Malaware removal. [Solved]

I ran Malaware bytes today and it found 39 infections.. well my anti virus said there was none even when I ran their spyware a few days ago it still said none.. the computer hangs and has not been behaving very good.. so thought I`d return here and see what to do.. I removed those Malawarebytes infections off and now ran this Old timers scan so you can see if its ok now I noticed last few days in start up there were these 2 startup programs all in chinese writing of course I can`t understand them at all so please can you see what the computer is doing or if going ok now.. I was on here a while ago as Lorraine but had to reregister again as it wouldn`t recogise me so its not as if I am new here I have been here for your help a few times.. thanks for any help now will post the old timers scan for you here..

OTL logfile created on: 30/03/2012 4:01:11 PM - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1023.36 Mb Total Physical Memory | 555.41 Mb Available Physical Memory | 54.27% Memory free
2.40 Gb Paging File | 1.96 Gb Available in Paging File | 81.69% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 94.16 Gb Total Space | 43.32 Gb Free Space | 46.01% Space Free | Partition Type: NTFS
Drive D: | 8.49 Gb Total Space | 0.95 Gb Free Space | 11.16% Space Free | Partition Type: FAT32

Computer Name: YOUR-C6B5E4EABC | User Name: HP_Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\afwServ.exe (AVAST Software)
PRC - C:\Program Files\Telstra\Mobile Broadband Manager\TelstraUCM.exe (Telstra)
PRC - C:\Program Files\Sierra Wireless Inc\Common\SwiCardDetect.exe (Sierra Wireless, Inc.)
PRC - C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)
PRC - C:\Program Files\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
PRC - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard)
PRC - C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions)
PRC - C:\Program Files\PC-Doctor 5 for Windows\PcdSmartMonitor.exe ()
PRC - C:\WINDOWS\arservice.exe (Microsoft)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\12032901\algo.dll ()
MOD - C:\Program Files\WOT\WOT.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
MOD - C:\Program Files\Updates from HP\9972322\6.3.2.116-9972322\Program\bwfiles.dll ()
MOD - C:\Program Files\Updates from HP\9972322\6.3.2.116-9972322\Program\FrExt.dll ()
MOD - C:\Program Files\Updates from HP\9972322\6.3.2.116-9972322\Program\clntutil.dll ()
MOD - C:\WINDOWS\system32\nview.dll ()
MOD - C:\WINDOWS\system32\nvshell.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\Matrix.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\Common.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\Pcd5Services.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\ProgressTrace.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\PcdSmartMonitor.exe ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\pcdrindicator.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\Smart.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\Scsi.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\Lsapi.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\Dapi5.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\IPC.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\Http.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\Enumerator.dll ()
MOD - C:\Program Files\PC-Doctor 5 for Windows\SharedAll.dll ()
MOD - C:\Program Files\Updates from HP\9972322\Program\HPClientExt.dll ()
MOD - C:\WINDOWS\armcex.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (avast! Firewall) – C:\Program Files\AVAST Software\Avast\afwServ.exe (AVAST Software)
SRV - (SwiCardDetectSvc) – C:\Program Files\Sierra Wireless Inc\Common\SwiCardDetect.exe (Sierra Wireless, Inc.)
SRV - (ICQ Service) – C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (ARSVC) – C:\WINDOWS\arservice.exe (Microsoft)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SBRE) – C:\WINDOWS\system32\drivers\SBREdrv.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (cpuz134) – C:\DOCUME~1\HP_ADM~1.000\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys File not found
DRV - (Changer) – File not found
DRV - (aswFW) – C:\WINDOWS\System32\drivers\aswFW.sys (AVAST Software)
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswNdis2) – C:\WINDOWS\System32\drivers\aswNdis2.sys (AVAST Software)
DRV - (aswKbd) – C:\WINDOWS\System32\drivers\aswKbd.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswNdis) – C:\WINDOWS\system32\drivers\aswNdis.sys (ALWIL Software)
DRV - (massfilter_lte) – C:\WINDOWS\system32\drivers\massfilter_LTE.sys (HandSet Incorporated)
DRV - (swg3kser00) – C:\WINDOWS\system32\drivers\swg3kser00.sys (Sierra Wireless Incorporated)
DRV - (SWNC8UA3) Sierra Wireless MUX NDIS Driver (UMTSA3) – C:\WINDOWS\system32\drivers\swnc8ua3.sys (Sierra Wireless Inc.)
DRV - (swiwdmbx) – C:\WINDOWS\system32\drivers\swiwdmbx.sys (Sierra Wireless Inc.)
DRV - (rspSanity) – C:\WINDOWS\system32\drivers\rspSanity32.sys (Resplendence Software Projects Sp.)
DRV - (ZTEusbnet) – C:\WINDOWS\system32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (ZTEusbser6k) – C:\WINDOWS\system32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\WINDOWS\system32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (massfilter) – C:\WINDOWS\system32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (PCASp50) – C:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (RT73) – C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (PCD5SRVC{8A863ACB-F5F6CC6A-05010003}) – C:\Program Files\PC-Doctor 5 for Windows\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)
DRV - (ftsata2) – C:\WINDOWS\system32\drivers\ftsata2.sys (Promise Technology, Inc.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (bb-run) – C:\WINDOWS\system32\drivers\bb-run.sys (Promise Technology, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.telstra.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.au/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ninemsn.com.au/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B8 EF 3D F6 1F 08 CD 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{7BFDF2A8-02A7-4339-8439-476B8727D268}: "URL" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@ei.MyScrapNook_12.com/Plugin: C:\Program Files\MyScrapNook_12EI\Installr\1.bin\NP12EISB.dll (My Scrap Nook)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@mywebsearch.com/Plugin: C:\Program Files\MyWebSearch\bar\1.bin\NPMyWebS.dll File not found
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.91: C:\Program Files\NOS\bin\np_gp.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\MyWebSearch\bar\1.bin

[2011/07/19 06:05:25 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2004/08/10 22:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Yahoo!7 Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo!7 Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BigPondWirelessBroadbandCM] C:\Program Files\Telstra\Mobile Broadband Manager\TelstraUCM.exe (Telstra)
O4 - HKLM..\Run: [DMAScheduler] c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions)
O4 - HKLM..\Run: [ftutil2] C:\WINDOWS\System32\ftutil2.dll (Promise Technology, Inc.)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [HPSUreset] c:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PCDrSmartMonitor] C:\Program Files\PC-Doctor 5 for Windows\PcdSmartMonitor.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PMLreset] c:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [RBreset] c:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard)
F3 - HKCU WinNT: Load - (꧘粐粐ᥨ�粐粐粐粐��粐濫矝) - File not found
F3 - HKCU WinNT: Run - (꧘粐粐ᥨ�粐粐粐粐��粐濫矝) - File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} http://audownload.authentium.net/bigpond/3…/bin/wizard.exe (Reg Error: Key error.)
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab (Symantec Script Runner Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1290830994407 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1290831135252 (MUWebControl Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab (GMNRev Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {84818113-96C5-11D2-BE39-006008BF4DD5} http://www.scotlandspeople.gov.uk/Viewers/…ol/viewdw32.ocx (ViewDirector Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4542B8BE-225E-488F-BBDA-C88D51C90B99}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C787B870-34FF-4931-BDFF-920EB089A7A0}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D1ED57DB-54BC-4A28-882E-3073C1B6101A}: DhcpNameServer = [removed] [removed] [removed] [removed]
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/05/25 20:05:54 | 000,000,050 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{e0c7fdad-7248-11e1-91ad-0016ec93af39}\Shell - "" = AutoRun
O33 - MountPoints2\{e0c7fdad-7248-11e1-91ad-0016ec93af39}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e0c7fdad-7248-11e1-91ad-0016ec93af39}\Shell\AutoRun\command - "" = J:\WIN\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - C:\WINDOWS\System32\LCodcCMP.dll (LEAD Technologies, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/03/30 15:39:29 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\HiJackThis.exe
[2012/03/30 15:38:30 | 000,593,920 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\OTL.exe
[2012/03/30 13:43:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/03/30 13:43:42 | 000,020,464 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/03/30 00:28:48 | 000,000,000 | RH-D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Recent
[2012/03/29 22:25:30 | 000,000,000 | —D | C] – C:\Program Files\MyScrapNook_12EI
[2012/03/29 16:54:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Internet Security
[2012/03/29 16:54:28 | 000,337,880 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2012/03/29 16:54:28 | 000,020,696 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/03/29 16:54:25 | 000,112,984 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFW.sys
[2012/03/29 16:53:54 | 000,196,440 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswNdis2.sys
[2012/03/29 16:53:54 | 000,035,672 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/03/29 16:53:53 | 000,053,848 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/03/29 16:53:53 | 000,024,408 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswKbd.sys
[2012/03/29 16:53:52 | 000,612,184 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/03/29 16:53:52 | 000,095,704 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/03/29 16:53:52 | 000,089,048 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2012/03/29 16:53:51 | 000,024,920 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/03/29 16:52:43 | 000,012,112 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswNdis.sys
[2012/03/29 16:52:40 | 000,041,184 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2012/03/29 16:52:38 | 000,201,352 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2012/03/29 16:52:04 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2012/03/29 00:37:48 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\OpenOffice.org
[2012/03/28 23:05:09 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2012/03/28 23:05:09 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2012/03/28 23:05:08 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2012/03/28 13:58:42 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Telstra
[2012/03/28 13:57:23 | 000,114,688 | R— | C] (ZTE Corporation) – C:\WINDOWS\System32\drivers\ZTEusbnet.sys
[2012/03/28 13:57:23 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys
[2012/03/28 13:57:23 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys
[2012/03/28 13:57:23 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys
[2012/03/28 13:57:23 | 000,007,680 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\massfilter.sys
[2012/03/28 13:55:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Telstra
[2012/03/25 01:20:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2012/03/25 01:20:35 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2012/03/23 20:06:43 | 000,125,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\MSSTDFMT.DLL
[2012/03/23 20:06:43 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\MsiZap.exe
[2012/03/23 20:06:43 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\msicuu.exe
[2012/03/23 20:06:42 | 000,049,152 | —- | C] (Rocky Mountain Computer Consulting, Inc.) – C:\WINDOWS\BPS2check.exe
[2012/03/23 14:44:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2012/03/23 06:12:12 | 004,435,968 | —- | C] (Google Inc.) – C:\WINDOWS\System32\GPhotos.scr
[2012/03/20 16:12:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Telstra
[2012/03/20 16:07:26 | 000,138,264 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zgdcnet.sys
[2012/03/20 16:07:26 | 000,113,168 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zgdcvousb.sys
[2012/03/20 16:07:26 | 000,113,168 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zgdcnmea.sys
[2012/03/20 16:07:26 | 000,113,168 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zgdcmdm.sys
[2012/03/20 16:07:26 | 000,113,168 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zgdcdiag.sys
[2012/03/20 16:07:26 | 000,113,168 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zgdcat.sys
[2012/03/20 16:07:26 | 000,015,896 | R— | C] (HandSet Incorporated) – C:\WINDOWS\System32\drivers\massfilter_LTE.sys
[2012/03/20 16:06:23 | 000,215,552 | R— | C] (Sierra Wireless Incorporated) – C:\WINDOWS\System32\drivers\swg3kser00.sys
[2012/03/20 16:06:16 | 000,208,128 | R— | C] (Sierra Wireless Inc.) – C:\WINDOWS\System32\drivers\swnc8ua3.sys
[2012/03/20 16:06:08 | 000,083,968 | R— | C] (Sierra Wireless Inc.) – C:\WINDOWS\System32\drivers\swiwdmbx.sys
[2012/03/20 15:55:21 | 000,000,000 | —D | C] – C:\Program Files\Sierra Wireless Inc
[2012/03/20 15:55:21 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Sierra Wireless
[2012/03/20 15:55:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sierra Wireless
[2012/03/19 21:50:41 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\New Folder
[2012/03/19 21:17:49 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\SystemOptimizeExpert
[2012/03/19 21:17:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SystemOptimizeExpert
[2012/03/19 16:39:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\My Webs
[2012/03/18 22:16:35 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\New Folder
[2012/03/18 18:48:34 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\My Pictures
[2012/03/18 01:28:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Netsweeper
[2012/03/18 01:28:39 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Netsweeper
[2012/03/18 01:17:40 | 000,000,000 | —D | C] – C:\Program Files\bigpond
[2012/03/18 00:26:39 | 000,027,192 | —- | C] (Resplendence Software Projects Sp.) – C:\WINDOWS\System32\drivers\rspSanity32.sys
[2012/03/17 14:29:23 | 000,000,000 | —D | C] – C:\ProgramData
[2012/03/17 14:29:00 | 000,000,000 | —D | C] – C:\Program Files\Common Files\LS Getting Started
[2012/03/17 13:59:34 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2012/03/12 14:15:34 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Outlook Files
[2012/03/11 23:14:54 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\My Music
[2012/03/11 00:50:01 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Gmail - This chart is awesome! Everyone can use it_files
[2012/03/10 21:26:11 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Downloads
[2012/03/10 00:08:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2012/03/10 00:07:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Yahoo!7 Messenger
[2012/03/06 23:53:19 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\My Received Files
[2012/03/02 00:27:19 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\vlc
[2012/03/02 00:25:14 | 000,000,000 | —D | C] – C:\Program Files\VideoLAN
[2012/03/01 23:53:56 | 000,000,000 | —D | C] – C:\Program Files\WebP Codec
[2012/03/01 00:07:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ICQ7.5
[2012/03/01 00:06:22 | 000,000,000 | —D | C] – C:\Program Files\ICQ7.5
[2012/02/29 21:24:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\LightScribe

========== Files - Modified Within 30 Days ==========

[2012/03/30 16:10:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{DC70CF19-C312-4A56-ADAC-3F6B496F1C93}.job
[2012/03/30 16:10:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{57AB064D-4025-496A-B1CF-191839F9ED02}.job
[2012/03/30 16:06:02 | 000,000,410 | -H– | M] () – C:\WINDOWS\tasks\DMATask 0 {D2B22905-47C9-4b82-8E74-47AA9D2DE378} 0~0.job
[2012/03/30 15:56:00 | 000,000,906 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/03/30 15:52:01 | 000,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2012/03/30 15:51:03 | 000,038,400 | —- | M] () – C:\WINDOWS\System32\pcdhdm.cpl
[2012/03/30 15:50:46 | 000,045,378 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012/03/30 15:48:27 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cd08f460cc4b7a.job
[2012/03/30 15:48:08 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/03/30 15:48:02 | 1073,139,712 | -HS- | M] () – C:\hiberfil.sys
[2012/03/30 15:41:01 | 000,625,664 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\dds.scr
[2012/03/30 15:39:33 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\HiJackThis.exe
[2012/03/30 15:38:41 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\OTL.exe
[2012/03/30 14:00:07 | 000,000,464 | —- | M] () – C:\WINDOWS\tasks\At4.job
[2012/03/30 13:43:45 | 000,000,795 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/03/30 13:06:47 | 000,000,279 | -HS- | M] () – C:\boot.ini
[2012/03/30 10:53:26 | 000,002,625 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2012/03/30 10:10:01 | 000,000,464 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2012/03/29 20:40:01 | 000,000,464 | —- | M] () – C:\WINDOWS\tasks\At2.job
[2012/03/29 16:33:00 | 000,000,464 | —- | M] () – C:\WINDOWS\tasks\At3.job
[2012/03/29 11:18:37 | 000,288,496 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/03/28 17:41:25 | 000,000,209 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Family Tree magazine Forum • Index page.url
[2012/03/28 13:02:04 | 000,562,534 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\AGL Energy Online You have successfully set up Direct Debit.mht
[2012/03/28 00:01:10 | 001,652,966 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\All sizes Golden carpet of leaves Flickr - Photo Sharing!.mht
[2012/03/27 21:30:01 | 000,548,122 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\The new Greypath forums Greypath is the leading seniors website in Australia providing forums, news, competitions, blogging and special interest groups.mht
[2012/03/27 21:27:54 | 000,412,822 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\How to uplift an image to the forums.pdf
[2012/03/27 19:57:07 | 000,000,188 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\www.circlesoffriends.net.url
[2012/03/27 16:53:24 | 000,443,972 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/03/27 16:53:24 | 000,072,380 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/03/27 15:06:17 | 000,309,236 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\EnglandWalesFreeBMDMarriageIndex18371915_326336259.jpg
[2012/03/27 14:05:35 | 000,630,389 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\1851EnglandCensus_325242890.jpg
[2012/03/26 21:05:04 | 001,325,359 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910198.jpg
[2012/03/26 21:00:27 | 000,690,744 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910301.jpg
[2012/03/26 20:26:22 | 000,132,661 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\CD - Pre Civil Registration Marriages - Mabe.pdf
[2012/03/26 19:39:30 | 000,516,985 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\1851EnglandCensus_325243607.jpg
[2012/03/26 16:19:04 | 000,214,901 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Cornwall Family History Society, Parish Births, Marriages, Death Records.mht
[2012/03/26 01:15:31 | 000,000,111 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Zoomers.url
[2012/03/25 23:57:33 | 000,000,215 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\YP Trivia Challenge - Daily Trivia Game.url
[2012/03/25 23:18:22 | 000,000,138 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Our Coffee Shop ~ Our Place to Relax and Yak.url
[2012/03/25 16:45:33 | 007,940,608 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\211177_pierre_daspe1.pps
[2012/03/25 01:20:39 | 000,000,693 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2012/03/24 23:11:59 | 000,044,556 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\pcd update system info.html
[2012/03/24 22:58:26 | 000,343,440 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\pcd.html
[2012/03/24 15:42:57 | 000,000,116 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Cornwall Family History Society, Parish Births, Marriages, Death Records.url
[2012/03/23 21:08:15 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/03/23 19:08:09 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2012/03/23 19:07:57 | 000,001,736 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2012/03/23 13:30:44 | 000,942,515 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Measurements and Conversions - Sunbeam.mht
[2012/03/23 13:26:20 | 000,700,742 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\bm2500_ib_web_version.pdf
[2012/03/23 08:03:27 | 000,986,054 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\EnglandWalesFreeBMDMarriageIndex18371915_326469427.jpg
[2012/03/23 06:12:12 | 004,435,968 | —- | M] (Google Inc.) – C:\WINDOWS\System32\GPhotos.scr
[2012/03/22 23:14:57 | 004,447,232 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Orchideas-de-Vietnam.pps
[2012/03/22 22:24:05 | 000,000,122 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\www.picturesofengland.com.url
[2012/03/22 20:08:50 | 000,000,172 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Family Tree magazine Forum • View forum - Family History for the Computer User.url
[2012/03/21 23:35:47 | 003,741,302 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\1206_greenpeace.pdf
[2012/03/21 20:02:36 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/03/20 23:43:13 | 000,661,374 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\NewYorkPassengerLists18201957_291873630.jpg
[2012/03/20 23:40:12 | 000,486,222 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\USPassportApplications17951925_71685944.jpg
[2012/03/20 23:27:23 | 000,630,884 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\USPassportApplications17951925_69584326.jpg
[2012/03/20 23:08:27 | 000,000,132 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Health sense - Home.url
[2012/03/20 23:01:27 | 000,000,197 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Friendly Faces - Home.url
[2012/03/20 20:06:11 | 000,803,984 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\My services - BigPond.mht
[2012/03/19 21:42:44 | 000,135,785 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\st michaels mount…jpg
[2012/03/19 16:45:23 | 000,011,776 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/18 20:50:45 | 000,356,280 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\sstips.pdf
[2012/03/18 13:00:02 | 001,351,964 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Germany,Alemana vu.pps
[2012/03/18 01:47:38 | 000,184,484 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\margaret-whitlam-dies-aged-92-20120317-1vbqr.html
[2012/03/16 23:30:59 | 000,008,210 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/16 23:29:45 | 000,031,346 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/16 22:22:56 | 000,035,332 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Euclid_flowchart_1.png
[2012/03/16 20:00:43 | 000,996,984 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910270.jpg
[2012/03/15 00:55:32 | 000,019,714 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\pict1.gif
[2012/03/15 00:55:26 | 000,078,422 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\untitled.bmp
[2012/03/15 00:49:14 | 000,066,004 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\NidawiSparkle1.gif
[2012/03/15 00:49:13 | 000,019,350 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\proud-pomh.jpg
[2012/03/15 00:16:22 | 000,045,466 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\viewArticle.cfm
[2012/03/14 21:13:30 | 000,643,580 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\1901EnglandCensus_305499634.jpg
[2012/03/14 21:12:11 | 001,034,938 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\EnglandWalesFreeBMDBirthIndex18371915_326213636.jpg
[2012/03/14 21:08:38 | 000,954,168 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandDeathsandBurials18132001_224714432.jpg
[2012/03/14 12:09:36 | 000,051,458 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/13 23:21:27 | 000,128,553 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Last Week.jpg
[2012/03/13 23:21:04 | 000,091,748 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Last Fall.jpg
[2012/03/13 22:15:26 | 000,050,387 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/13 21:42:53 | 000,022,637 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\6ChAq.jpg
[2012/03/13 21:21:31 | 000,389,833 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\yGer5zSFCwXUjagXn3kTlZWq5jisvJwdn3EoUTKzvFCNLXUCpsNcm1!WQZnWFB5A.jpg
[2012/03/13 20:35:37 | 000,028,424 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Francis Rake.jpg
[2012/03/13 20:32:24 | 000,053,114 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Francis Beaven Rake australia.jpg
[2012/03/13 18:45:31 | 000,063,179 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/12 23:50:26 | 000,027,648 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\TS001012778.dot
[2012/03/12 23:44:37 | 000,084,123 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\TR001192484.PNG
[2012/03/12 22:10:30 | 005,348,701 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Baden_Powell_Round_About_Midnight_WMV V9_001.mp3
[2012/03/12 22:10:29 | 002,350,679 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Baden_Powell_Gracioso_WMV V9_001.mp3
[2012/03/12 22:10:07 | 003,240,888 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Baden_Powell_Samba_Triste_Europe_by_Loronix_WMV V9.mp3
[2012/03/12 22:03:55 | 003,500,065 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Ben Webster Quintet 1953 - Danny Boy.mp3
[2012/03/12 22:03:46 | 004,055,953 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Erroll_Garner_plays_Misty(1)_WMV V9.mp3
[2012/03/12 19:28:58 | 000,000,119 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\FamilySearch.org — Free Family History and Genealogy Records.url
[2012/03/12 19:27:27 | 000,951,982 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/12 19:27:20 | 000,974,262 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/12 16:06:04 | 000,066,297 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\13850.gif
[2012/03/12 16:06:03 | 000,125,304 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\11201.gif
[2012/03/12 16:06:02 | 000,083,451 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\11200.gif
[2012/03/12 16:06:02 | 000,048,863 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\11197.gif
[2012/03/12 11:55:09 | 000,000,114 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Dropbox - Simplify your life.url
[2012/03/12 11:38:39 | 000,062,642 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Birds With Sigma Tele.htm
[2012/03/12 11:37:00 | 000,068,011 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Zoo 11.3.htm
[2012/03/12 00:21:01 | 001,441,507 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Orchids_1.PPS
[2012/03/11 22:41:00 | 001,464,530 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910179.jpg
[2012/03/11 21:55:04 | 000,662,099 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910443.jpg
[2012/03/11 17:27:32 | 000,068,384 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\zennor2.jpg
[2012/03/11 17:27:11 | 000,100,804 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\weekstmary.jpg
[2012/03/11 17:26:48 | 000,099,867 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\whitstone.jpg
[2012/03/11 14:08:39 | 000,302,714 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\childhood-969x1024.jpg
[2012/03/11 14:08:15 | 000,056,947 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Family-Tree_640.jpg
[2012/03/11 14:00:25 | 000,050,601 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\famgrec.pdf
[2012/03/11 14:00:04 | 000,050,206 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\anchart.pdf
[2012/03/11 13:49:12 | 000,224,152 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Rake Family Tree.ged
[2012/03/11 13:46:12 | 000,020,184 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\600.jpg
[2012/03/11 13:34:47 | 000,003,972 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\vintage-stpatsday15.jpg
[2012/03/11 00:50:01 | 000,140,882 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Gmail - This chart is awesome! Everyone can use it.htm
[2012/03/10 21:36:12 | 000,136,038 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\animat10.jpg
[2012/03/10 21:06:56 | 000,009,247 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\smileywinking.gif
[2012/03/10 00:07:55 | 000,000,829 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo!7 Messenger.lnk
[2012/03/10 00:07:55 | 000,000,811 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Yahoo!7 Messenger.lnk
[2012/03/09 18:02:44 | 000,026,976 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\avatar_59_1327299910.png
[2012/03/09 18:02:14 | 000,000,209 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\The Over 50 Golden Group - Index.url
[2012/03/08 23:57:12 | 000,152,569 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\birthday.jpg
[2012/03/08 23:56:28 | 000,045,538 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\birthday3.jpg
[2012/03/08 23:56:26 | 000,064,526 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\boopbirthday4.jpg
[2012/03/08 23:56:26 | 000,029,998 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\boopbirthday1.jpg
[2012/03/08 23:56:25 | 000,041,308 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\birthdaybetty2.jpg
[2012/03/08 23:55:18 | 000,004,714 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\boop-stpatricksday18.jpg
[2012/03/08 23:54:09 | 000,072,008 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\stpat-boop2.jpg
[2012/03/08 23:53:45 | 000,071,119 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\stpat-boop1.jpg
[2012/03/08 23:52:38 | 000,042,991 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\boopvintage3.jpg
[2012/03/08 23:50:38 | 000,050,641 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\stpatty1.jpg
[2012/03/08 23:50:06 | 000,122,214 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\pattyblondem.jpg
[2012/03/08 23:49:27 | 000,140,407 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ani-stpaddyboop3.gif
[2012/03/08 23:49:25 | 000,342,532 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\st-patty1.gif
[2012/03/08 23:49:24 | 000,308,561 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\san-patty1m-400.gif
[2012/03/08 23:49:23 | 000,085,968 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ani-stpaddyboop2.gif
[2012/03/08 23:49:20 | 000,074,475 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ani-stpaddyboop1.gif
[2012/03/08 23:49:18 | 000,029,904 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\welcome.jpg
[2012/03/08 23:49:17 | 000,055,431 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\leprechaun2.jpg
[2012/03/08 23:49:17 | 000,055,383 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\imirish.jpg
[2012/03/08 23:49:17 | 000,043,831 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\blank.jpg
[2012/03/08 23:45:42 | 000,395,989 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Happy St_ Patrick's Day!.mht
[2012/03/08 13:20:22 | 000,000,111 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Electricity Suppliers, Gas Suppliers, Energy Providers AGL Energy.url
[2012/03/07 23:40:15 | 000,339,832 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Violets.gif
[2012/03/07 23:40:10 | 000,049,462 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Lillyofvalgdaft.gif
[2012/03/07 23:40:10 | 000,023,533 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\1264403127qE9kdudjpg2.jpg
[2012/03/07 23:40:10 | 000,010,043 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\photo-352.jpg
[2012/03/07 23:06:21 | 000,064,762 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\517700-queen-mary-2.jpg
[2012/03/07 23:05:55 | 000,086,415 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\517448-queen-mary-2.jpg
[2012/03/07 23:05:44 | 000,067,569 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\517435-queen-mary-2.jpg
[2012/03/07 23:05:27 | 000,065,418 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\517525-queen-mary-2.jpg
[2012/03/07 23:03:48 | 000,076,870 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\936561-flood-warnings-threat-southern-nsw.jpg
[2012/03/07 23:03:35 | 000,078,891 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\936556-flood-warnings-threat-southern-nsw.jpg
[2012/03/07 23:03:15 | 000,084,364 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\935854-flood-warnings-threat-southern-nsw.jpg
[2012/03/07 22:55:53 | 000,050,473 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\296334-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:52:55 | 000,075,407 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\296425-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:52:37 | 000,070,387 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808520-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:52:09 | 000,092,728 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808402-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:51:33 | 000,101,019 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808496-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:51:15 | 000,085,733 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808348-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:51:04 | 000,106,453 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808343-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:48:33 | 000,110,494 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\805954-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:41:19 | 000,066,173 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\767683-australia-039-s-total-rainfall.jpg
[2012/03/07 22:34:22 | 000,088,752 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\927098-moree-nsw-in-flood-0900-hrs-3feb-2012.jpg
[2012/03/07 22:06:26 | 000,007,393 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\images.jpg
[2012/03/07 21:43:51 | 000,047,526 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ATT0020012.gif
[2012/03/07 21:32:21 | 000,109,773 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\927126-moree-nsw-in-flood-0900-hrs-3feb-2012.jpg
[2012/03/07 21:25:36 | 000,041,224 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\243460-wee-waa-nsw-in-flood.jpg
[2012/03/07 21:25:21 | 000,101,065 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\244977-moree-nsw-in-flood.jpg
[2012/03/07 21:25:17 | 000,079,423 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\244397-moree-nsw-in-flood.jpg
[2012/03/07 21:23:03 | 000,070,947 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\245042-moree-nsw-in-flood.jpg
[2012/03/07 21:22:57 | 000,080,309 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\244745-moree-nsw-in-flood.jpg
[2012/03/07 21:22:52 | 000,084,833 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985127-nsw-floods.jpg
[2012/03/07 21:22:45 | 000,099,701 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985542-nsw-floods.jpg
[2012/03/07 21:22:34 | 000,114,432 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985539-nsw-floods.jpg
[2012/03/07 21:21:34 | 000,089,269 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985139-nsw-floods.jpg
[2012/03/07 21:20:42 | 000,096,066 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985599-nsw-floods.jpg
[2012/03/07 21:20:23 | 000,069,020 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\123428-nsw-floods.jpg
[2012/03/07 21:20:19 | 000,027,341 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\125622-nsw-floods.jpg
[2012/03/07 21:20:13 | 000,074,380 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\123452-nsw-floods.jpg
[2012/03/07 21:16:17 | 000,063,535 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\125314-nsw-floods.jpg
[2012/03/07 21:15:34 | 000,069,756 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\125634-nsw-floods.jpg
[2012/03/07 15:02:50 | 000,072,030 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ATT00123.jpg
[2012/03/07 15:00:58 | 000,922,463 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ATT00001.png
[2012/03/07 15:00:58 | 000,369,881 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ATT00002.png
[2012/03/07 11:15:19 | 000,041,184 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2012/03/07 11:15:14 | 000,201,352 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2012/03/07 11:04:25 | 000,112,984 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFW.sys
[2012/03/07 11:03:51 | 000,612,184 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/03/07 11:03:38 | 000,337,880 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2012/03/07 11:03:23 | 000,196,440 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswNdis2.sys
[2012/03/07 11:02:43 | 000,024,408 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswKbd.sys
[2012/03/07 11:02:00 | 000,035,672 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/03/07 11:01:53 | 000,053,848 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/03/07 11:01:39 | 000,095,704 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/03/07 11:01:35 | 000,089,048 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2012/03/07 11:01:30 | 000,020,696 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/03/07 10:58:29 | 000,024,920 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/03/07 10:44:51 | 000,012,112 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswNdis.sys
[2012/03/06 21:40:57 | 000,000,200 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Friendly Seniors Daily Trivia - Daily Trivia Game.url
[2012/03/01 00:07:38 | 000,001,516 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Microsoft\Internet Explorer\Quick Launch\ICQ7.5.lnk
[2012/03/01 00:07:38 | 000,001,498 | —- | M] () – C:\Documents and Settings\All Users\Desktop\ICQ7.5.lnk

========== Files Created - No Company Name ==========

[2012/03/30 15:40:53 | 000,625,664 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\dds.scr
[2012/03/30 13:43:45 | 000,000,795 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/03/28 13:02:02 | 000,562,534 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\AGL Energy Online You have successfully set up Direct Debit.mht
[2012/03/28 12:53:30 | 000,000,209 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Family Tree magazine Forum • Index page.url
[2012/03/28 00:01:06 | 001,652,966 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\All sizes Golden carpet of leaves Flickr - Photo Sharing!.mht
[2012/03/27 21:29:54 | 000,548,122 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\The new Greypath forums Greypath is the leading seniors website in Australia providing forums, news, competitions, blogging and special interest groups.mht
[2012/03/27 21:27:54 | 000,412,822 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\How to uplift an image to the forums.pdf
[2012/03/27 15:06:12 | 000,309,236 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\EnglandWalesFreeBMDMarriageIndex18371915_326336259.jpg
[2012/03/27 14:05:23 | 000,630,389 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\1851EnglandCensus_325242890.jpg
[2012/03/26 21:05:04 | 001,325,359 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910198.jpg
[2012/03/26 21:00:27 | 000,690,744 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910301.jpg
[2012/03/26 20:26:21 | 000,132,661 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\CD - Pre Civil Registration Marriages - Mabe.pdf
[2012/03/26 19:39:29 | 000,516,985 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\1851EnglandCensus_325243607.jpg
[2012/03/26 16:19:00 | 000,214,901 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Cornwall Family History Society, Parish Births, Marriages, Death Records.mht
[2012/03/26 01:15:31 | 000,000,111 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Zoomers.url
[2012/03/25 23:18:22 | 000,000,138 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Our Coffee Shop ~ Our Place to Relax and Yak.url
[2012/03/25 16:45:32 | 007,940,608 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\211177_pierre_daspe1.pps
[2012/03/25 01:20:39 | 000,000,693 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2012/03/24 23:11:59 | 000,044,556 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\pcd update system info.html
[2012/03/24 20:45:10 | 000,000,188 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\www.circlesoffriends.net.url
[2012/03/24 15:42:57 | 000,000,116 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Cornwall Family History Society, Parish Births, Marriages, Death Records.url
[2012/03/23 23:56:35 | 000,000,882 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cd08f460cc4b7a.job
[2012/03/23 20:06:42 | 000,000,112 | —- | C] () – C:\WINDOWS\check.bat
[2012/03/23 13:30:38 | 000,942,515 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Measurements and Conversions - Sunbeam.mht
[2012/03/23 13:26:20 | 000,700,742 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\bm2500_ib_web_version.pdf
[2012/03/23 08:03:27 | 000,986,054 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\EnglandWalesFreeBMDMarriageIndex18371915_326469427.jpg
[2012/03/22 23:14:46 | 004,447,232 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Orchideas-de-Vietnam.pps
[2012/03/22 22:24:05 | 000,000,122 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\www.picturesofengland.com.url
[2012/03/22 20:10:34 | 000,000,444 | -H– | C] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{57AB064D-4025-496A-B1CF-191839F9ED02}.job
[2012/03/22 20:08:50 | 000,000,172 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Family Tree magazine Forum • View forum - Family History for the Computer User.url
[2012/03/21 23:35:46 | 003,741,302 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\1206_greenpeace.pdf
[2012/03/20 23:43:02 | 000,661,374 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\NewYorkPassengerLists18201957_291873630.jpg
[2012/03/20 23:40:05 | 000,486,222 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\USPassportApplications17951925_71685944.jpg
[2012/03/20 23:27:13 | 000,630,884 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\USPassportApplications17951925_69584326.jpg
[2012/03/20 23:08:27 | 000,000,132 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Health sense - Home.url
[2012/03/20 20:06:03 | 000,803,984 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\My services - BigPond.mht
[2012/03/19 21:42:44 | 000,135,785 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\st michaels mount…jpg
[2012/03/18 20:50:44 | 000,356,280 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\sstips.pdf
[2012/03/18 12:59:59 | 001,351,964 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Germany,Alemana vu.pps
[2012/03/18 01:47:37 | 000,184,484 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\margaret-whitlam-dies-aged-92-20120317-1vbqr.html
[2012/03/16 23:31:01 | 000,008,210 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/16 23:29:49 | 000,031,346 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/16 22:22:53 | 000,035,332 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Euclid_flowchart_1.png
[2012/03/16 20:00:43 | 000,996,984 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910270.jpg
[2012/03/15 00:55:43 | 000,019,714 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\pict1.gif
[2012/03/15 00:55:25 | 000,078,422 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\untitled.bmp
[2012/03/15 00:49:34 | 000,066,004 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\NidawiSparkle1.gif
[2012/03/15 00:49:24 | 000,019,350 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\proud-pomh.jpg
[2012/03/15 00:16:21 | 000,045,466 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\viewArticle.cfm
[2012/03/14 21:13:22 | 000,643,580 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\1901EnglandCensus_305499634.jpg
[2012/03/14 21:12:11 | 001,034,938 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\EnglandWalesFreeBMDBirthIndex18371915_326213636.jpg
[2012/03/14 21:08:25 | 000,954,168 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandDeathsandBurials18132001_224714432.jpg
[2012/03/14 12:09:39 | 000,051,458 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/13 23:21:34 | 000,128,553 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Last Week.jpg
[2012/03/13 23:21:15 | 000,091,748 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Last Fall.jpg
[2012/03/13 22:15:29 | 000,050,387 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/13 21:43:59 | 000,022,637 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\6ChAq.jpg
[2012/03/13 21:21:37 | 000,389,833 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\yGer5zSFCwXUjagXn3kTlZWq5jisvJwdn3EoUTKzvFCNLXUCpsNcm1!WQZnWFB5A.jpg
[2012/03/13 20:35:55 | 000,028,424 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Francis Rake.jpg
[2012/03/13 20:32:52 | 000,053,114 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Francis Beaven Rake australia.jpg
[2012/03/13 18:45:35 | 000,063,179 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/12 23:50:25 | 000,027,648 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\TS001012778.dot
[2012/03/12 23:45:36 | 000,084,123 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\TR001192484.PNG
[2012/03/12 22:09:11 | 003,240,888 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Baden_Powell_Samba_Triste_Europe_by_Loronix_WMV V9.mp3
[2012/03/12 21:58:11 | 005,348,701 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Baden_Powell_Round_About_Midnight_WMV V9_001.mp3
[2012/03/12 19:28:58 | 000,000,119 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\FamilySearch.org — Free Family History and Genealogy Records.url
[2012/03/12 19:27:27 | 000,951,982 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/12 19:27:19 | 000,974,262 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\![removed]
[2012/03/12 16:06:43 | 000,066,297 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\13850.gif
[2012/03/12 16:06:35 | 000,048,863 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\11197.gif
[2012/03/12 16:06:29 | 000,125,304 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\11201.gif
[2012/03/12 16:06:18 | 000,083,451 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\11200.gif
[2012/03/12 11:55:09 | 000,000,114 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Dropbox - Simplify your life.url
[2012/03/12 11:38:38 | 000,062,642 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Birds With Sigma Tele.htm
[2012/03/12 11:36:59 | 000,068,011 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Zoo 11.3.htm
[2012/03/12 00:20:53 | 001,441,507 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Orchids_1.PPS
[2012/03/11 23:42:44 | 003,500,065 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Ben Webster Quintet 1953 - Danny Boy.mp3
[2012/03/11 23:24:58 | 004,055,953 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Erroll_Garner_plays_Misty(1)_WMV V9.mp3
[2012/03/11 23:13:23 | 002,350,679 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Baden_Powell_Gracioso_WMV V9_001.mp3
[2012/03/11 22:41:00 | 001,464,530 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910179.jpg
[2012/03/11 21:54:58 | 000,662,099 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\DorsetEnglandBaptismsMarriagesandBurials15381812_369910443.jpg
[2012/03/11 17:27:42 | 000,068,384 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\zennor2.jpg
[2012/03/11 17:27:18 | 000,100,804 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\weekstmary.jpg
[2012/03/11 17:27:01 | 000,099,867 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\whitstone.jpg
[2012/03/11 14:09:58 | 000,302,714 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\childhood-969x1024.jpg
[2012/03/11 14:08:23 | 000,056,947 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Family-Tree_640.jpg
[2012/03/11 14:00:25 | 000,050,601 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\famgrec.pdf
[2012/03/11 14:00:04 | 000,050,206 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\anchart.pdf
[2012/03/11 13:49:11 | 000,224,152 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Rake Family Tree.ged
[2012/03/11 13:46:20 | 000,020,184 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\600.jpg
[2012/03/11 13:36:04 | 000,003,972 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\vintage-stpatsday15.jpg
[2012/03/11 00:50:00 | 000,140,882 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Gmail - This chart is awesome! Everyone can use it.htm
[2012/03/10 21:37:12 | 000,136,038 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\animat10.jpg
[2012/03/10 21:07:19 | 000,009,247 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\smileywinking.gif
[2012/03/10 00:07:55 | 000,000,829 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo!7 Messenger.lnk
[2012/03/10 00:07:55 | 000,000,811 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Yahoo!7 Messenger.lnk
[2012/03/09 19:31:00 | 000,026,976 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\avatar_59_1327299910.png
[2012/03/08 23:58:14 | 000,029,998 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\boopbirthday1.jpg
[2012/03/08 23:58:01 | 000,064,526 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\boopbirthday4.jpg
[2012/03/08 23:57:48 | 000,045,538 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\birthday3.jpg
[2012/03/08 23:57:18 | 000,152,569 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\birthday.jpg
[2012/03/08 23:56:41 | 000,041,308 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\birthdaybetty2.jpg
[2012/03/08 23:55:55 | 000,004,714 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\boop-stpatricksday18.jpg
[2012/03/08 23:54:14 | 000,072,008 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\stpat-boop2.jpg
[2012/03/08 23:53:51 | 000,071,119 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\stpat-boop1.jpg
[2012/03/08 23:53:14 | 000,042,991 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\boopvintage3.jpg
[2012/03/08 23:52:49 | 000,029,904 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\welcome.jpg
[2012/03/08 23:52:17 | 000,043,831 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\blank.jpg
[2012/03/08 23:51:51 | 000,140,407 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ani-stpaddyboop3.gif
[2012/03/08 23:51:44 | 000,085,968 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ani-stpaddyboop2.gif
[2012/03/08 23:51:38 | 000,074,475 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ani-stpaddyboop1.gif
[2012/03/08 23:51:21 | 000,055,431 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\leprechaun2.jpg
[2012/03/08 23:51:09 | 000,055,383 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\imirish.jpg
[2012/03/08 23:50:43 | 000,050,641 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\stpatty1.jpg
[2012/03/08 23:50:11 | 000,122,214 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\pattyblondem.jpg
[2012/03/08 23:49:41 | 000,342,532 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\st-patty1.gif
[2012/03/08 23:49:35 | 000,308,561 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\san-patty1m-400.gif
[2012/03/08 23:45:41 | 000,395,989 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Happy St_ Patrick's Day!.mht
[2012/03/08 13:20:22 | 000,000,111 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\Electricity Suppliers, Gas Suppliers, Energy Providers AGL Energy.url
[2012/03/07 23:42:56 | 000,010,043 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\photo-352.jpg
[2012/03/07 23:41:44 | 000,023,533 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\1264403127qE9kdudjpg2.jpg
[2012/03/07 23:41:38 | 000,049,462 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Lillyofvalgdaft.gif
[2012/03/07 23:41:29 | 000,339,832 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\Violets.gif
[2012/03/07 23:06:27 | 000,064,762 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\517700-queen-mary-2.jpg
[2012/03/07 23:06:00 | 000,086,415 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\517448-queen-mary-2.jpg
[2012/03/07 23:05:51 | 000,067,569 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\517435-queen-mary-2.jpg
[2012/03/07 23:05:40 | 000,065,418 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\517525-queen-mary-2.jpg
[2012/03/07 23:03:56 | 000,076,870 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\936561-flood-warnings-threat-southern-nsw.jpg
[2012/03/07 23:03:45 | 000,078,891 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\936556-flood-warnings-threat-southern-nsw.jpg
[2012/03/07 23:03:32 | 000,084,364 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\935854-flood-warnings-threat-southern-nsw.jpg
[2012/03/07 22:56:04 | 000,050,473 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\296334-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:53:03 | 000,075,407 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\296425-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:52:43 | 000,070,387 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808520-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:52:24 | 000,092,728 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808402-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:51:52 | 000,101,019 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808496-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:51:28 | 000,085,733 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808348-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:51:11 | 000,106,453 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\808343-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:49:32 | 000,110,494 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\805954-rain-wreaks-havoc-across-nsw.jpg
[2012/03/07 22:43:30 | 000,066,173 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\767683-australia-039-s-total-rainfall.jpg
[2012/03/07 22:34:30 | 000,088,752 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\927098-moree-nsw-in-flood-0900-hrs-3feb-2012.jpg
[2012/03/07 22:34:18 | 000,109,773 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\927126-moree-nsw-in-flood-0900-hrs-3feb-2012.jpg
[2012/03/07 22:33:08 | 000,041,224 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\243460-wee-waa-nsw-in-flood.jpg
[2012/03/07 22:32:54 | 000,101,065 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\244977-moree-nsw-in-flood.jpg
[2012/03/07 22:32:43 | 000,079,423 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\244397-moree-nsw-in-flood.jpg
[2012/03/07 22:30:02 | 000,070,947 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\245042-moree-nsw-in-flood.jpg
[2012/03/07 22:29:52 | 000,080,309 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\244745-moree-nsw-in-flood.jpg
[2012/03/07 22:29:44 | 000,084,833 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985127-nsw-floods.jpg
[2012/03/07 22:29:36 | 000,099,701 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985542-nsw-floods.jpg
[2012/03/07 22:29:29 | 000,114,432 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985539-nsw-floods.jpg
[2012/03/07 22:29:21 | 000,089,269 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985139-nsw-floods.jpg
[2012/03/07 22:28:40 | 000,096,066 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\985599-nsw-floods.jpg
[2012/03/07 22:28:27 | 000,069,020 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\123428-nsw-floods.jpg
[2012/03/07 22:28:20 | 000,027,341 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\125622-nsw-floods.jpg
[2012/03/07 22:28:09 | 000,074,380 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\123452-nsw-floods.jpg
[2012/03/07 22:27:59 | 000,063,535 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\125314-nsw-floods.jpg
[2012/03/07 22:27:49 | 000,069,756 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\125634-nsw-floods.jpg
[2012/03/07 22:06:39 | 000,007,393 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\images.jpg
[2012/03/07 21:44:02 | 000,047,526 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ATT0020012.gif
[2012/03/07 15:04:15 | 000,072,030 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ATT00123.jpg
[2012/03/07 15:01:28 | 000,369,881 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ATT00002.png
[2012/03/07 15:01:11 | 000,922,463 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\My Documents\ATT00001.png
[2012/03/06 02:01:12 | 1073,139,712 | -HS- | C] () – C:\hiberfil.sys
[2012/03/01 00:07:38 | 000,001,516 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Microsoft\Internet Explorer\Quick Launch\ICQ7.5.lnk
[2012/03/01 00:07:38 | 000,001,498 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ICQ7.5.lnk
[2012/02/28 14:13:23 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/03 15:23:37 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2011/11/17 11:10:46 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\wscif.dll
[2011/05/21 17:01:51 | 000,000,048 | —- | C] () – C:\WINDOWS\cgminivw.ini
[2011/05/07 18:57:10 | 000,000,183 | —- | C] () – C:\WINDOWS\Z.ini
[2011/04/30 23:51:27 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2011/04/24 02:15:25 | 000,000,286 | —- | C] () – C:\WINDOWS\reimage.ini
[2011/03/20 00:12:30 | 000,001,514 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\wklnhst.dat
[2010/12/26 10:53:29 | 000,002,048 | —- | C] () – C:\WINDOWS\System32\drivers\rt73.bin
[2010/12/14 22:09:45 | 000,315,392 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2010/12/14 22:09:45 | 000,295,018 | —- | C] () – C:\WINDOWS\System32\Install7x.dll
[2010/12/02 19:17:28 | 000,011,776 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/27 02:43:00 | 000,000,159 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Local Settings\Application Data\fusioncache.dat
[2010/08/19 00:21:15 | 000,023,116 | —- | C] () – C:\WINDOWS\hpqins15.dat.temp

========== LOP Check ==========

[2012/03/29 16:52:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2012/01/03 00:03:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ask
[2009/08/15 18:15:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Authentium(2)
[2008/03/19 18:27:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avg7
[2007/03/18 18:32:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg7(2)
[2007/03/18 18:29:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg7(3)
[2007/03/18 18:19:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg7(4)
[2007/04/11 10:11:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2007/04/14 15:23:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canon
[2010/01/26 00:11:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Downloader
[2009/08/01 19:49:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\eBay
[2007/11/13 19:13:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Emotum
[2010/01/01 13:34:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\F-Secure
[2010/08/31 16:01:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FileCure
[2008/03/19 18:26:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2007/03/18 18:29:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft(3)
[2007/03/18 18:19:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft(4)
[2012/03/01 00:07:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ICQ
[2008/01/19 16:29:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2012/02/29 21:24:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2008/03/06 20:38:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MailFrontier
[2009/10/18 17:35:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MyHeritage
[2009/08/29 13:17:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2012/03/20 15:55:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sierra Wireless
[2012/03/19 21:17:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SystemOptimizeExpert
[2012/03/20 16:12:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Telstra
[2007/10/31 19:25:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/05/24 01:00:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2010/08/20 21:36:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\VirtualizedApplications
[2009/07/11 16:31:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WholeSecurity
[2009/08/25 21:13:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/05/23 20:44:26 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2009/12/28 20:10:30 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
[2009/12/04 22:09:21 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2012/03/30 10:10:01 | 000,000,464 | —- | M] () – C:\WINDOWS\Tasks\At1.job
[2012/03/29 20:40:01 | 000,000,464 | —- | M] () – C:\WINDOWS\Tasks\At2.job
[2012/03/29 16:33:00 | 000,000,464 | —- | M] () – C:\WINDOWS\Tasks\At3.job
[2012/03/30 14:00:07 | 000,000,464 | —- | M] () – C:\WINDOWS\Tasks\At4.job
[2012/03/30 16:11:02 | 000,000,410 | -H– | M] () – C:\WINDOWS\Tasks\DMATask 0 {D2B22905-47C9-4b82-8E74-47AA9D2DE378} 0~0.job
[2011/02/21 00:44:00 | 000,000,480 | —- | M] () – C:\WINDOWS\Tasks\Easy Internet Sign-up.job
[2012/03/30 16:10:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{57AB064D-4025-496A-B1CF-191839F9ED02}.job
[2012/03/30 16:10:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{DC70CF19-C312-4A56-ADAC-3F6B496F1C93}.job

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/05/25 20:05:54 | 000,000,050 | —- | M] () – C:\AUTOEXEC.BAT
[2010/11/27 02:40:23 | 000,000,211 | RHS- | M] () – C:\BOOT.BAK
[2012/03/30 13:06:47 | 000,000,279 | -HS- | M] () – C:\boot.ini
[2004/08/10 08:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2008/01/17 13:08:23 | 000,000,074 | —- | M] () – C:\CMLoader.log
[2005/10/18 13:47:20 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2007/05/23 16:53:39 | 001,268,575 | —- | M] () – C:\EasyShare.dmp
[2007/05/23 16:53:01 | 000,000,372 | —- | M] () – C:\EasyShareInstall.log
[2012/03/30 15:48:02 | 1073,139,712 | -HS- | M] () – C:\hiberfil.sys
[2005/10/18 13:47:20 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/03/27 00:44:48 | 000,023,484 | —- | M] () – C:\JavaRa.log
[2008/01/05 13:38:01 | 000,001,060 | —- | M] () – C:\libSRTP_log.txt
[2010/09/01 19:41:52 | 000,003,859 | —- | M] () – C:\Marriages examples.csv
[2005/10/18 13:47:20 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/10 08:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/11/28 14:55:05 | 000,250,048 | RHS- | M] () – C:\ntldr
[2012/03/30 15:48:01 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2008/06/13 18:33:47 | 000,001,761 | —- | M] () – C:\photodex-presenter-install.log
[2010/11/27 19:14:39 | 000,006,090 | —- | M] () – C:\resetlog.txt
[2008/03/16 16:17:48 | 000,000,232 | -H– | M] () – C:\sqmdata00.sqm
[2008/03/17 09:19:45 | 000,000,232 | -H– | M] () – C:\sqmdata01.sqm
[2008/03/17 10:35:50 | 000,000,232 | -H– | M] () – C:\sqmdata02.sqm
[2008/03/17 11:45:00 | 000,000,232 | -H– | M] () – C:\sqmdata03.sqm
[2008/03/18 17:30:30 | 000,000,232 | -H– | M] () – C:\sqmdata04.sqm
[2008/03/18 17:35:11 | 000,000,232 | -H– | M] () – C:\sqmdata05.sqm
[2008/03/18 18:01:47 | 000,000,232 | -H– | M] () – C:\sqmdata06.sqm
[2008/03/19 18:24:02 | 000,000,232 | -H– | M] () – C:\sqmdata07.sqm
[2008/09/28 12:24:09 | 000,000,268 | -H– | M] () – C:\sqmdata08.sqm
[2007/01/03 17:47:23 | 000,000,232 | -H– | M] () – C:\sqmdata09.sqm
[2007/01/06 09:21:36 | 000,000,268 | -H– | M] () – C:\sqmdata10.sqm
[2007/01/14 22:15:25 | 000,000,232 | -H– | M] () – C:\sqmdata11.sqm
[2007/01/14 22:16:41 | 000,000,232 | -H– | M] () – C:\sqmdata12.sqm
[2007/01/30 15:16:28 | 000,000,304 | -H– | M] () – C:\sqmdata13.sqm
[2007/02/28 05:23:38 | 000,000,268 | -H– | M] () – C:\sqmdata14.sqm
[2007/03/04 13:56:04 | 000,000,268 | -H– | M] () – C:\sqmdata15.sqm
[2007/03/11 14:43:37 | 000,000,268 | -H– | M] () – C:\sqmdata16.sqm
[2008/03/08 19:27:56 | 000,000,232 | -H– | M] () – C:\sqmdata17.sqm
[2008/03/08 19:32:36 | 000,000,232 | -H– | M] () – C:\sqmdata18.sqm
[2008/03/11 14:41:34 | 000,000,232 | -H– | M] () – C:\sqmdata19.sqm
[2008/03/16 16:17:48 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2008/03/17 09:19:45 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2008/03/17 10:35:50 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2008/03/17 11:45:00 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2008/03/18 17:30:30 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2008/03/18 17:35:11 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2008/03/18 18:01:46 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2008/03/19 18:24:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2008/09/28 12:24:09 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2007/01/03 17:47:23 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2007/01/06 09:21:36 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2007/01/14 22:15:25 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2007/01/14 22:16:41 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2007/01/30 15:16:28 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2007/02/28 05:23:38 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2007/03/04 13:56:04 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2007/03/11 14:43:37 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2008/03/08 19:27:56 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2008/03/08 19:32:36 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2008/03/11 14:41:34 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm
[2001/05/24 13:59:30 | 000,162,304 | —- | M] () – C:\UNWISE.EXE
[2008/08/24 00:02:39 | 000,000,146 | —- | M] () – C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/10/18 13:46:28 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 23:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/10/20 18:21:50 | 000,278,016 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5mu.dll
[2008/07/06 21:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
[2002/05/14 16:50:34 | 000,011,264 | —- | M] (BVRP Software) – C:\WINDOWS\system32\spool\prtprocs\w32x86\wfxprint2000.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/03/07 11:15:19 | 000,041,184 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2008/08/10 02:24:41 | 000,000,000 | —- | M] () – C:\WINDOWS\WLXPGSS(2).SCR
[2010/04/17 01:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >
[2006/12/27 16:39:55 | 000,000,219 | —- | M] () – C:\Documents and Settings\All Users\Favorites\BigPond Broadband ADSL FAQ.url
[2007/03/13 14:06:43 | 000,000,180 | —- | M] () – C:\Documents and Settings\All Users\Favorites\BigPond.url
[2007/03/13 14:06:43 | 000,000,181 | —- | M] () – C:\Documents and Settings\All Users\Favorites\Google.url
[2007/03/13 14:06:43 | 000,000,073 | —- | M] () – C:\Documents and Settings\All Users\Favorites\SpeedStream ADSL modem.url
[2007/03/13 14:06:44 | 000,000,176 | —- | M] () – C:\Documents and Settings\All Users\Favorites\telstra.com.url
[2007/03/13 14:06:43 | 000,000,223 | —- | M] () – C:\Documents and Settings\All Users\Favorites\Usage meter.url
[2007/03/13 14:06:43 | 000,000,198 | —- | M] () – C:\Documents and Settings\All Users\Favorites\Welcome to Telstra BigPond.url

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/10/18 23:35:44 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2005/10/18 23:35:44 | 000,659,456 | —- | M] () – C:\WINDOWS\System32\config\software.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/11/28 14:59:13 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/11/27 02:45:30 | 000,000,170 | -HS- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/10/18 13:52:34 | 000,000,079 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2012/03/30 15:39:33 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\HiJackThis.exe
[2012/03/30 15:38:41 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Administrator.YOUR-C6B5E4EABC.000\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-03-22 20:50:32

< >

< >

< End of report >

Hi,

Please do the following:

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• when the window opens, click on Change Parameters
• under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
• click OK
• Press Start Scan
  
  • If Malicious objects are found then ensure Cure is selected
  • If TDLFS File System is found then ensure Delete is selected
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

NEXT


Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Hi Catbyte.. here is the scan logs you requested…

6:06:57.0281 3160 TDSS rootkit removing tool [removed] Mar 26 2012 13:40:18
16:06:58.0187 3160 ============================================================
16:06:58.0187 3160 Current date / time: 2012/04/01 16:06:58.0187
16:06:58.0187 3160 SystemInfo:
16:06:58.0187 3160
16:06:58.0187 3160 OS Version: 5.1.2600 ServicePack: 3.0
16:06:58.0187 3160 Product type: Workstation
16:06:58.0187 3160 ComputerName: YOUR-C6B5E4EABC
16:06:58.0187 3160 UserName: HP_Administrator
16:06:58.0187 3160 Windows directory: C:\WINDOWS
16:06:58.0187 3160 System windows directory: C:\WINDOWS
16:06:58.0187 3160 Processor architecture: Intel x86
16:06:58.0187 3160 Number of processors: 2
16:06:58.0187 3160 Page size: 0x1000
16:06:58.0187 3160 Boot type: Normal boot
16:06:58.0187 3160 ============================================================
16:07:01.0234 3160 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
16:07:01.0265 3160 \Device\Harddisk0\DR0:
16:07:01.0265 3160 MBR used
16:07:01.0265 3160 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xBC4FEF1
16:07:01.0265 3160 \Device\Harddisk0\DR0\Partition1: MBR, Type 0xC, StartLBA 0x119171EB, BlocksNum 0x11018D6
16:07:01.0500 3160 Initialize success
16:07:01.0500 3160 ============================================================
16:07:34.0515 2744 ============================================================
16:07:34.0515 2744 Scan started
16:07:34.0515 2744 Mode: Manual; TDLFS;
16:07:34.0515 2744 ============================================================
16:07:34.0937 2744 Aavmker4 (473f97edc5a5312f3665ab2921196c0c) C:\WINDOWS\system32\drivers\Aavmker4.sys
16:07:34.0937 2744 Aavmker4 - ok
16:07:34.0968 2744 Abiosdsk - ok
16:07:34.0984 2744 abp480n5 - ok
16:07:35.0031 2744 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:07:35.0046 2744 ACPI - ok
16:07:35.0093 2744 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
16:07:35.0093 2744 ACPIEC - ok
16:07:35.0109 2744 adpu160m - ok
16:07:35.0140 2744 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
16:07:35.0140 2744 aec - ok
16:07:35.0187 2744 AegisP (91f3df93f40a74d222cd166fe95db633) C:\WINDOWS\system32\DRIVERS\AegisP.sys
16:07:35.0187 2744 AegisP - ok
16:07:35.0234 2744 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
16:07:35.0234 2744 AFD - ok
16:07:35.0296 2744 AgereSoftModem (994a42d273c35b43ee9d1e8a5d8bc639) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
16:07:35.0328 2744 AgereSoftModem - ok
16:07:35.0343 2744 Aha154x - ok
16:07:35.0359 2744 aic78u2 - ok
16:07:35.0375 2744 aic78xx - ok
16:07:35.0437 2744 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll
16:07:35.0437 2744 Alerter - ok
16:07:35.0484 2744 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe
16:07:35.0484 2744 ALG - ok
16:07:35.0500 2744 AliIde - ok
16:07:35.0531 2744 amsint - ok
16:07:35.0687 2744 Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
16:07:35.0687 2744 Apple Mobile Device - ok
16:07:35.0734 2744 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll
16:07:35.0734 2744 AppMgmt - ok
16:07:35.0765 2744 aracpi (00523019e3579c8f8a94457fe25f0f24) C:\WINDOWS\system32\DRIVERS\aracpi.sys
16:07:35.0765 2744 aracpi - ok
16:07:35.0781 2744 arhidfltr (9fedaa46eb1a572ac4d9ee6b5f123cf2) C:\WINDOWS\system32\DRIVERS\arhidfltr.sys
16:07:35.0796 2744 arhidfltr - ok
16:07:35.0812 2744 arkbcfltr (82969576093cd983dd559f5a86f382b4) C:\WINDOWS\system32\DRIVERS\arkbcfltr.sys
16:07:35.0812 2744 arkbcfltr - ok
16:07:35.0828 2744 armoucfltr (9b21791d8a78faece999fadbebda6c22) C:\WINDOWS\system32\DRIVERS\armoucfltr.sys
16:07:35.0828 2744 armoucfltr - ok
16:07:36.0000 2744 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
16:07:36.0000 2744 Arp1394 - ok
16:07:36.0062 2744 ARPolicy (7a2da7c7b0c524ef26a79f17a5c69fde) C:\WINDOWS\system32\DRIVERS\arpolicy.sys
16:07:36.0062 2744 ARPolicy - ok
16:07:36.0109 2744 ARSVC (9a0d9b2e263bede80fb79ddbad240ec1) C:\WINDOWS\arservice.exe
16:07:37.0500 2744 ARSVC - ok
16:07:37.0656 2744 asc - ok
16:07:37.0718 2744 asc3350p - ok
16:07:37.0734 2744 asc3550 - ok
16:07:37.0890 2744 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
16:07:37.0937 2744 aspnet_state - ok
16:07:37.0984 2744 aswFsBlk (0ae43c6c411254049279c2ee55630f95) C:\WINDOWS\system32\drivers\aswFsBlk.sys
16:07:37.0984 2744 aswFsBlk - ok
16:07:38.0031 2744 aswFW (80beddcbb4a1417cec0c78a61cac0f66) C:\WINDOWS\system32\drivers\aswFW.sys
16:07:38.0031 2744 aswFW - ok
16:07:38.0046 2744 aswKbd (81e695913fefd4e23360a69c0f151797) C:\WINDOWS\system32\drivers\aswKbd.sys
16:07:38.0046 2744 aswKbd - ok
16:07:38.0093 2744 aswMon2 (8c30b7ddd2f1d8d138ebe40345af2b11) C:\WINDOWS\system32\drivers\aswMon2.sys
16:07:38.0093 2744 aswMon2 - ok
16:07:38.0109 2744 aswNdis (7b948e3657bea62e437bc46ca6ef6012) C:\WINDOWS\system32\DRIVERS\aswNdis.sys
16:07:38.0109 2744 aswNdis - ok
16:07:38.0125 2744 aswNdis2 (72c8f79d72b4ff6e1627276ddf4b01c9) C:\WINDOWS\system32\drivers\aswNdis2.sys
16:07:38.0140 2744 aswNdis2 - ok
16:07:38.0171 2744 AswRdr (da12626fd9a67f4e917e2f2fbe1e1764) C:\WINDOWS\system32\drivers\AswRdr.sys
16:07:38.0171 2744 AswRdr - ok
16:07:38.0218 2744 aswSnx (dcb199b967375753b5019ec15f008f53) C:\WINDOWS\system32\drivers\aswSnx.sys
16:07:38.0250 2744 aswSnx - ok
16:07:38.0296 2744 aswSP (b32873e5a1443c0a1e322266e203bf10) C:\WINDOWS\system32\drivers\aswSP.sys
16:07:38.0312 2744 aswSP - ok
16:07:38.0343 2744 aswTdi (6ff544175a9180c5d88534d3d9c9a9f7) C:\WINDOWS\system32\drivers\aswTdi.sys
16:07:38.0343 2744 aswTdi - ok
16:07:38.0390 2744 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:07:38.0406 2744 AsyncMac - ok
16:07:38.0437 2744 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
16:07:38.0437 2744 atapi - ok
16:07:38.0453 2744 Atdisk - ok
16:07:38.0500 2744 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:07:38.0500 2744 Atmarpc - ok
16:07:38.0562 2744 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll
16:07:38.0562 2744 AudioSrv - ok
16:07:38.0609 2744 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
16:07:38.0625 2744 audstub - ok
16:07:38.0718 2744 avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
16:07:38.0734 2744 avast! Antivirus - ok
16:07:38.0765 2744 avast! Firewall (7d465549dfb0eca6601e9609c72cd20a) C:\Program Files\AVAST Software\Avast\afwServ.exe
16:07:38.0781 2744 avast! Firewall - ok
16:07:38.0937 2744 bb-run (7270d070173b20ac9487ea16bb08b45f) C:\WINDOWS\system32\DRIVERS\bb-run.sys
16:07:38.0937 2744 bb-run - ok
16:07:38.0968 2744 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
16:07:38.0984 2744 Beep - ok
16:07:39.0031 2744 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll
16:07:39.0109 2744 BITS - ok
16:07:39.0203 2744 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
16:07:39.0234 2744 Bonjour Service - ok
16:07:39.0281 2744 Bridge (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys
16:07:39.0281 2744 Bridge - ok
16:07:39.0281 2744 BridgeMP (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys
16:07:39.0281 2744 BridgeMP - ok
16:07:39.0343 2744 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll
16:07:39.0343 2744 Browser - ok
16:07:39.0375 2744 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
16:07:39.0375 2744 cbidf2k - ok
16:07:39.0390 2744 cd20xrnt - ok
16:07:39.0406 2744 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
16:07:39.0406 2744 Cdaudio - ok
16:07:39.0453 2744 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
16:07:39.0453 2744 Cdfs - ok
16:07:39.0484 2744 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:07:39.0484 2744 Cdrom - ok
16:07:39.0500 2744 Changer - ok
16:07:39.0531 2744 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe
16:07:39.0531 2744 CiSvc - ok
16:07:39.0578 2744 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe
16:07:39.0578 2744 ClipSrv - ok
16:07:39.0687 2744 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:07:39.0718 2744 clr_optimization_v2.0.50727_32 - ok
16:07:39.0734 2744 CmdIde - ok
16:07:39.0750 2744 COMSysApp - ok
16:07:39.0781 2744 Cpqarray - ok
16:07:39.0968 2744 cpuz134 - ok
16:07:40.0125 2744 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll
16:07:40.0125 2744 CryptSvc - ok
16:07:40.0218 2744 dac2w2k - ok
16:07:40.0234 2744 dac960nt - ok
16:07:40.0312 2744 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
16:07:40.0343 2744 DcomLaunch - ok
16:07:40.0390 2744 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll
16:07:40.0390 2744 Dhcp - ok
16:07:40.0437 2744 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
16:07:40.0437 2744 Disk - ok
16:07:40.0453 2744 dmadmin - ok
16:07:40.0515 2744 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
16:07:40.0546 2744 dmboot - ok
16:07:40.0578 2744 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
16:07:40.0578 2744 dmio - ok
16:07:40.0609 2744 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
16:07:40.0609 2744 dmload - ok
16:07:40.0640 2744 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll
16:07:40.0656 2744 dmserver - ok
16:07:40.0687 2744 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
16:07:40.0687 2744 DMusic - ok
16:07:40.0734 2744 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll
16:07:40.0750 2744 Dnscache - ok
16:07:40.0796 2744 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll
16:07:40.0796 2744 Dot3svc - ok
16:07:40.0812 2744 dpti2o - ok
16:07:40.0859 2744 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
16:07:40.0859 2744 drmkaud - ok
16:07:40.0906 2744 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll
16:07:40.0921 2744 EapHost - ok
16:07:40.0953 2744 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll
16:07:40.0953 2744 ERSvc - ok
16:07:41.0000 2744 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
16:07:41.0015 2744 Eventlog - ok
16:07:41.0062 2744 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll
16:07:41.0078 2744 EventSystem - ok
16:07:41.0203 2744 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
16:07:41.0203 2744 Fastfat - ok
16:07:41.0265 2744 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
16:07:41.0281 2744 FastUserSwitchingCompatibility - ok
16:07:41.0328 2744 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe
16:07:41.0343 2744 Fax - ok
16:07:41.0421 2744 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
16:07:41.0421 2744 Fdc - ok
16:07:41.0453 2744 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
16:07:41.0453 2744 Fips - ok
16:07:41.0500 2744 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
16:07:41.0500 2744 Flpydisk - ok
16:07:41.0546 2744 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
16:07:41.0562 2744 FltMgr - ok
16:07:41.0656 2744 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:07:41.0671 2744 FontCache3.0.0.0 - ok
16:07:41.0703 2744 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:07:41.0703 2744 Fs_Rec - ok
16:07:41.0734 2744 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:07:41.0734 2744 Ftdisk - ok
16:07:41.0765 2744 ftsata2 (22399d3ce5840c6082844679cca5d2fc) C:\WINDOWS\system32\DRIVERS\ftsata2.sys
16:07:41.0765 2744 ftsata2 - ok
16:07:41.0812 2744 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:07:41.0812 2744 Gpc - ok
16:07:41.0968 2744 gupdate (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
16:07:41.0968 2744 gupdate - ok
16:07:41.0984 2744 gupdatem (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
16:07:41.0984 2744 gupdatem - ok
16:07:42.0078 2744 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
16:07:42.0078 2744 gusvc - ok
16:07:42.0125 2744 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
16:07:42.0125 2744 HDAudBus - ok
16:07:42.0218 2744 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:07:42.0250 2744 helpsvc - ok
16:07:42.0328 2744 HidServ - ok
16:07:42.0375 2744 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:07:42.0390 2744 HidUsb - ok
16:07:42.0437 2744 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll
16:07:42.0453 2744 hkmsvc - ok
16:07:42.0468 2744 hpn - ok
16:07:42.0531 2744 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
16:07:42.0531 2744 HPZid412 - ok
16:07:42.0578 2744 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
16:07:42.0578 2744 HPZipr12 - ok
16:07:42.0671 2744 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
16:07:42.0671 2744 HPZius12 - ok
16:07:42.0734 2744 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
16:07:42.0750 2744 HTTP - ok
16:07:42.0812 2744 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll
16:07:42.0828 2744 HTTPFilter - ok
16:07:42.0828 2744 i2omgmt - ok
16:07:42.0859 2744 i2omp - ok
16:07:42.0906 2744 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:07:42.0921 2744 i8042prt - ok
16:07:42.0984 2744 iaStor (9a65e42664d1534b68512caad0efe963) C:\WINDOWS\system32\DRIVERS\iaStor.sys
16:07:43.0015 2744 iaStor - ok
16:07:43.0109 2744 ICQ Service (7a95a3ad931b97fec5067e40636ce37f) C:\Program Files\ICQ6Toolbar\ICQ Service.exe
16:07:43.0109 2744 ICQ Service - ok
16:07:43.0250 2744 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
16:07:43.0265 2744 IDriverT - ok
16:07:43.0390 2744 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:07:43.0421 2744 idsvc - ok
16:07:43.0546 2744 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
16:07:43.0546 2744 Imapi - ok
16:07:43.0609 2744 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe
16:07:43.0625 2744 ImapiService - ok
16:07:43.0687 2744 ini910u - ok
16:07:43.0890 2744 IntcAzAudAddService (64be56b8858ca0153c725c720ffd194f) C:\WINDOWS\system32\drivers\RtkHDAud.sys
16:07:44.0031 2744 IntcAzAudAddService - ok
16:07:44.0078 2744 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
16:07:44.0078 2744 IntelIde - ok
16:07:44.0156 2744 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:07:44.0156 2744 intelppm - ok
16:07:44.0187 2744 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
16:07:44.0187 2744 Ip6Fw - ok
16:07:44.0250 2744 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:07:44.0250 2744 IpFilterDriver - ok
16:07:44.0281 2744 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:07:44.0281 2744 IpInIp - ok
16:07:44.0312 2744 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:07:44.0312 2744 IpNat - ok
16:07:44.0359 2744 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:07:44.0359 2744 IPSec - ok
16:07:44.0390 2744 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
16:07:44.0390 2744 IRENUM - ok
16:07:44.0421 2744 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:07:44.0421 2744 isapnp - ok
16:07:44.0640 2744 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe
16:07:44.0656 2744 JavaQuickStarterService - ok
16:07:44.0734 2744 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:07:44.0734 2744 Kbdclass - ok
16:07:44.0828 2744 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
16:07:44.0843 2744 kmixer - ok
16:07:44.0875 2744 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
16:07:44.0875 2744 KSecDD - ok
16:07:44.0906 2744 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll
16:07:44.0921 2744 lanmanserver - ok
16:07:44.0968 2744 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll
16:07:45.0015 2744 lanmanworkstation - ok
16:07:45.0046 2744 lbrtfdc - ok
16:07:45.0125 2744 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll
16:07:45.0125 2744 LmHosts - ok
16:07:45.0171 2744 massfilter (59f57b06d1e3c7a3f22d62c7c5b4c3c3) C:\WINDOWS\system32\drivers\massfilter.sys
16:07:45.0171 2744 massfilter - ok
16:07:45.0218 2744 massfilter_lte (ddd2330edadabc78c1b2ba244478e4e6) C:\WINDOWS\system32\drivers\massfilter_lte.sys
16:07:45.0218 2744 massfilter_lte - ok
16:07:45.0312 2744 McrdSvc (df0a511f38f16016bf658fca0090cb87) C:\WINDOWS\ehome\mcrdsvc.exe
16:07:45.0312 2744 McrdSvc - ok
16:07:45.0375 2744 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll
16:07:45.0375 2744 Messenger - ok
16:07:45.0421 2744 MHN (b7521f69c0a9b29d356157229376fb21) C:\WINDOWS\System32\mhn.dll
16:07:45.0421 2744 MHN - ok
16:07:45.0468 2744 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
16:07:45.0484 2744 MHNDRV - ok
16:07:45.0531 2744 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
16:07:45.0531 2744 mnmdd - ok
16:07:45.0578 2744 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe
16:07:45.0593 2744 mnmsrvc - ok
16:07:45.0656 2744 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
16:07:45.0671 2744 Modem - ok
16:07:45.0703 2744 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:07:45.0703 2744 Mouclass - ok
16:07:45.0812 2744 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:07:45.0812 2744 mouhid - ok
16:07:45.0859 2744 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
16:07:45.0875 2744 MountMgr - ok
16:07:45.0875 2744 mraid35x - ok
16:07:45.0937 2744 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:07:45.0937 2744 MRxDAV - ok
16:07:46.0000 2744 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:07:46.0015 2744 MRxSmb - ok
16:07:46.0046 2744 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
16:07:46.0046 2744 Msfs - ok
16:07:46.0062 2744 MSIServer - ok
16:07:46.0109 2744 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:07:46.0109 2744 MSKSSRV - ok
16:07:46.0125 2744 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:07:46.0125 2744 MSPCLOCK - ok
16:07:46.0171 2744 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
16:07:46.0171 2744 MSPQM - ok
16:07:46.0187 2744 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:07:46.0203 2744 mssmbios - ok
16:07:46.0265 2744 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
16:07:46.0281 2744 Mup - ok
16:07:46.0328 2744 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll
16:07:46.0359 2744 napagent - ok
16:07:46.0406 2744 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
16:07:46.0406 2744 NDIS - ok
16:07:46.0453 2744 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:07:46.0468 2744 NdisTapi - ok
16:07:46.0531 2744 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:07:46.0531 2744 Ndisuio - ok
16:07:46.0578 2744 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:07:46.0578 2744 NdisWan - ok
16:07:46.0640 2744 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
16:07:46.0640 2744 NDProxy - ok
16:07:46.0718 2744 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
16:07:46.0718 2744 NetBIOS - ok
16:07:46.0765 2744 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
16:07:46.0781 2744 NetBT - ok
16:07:46.0828 2744 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
16:07:46.0843 2744 NetDDE - ok
16:07:46.0843 2744 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
16:07:46.0859 2744 NetDDEdsdm - ok
16:07:46.0906 2744 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
16:07:46.0906 2744 Netlogon - ok
16:07:46.0953 2744 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll
16:07:46.0968 2744 Netman - ok
16:07:47.0109 2744 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:07:47.0109 2744 NetTcpPortSharing - ok
16:07:47.0171 2744 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
16:07:47.0171 2744 NIC1394 - ok
16:07:47.0234 2744 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll
16:07:47.0250 2744 Nla - ok
16:07:47.0281 2744 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
16:07:47.0281 2744 Npfs - ok
16:07:47.0312 2744 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
16:07:47.0343 2744 Ntfs - ok
16:07:47.0359 2744 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
16:07:47.0359 2744 NtLmSsp - ok
16:07:47.0421 2744 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll
16:07:47.0468 2744 NtmsSvc - ok
16:07:47.0593 2744 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
16:07:47.0593 2744 Null - ok
16:07:47.0734 2744 nv (34da533ef41bafa187a38a78146fbe49) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
16:07:47.0843 2744 nv - ok
16:07:47.0906 2744 NVSvc (cde37723e151f52f63a76e92bc19780b) C:\WINDOWS\system32\nvsvc32.exe
16:07:47.0921 2744 NVSvc - ok
16:07:47.0953 2744 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:07:47.0953 2744 NwlnkFlt - ok
16:07:47.0984 2744 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:07:47.0984 2744 NwlnkFwd - ok
16:07:48.0015 2744 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
16:07:48.0031 2744 ohci1394 - ok
16:07:48.0062 2744 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
16:07:48.0062 2744 Parport - ok
16:07:48.0078 2744 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
16:07:48.0093 2744 PartMgr - ok
16:07:48.0109 2744 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
16:07:48.0109 2744 ParVdm - ok
16:07:48.0187 2744 PCASp50 (1961590aa191b6b7dcf18a6a693af7b8) C:\WINDOWS\system32\Drivers\PCASp50.sys
16:07:48.0187 2744 PCASp50 - ok
16:07:48.0343 2744 PCD5SRVC{8A863ACB-F5F6CC6A-05010003} (8e8a962565d46855f031ecbf23ace17a) C:\PROGRA~1\PC-DOC~1\PCD5SRVC.pkms
16:07:48.0390 2744 PCD5SRVC{8A863ACB-F5F6CC6A-05010003} - ok
16:07:48.0437 2744 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
16:07:48.0437 2744 PCI - ok
16:07:48.0453 2744 PCIDump - ok
16:07:48.0484 2744 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
16:07:48.0484 2744 PCIIde - ok
16:07:48.0515 2744 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
16:07:48.0515 2744 Pcmcia - ok
16:07:48.0531 2744 PDCOMP - ok
16:07:48.0562 2744 PDFRAME - ok
16:07:48.0578 2744 PDRELI - ok
16:07:48.0593 2744 PDRFRAME - ok
16:07:48.0609 2744 perc2 - ok
16:07:48.0625 2744 perc2hib - ok
16:07:48.0718 2744 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
16:07:48.0718 2744 PlugPlay - ok
16:07:48.0828 2744 Pml Driver HPZ12 (2d091a99624fb9e7eef0a86d872ec0c3) C:\WINDOWS\system32\HPZipm12.exe
16:07:48.0828 2744 Pml Driver HPZ12 - ok
16:07:48.0875 2744 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
16:07:48.0890 2744 PolicyAgent - ok
16:07:48.0921 2744 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
16:07:48.0937 2744 PptpMiniport - ok
16:07:48.0953 2744 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
16:07:48.0953 2744 ProtectedStorage - ok
16:07:48.0984 2744 Ps2 (390c204ced3785609ab24e9c52054a84) C:\WINDOWS\system32\DRIVERS\PS2.sys
16:07:48.0984 2744 Ps2 - ok
16:07:49.0015 2744 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
16:07:49.0015 2744 PSched - ok
16:07:49.0062 2744 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:07:49.0078 2744 Ptilink - ok
16:07:49.0093 2744 PxHelp20 (0457e25bb122b854e267cf552dcdc370) C:\WINDOWS\system32\Drivers\PxHelp20.sys
16:07:49.0093 2744 PxHelp20 - ok
16:07:49.0109 2744 ql1080 - ok
16:07:49.0125 2744 Ql10wnt - ok
16:07:49.0140 2744 ql12160 - ok
16:07:49.0156 2744 ql1240 - ok
16:07:49.0171 2744 ql1280 - ok
16:07:49.0203 2744 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
16:07:49.0203 2744 RasAcd - ok
16:07:49.0265 2744 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll
16:07:49.0281 2744 RasAuto - ok
16:07:49.0343 2744 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:07:49.0343 2744 Rasl2tp - ok
16:07:49.0390 2744 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll
16:07:49.0406 2744 RasMan - ok
16:07:49.0468 2744 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:07:49.0468 2744 RasPppoe - ok
16:07:49.0500 2744 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
16:07:49.0500 2744 Raspti - ok
16:07:49.0562 2744 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
16:07:49.0562 2744 Rdbss - ok
16:07:49.0609 2744 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:07:49.0609 2744 RDPCDD - ok
16:07:49.0656 2744 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
16:07:49.0671 2744 rdpdr - ok
16:07:49.0734 2744 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
16:07:49.0734 2744 RDPWD - ok
16:07:49.0859 2744 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe
16:07:49.0875 2744 RDSessMgr - ok
16:07:49.0921 2744 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
16:07:49.0921 2744 redbook - ok
16:07:49.0968 2744 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll
16:07:49.0984 2744 RemoteAccess - ok
16:07:50.0031 2744 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll
16:07:50.0046 2744 RemoteRegistry - ok
16:07:50.0062 2744 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe
16:07:50.0078 2744 RpcLocator - ok
16:07:50.0140 2744 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
16:07:50.0156 2744 RpcSs - ok
16:07:50.0218 2744 rspSanity (bcbf88fabf84f0f76fd7b11df65921fa) C:\WINDOWS\system32\DRIVERS\rspSanity32.sys
16:07:50.0218 2744 rspSanity - ok
16:07:50.0234 2744 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe
16:07:50.0250 2744 RSVP - ok
16:07:50.0312 2744 RT73 (abdc839bd1c53f9c17449b10221cb942) C:\WINDOWS\system32\DRIVERS\rt73.sys
16:07:50.0328 2744 RT73 - ok
16:07:50.0359 2744 RTL8023xp (7988bfe882bcd94199225b5c3482f1bd) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
16:07:50.0375 2744 RTL8023xp - ok
16:07:50.0656 2744 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
16:07:50.0656 2744 rtl8139 - ok
16:07:50.0687 2744 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
16:07:50.0703 2744 SamSs - ok
16:07:50.0734 2744 SBRE - ok
16:07:50.0765 2744 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe
16:07:50.0781 2744 SCardSvr - ok
16:07:50.0828 2744 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll
16:07:50.0843 2744 Schedule - ok
16:07:50.0890 2744 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:07:50.0890 2744 Secdrv - ok
16:07:50.0937 2744 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll
16:07:50.0953 2744 seclogon - ok
16:07:51.0078 2744 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll
16:07:51.0093 2744 SENS - ok
16:07:51.0109 2744 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
16:07:51.0109 2744 Serial - ok
16:07:51.0140 2744 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
16:07:51.0140 2744 Sfloppy - ok
16:07:51.0187 2744 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll
16:07:51.0203 2744 SharedAccess - ok
16:07:51.0250 2744 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
16:07:51.0265 2744 ShellHWDetection - ok
16:07:51.0296 2744 Simbad - ok
16:07:51.0328 2744 Sparrow - ok
16:07:51.0359 2744 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
16:07:51.0359 2744 splitter - ok
16:07:51.0406 2744 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
16:07:51.0421 2744 Spooler - ok
16:07:51.0484 2744 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
16:07:51.0484 2744 sr - ok
16:07:51.0546 2744 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll
16:07:51.0609 2744 srservice - ok
16:07:51.0703 2744 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
16:07:51.0703 2744 Srv - ok
16:07:51.0750 2744 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll
16:07:51.0765 2744 SSDPSRV - ok
16:07:51.0843 2744 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll
16:07:51.0875 2744 stisvc - ok
16:07:51.0906 2744 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
16:07:51.0906 2744 swenum - ok
16:07:51.0984 2744 swg3kser00 (fdbd13ce3b3fc298e7fbb98b026f1ecb) C:\WINDOWS\system32\DRIVERS\swg3kser00.sys
16:07:52.0000 2744 swg3kser00 - ok
16:07:52.0109 2744 SwiCardDetectSvc (9507e7c896fabfb2e89c6e49400f6c4e) C:\Program Files\Sierra Wireless Inc\Common\SwiCardDetect.exe
16:07:52.0125 2744 SwiCardDetectSvc - ok
16:07:52.0234 2744 swiwdmbx (c61566be5b8da87f1b2bd3d9ec08592d) C:\WINDOWS\system32\DRIVERS\swiwdmbx.sys
16:07:52.0250 2744 swiwdmbx - ok
16:07:52.0265 2744 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
16:07:52.0265 2744 swmidi - ok
16:07:52.0312 2744 SWNC8UA3 (1d394f1585793ac2a9738028ff97fbe3) C:\WINDOWS\system32\DRIVERS\swnc8ua3.sys
16:07:52.0312 2744 SWNC8UA3 - ok
16:07:52.0328 2744 SwPrv - ok
16:07:52.0468 2744 symc810 - ok
16:07:52.0484 2744 symc8xx - ok
16:07:52.0500 2744 sym_hi - ok
16:07:52.0515 2744 sym_u3 - ok
16:07:52.0531 2744 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
16:07:52.0546 2744 sysaudio - ok
16:07:52.0562 2744 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe
16:07:52.0578 2744 SysmonLog - ok
16:07:52.0609 2744 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll
16:07:52.0640 2744 TapiSrv - ok
16:07:52.0687 2744 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
16:07:52.0718 2744 Tcpip - ok
16:07:52.0781 2744 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
16:07:52.0781 2744 TDPIPE - ok
16:07:52.0796 2744 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
16:07:52.0812 2744 TDTCP - ok
16:07:52.0859 2744 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
16:07:52.0875 2744 TermDD - ok
16:07:52.0921 2744 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll
16:07:52.0937 2744 TermService - ok
16:07:53.0015 2744 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
16:07:53.0031 2744 Themes - ok
16:07:53.0093 2744 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe
16:07:53.0109 2744 TlntSvr - ok
16:07:53.0125 2744 TosIde - ok
16:07:53.0156 2744 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll
16:07:53.0171 2744 TrkWks - ok
16:07:53.0218 2744 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
16:07:53.0218 2744 Udfs - ok
16:07:53.0234 2744 ultra - ok
16:07:53.0281 2744 UMWdf (9651e5d850b6f6bd7c77c70aa06f02bf) C:\WINDOWS\system32\wdfmgr.exe
16:07:53.0296 2744 UMWdf - ok
16:07:53.0437 2744 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
16:07:53.0453 2744 Update - ok
16:07:53.0515 2744 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll
16:07:53.0562 2744 upnphost - ok
16:07:53.0578 2744 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe
16:07:53.0593 2744 UPS - ok
16:07:53.0640 2744 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:07:53.0640 2744 usbccgp - ok
16:07:53.0718 2744 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:07:53.0718 2744 usbehci - ok
16:07:53.0734 2744 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:07:53.0750 2744 usbhub - ok
16:07:53.0796 2744 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
16:07:53.0796 2744 usbohci - ok
16:07:53.0859 2744 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
16:07:53.0859 2744 usbprint - ok
16:07:53.0890 2744 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:07:53.0890 2744 usbscan - ok
16:07:53.0921 2744 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:07:53.0921 2744 usbstor - ok
16:07:53.0953 2744 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:07:53.0953 2744 usbuhci - ok
16:07:53.0984 2744 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
16:07:53.0984 2744 VgaSave - ok
16:07:54.0031 2744 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
16:07:54.0031 2744 ViaIde - ok
16:07:54.0046 2744 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
16:07:54.0062 2744 VolSnap - ok
16:07:54.0109 2744 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe
16:07:54.0140 2744 VSS - ok
16:07:54.0203 2744 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll
16:07:54.0234 2744 W32Time - ok
16:07:54.0265 2744 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:07:54.0265 2744 Wanarp - ok
16:07:54.0343 2744 WDICA - ok
16:07:54.0390 2744 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
16:07:54.0406 2744 wdmaud - ok
16:07:54.0484 2744 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll
16:07:54.0500 2744 WebClient - ok
16:07:54.0593 2744 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll
16:07:54.0609 2744 winmgmt - ok
16:07:54.0671 2744 WmdmPmSN (b9715b9c18bc6c8f4b66733d208cc9f7) C:\WINDOWS\system32\MsPMSNSv.dll
16:07:54.0687 2744 WmdmPmSN - ok
16:07:54.0734 2744 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll
16:07:54.0765 2744 Wmi - ok
16:07:54.0781 2744 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe
16:07:54.0796 2744 WmiApSrv - ok
16:07:54.0875 2744 WpdUsb (bbaeaca1ffa3c86361cf0998474f6c3a) C:\WINDOWS\system32\Drivers\wpdusb.sys
16:07:54.0875 2744 WpdUsb - ok
16:07:54.0937 2744 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
16:07:54.0937 2744 WS2IFSL - ok
16:07:55.0000 2744 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll
16:07:55.0015 2744 wscsvc - ok
16:07:55.0109 2744 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll
16:07:55.0125 2744 wuauserv - ok
16:07:55.0187 2744 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll
16:07:55.0218 2744 WZCSVC - ok
16:07:55.0296 2744 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll
16:07:55.0312 2744 xmlprov - ok
16:07:55.0468 2744 YahooAUService (dd0042f0c3b606a6a8b92d49afb18ad6) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
16:07:55.0484 2744 YahooAUService - ok
16:07:55.0625 2744 ZTEusbmdm6k (513c31379b7f107e69a908d6e69d3928) C:\WINDOWS\system32\DRIVERS\ZTEusbmdm6k.sys
16:07:55.0625 2744 ZTEusbmdm6k - ok
16:07:55.0656 2744 ZTEusbnet (7df32dc0267c91bacf7e2b4e38ac5df1) C:\WINDOWS\system32\DRIVERS\ZTEusbnet.sys
16:07:55.0656 2744 ZTEusbnet - ok
16:07:55.0687 2744 ZTEusbnmea (513c31379b7f107e69a908d6e69d3928) C:\WINDOWS\system32\DRIVERS\ZTEusbnmea.sys
16:07:55.0703 2744 ZTEusbnmea - ok
16:07:55.0734 2744 ZTEusbser6k (513c31379b7f107e69a908d6e69d3928) C:\WINDOWS\system32\DRIVERS\ZTEusbser6k.sys
16:07:55.0734 2744 ZTEusbser6k - ok
16:07:55.0796 2744 MBR (0x1B8) (d11c727e03bb7318dcda069b06e652f0) \Device\Harddisk0\DR0
16:07:55.0953 2744 \Device\Harddisk0\DR0 - ok
16:07:55.0953 2744 Boot (0x1200) (9d3997242c219618661a1b325ab9d97e) \Device\Harddisk0\DR0\Partition0
16:07:55.0953 2744 \Device\Harddisk0\DR0\Partition0 - ok
16:07:55.0968 2744 Boot (0x1200) (e30da363d38aef44954ca3dd290df320) \Device\Harddisk0\DR0\Partition1
16:07:55.0968 2744 \Device\Harddisk0\DR0\Partition1 - ok
16:07:55.0984 2744 ============================================================
16:07:55.0984 2744 Scan finished
16:07:55.0984 2744 ============================================================
16:07:56.0000 3680 Detected object count: 0
16:07:56.0000 3680 Actual detected object count: 0









ComboFix 12-03-31.03 - HP_Administrator 01/04/2012 17:04:41.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.580 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\HP_ADM~1.000\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\09\01
c:\documents and settings\09\01\AVPAPP32.loc
c:\documents and settings\09\01\AVPSVC32.loc
c:\documents and settings\09\01\avScanUI.loc
c:\documents and settings\09\01\avScnTsk.loc
c:\documents and settings\09\01\AVSubmit.loc
c:\documents and settings\09\01\fwAlRes.loc
c:\documents and settings\09\01\isCfgCmp.loc
c:\documents and settings\09\01\isError.loc
c:\documents and settings\09\01\ISProd.loc
c:\documents and settings\09\01\isRes.loc
c:\documents and settings\09\01\isStatus.loc
c:\documents and settings\09\01\IWPLog.loc
c:\documents and settings\09\01\MCPlgRes.loc
c:\documents and settings\09\01\NAVLogV.loc
c:\documents and settings\09\01\NAVLUCbk.loc
c:\documents and settings\09\01\NAVShExt.loc
c:\documents and settings\09\01\NAVTskWz.loc
c:\documents and settings\09\01\Navw32.loc
c:\documents and settings\09\01\NISOpts.loc
c:\documents and settings\09\01\OfficeAV.loc
c:\documents and settings\09\01\osCheck.loc
c:\documents and settings\09\01\Readme.txt
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\HP_Administrator.HP\WINDOWS
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC.000\Local Settings\Temp\IadHide5.dll
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC.000\WINDOWS
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\1.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\a.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\b.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\c.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\d.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\e.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\f.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\g.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\h.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\i.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\J.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\k.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\l.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\m.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\n.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\o.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\p.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\q.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\r.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\s.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\t.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\u.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\v.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\w.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\x.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\y.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\Application Data\PriceGong\Data\z.xml
c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC\WINDOWS
c:\documents and settings\HP_Administrator\WINDOWS
c:\hp\bin\cloaker.exe
c:\program files\Internet Explorer\SET124.tmp
c:\program files\Internet Explorer\SET125.tmp
c:\program files\Internet Explorer\SET126.tmp
c:\program files\Internet Explorer\SET127.tmp
c:\program files\MyScrapNook_12EI
c:\program files\MyScrapNook_12EI\Installr\1.bin\12EIPlug.dll
c:\program files\MyScrapNook_12EI\Installr\1.bin\12EZSETP.dll
c:\program files\MyScrapNook_12EI\Installr\1.bin\NP12EISb.dll
c:\windows\HPCPCUninstaller-6.3.2.116-9972322.exe
c:\windows\kb913800.exe
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\spool\prtprocs\w32x86\wfxprint2000.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-03-01 to 2012-04-01 )))))))))))))))))))))))))))))))
.
.
2012-03-30 02:43 . 2011-12-10 04:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-03-29 05:54 . 2012-03-07 00:03 337880 —-a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-29 05:54 . 2012-03-07 00:01 20696 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-03-29 05:54 . 2012-03-07 00:04 112984 —-a-w- c:\windows\system32\drivers\aswFW.sys
2012-03-29 05:53 . 2012-03-07 00:03 196440 —-a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-03-29 05:53 . 2012-03-07 00:02 35672 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2012-03-29 05:53 . 2012-03-07 00:02 24408 —-a-w- c:\windows\system32\drivers\aswKbd.sys
2012-03-29 05:53 . 2012-03-07 00:01 53848 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-29 05:53 . 2012-03-07 00:03 612184 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-29 05:53 . 2012-03-07 00:01 95704 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2012-03-29 05:53 . 2012-03-07 00:01 89048 —-a-w- c:\windows\system32\drivers\aswmon.sys
2012-03-29 05:53 . 2012-03-06 23:58 24920 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2012-03-29 05:52 . 2012-03-06 23:44 12112 —-a-w- c:\windows\system32\drivers\aswNdis.sys
2012-03-29 05:52 . 2012-03-07 00:15 41184 —-a-w- c:\windows\avastSS.scr
2012-03-29 05:52 . 2012-03-07 00:15 201352 —-a-w- c:\windows\system32\aswBoot.exe
2012-03-29 05:52 . 2012-03-29 05:52 ——– d—–w- c:\program files\AVAST Software
2012-03-29 05:12 . 2012-03-29 05:12 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Bigpond
2012-03-28 13:37 . 2012-03-28 13:37 ——– d—–w- c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\OpenOffice.org
2012-03-28 02:58 . 2012-03-28 04:10 ——– d—–w- c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Telstra
2012-03-28 02:57 . 2010-07-16 00:04 7680 —-a-r- c:\windows\system32\drivers\massfilter.sys
2012-03-28 02:57 . 2010-07-16 00:04 114688 —-a-r- c:\windows\system32\drivers\ZTEusbnet.sys
2012-03-28 02:57 . 2010-07-16 00:04 105856 —-a-r- c:\windows\system32\drivers\ZTEusbser6k.sys
2012-03-28 02:57 . 2010-07-16 00:04 105856 —-a-r- c:\windows\system32\drivers\ZTEusbnmea.sys
2012-03-28 02:57 . 2010-07-16 00:04 105856 —-a-r- c:\windows\system32\drivers\ZTEusbmdm6k.sys
2012-03-24 14:20 . 2012-03-24 14:20 ——– d—–w- c:\program files\CCleaner
2012-03-23 09:06 . 2008-08-11 07:44 94720 —-a-w- c:\windows\MsiZap.exe
2012-03-23 09:06 . 2008-08-11 07:44 40960 —-a-w- c:\windows\msicuu.exe
2012-03-23 09:06 . 2006-07-23 22:50 125744 —-a-w- c:\windows\MSSTDFMT.DLL
2012-03-23 09:06 . 2010-08-27 02:39 112 —-a-w- c:\windows\check.bat
2012-03-23 09:06 . 2010-07-07 02:33 49152 —-a-w- c:\windows\BPS2check.exe
2012-03-23 08:06 . 2012-03-23 08:06 ——– d-sh–w- c:\windows\system32\config\systemprofile\IECompatCache
2012-03-23 03:44 . 2012-03-23 03:44 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2012-03-22 19:12 . 2012-03-22 19:12 4435968 —-a-w- c:\windows\system32\GPhotos.scr
2012-03-20 05:12 . 2012-03-20 05:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Telstra
2012-03-20 05:07 . 2012-03-20 05:07 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Sierra Wireless
2012-03-20 05:07 . 2011-08-09 03:28 15896 —-a-r- c:\windows\system32\drivers\massfilter_LTE.sys
2012-03-20 05:07 . 2011-08-09 03:28 138264 —-a-r- c:\windows\system32\drivers\zgdcnet.sys
2012-03-20 05:07 . 2011-08-09 03:28 113168 —-a-r- c:\windows\system32\drivers\zgdcvousb.sys
2012-03-20 05:07 . 2011-08-09 03:28 113168 —-a-r- c:\windows\system32\drivers\zgdcnmea.sys
2012-03-20 05:07 . 2011-08-09 03:28 113168 —-a-r- c:\windows\system32\drivers\zgdcmdm.sys
2012-03-20 05:07 . 2011-08-09 03:28 113168 —-a-r- c:\windows\system32\drivers\zgdcdiag.sys
2012-03-20 05:07 . 2011-08-09 03:28 113168 —-a-r- c:\windows\system32\drivers\zgdcat.sys
2012-03-20 05:06 . 2011-07-21 00:52 215552 —-a-r- c:\windows\system32\drivers\swg3kser00.sys
2012-03-20 05:06 . 2011-07-21 00:52 208128 —-a-r- c:\windows\system32\drivers\swnc8ua3.sys
2012-03-20 05:06 . 2011-07-21 00:52 83968 —-a-r- c:\windows\system32\drivers\swiwdmbx.sys
2012-03-20 04:55 . 2012-03-28 02:55 ——– d—–w- c:\program files\Sierra Wireless Inc
2012-03-20 04:55 . 2012-03-20 04:55 ——– d—–w- c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\Sierra Wireless
2012-03-20 04:55 . 2012-03-20 04:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Sierra Wireless
2012-03-19 10:17 . 2012-03-19 10:17 ——– d—–w- c:\documents and settings\All Users\Application Data\SystemOptimizeExpert
2012-03-19 10:17 . 2012-03-19 10:17 ——– d—–w- c:\documents and settings\HP_Administrator.YOUR-C6B5E4EABC.000\Application Data\SystemOptimizeExpert
2012-03-18 05:23 . 2012-03-18 05:23 ——– d-sh–w- c:\windows\system32\config\systemprofile\PrivacIE
2012-03-18 05:23 . 2012-03-18 05:23 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2012-03-17 14:28 . 2012-03-17 14:28 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Netsweeper
2012-03-17 14:28 . 2012-03-17 14:28 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Netsweeper
2012-03-17 14:28 . 2012-03-17 14:28 ——– d—–w- c:\documents and settings\LocalService\Application Data\Netsweeper
2012-03-17 14:17 . 2012-03-29 05:14 ——– d—–w- c:\program files\bigpond
2012-03-17 13:26 . 2010-08-23 06:07 27192 —-a-w- c:\windows\system32\drivers\rspSanity32.sys
2012-03-17 03:29 . 2012-03-17 03:29 ——– dc—-w- C:\ProgramData
2012-03-17 03:29 . 2012-03-17 03:29 ——– d—a-w- c:\program files\Common Files\LS Getting Started
2012-03-17 02:59 . 2012-03-17 02:59 ——– d—–w- c:\program files\Microsoft Works
2012-03-09 13:08 . 2012-03-09 13:16 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-01 07:22 . 2011-01-10 05:31 38400 —-a-w- c:\windows\system32\pcdhdm.cpl
2012-03-23 10:08 . 2011-05-28 13:29 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-28 03:17 . 2012-02-28 03:18 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-02-28 03:17 . 2011-01-12 11:53 472808 —-a-w- c:\windows\system32\deployJava1.dll
2012-02-03 09:22 . 2004-08-10 04:00 1860096 —-a-w- c:\windows\system32\win32k.sys
2012-01-11 19:06 . 2012-02-28 03:13 3072 ——w- c:\windows\system32\iacenc.dll
2012-01-09 16:20 . 2004-08-10 04:00 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15 123536 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"ftutil2"="ftutil2.dll" [2004-06-07 106496]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-08 16010240]
"nwiz"="nwiz.exe" [2006-02-14 1519616]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-19 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]
"PCDrSmartMonitor"="c:\program files\PC-Doctor 5 for Windows\PcdSmartMonitor.exe" [2006-02-02 360448]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2010-06-09 49208]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-02-14 7557120]
"BigPondWirelessBroadbandCM"="c:\program files\Telstra\Mobile Broadband Manager\TelstraUCM.exe" [2011-09-13 6199192]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-07 4241512]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-19 65588]
Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2010-12-14 618496]
Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-5-25 36903]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AlwaysReady Power Message APP"=ARPWRMSG.EXE
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [29/03/2012 3:52 PM 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [29/03/2012 3:53 PM 196440]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [29/03/2012 3:54 PM 112984]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [29/03/2012 3:53 PM 24408]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [29/03/2012 3:53 PM 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [29/03/2012 3:54 PM 337880]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [29/03/2012 3:54 PM 20696]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [29/03/2012 3:52 PM 134920]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [7/07/2009 10:56 PM 247608]
R2 SwiCardDetectSvc;Sierra Wireless Card Detection Service;c:\program files\Sierra Wireless Inc\Common\SwiCardDetect.exe [24/06/2011 11:10 AM 238960]
R3 PCD5SRVC{8A863ACB-F5F6CC6A-05010003};PCD5SRVC{8A863ACB-F5F6CC6A-05010003} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\PC-DOC~1\PCD5SRVC.pkms [8/02/2006 6:38 PM 21120]
S1 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys –> c:\windows\system32\drivers\SBREdrv.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22/09/2008 8:03 PM 133104]
S3 cpuz134;cpuz134;\??\c:\docume~1\HP_ADM~1.000\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys –> c:\docume~1\HP_ADM~1.000\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [22/09/2008 8:03 PM 133104]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [28/03/2012 12:57 PM 7680]
S3 massfilter_lte;LTE Device Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_LTE.sys [20/03/2012 3:07 PM 15896]
S3 rspSanity;rspSanity;c:\windows\system32\drivers\rspSanity32.sys [17/03/2012 11:26 PM 27192]
S3 swg3kser00;Sierra Wireless QMI USB Device for Legacy Serial Communication;c:\windows\system32\drivers\swg3kser00.sys [20/03/2012 3:06 PM 215552]
S3 swiwdmbx;Sierra Wireless USB Bus Service;c:\windows\system32\drivers\swiwdmbx.sys [20/03/2012 3:06 PM 83968]
S3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\drivers\swnc8ua3.sys [20/03/2012 3:06 PM 208128]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [28/03/2012 12:57 PM 114688]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 06:57]
.
2012-03-29 c:\windows\Tasks\At1.job
- c:\program files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2010-11-16 10:12]
.
2012-03-31 c:\windows\Tasks\At2.job
- c:\program files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2010-11-16 10:12]
.
2012-03-30 c:\windows\Tasks\At3.job
- c:\program files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2010-11-16 10:12]
.
2012-03-31 c:\windows\Tasks\At4.job
- c:\program files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2010-11-16 10:12]
.
2012-04-01 c:\windows\Tasks\DMATask 0 {D2B22905-47C9-4b82-8E74-47AA9D2DE378} 0~0.job
- c:\program files\HP DigitalMedia Archive\DMAScheduler.exe [2006-03-19 23:05]
.
2011-02-20 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Hewlett-Packard\SDP\HPSdpApp.exe [2005-09-08 09:23]
.
2012-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cd08f460cc4b7a.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-09-22 22:47]
.
2012-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-09-22 22:47]
.
2012-04-01 c:\windows\Tasks\User_Feed_Synchronization-{57AB064D-4025-496A-B1CF-191839F9ED02}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 17:31]
.
2012-04-01 c:\windows\Tasks\User_Feed_Synchronization-{DC70CF19-C312-4A56-ADAC-3F6B496F1C93}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 17:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com.au/
uInternet Connection Wizard,ShellNext = hxxp://www.symantec.com/techsupp/servlet/ProductMessages?module=3009&error=400672&language=English&product=NAV&version=12.0.5.3&build=HPCPC_60D
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 10.0.0.138
DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} - hxxp://audownload.authentium.net/bigpond/398127b/bin/wizard.exe
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-PMLreset - c:\hp\bin\cloaker.exe
HKLM-Run-HPSUreset - c:\hp\bin\cloaker.exe
HKLM-Run-RBreset - c:\hp\bin\cloaker.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-01 17:20
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCD5SRVC{8A863ACB-F5F6CC6A-05010003}]
"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,b7,34,f2,14,f6,85,45,87,1c,41,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,b7,34,f2,14,f6,85,45,87,1c,41,\
.
[HKEY_USERS\S-1-5-21-3215866391-204183478-2582056896-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Toolbar\AncestryToolbar\Options]
@DACL=(02 0000)
"Visible"=dword:00000001
"Welcome"=dword:00000001
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1540)
c:\windows\system32\WININET.dll
c:\docume~1\HP_ADM~1.000\LOCALS~1\Temp\IadHide5.dll
c:\windows\system32\nview.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\arservice.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\eHome\ehmsas.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2012-04-01 17:29:48 - machine was rebooted
ComboFix-quarantined-files.txt 2012-04-01 07:29
.
Pre-Run: 46,311,985,152 bytes free
Post-Run: 46,428,360,704 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 09B79D47FA1E0E3D6EEA06BA650B72F5

Thanks for your help

Hi,

yes, ComboFix removed the infection

we just need to clean up the tools now, please do the following:


You can delete the TDSSKiller logs and program from your desktop.


NEXT

Follow these steps to uninstall Combofix

• Make sure your security programs are totally disabled.
• Click START then RUN
• Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

If there are any logs/tools remaining on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
  
  
• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  
  
• Download TFC to your desktop
  
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
  It's normal after running TFC cleaner that the PC will be slower to boot the first time.
  
  
• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an addon available for both Firefox and IE
  
  
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
  
• In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
  PC Safety and Security–What Do I Need?.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.