows\temp directory! Additionally it also found the "cache.txt" file in the Windows\Offline Web Pages directory, which I've been talking about before. So far I have not seen the rougue "svchost.exe" come back again wouldn't it seem that something is still there for it to reappear again after being removed by MBAM the first time around? Also it seems I am NOT able to run the ESET scanner. Every time I click Start it tries to get updates and says it cannot and asks if proxy is configured. Proxy is NOT configured and my Internet connection is fine. ESET is the only thing having problems getting online. Perhaps a temporary problem with their server? Is there an alternate tool you want me to use or should I just keep trying ESET over a period of time? I've already been trying off and on for the past 30 minutes. Here is the latest MBAM log. Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7695 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 9/11/2011 9:13:30 AM mbam-log-2011-09-11 (09-13-30).txt Scan type: Quick scan Objects scanned: 272526 Time elapsed: 4 minute(s), 57 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: c:\Windows\temp\svchost.exe (Trojan.Agent) -> 1552 -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Windows\temp\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\Windows\offline web pages\cache.txt (Trojan.Agent) -> Quarantined and deleted successfully.

AllenM

Post #10September 11, 2011, 4:41 PM UTC

Hi mowman, Wouldn't you know it? A few minutes after I posted, ESET started working. The server problem or whatever appears to be resolved.It is now downloading updates so I'll update again when the scan completes. Thanks Allen

mowman

Post #11September 11, 2011, 5:00 PM UTC

ESET does that sometimes,not sure why.I will be offline now until tomorrow so after the scan finishes can you do the following in the meantime.

1.Clean out your temp files.
Download Attribune's ATF Cleaner and save to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

2.Run another updated MBAM scan to make sure those entries are gone.

3.Post a new OTL log and tell me how the computer is running now

AllenM

Post #12September 11, 2011, 5:30 PM UTC

HI mowman, Hopefully you catch this before you go offline. When I try to download the ATF Cleaner I get a message saying "ID does not exist". Thanks Allen

mowman

Post #13September 11, 2011, 5:59 PM UTC

Try this cleaner instead

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

AllenM

Post #14September 12, 2011, 3:09 AM UTC

Hi mowman,

So far everything looks good. I have attached the requested logs below. A FULL scan with MBAM is now clean. Ran all the other progams you recommended.

Please let me know how the logs looks.

OTL:

OTL logfile created on: 9/11/2011 5:52:00 PM - Run 3
OTL by OldTimer - Version 3.2.27.0 Folder = I:\WhatTheTech
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.15 Gb Available Physical Memory | 66.17% Memory free
12.99 Gb Paging File | 11.75 Gb Available in Paging File | 90.44% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.76 Gb Total Space | 419.79 Gb Free Space | 90.13% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 407.94 Gb Free Space | 87.59% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 405.65 Gb Free Space | 87.09% Space Free | Partition Type: NTFS
Drive I: | 3.72 Gb Total Space | 2.97 Gb Free Space | 80.04% Space Free | Partition Type: FAT32
Drive Y: | 931.50 Gb Total Space | 136.38 Gb Free Space | 14.64% Space Free | Partition Type: NTFS

Computer Name: ALLEN-SAMUEL | User Name: allenm | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - I:\WhatTheTech\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe (Symantec Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - D:\Program Files\Norton Utilities 14\nu.exe (Symantec Corporation)
PRC - D:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - D:\Program Files\Logitech\SetPointP\LBTWiz.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\CryptoExpert Professional\cexpert_tray.exe (InterCrypto Ltd)
PRC - C:\Program Files\CryptoExpert Professional\cexpertcoreclient.exe (InterCrypto Ltd)
PRC - C:\Program Files\CryptoExpert Professional\cexpertcoreserver.exe (InterCrypto Ltd)
PRC - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
PRC - C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
PRC - D:\Program Files\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
PRC - D:\Program Files\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
PRC - D:\Program Files\RAXCO\PerfectDisk10\PerfectDisk.exe (Raxco Software, Inc.)
PRC - D:\Program Files\RAXCO\PerfectDisk10\PDAgentS1.exe (Raxco Software, Inc.)
PRC - D:\Program Files\RAXCO\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
PRC - D:\Program Files\RAXCO\PerfectDisk10\PDEngine.exe (Raxco Software, Inc.)
PRC - D:\Program Files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe (Symantec)
PRC - D:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - D:\Program Files\Norton Ghost\Agent\SymDB.exe (Symantec Corporation)
PRC - D:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe (Symantec)
PRC - C:\Program Files\GIGABYTE\GEST\gest.exe ()
PRC - C:\Program Files\CyberLink\Shared Files\brs.exe (cyberlink)
PRC - C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\CtHelper.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\CTxfispi.exe (Creative Technology Ltd)
PRC - D:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
PRC - D:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe (American Power Conversion Corporation)
PRC - C:\Users\allenm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Snsicon.exe (Second Nature Software, Inc.)
PRC - C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\GIGABYTE\GEST\etiv.dll ()
MOD - C:\Program Files\GIGABYTE\GEST\ycc.dll ()
MOD - C:\Program Files\GIGABYTE\GEST\gest.exe ()
MOD - C:\Windows\CTXFIRES.DLL ()
MOD - C:\Windows\System32\APOMngr.DLL ()
MOD - C:\Windows\System32\ctmmactl.dll ()
MOD - D:\Program Files\AEP2007 Pro\CtxMenu.dll ()

========== Win32 Services (SafeList) ==========

SRV - (WPFFontCache_v0400) – File not found
SRV - (GEARSecurity) – File not found
SRV - (FastUserSwitchingCompatibility) – File not found
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (NIS) – C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe (Symantec Corporation)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (DriveShareSvc) – C:\Program Files\CryptoExpert Professional\drivesharessvc.exe (InterCrypto Ltd)
SRV - (NAUpdate) – C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
SRV - (Norton Ghost) – D:\Program Files\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
SRV - (PDAgent) – D:\Program Files\Raxco\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
SRV - (PDEngine) – D:\Program Files\Raxco\PerfectDisk10\PDEngine.exe (Raxco Software, Inc.)
SRV - (GenericMount Helper Service) – D:\Program Files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe (Symantec)
SRV - (TomTomHOMEService) – D:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (SymSnapService) – D:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe (Symantec)
SRV - (SENS) – C:\Windows\System32\sens32.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (GEST Service) – C:\Program Files\GIGABYTE\GEST\GSvr.exe ()
SRV - (CTAudSvcService) – C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (Symantec RemoteAssist) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (APC UPS Service) – D:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
SRV - (Logitech Easy Synchronization) – D:\Program Files\Logitech\Easy Synchronization\servicestub.exe ()
SRV - (XWNTSERV) – C:\Windows\System32\XWNTSERV.EXE ()
SRV - (C-DillaSrv) – C:\Windows\System32\drivers\CDANTSRV.EXE (C-Dilla Ltd)

========== Driver Services (SafeList) ==========

DRV - (gdrv) – C:\Windows\gdrv.sys (Windows ® 2000 DDK provider)
DRV - (GVTDrv) – C:\Windows\System32\drivers\GVTDrv.sys ()
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110901.001\BHDrvx86.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110911.002\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110911.002\NAVENG.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110909.030\IDSvix86.sys (Symantec Corporation)
DRV - (SymNetS) – C:\Windows\System32\Drivers\NIS\1206000.01D\SYMNETS.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SymIM) – C:\Windows\System32\drivers\SymIMV.sys (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\NIS\1206000.01D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\NIS\1206000.01D\SRTSPX.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\NIS\1206000.01D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\NIS\1206000.01D\SYMDS.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\NIS\1206000.01D\Ironx86.SYS (Symantec Corporation)
DRV - (vpcvmm) – C:\Windows\System32\drivers\vpcvmm.sys (Microsoft Corporation)
DRV - (vpcbus) – C:\Windows\System32\drivers\vpchbus.sys (Microsoft Corporation)
DRV - (vmbus) – C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (vpcusb) – C:\Windows\System32\drivers\vpcusb.sys (Microsoft Corporation)
DRV - (vpcnfltr) – C:\Windows\System32\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (DVDHlp) – C:\Windows\System32\drivers\dvdhlp.sys (SlySoft, Inc.)
DRV - (LMouFilt) – C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LHidEqd) – C:\Windows\System32\drivers\LHidEqd.sys (Logitech, Inc.)
DRV - (LEqdUsb) – C:\Windows\System32\drivers\LEqdUsb.sys (Logitech, Inc.)
DRV - (cc_4g) – C:\Windows\system32\Drivers\cc_4g.sys (SecureAction Research, LLC)
DRV - (GenericMount) – C:\Windows\System32\drivers\GenericMount.sys (Symantec Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (ElbyCDI0) – C:\Windows\System32\drivers\ElbyCDI0.sys (Elaborate Bytes AG)
DRV - (DefragFS) – C:\Windows\System32\drivers\DefragFs.sys (Raxco Software, Inc.)
DRV - (MagicTune) – C:\Windows\system32\drivers\MTiCtwl.sys (Samsung Electronics, Inc. )
DRV - (WimFltr) – C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (VProEventMonitor) – C:\Windows\System32\drivers\vproeventmonitor.sys (Symantec Corporation)
DRV - (symsnap) – C:\Windows\system32\DRIVERS\symsnap.sys (StorageCraft)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (ET5Drv) – C:\Windows\System32\drivers\ET5Drv.sys (Windows ® 2000 DDK provider)
DRV - (SIUSBXP) – C:\Windows\System32\drivers\SiUSBXp.sys (Silicon Laboratories)
DRV - ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) – D:\Program Files\CyberLink\PowerDVD\000.fcl (Cyberlink Corp.)
DRV - (ha20x2k) – C:\Windows\System32\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\Windows\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\Windows\System32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\Windows\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\Windows\System32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctdvda2k) – C:\Windows\System32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\System32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\Windows\System32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTHWIUT.DLL) – C:\Windows\System32\CTHWIUT.DLL (Creative Technology Ltd.)
DRV - (CT20XUT.DLL) – C:\Windows\System32\CT20XUT.DLL (Creative Technology Ltd.)
DRV - (CTEXFIFX.DLL) – C:\Windows\System32\CTEXFIFX.DLL (Creative Technology Ltd.)
DRV - (CTEDSPSY.DLL) – C:\Windows\System32\CTEDSPSY.DLL (Creative Technology Ltd)
DRV - (CTEDSPIO.DLL) – C:\Windows\System32\CTEDSPIO.DLL (Creative Technology Ltd)
DRV - (CTERFXFX.DLL) – C:\Windows\System32\CTERFXFX.DLL (Creative Technology Ltd)
DRV - (CTEDSPFX.DLL) – C:\Windows\System32\CTEDSPFX.DLL (Creative Technology Ltd)
DRV - (CTEAPSFX.DLL) – C:\Windows\System32\CTEAPSFX.DLL (Creative Technology Ltd)
DRV - (CTSBLFX.DLL) – C:\Windows\System32\CTSBLFX.DLL (Creative Technology Ltd)
DRV - (CTAUDFX.DLL) – C:\Windows\System32\CTAUDFX.DLL (Creative Technology Ltd)
DRV - (COMMONFX.DLL) – C:\Windows\System32\COMMONFX.DLL (Creative Technology Ltd)
DRV - (SaiH0255) – C:\Windows\System32\drivers\SaiH0255.sys (Saitek)
DRV - (JRAID) – C:\Windows\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV - (BVRPMPR5) – C:\Windows\System32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (cc_firewall) – C:\Windows\System32\drivers\cc_firewall.sys (SecureAction Research, LLC)
DRV - (DFUBTUSB) – C:\Windows\System32\drivers\frmupgr.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\Windows\System32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (CLBStor) – C:\Windows\System32\drivers\CLBStor.sys (Cyberlink Co.,Ltd.)
DRV - (MYFAULT) – C:\Windows\System32\drivers\myfault.sys (Sysinternals)
DRV - (ASPI32) – C:\Windows\System32\drivers\aspi32.sys (Adaptec)
DRV - (Pronto2G) – C:\Windows\System32\drivers\PRONTO2G.sys (Philips Electronics)
DRV - (cvintdrv) – C:\Windows\System32\drivers\cvintdrv.sys ()
DRV - (imhidusb) – C:\Windows\System32\drivers\imhidusb.sys (Immersion Corporation)
DRV - (prohlp02) – C:\Windows\System32\drivers\prohlp02.sys (Protection Technology)
DRV - (prodrv06) – C:\Windows\System32\drivers\prodrv06.sys (Protection Technology)
DRV - (Cinemsup) – C:\Windows\System32\drivers\cinemsup.sys (Sonic Solutions)
DRV - (sfhlp01) – C:\Windows\System32\drivers\sfhlp01.sys (Protection Technology)
DRV - (CDRPDACC) – D:\Program Files\321Studios\Shared\CDRPDACC.SYS (Arrowkey)
DRV - (prosync1) – C:\Windows\System32\drivers\prosync1.sys (Protection Technology)
DRV - (XwpNTrdr) – C:\Windows\System32\drivers\XWPFSW2K.SYS ()
DRV - (pfc) – C:\Windows\System32\drivers\pfc.sys (Padus, Inc.)
DRV - (WFsys) – C:\Windows\System32\drivers\wfsys.sys (Leadtek Research Inc.)
DRV - (C-Dilla) – C:\Windows\System32\drivers\CDANT.SYS (Macrovision)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://community.norton.com/t5/user/viewpr…ge/user-id/8710
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.5
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_1_3 [2011/09/11 12:53:18 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2011/09/01 20:11:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2011/07/23 18:16:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2011/07/02 18:17:33 | 000,000,000 | —D | M]

[2010/07/03 19:56:17 | 000,000,000 | —D | M] (No name found) – C:\Users\allenm\AppData\Roaming\Mozilla\Extensions
[2009/12/24 21:32:30 | 000,000,000 | —D | M] (No name found) – C:\Users\allenm\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/02/13 11:33:37 | 000,000,000 | —D | M] (No name found) – C:\Users\allenm\AppData\Roaming\Mozilla\Firefox\Profiles\m4j4hu7i.default\extensions
[2010/07/03 19:56:17 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\allenm\AppData\Roaming\Mozilla\Firefox\Profiles\m4j4hu7i.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/28 17:45:33 | 000,002,470 | —- | M] () – C:\Users\allenm\AppData\Roaming\Mozilla\Firefox\Profiles\m4j4hu7i.default\searchplugins\safesearch.xml
[2011/09/11 12:53:18 | 000,000,000 | —D | M] (Norton Toolbar) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\COFFPLGN_2011_7_1_3
[2011/09/01 20:11:46 | 000,000,000 | —D | M] (Symantec IPS) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPLGN
[2008/12/14 19:05:39 | 000,000,000 | —D | M] (Java Console) – D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2009/01/15 21:56:58 | 000,000,000 | —D | M] (Java Console) – D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2010/05/02 20:03:38 | 000,000,000 | —D | M] (Java Console) – D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

O1 HOSTS File: ([2011/09/10 18:17:26 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (PDF-XChange Viewer IE-Plugin) - {C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F} - D:\Program Files\Tracker Software\PDF-XChange 4 Pro\PDF-XChange PDF Viewer\pdf-viewer\PDFXCviewIEPlugin.dll (Tracker Software Products Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\CyberLink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [Bluetooth Connection Assistant] File not found
O4 - HKLM..\Run: [CTHelper] C:\Windows\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTXFIREG] C:\Windows\System32\Ctxfireg.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EasyTuneVPro] C:\Program Files\GIGABYTE\ET5Pro\ETcall.exe ()
O4 - HKLM..\Run: [EvtMgr6] D:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\run.exe ()
O4 - HKLM..\Run: [LanguageShortcut] D:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [NBAgent] D:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [Norton Ghost 15.0] D:\Program Files\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKCU..\Run: [cryptoexpert] C:\Program Files\CryptoExpert Professional\cexpert_tray.exe (InterCrypto Ltd)
O4 - HKCU..\Run: [NortonUtilities] D:\Program Files\Norton Utilities 14\rmtray.exe (Symantec Corporation)
O4 - Startup: C:\Users\allenm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Snsicon.exe (Second Nature Software, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\InfoDelivery present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Security present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\ZOOM present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF 03 [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = _ [binary data]
O8 - Extra context menu item: E&xport; to Microsoft Excel - D:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O8 - Extra context menu item: Se&nd; to OneNote - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in Computer)
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKCU\..Trusted Domains: att.com ([www.wireless] https in Trusted sites)
O15 - HKCU\..Trusted Domains: comcast.net ([login] https in Trusted sites)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: lithium.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: norton.com ([community] http in Trusted sites)
O15 - HKCU\..Trusted Domains: samuelhairstylist.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: symantec.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: weather.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: youtube.com ([www] http in Trusted sites)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab (Reg Error: Key error.)
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…8090.0296064815 (Reg Error: Key error.)
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} https://www-secure.symantec.com/techsupp/as…rl/SymAData.cab (ActiveDataInfo Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D27CDB70-AE6D-11cf-96B8-444553540000} (Macromedia Flash Factory Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.30.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{751D870F-03E9-487D-BE13-A2257B5B6E4F}: DhcpNameServer = 192.168.30.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Users\allenm\Pictures\Second Nature.bmp
O24 - Desktop BackupWallPaper: C:\Users\allenm\Pictures\Second Nature.bmp
O28 - HKLM ShellExecuteHooks: {FE24CD78-7C63-465D-8787-4EDF7FC79895} - D:\Program Files\Logitech\Easy Synchronization\shellexecutehook.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/04/08 19:46:55 | 000,000,659 | —- | M] () - C:\autoAlbum.log – [ NTFS ]
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/12/30 19:30:34 | 000,000,129 | R— | M] () - I:\Autorun.inf – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SENS - C:\Windows\System32\sens32.dll (Microsoft Corporation)
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.clmp3enc - D:\Program Files\CyberLink\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\Windows\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/09/11 12:53:29 | 000,000,000 | —D | C] – C:\Users\allenm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2011/09/11 09:05:12 | 000,000,000 | —D | C] – C:\Users\allenm\AppData\Roaming\Malwarebytes
[2011/09/11 09:05:06 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/09/11 09:05:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/09/11 09:05:05 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/09/11 09:05:02 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/09/10 18:20:24 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/09/10 18:20:21 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/09/10 18:01:23 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/09/10 18:01:23 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/09/10 18:01:23 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/09/10 18:01:20 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/09/10 18:01:19 | 000,000,000 | —D | C] – C:\ComboFix
[2011/09/10 18:00:02 | 000,000,000 | —D | C] – C:\Qoobox
[2011/09/10 17:59:45 | 004,201,507 | R— | C] (Swearware) – C:\Users\allenm\Desktop\ComboFix.exe
[2011/09/09 20:38:22 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/09/01 21:00:39 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/09/01 21:00:39 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/09/01 21:00:38 | 001,797,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/09/01 21:00:38 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/09/01 21:00:37 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/09/01 20:20:46 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/08/13 11:06:06 | 000,000,000 | —D | C] – C:\Users\allenm\AppData\Roaming\Mael
[2011/08/13 10:53:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HxD Hex Editor
[2008/02/20 20:59:14 | 000,034,816 | —- | C] ( ) – C:\Windows\System32\a3d.dll
[2008/02/20 20:44:02 | 000,010,240 | —- | C] ( ) – C:\Windows\System32\killapps.exe
[2007/09/21 19:42:42 | 000,019,008 | —- | C] (Windows ® Server 2003 DDK provider) – C:\Program Files\markfun.a64
[2007/08/21 19:49:28 | 000,017,912 | —- | C] (Windows ® 2000 DDK provider) – C:\Program Files\markfun.w32
[2007/03/10 15:16:21 | 000,774,144 | —- | C] (RealNetworks, Inc.) – C:\Program Files\RngInterstitial.dll
[2005/03/03 14:36:47 | 000,014,976 | —- | C] ( ) – C:\Windows\System32\drivers\winddx.sys
[2003/11/13 15:44:00 | 000,319,488 | —- | C] (Polar [removed] www.polarsoftware.com) – C:\Program Files\PolarZIPLight.dll

========== Files - Modified Within 30 Days ==========

[2011/09/11 17:08:05 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/11 13:01:48 | 000,009,728 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/11 13:01:48 | 000,009,728 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/11 12:53:30 | 000,016,608 | —- | M] (Windows ® 2000 DDK provider) – C:\Windows\gdrv.sys
[2011/09/11 12:53:23 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/11 12:53:11 | 000,001,024 | —- | M] () – C:\XWP2KFSD.TRC
[2011/09/11 12:53:11 | 000,001,024 | —- | M] () – C:\XWP2KFSD.TR_
[2011/09/11 12:52:48 | 2616,057,856 | -HS- | M] () – C:\hiberfil.sys
[2011/09/11 12:51:23 | 000,054,928 | —- | M] () – C:\Windows\System32\BMXStateBkp-{00000005-00000000-00000001-00001102-00000005-002C1102}.rfx
[2011/09/11 12:51:23 | 000,054,928 | —- | M] () – C:\Windows\System32\BMXState-{00000005-00000000-00000001-00001102-00000005-002C1102}.rfx
[2011/09/11 12:51:23 | 000,004,096 | -HS- | M] () – C:\VSNAP.IDX
[2011/09/11 12:51:23 | 000,000,788 | —- | M] () – C:\Windows\System32\DVCState-{00000005-00000000-00000001-00001102-00000005-002C1102}.rfx
[2011/09/11 09:05:06 | 000,000,766 | —- | M] () – C:\Users\allenm\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/09/10 18:30:19 | 000,024,944 | —- | M] () – C:\Windows\System32\drivers\GVTDrv.sys
[2011/09/10 18:30:19 | 000,000,004 | —- | M] () – C:\Windows\System32\GVTunner.ref
[2011/09/10 18:17:26 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/09/10 17:53:10 | 004,201,507 | R— | M] (Swearware) – C:\Users\allenm\Desktop\ComboFix.exe
[2011/09/10 16:39:48 | 000,631,524 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/09/10 16:39:48 | 000,107,976 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/09/09 20:38:14 | 526,167,130 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/09/09 11:52:13 | 005,350,400 | —- | M] () – C:\backup.pst
[2011/09/09 07:58:11 | 000,002,240 | -H– | M] () – C:\Users\allenm\Documents\Default.rdp
[2011/09/04 10:15:39 | 000,000,035 | —- | M] () – C:\Windows\iltwain.ini
[2011/08/13 10:53:57 | 000,000,598 | —- | M] () – C:\Users\Public\Desktop\HxD.lnk

========== Files Created - No Company Name ==========

[2011/09/11 09:05:06 | 000,000,766 | —- | C] () – C:\Users\allenm\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/09/10 18:30:19 | 000,000,004 | —- | C] () – C:\Windows\System32\GVTunner.ref
[2011/09/10 18:01:23 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/09/10 18:01:23 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/09/10 18:01:23 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/09/10 18:01:23 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/09/10 18:01:23 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/09/09 20:38:14 | 526,167,130 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/09/09 08:57:40 | 000,004,096 | -HS- | C] () – C:\VSNAP.IDX
[2011/08/13 10:53:57 | 000,000,598 | —- | C] () – C:\Users\Public\Desktop\HxD.lnk
[2011/06/17 16:17:09 | 000,080,896 | —- | C] () – C:\Windows\System32\RDVGHelper.exe
[2011/06/17 16:16:15 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2010/08/28 14:46:43 | 001,064,896 | —- | C] () – C:\Windows\System32\BDHDCopyHelper.dll
[2010/08/28 14:46:43 | 000,135,168 | —- | C] () – C:\Windows\System32\VERSI0N.dll
[2010/07/12 15:08:04 | 000,000,760 | —- | C] () – C:\Users\allenm\AppData\Roaming\setup_ldm.iss
[2010/07/03 22:15:24 | 000,002,655 | —- | C] () – C:\ProgramData\LUUnInstall.LiveUpdate
[2010/07/03 14:15:23 | 000,000,000 | —- | C] () – C:\Users\allenm\AppData\Roaming\.NANotifyHere
[2010/02/27 17:37:07 | 000,000,608 | -HS- | C] () – C:\Windows\System32\winzvprt5.sys
[2010/02/27 17:37:07 | 000,000,160 | —- | C] () – C:\Windows\System32\zvprt5.ini
[2010/02/14 19:55:21 | 000,295,536 | -H– | C] () – C:\Windows\System32\mlfcache.dat
[2010/02/06 20:56:36 | 000,000,080 | —- | C] () – C:\Windows\SiteSpiderforms.ini
[2010/02/06 20:38:59 | 000,000,081 | —- | C] () – C:\Windows\mapforms.ini
[2010/02/06 17:54:40 | 000,000,108 | -HS- | C] () – C:\Windows\WSYS049.SYS
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/13 21:33:53 | 000,694,456 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 19:05:48 | 000,631,524 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 19:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 19:05:48 | 000,107,976 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 19:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 19:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 19:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 16:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 16:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/10 14:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2009/06/06 19:22:38 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/05/24 11:00:12 | 000,000,510 | —- | C] () – C:\Windows\WORDPAD.INI
[2009/03/15 20:43:04 | 000,020,605 | —- | C] () – C:\Windows\HL-4070CDW.INI
[2009/03/05 06:54:58 | 000,073,728 | —- | C] () – C:\Windows\System32\RtNicProp32.dll
[2009/02/08 22:07:03 | 000,000,745 | —- | C] () – C:\Windows\COD.INI
[2009/02/08 21:42:31 | 000,043,520 | —- | C] () – C:\Windows\System32\CmdLineExt03.dll
[2009/01/01 19:16:04 | 000,019,500 | —- | C] () – C:\Windows\hpqins13.dat.temp
[2009/01/01 18:44:33 | 000,019,500 | —- | C] () – C:\Windows\hpqins13.dat
[2008/12/21 15:14:12 | 000,000,148 | —- | C] () – C:\Windows\BRVIDEO.INI
[2008/12/21 15:14:12 | 000,000,023 | —- | C] () – C:\Windows\Brownie.ini
[2008/12/21 15:14:12 | 000,000,000 | —- | C] () – C:\Windows\brmx2001.ini
[2008/12/21 15:14:10 | 000,000,564 | —- | C] () – C:\Windows\BRWMARK.INI
[2008/12/21 15:14:10 | 000,000,034 | —- | C] () – C:\Windows\System32\bd407cdw.dat
[2008/12/21 15:14:10 | 000,000,026 | —- | C] () – C:\Windows\BRPP2KA.INI
[2008/12/21 15:13:18 | 000,045,056 | —- | C] () – C:\Windows\System32\BRTCPCON.DLL
[2008/12/21 15:13:17 | 000,000,114 | —- | C] () – C:\Windows\System32\BRLMW03A.INI
[2008/12/21 15:13:15 | 000,000,050 | —- | C] () – C:\Windows\System32\BAOCH06A.DAT
[2008/08/10 18:06:38 | 000,148,895 | —- | C] () – C:\Windows\hpoins19.dat
[2008/08/10 18:06:23 | 000,026,952 | —- | C] () – C:\Windows\hpomdl19.dat
[2008/06/07 17:34:30 | 000,018,790 | —- | C] () – C:\Windows\System32\ddmon.dll
[2008/06/04 12:38:39 | 000,000,012 | —- | C] () – C:\Windows\bthservsdp.dat
[2008/06/02 16:09:02 | 000,000,000 | —- | C] () – C:\Windows\Irremote.ini
[2008/06/02 15:34:58 | 000,108,544 | —- | C] () – C:\Windows\System32\APOMngr.DLL
[2008/06/02 15:34:58 | 000,069,120 | —- | C] () – C:\Windows\System32\CmdRtr.DLL
[2008/06/02 14:52:53 | 000,023,340 | —- | C] () – C:\Windows\System32\emptyregdb.dat
[2008/05/31 10:39:03 | 000,024,944 | —- | C] () – C:\Windows\System32\drivers\GVTDrv.sys
[2008/05/30 12:37:45 | 001,048,576 | —- | C] () – C:\Program Files\6a89og0p.0
[2008/05/30 12:35:15 | 000,071,703 | —- | C] () – C:\Program Files\bios.ini
[2008/05/30 12:34:45 | 000,000,029 | —- | C] () – C:\Program Files\new_ver.ini
[2008/05/28 14:05:32 | 000,000,047 | —- | C] () – C:\Windows\hwm.ini
[2008/02/25 14:55:32 | 000,101,603 | —- | C] () – C:\Windows\System32\instwdm.ini
[2008/02/20 21:24:36 | 000,000,054 | —- | C] () – C:\Windows\System32\ctzapxx.ini
[2008/02/20 21:00:12 | 000,043,520 | —- | C] () – C:\Windows\System32\CTBurst.dll
[2008/02/20 20:58:46 | 000,037,888 | —- | C] () – C:\Windows\System32\psconv.exe
[2008/02/20 20:49:46 | 000,321,512 | —- | C] () – C:\Windows\System32\ctdlang.dat
[2008/02/20 20:49:46 | 000,056,509 | —- | C] () – C:\Windows\System32\ctdnlstr.dat
[2008/02/20 20:46:46 | 000,013,312 | —- | C] () – C:\Windows\System32\regplib.exe
[2008/02/20 20:46:20 | 000,149,838 | —- | C] () – C:\Windows\System32\CTBAS2W.DAT
[2008/02/20 20:44:34 | 000,274,587 | —- | C] () – C:\Windows\System32\CTSBAS2W.DAT
[2008/02/20 20:44:26 | 000,241,084 | —- | C] () – C:\Windows\System32\CTSBASW.DAT
[2008/02/20 20:44:26 | 000,115,166 | —- | C] () – C:\Windows\System32\CTBASICW.DAT
[2008/02/20 20:44:10 | 000,313,207 | —- | C] () – C:\Windows\System32\ctstatic.dat
[2008/02/20 20:44:10 | 000,053,932 | —- | C] () – C:\Windows\System32\ctdaught.dat
[2008/02/20 20:44:08 | 000,005,120 | —- | C] () – C:\Windows\System32\enlocstr.exe
[2008/02/15 19:25:46 | 000,847,872 | —- | C] () – C:\Windows\System32\SaiC0255.Dll
[2008/02/15 19:25:46 | 000,008,704 | —- | C] () – C:\Windows\System32\SaiC0255_0C.dll
[2008/02/15 19:25:46 | 000,008,192 | —- | C] () – C:\Windows\System32\SaiC0255_10.dll
[2008/02/15 19:25:46 | 000,008,192 | —- | C] () – C:\Windows\System32\SaiC0255_0A.dll
[2008/02/15 19:25:46 | 000,008,192 | —- | C] () – C:\Windows\System32\SaiC0255_07.dll
[2008/02/15 19:25:46 | 000,007,680 | —- | C] () – C:\Windows\System32\SaiC0255_09.dll
[2008/02/15 19:25:46 | 000,007,168 | —- | C] () – C:\Windows\System32\SaiC0255_0402.dll
[2008/02/15 19:25:46 | 000,005,632 | —- | C] () – C:\Windows\System32\SaiC0255_11.dll
[2008/02/14 14:28:56 | 000,000,029 | —- | C] () – C:\Program Files\version.ini
[2008/02/14 14:23:12 | 000,231,944 | —- | C] () – C:\Program Files\gwflash.exe
[2007/11/25 15:19:21 | 000,215,144 | R— | C] () – C:\Windows\patchw32.A449.dll
[2007/11/25 15:18:38 | 000,215,144 | R— | C] () – C:\Windows\pw32a0.dll
[2007/09/03 13:25:25 | 000,003,072 | —- | C] () – C:\Windows\CTXFIRES.DLL
[2007/08/13 20:45:02 | 000,077,824 | —- | C] () – C:\Windows\System32\ctmmactl.dll
[2007/08/12 13:39:56 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2007/06/02 14:40:04 | 000,000,087 | —- | C] () – C:\Windows\encore_launcher.ini
[2007/05/18 14:55:38 | 000,012,288 | —- | C] () – C:\Windows\System32\DivXWMPExtType.dll
[2007/05/18 14:48:50 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2007/04/05 04:31:22 | 000,248,640 | —- | C] () – C:\Program Files\update.exe
[2007/03/30 04:36:28 | 000,000,301 | —- | C] () – C:\Program Files\update.ini
[2007/03/02 04:48:50 | 000,240,448 | —- | C] () – C:\Program Files\gwf32.exe
[2006/11/23 23:47:50 | 000,207,680 | —- | C] () – C:\Program Files\BIOS_Run.exe
[2006/11/03 18:09:40 | 000,000,528 | —- | C] () – C:\Program Files\CONFIG.INI
[2006/10/02 17:25:18 | 000,000,307 | —- | C] () – C:\Windows\System32\kill.ini
[2006/05/23 21:20:42 | 000,034,304 | —- | C] () – C:\Windows\PSCONV.EXE
[2006/03/02 19:24:14 | 000,000,012 | —- | C] () – C:\Windows\clocked.ini
[2006/01/21 16:01:45 | 000,000,000 | —- | C] () – C:\Windows\QuickInstall.INI
[2005/12/12 23:28:23 | 000,000,031 | —- | C] () – C:\Windows\sbewin32.INI
[2005/11/07 22:28:37 | 000,000,083 | —- | C] () – C:\Windows\usrwiz.ini
[2005/05/13 20:58:03 | 000,000,058 | —- | C] () – C:\Windows\CTACD.INI
[2005/04/27 19:40:26 | 000,006,800 | —- | C] () – C:\Program Files\W95_HUA.vxd
[2005/04/10 23:22:12 | 000,069,632 | R— | C] () – C:\Windows\System32\xmltok.dll
[2005/04/10 23:22:12 | 000,036,864 | R— | C] () – C:\Windows\System32\xmlparse.dll
[2005/04/10 21:11:57 | 000,056,320 | —- | C] () – C:\Windows\System32\iyvu9_32.dll
[2005/03/24 08:50:42 | 000,000,000 | —- | C] () – C:\Windows\PhotoNow.INI
[2005/03/19 13:18:29 | 000,000,056 | RHS- | C] () – C:\Windows\System32\9FA9EED978.sys
[2005/03/19 13:18:28 | 000,005,642 | -HS- | C] () – C:\Windows\System32\KGyGaAvL.sys
[2005/03/03 14:36:47 | 000,466,944 | —- | C] () – C:\Windows\System32\SLLights.dll
[2005/03/03 14:36:47 | 000,376,832 | —- | C] () – C:\Windows\System32\slmh.exe
[2005/03/03 14:36:47 | 000,167,936 | —- | C] () – C:\Windows\System32\minirec.exe
[2005/03/03 14:36:47 | 000,061,440 | —- | C] () – C:\Windows\SmCfg.exe
[2005/03/03 10:17:45 | 000,000,296 | —- | C] () – C:\Windows\EReg206.dat
[2005/01/30 06:03:13 | 001,626,112 | —- | C] () – C:\Windows\System32\nwiz.exe
[2005/01/30 06:03:13 | 001,019,904 | —- | C] () – C:\Windows\System32\nvwimg.dll
[2005/01/30 06:03:12 | 001,703,936 | —- | C] () – C:\Windows\System32\nvwdmcpl.dll
[2005/01/30 06:03:10 | 000,466,944 | —- | C] () – C:\Windows\System32\nvshell.dll
[2005/01/30 06:03:09 | 001,339,392 | —- | C] () – C:\Windows\System32\nvdspsch.exe
[2005/01/30 06:03:09 | 000,442,368 | —- | C] () – C:\Windows\System32\nvappbar.exe
[2005/01/30 06:03:07 | 001,474,560 | —- | C] () – C:\Windows\System32\nview.dll
[2005/01/30 06:03:07 | 000,425,984 | —- | C] () – C:\Windows\System32\keystone.exe
[2005/01/07 01:40:02 | 000,205,312 | R— | C] () – C:\Windows\patchw32.dll
[2005/01/07 01:39:07 | 000,205,312 | R— | C] () – C:\Windows\pw32a.dll
[2004/12/23 21:01:36 | 000,004,133 | —- | C] () – C:\Windows\entrust.ini
[2004/12/21 00:21:55 | 000,001,345 | —- | C] () – C:\Windows\checkip.dat
[2004/12/21 00:20:46 | 000,001,341 | —- | C] () – C:\Windows\ipconfig.dat
[2004/12/19 17:01:33 | 000,000,031 | —- | C] () – C:\Windows\bewin32.INI
[2004/12/19 15:40:37 | 000,001,024 | RH– | C] () – C:\Windows\System32\ntiembed.dll
[2004/12/18 09:59:47 | 000,000,000 | —- | C] () – C:\Windows\WinPM.INI
[2004/12/18 09:20:57 | 003,870,720 | —- | C] () – C:\Windows\System32\qt-mt323.dll
[2004/12/14 14:44:04 | 000,000,000 | —- | C] () – C:\Windows\WinDB.INI
[2004/12/13 22:01:39 | 000,000,273 | —- | C] () – C:\Windows\hpqgrcpy.INI
[2004/11/29 00:47:53 | 000,000,145 | —- | C] () – C:\Windows\hpgmdl01.dat.temp
[2004/11/29 00:17:36 | 000,085,312 | —- | C] () – C:\Windows\hpgins01.dat.temp
[2004/11/25 21:47:41 | 000,085,312 | —- | C] () – C:\Windows\hpgins01.dat
[2004/10/11 21:35:00 | 000,057,344 | —- | C] () – C:\Windows\System32\tmimlaun.dll
[2004/10/07 10:25:00 | 000,002,516 | —- | C] () – C:\Windows\System32\drivers\default.bin.old
[2004/10/07 10:25:00 | 000,002,516 | —- | C] () – C:\Windows\System32\default.bin.old
[2004/10/07 10:18:13 | 000,069,632 | —- | C] () – C:\Windows\erase_SR.exe
[2004/09/29 10:37:13 | 000,051,304 | —- | C] () – C:\Windows\System32\drivers\atnt40k.sys
[2004/09/16 13:24:26 | 003,375,104 | —- | C] () – C:\Windows\System32\qt-mt331.dll
[2004/09/15 20:19:59 | 000,000,000 | —- | C] () – C:\Windows\500A121a.INI
[2004/07/26 18:40:30 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2004/07/26 11:00:00 | 000,007,140 | —- | C] () – C:\Windows\System32\drivers\cvintdrv.sys
[2004/06/16 20:38:54 | 000,002,516 | —- | C] () – C:\Windows\System32\drivers\default.bin
[2004/06/16 20:38:54 | 000,002,516 | —- | C] () – C:\Windows\System32\default.bin
[2004/05/27 09:53:41 | 000,051,200 | —- | C] () – C:\Windows\tbat_del.exe
[2004/05/22 20:08:45 | 000,102,520 | —- | C] () – C:\Windows\TrueInstall.exe
[2004/05/22 18:31:54 | 000,000,000 | —- | C] () – C:\Windows\netscape.INI
[2004/05/22 18:27:29 | 000,634,065 | —- | C] () – C:\Windows\cd32.exe
[2004/04/14 10:20:40 | 000,000,000 | —- | C] () – C:\Windows\500A_20h.INI
[2004/03/31 00:04:20 | 000,121,470 | —- | C] () – C:\Windows\System32\drivers\XWPFSW2K.SYS
[2004/03/31 00:04:20 | 000,055,296 | —- | C] () – C:\Windows\System32\XWPSHELL.DLL
[2004/03/31 00:04:19 | 000,185,052 | —- | C] () – C:\Windows\System32\XWNTSERV.EXE
[2004/03/31 00:04:19 | 000,058,475 | —- | C] () – C:\Windows\System32\XWNTFS32.DLL
[2004/03/09 20:32:14 | 000,000,000 | —- | C] () – C:\Windows\PROTOCOL.INI
[2004/03/06 12:25:11 | 000,000,104 | —- | C] () – C:\Windows\CTRec.INI
[2004/03/02 15:05:09 | 000,000,020 | —- | C] () – C:\Windows\GaxFMRg.dat
[2004/03/02 10:28:53 | 000,000,502 | —- | C] () – C:\Windows\MTU.INI
[2004/03/02 10:28:17 | 000,000,064 | —- | C] () – C:\Windows\winhelp.ini
[2004/03/01 22:32:34 | 000,389,120 | —- | C] () – C:\Windows\deinss20.exe
[2004/03/01 22:28:11 | 000,028,672 | —- | C] () – C:\Windows\SETUPIBM.EXE
[2004/02/22 03:04:13 | 000,000,815 | —- | C] () – C:\Windows\BZII.INI
[2004/02/21 15:49:03 | 000,000,746 | —- | C] () – C:\Windows\SIERRA.INI
[2004/02/21 00:09:24 | 000,000,285 | —- | C] () – C:\Windows\EReg072.dat
[2004/02/20 22:07:48 | 000,003,327 | —- | C] () – C:\Windows\wininit.ini
[2004/02/20 21:47:26 | 000,021,840 | —- | C] () – C:\Windows\System32\SIntfNT.dll
[2004/02/20 21:47:26 | 000,017,212 | —- | C] () – C:\Windows\System32\SIntf32.dll
[2004/02/20 21:47:26 | 000,012,067 | —- | C] () – C:\Windows\System32\SIntf16.dll
[2004/02/20 15:36:50 | 000,001,609 | —- | C] () – C:\Windows\yahtzee.ini
[2004/02/20 00:39:55 | 000,000,195 | —- | C] () – C:\Windows\LODERUNN.INI
[2004/02/19 14:41:06 | 000,000,271 | —- | C] () – C:\Windows\PowerReg.dat
[2004/02/18 23:00:17 | 000,019,968 | —- | C] () – C:\Windows\System32\cpuinf32.dll
[2004/02/18 21:07:41 | 000,010,240 | —- | C] () – C:\Windows\System32\vidx16.dll
[2004/02/17 21:52:16 | 000,000,048 | —- | C] () – C:\Windows\PerWin.ini
[2004/02/13 20:23:17 | 000,000,541 | —- | C] () – C:\Windows\label.ini
[2004/02/13 15:53:34 | 000,000,035 | —- | C] () – C:\Windows\iltwain.ini
[2004/02/11 21:48:32 | 000,000,850 | —- | C] () – C:\Windows\ODBC.INI
[2004/02/11 21:13:35 | 000,001,675 | —- | C] () – C:\Windows\Slideshw.ini
[2004/02/11 00:22:31 | 000,000,030 | —- | C] () – C:\Windows\INTURS.DAT
[2004/02/10 11:39:17 | 000,000,121 | —- | C] () – C:\Windows\Winamp.ini
[2004/02/10 10:30:34 | 000,000,071 | —- | C] () – C:\Windows\qwimp.ini
[2004/02/10 10:15:17 | 000,000,165 | —- | C] () – C:\Windows\Quicken.ini
[2004/02/10 00:55:09 | 001,048,576 | —- | C] () – C:\Windows\System32\sfman.dat
[2004/02/09 23:55:08 | 000,000,231 | —- | C] () – C:\Windows\ac3api.ini
[2004/02/09 22:42:15 | 000,000,317 | —- | C] () – C:\Windows\SBWIN.INI
[2004/02/09 09:54:04 | 000,037,220 | —- | C] () – C:\Windows\nsreg.dat
[2004/02/09 09:51:38 | 000,009,663 | —- | C] () – C:\Windows\mozver.dat
[2004/02/08 11:05:06 | 000,000,051 | —- | C] () – C:\Windows\iTouch.ini
[2004/02/08 10:31:01 | 000,000,000 | —- | C] () – C:\Windows\fwenc.INI
[2004/02/07 17:53:10 | 000,004,161 | —- | C] () – C:\Windows\ODBCINST.INI
[2003/12/19 03:00:00 | 000,013,387 | —- | C] () – C:\Windows\System32\CinemSup.sys
[2003/05/31 18:43:38 | 000,005,632 | —- | C] () – C:\Windows\TrueProcess.exe
[2003/01/17 02:09:52 | 000,049,152 | —- | C] () – C:\Windows\System32\coinst.dll
[2001/10/28 19:42:30 | 000,116,224 | —- | C] () – C:\Windows\System32\redmonnt.dll
[1998/09/17 00:25:24 | 000,004,096 | —- | C] () – C:\Windows\delttsul.exe

========== LOP Check ==========

[2010/07/03 19:56:02 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\AquaNox
[2010/07/03 19:56:02 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Backup MyPC
[2010/07/03 19:56:02 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Blitware
[2010/07/03 19:56:03 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\CheckPoint
[2010/07/03 19:56:03 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\CoffeeCup Software
[2010/07/03 19:56:05 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Genie-Soft
[2010/08/13 19:22:39 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\GetRightToGo
[2010/07/03 19:56:05 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\HotSync
[2010/07/03 19:56:05 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Hummingbird
[2010/07/03 19:56:07 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Image Zone Express
[2010/07/03 19:56:07 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Individual Software
[2010/07/03 19:56:07 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\InterVideo
[2010/07/03 19:56:09 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\IsolatedStorage
[2010/07/03 19:56:09 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Leadertech
[2011/08/13 11:06:06 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Mael
[2011/06/17 18:49:52 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\NCH Swift Sound
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\NET6
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\NovaStor
[2007/10/07 18:32:18 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Novosoft
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\PDFCreator
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Printer Info Cache
[2010/07/03 19:56:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Qualcomm
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Quicken WillMaker
[2011/06/17 18:39:19 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Recordpad
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\RingCentral
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Second Nature
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\SoftLogica
[2010/07/03 19:56:25 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Stardock
[2010/07/03 19:56:41 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\SupportSoft
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Tific
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\TomTom
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\ubi.com
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\VERITAS
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\Viewpoint
[2010/07/03 19:56:47 | 000,000,000 | —D | M] – C:\Users\allenm\AppData\Roaming\WinBatch
[2009/07/13 21:53:46 | 000,000,364 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/01/22 20:29:01 | 000,002,821 | —- | M] () – C:\additdiag.txt
[2009/05/30 17:20:03 | 000,000,000 | —- | M] () – C:\AdobeDebug.txt
[2005/04/08 19:46:55 | 000,000,659 | —- | M] () – C:\autoAlbum.log
[2009/06/10 14:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2011/09/09 11:52:13 | 005,350,400 | —- | M] () – C:\backup.pst
[2010/07/03 22:35:25 | 010,532,120 | —- | M] () – C:\BESR2010PatchLog.txt
[2008/06/02 14:06:54 | 000,000,355 | -HS- | M] () – C:\Boot.BAK
[2008/06/02 15:22:23 | 000,000,355 | RHS- | M] () – C:\Boot.ini.saved
[2010/11/20 05:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2010/07/03 20:33:03 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2005/11/11 10:05:36 | 000,001,571 | —- | M] () – C:\cclog.txt
[2009/06/10 14:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2008/05/27 22:24:17 | 000,000,186 | —- | M] () – C:\csb.log
[2008/11/29 21:10:14 | 000,262,144 | —- | M] () – C:\DEFAULT
[2007/12/08 00:51:23 | 000,000,000 | —- | M] () – C:\Diagnostics.txt
[2010/07/03 21:43:53 | 000,000,063 | -H– | M] () – C:\DocScan.ind
[2007/03/10 16:36:35 | 000,000,109 | —- | M] () – C:\DownloadLog.txt
[2005/02/08 01:08:42 | 000,000,055 | —- | M] () – C:\DVDPATH.TXT
[2011/09/11 12:52:48 | 2616,057,856 | -HS- | M] () – C:\hiberfil.sys
[2004/02/08 02:09:48 | 000,000,000 | —- | M] () – C:\IO.SYS
[2007/09/15 16:56:27 | 000,000,177 | —- | M] () – C:\ITB.log
[2010/05/22 19:43:57 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2004/02/08 02:09:48 | 000,000,000 | —- | M] () – C:\MSDOS.SYS
[2005/11/08 21:38:41 | 000,001,261 | —- | M] () – C:\net_save.dna
[2005/01/30 09:36:38 | 000,047,564 | —- | M] () – C:\NTDETECT.COM
[2005/01/30 09:36:38 | 000,250,032 | —- | M] () – C:\ntldr
[2011/09/11 12:52:52 | 3488,079,872 | -HS- | M] () – C:\pagefile.sys
[2008/11/29 21:10:59 | 000,262,144 | —- | M] () – C:\SAM
[2008/06/08 23:38:05 | 000,262,144 | —- | M] () – C:\SAM.0608
[2008/11/29 21:09:04 | 000,262,144 | —- | M] () – C:\SECURITY
[2008/06/08 09:03:20 | 000,262,144 | —- | M] () – C:\SECURITY.0608
[2008/06/02 13:43:59 | 000,000,122 | —- | M] () – C:\service.log
[2008/11/29 21:16:42 | 046,923,776 | —- | M] () – C:\SOFTWARE
[2008/06/08 23:49:26 | 045,088,768 | —- | M] () – C:\SOFTWARE.0608
[2008/11/29 21:16:42 | 024,117,248 | —- | M] () – C:\SYSTEM
[2008/06/08 23:49:26 | 017,563,648 | —- | M] () – C:\SYSTEM.0608
[2007/09/30 11:54:21 | 000,000,211 | —- | M] () – C:\temp.ini
[2004/06/17 11:42:32 | 000,507,904 | —- | M] () – C:\Test.mdb
[2010/07/03 21:43:53 | 000,050,296 | —- | M] () – C:\Test.tif
[2004/10/11 21:43:00 | 000,000,019 | —- | M] () – C:\TMIMLAUN.TXT
[2004/03/04 01:18:39 | 000,000,144 | —- | M] () – C:\tmpRegInfo.txt
[2009/01/09 21:56:39 | 000,000,594 | —- | M] () – C:\updatedatfix.log
[2011/09/11 12:51:23 | 000,004,096 | -HS- | M] () – C:\VSNAP.IDX
[2008/06/02 14:07:44 | 000,001,760 | —- | M] () – C:\XWNTFS32.TRC
[2008/06/02 13:42:41 | 000,001,202 | —- | M] () – C:\XWNTFS32.TR_
[2011/09/11 12:53:11 | 000,001,024 | —- | M] () – C:\XWP2KFSD.TRC
[2011/09/11 12:53:11 | 000,001,024 | —- | M] () – C:\XWP2KFSD.TR_
[2007/03/28 21:19:48 | 000,004,668 | —- | M] () – C:\_Sid.txt

< %systemroot%\Fonts\*.com >
[2009/07/13 21:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/18 23:34:30 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2009/07/13 18:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2004/03/22 15:17:06 | 000,025,840 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/04/08 16:50:06 | 000,012,800 | —- | M] (ReaSoft Development) – C:\Windows\system32\spool\prtprocs\w32x86\reaproc.dll
[2010/11/20 05:21:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2006/01/30 11:11:50 | 000,135,168 | —- | M] (Second Nature Software) – C:\Windows\SNSVR.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2007/12/13 22:32:15 | 000,001,530 | -H– | M] () – C:\Users\allenm\AppData\Roaming\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2008/05/30 12:37:46 | 001,048,576 | —- | M] () – C:\Program Files\6a89og0p.0
[2008/05/30 12:35:31 | 000,071,703 | —- | M] () – C:\Program Files\bios.ini
[2006/11/23 23:47:50 | 000,207,680 | —- | M] () – C:\Program Files\BIOS_Run.exe
[2008/05/30 12:35:14 | 000,000,528 | —- | M] () – C:\Program Files\CONFIG.INI
[2009/07/13 21:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini
[2007/03/02 04:48:50 | 000,240,448 | —- | M] () – C:\Program Files\gwf32.exe
[2008/02/14 14:23:12 | 000,231,944 | —- | M] () – C:\Program Files\gwflash.exe
[2007/09/21 19:42:42 | 000,019,008 | —- | M] (Windows ® Server 2003 DDK provider) – C:\Program Files\markfun.a64
[2007/08/21 19:49:28 | 000,017,912 | —- | M] (Windows ® 2000 DDK provider) – C:\Program Files\markfun.w32
[2008/05/30 12:34:46 | 000,000,029 | —- | M] () – C:\Program Files\new_ver.ini
[2003/11/13 15:44:00 | 000,319,488 | —- | M] (Polar [removed] www.polarsoftware.com) – C:\Program Files\PolarZIPLight.dll
[2007/03/10 15:16:17 | 000,774,144 | —- | M] (RealNetworks, Inc.) – C:\Program Files\RngInterstitial.dll
[2007/04/05 04:31:22 | 000,248,640 | —- | M] () – C:\Program Files\update.exe
[2007/03/30 04:36:28 | 000,000,301 | —- | M] () – C:\Program Files\update.ini
[2008/02/14 14:28:56 | 000,000,029 | —- | M] () – C:\Program Files\version.ini
[2005/04/27 19:40:26 | 000,006,800 | —- | M] () – C:\Program Files\W95_HUA.vxd

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >
[2011/03/24 20:50:35 | 000,003,072 | —- | M] () – C:\Windows\system32\Cache.db

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2004/09/02 21:06:06 | 000,000,177 | -HS- | M] () – C:\Users\allenm\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2009/03/29 11:37:13 | 000,000,277 | -HS- | M] () – C:\Users\allenm\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (2).ini
[2011/06/17 15:44:57 | 000,000,221 | -HS- | M] () – C:\Users\allenm\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/09/10 17:53:10 | 004,201,507 | R— | M] (Swearware) – C:\Users\allenm\Desktop\ComboFix.exe
[2010/10/23 12:20:27 | 009,578,056 | —- | M] (SUPERAntiSpyware.com) – C:\Users\allenm\Desktop\SUPERAntiSpyware.exe
[2009/03/02 09:41:34 | 003,493,888 | —- | M] (SanDisk Corporation) – C:\Users\allenm\Desktop\U3Uninstall.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 14:20:04 | 000,000,802 | —- | M] () – C:\Windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/06/17 16:41:11 | 000,000,402 | -HS- | M] () – C:\Users\allenm\Favorites\desktop.ini
[2011/06/17 18:51:54 | 000,000,276 | —- | M] () – C:\Users\allenm\Favorites\NCH Software Download Site.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/07/03 22:15:24 | 000,002,655 | —- | M] () – C:\ProgramData\LUUnInstall.LiveUpdate

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >
[2002/07/16 07:12:04 | 000,019,994 | —- | M] () – C:\Windows\system32\fonts\ACADEMY_.PFB
[2002/07/16 07:12:04 | 000,000,932 | —- | M] () – C:\Windows\system32\fonts\ACADEMY_.PFM
[2002/07/16 07:12:04 | 000,032,300 | —- | M] () – C:\Windows\system32\fonts\ACADEMY_.TTF

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-09-02 04:01:53

========== Alternate Data Streams ==========

@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:D287FACF

< End of report >

_____________________________________________________________________________
ESET Log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=9068a632f55fdd4c88717c6efcb6963f
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-11 06:39:48
# local_time=2011-09-11 11:39:48 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=3584 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776574 100 94 7319437 67304134 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=391352
# found=7
# cleaned=7
# scan_time=7045
C:\Program Files\AskTBar\bar\4.bin\ASKTBAR.DLL Win32/Toolbar.AskSBar application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Program Files\AskTBar\bar\5.bin\A5POPSWT.DLL Win32/Toolbar.AskSBar application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Program Files\AskTBar\bar\5.bin\ASKTBAR.DLL Win32/Toolbar.AskSBar application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\Install Archives\Hex Editor\cnet_HxDSetupEN_zip.exe a variant of Win32/InstallCore.C application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\Install Archives\iPhone\3GP\3gp_converter_setup.exe a variant of Win32/SweetIM.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\Install Archives\Nero Updates\Ultra 7 Update\Nero-7.7.5.1_eng_trial.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
E:\Install Archives\Nero Updates\Ultra 7 Update\Enhanced Free Update\Nero-7.10.1.0_eng_update_wch.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C

mowman

Post #15September 12, 2011, 12:59 PM UTC

You appear clean of infections,please do the following.

Delete aswMBR,TDSSKiller,ESET and any logs you have.

ComboFix - Cleanup
Time for some housekeeping

Click Start…select Run from the menu.
Copy and paste the following into the text entry box:
Combofix /Uninstall
Click the OK button. (See image below as reference.)

🖼Click to load external image (Posted Image)

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

Here are some recommendations to help you stay clean.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/

Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

So How did I get infected?
Miekies' prevention suggestions
Hardening Windows Security - Part 1 & Part 2.

Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Thats it you are good to go.Safe surfing

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Infected with W32.Morto

✨ Ask AI

Ask AI