Spyware / Malware / Virus Removal

Ransomware leads to MBR virus! [Closed]

25 min read

Looking for the outcome? Ask AI

Deleted Member Topic Starter

Post #1July 20, 2012, 4:52 PM UTC

Our Windows Small Business Server 2003 Standard system was infected with "Anti-Child Porn Spam Protection", ransomware that encrypted every user-created file on the Data Drive and OS Drive with a 1-way AES-256bit encryption key and then performed a DoD wipe on the sectors that were used to generate the key. The system is now clean except for one MBR infected item. See below: 7/20/2012 12:40:35 PM Startup scanner boot sector MBR sector of the 0. physical disk probably unknown TSR.BOOT virus unable to clean I've run a ton of tools and even ran a "MBR Fix" tool that came with Hiren's and nothing seems to be getting rid of this bug… any help would be immensely appreciated! This is my first time here but seeing as how helpful I've seen some of these posts, I just had to ask!

Tomk

Post #2July 21, 2012, 4:18 PM UTC

Hi Brian Royer,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

As you can see in our terms of use… we don't work on business machines. Allot of the reason for this is the risks involved. Our purpose is not to replace a companies IT department or supplant the paid professionals out there. Business machines often times have "unique" programs installed that will react with our tools in unknown ways. And finally, we often get requests for help for business machines by people how do not have the authority to take on the responsibility of the machines.

One more thing, many of our tools will not even run on Servers.

All of that being said… here is a tool that I believe will run on your machine and may be able to help.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

FIX

Re-Run aswMBR

Click Scan

On completion of the scan

Click the Fix for TDL4 or FIXMBR for Whistler Button Select as appropriate

[external image: Posted Image]

[external image: Posted Image]

Save the log as before and post in your next reply

Deleted Member

Post #3July 23, 2012, 1:00 PM UTC

I ran aswMBR and it closed twice halfway through scanning. I don't understand why it's closing…

Tomk

Post #4July 23, 2012, 4:11 PM UTC

Well… it could be that I'm wrong and it won't work on your system… or it could be the malware fighting back.

Let's try a different approach.

MBRCheck
Please download MBRCheck.exe to your desktop.

Be sure to disable your security programs
Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
A window will open on your desktop
if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
If nothing unusual is found just press Enter
A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
Please post the contents of that file.

Deleted Member

Post #5July 23, 2012, 8:09 PM UTC

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Server 2003, Standard Edition
Windows Information:		Service Pack 2 (build 3790)
Logical Drives Mask:		0x0260001d

Kernel Drivers (total 123):
  0x80800000 \WINDOWS\system32\ntkrnlpa.exe
  0x80A50000 \WINDOWS\system32\hal.dll
  0xF7707000 \WINDOWS\system32\KDCOM.DLL
  0xF770F000 \WINDOWS\system32\BOOTVID.dll
  0xF7352000 ACPI.sys
  0xF7487000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
  0xF733C000 pci.sys
  0xF7497000 isapnp.sys
  0xF7717000 pciide.sys
  0xF74A7000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF74B7000 MountMgr.sys
  0xF7315000 ftdisk.sys
  0xF771F000 dmload.sys
  0xF72E9000 dmio.sys
  0xF72BB000 volsnap.sys
  0xF74C7000 PartMgr.sys
  0xF7727000 amdbusdr.sys
  0xF729E000 atapi.sys
  0xF74D7000 aic78xx.sys
  0xF727F000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
  0xF726A000 si3114.sys
  0xF74E7000 AmdEide.sys
  0xF7897000 SiWinAcc.sys
  0xF74F7000 disk.sys
  0xF7257000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF7232000 fltmgr.sys
  0xF7507000 Dfs.sys
  0xF720B000 KSecDD.sys
  0xF7B4A000 Ntfs.sys
  0xF76C8000 NDIS.sys
  0xF7878000 Mup.sys
  0xF7517000 crcdisk.sys
  0xBAF31000 edevmon.sys
  0xF780F000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xBA32C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF7697000 \SystemRoot\system32\DRIVERS\4mmdat.sys
  0xF7527000 \SystemRoot\system32\DRIVERS\TAPE.SYS
  0xBA2E1000 \SystemRoot\system32\DRIVERS\ati2mpad.sys
  0xBA2C5000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xF76A7000 \SystemRoot\system32\DRIVERS\watchdog.sys
  0xBA2B2000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xF76B7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF7537000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xBA29D000 \SystemRoot\system32\DRIVERS\serial.sys
  0xF7547000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xF7557000 \SystemRoot\system32\DRIVERS\fdc.sys
  0xBA285000 \SystemRoot\system32\DRIVERS\parport.sys
  0xBA270000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA246000 \SystemRoot\system32\DRIVERS\b57xp32.sys
  0xF7567000 \SystemRoot\system32\DRIVERS\amdk8.sys
  0xBA36E000 \SystemRoot\system32\DRIVERS\LMImirr.sys
  0xF779F000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xBA232000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xF7587000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xBA219000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xF7577000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xBA207000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xF7597000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xF75A7000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xF75B7000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xBA1D0000 \SystemRoot\system32\DRIVERS\rdpdr.sys
  0xF75C7000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xF79EB000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xBA1A9000 \SystemRoot\system32\DRIVERS\ks.sys
  0xBA15F000 \SystemRoot\system32\DRIVERS\update.sys
  0xF75E7000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xBA14A000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF79F5000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xF75F7000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xF7627000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0xBA034000 \SystemRoot\system32\DRIVERS\eamon.sys
  0xBA5BB000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xBA5C3000 \SystemRoot\System32\Drivers\Null.SYS
  0xBA5B3000 \SystemRoot\System32\Drivers\Beep.SYS
  0xBA012000 \SystemRoot\system32\DRIVERS\ehdrv.sys
  0xBA623000 \SystemRoot\System32\drivers\vga.sys
  0xF778F000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF7797000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xBA613000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xBA488000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xF77AF000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xB9FD9000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xBA603000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xB9F45000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xB9F14000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xBA468000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xB9EF7000 \SystemRoot\system32\DRIVERS\epfwtdir.sys
  0xB9ECD000 \SystemRoot\System32\drivers\afd.sys
  0xBA478000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xB9E9D000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xB9E27000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xB9E16000 \SystemRoot\System32\Drivers\Fips.SYS
  0xF7A9D000 \SystemRoot\System32\Drivers\BANTExt.sys
  0xB9DD9000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xBA448000 \SystemRoot\System32\Drivers\dump_diskdump.sys
  0xB9DC4000 \SystemRoot\System32\Drivers\dump_si3114.sys
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xBA3F8000 \SystemRoot\System32\drivers\Dxapi.sys
  0xBF9D4000 \SystemRoot\System32\drivers\dxg.sys
  0xF7767000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF9EB000 \SystemRoot\System32\ati2drad.dll
  0xBFA36000 \SystemRoot\System32\ATMFD.DLL
  0xB61BE000 \??\C:\WINDOWS\system32\drivers\exifs.sys
  0xB6039000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xB5FAD000 \SystemRoot\system32\DRIVERS\srv.sys
  0xF781F000 \SystemRoot\system32\DRIVERS\parvdm.sys
  0xB5E4A000 \??\C:\WINDOWS\system32\drivers\nfsrdr.sys
  0xB5DA9000 \SystemRoot\System32\Drivers\HTTP.sys
  0xB7CBC000 \??\C:\Program Files\LogMeIn\x86\RaInfo.sys
  0xF75D7000 \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
  0xB5D11000 \??\C:\WINDOWS\system32\drivers\rpcxdr.sys
  0xB59E7000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xB58BE000 \??\C:\Program Files\Free Ride Games\X4HSEx.Sys
  0xF79CD000 \??\C:\WINDOWS\system32\drivers\PSXDRV.SYS
  0xB562E000 \??\C:\WINDOWS\system32\drivers\portmap.sys
  0xB4A63000 \??\C:\WINDOWS\system32\drivers\nfssvr.sys
  0xB5937000 \SystemRoot\System32\Drivers\TDTCP.SYS
  0xB4998000 \SystemRoot\System32\Drivers\RDPWD.SYS
  0xBFF60000 \SystemRoot\System32\RDPDD.dll
  0xB533E000 \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aswMBR.sys
  0xBFA81000 \SystemRoot\System32\lmimirr.dll
  0xBFA86000 \SystemRoot\System32\lmimirr2.dll
  0x7C800000 \WINDOWS\system32\ntdll.dll

Processes (total 84):
	   0 System Idle Process
	   4 System
	 284 C:\WINDOWS\system32\smss.exe
	 336 csrss.exe
	 364 C:\WINDOWS\system32\winlogon.exe
	 412 C:\WINDOWS\system32\services.exe
	 424 C:\WINDOWS\system32\lsass.exe
	 640 C:\WINDOWS\system32\svchost.exe
	 784 svchost.exe
	 844 svchost.exe
	 868 svchost.exe
	 916 C:\WINDOWS\system32\svchost.exe
	1068 svchost.exe
	1204 C:\WINDOWS\system32\spoolsv.exe
	1232 msdtc.exe
	1352 C:\WINDOWS\system32\cisvc.exe
	1384 C:\WINDOWS\system32\nfsclnt.exe
	1432 C:\WINDOWS\system32\dfssvc.exe
	1456 C:\WINDOWS\system32\dns.exe
	1508 C:\Program Files\ESET\ESET Endpoint Antivirus\ekrn.exe
	1584 C:\Program Files\ESET\ESET Remote Administrator\Server\era.exe
	1644 C:\WINDOWS\system32\svchost.exe
	1692 C:\WINDOWS\system32\inetsrv\inetinfo.exe
	1712 llssrv.exe
	1792 C:\Program Files\LogMeIn\x86\LogMeIn.exe
	1848 C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
	1876 C:\Program Files\NovaStor\NovaBACKUP\NMSAccess.exe
	1896 C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
	1992 C:\WINDOWS\system32\ntfrs.exe
	2044 svchost.exe
	2144 C:\SFU\common\rshsvc.exe
	2184 sbscrexe.exe
	2356 C:\WINDOWS\system32\svchost.exe
	2440 C:\WINDOWS\system32\wins.exe
	2536 C:\WINDOWS\system32\PSXRUN.EXE
	2564 C:\WINDOWS\system32\PSXSS.EXE
	2608 C:\Program Files\Exchsrvr\bin\exmgmt.exe
	2828 C:\Program Files\Exchsrvr\bin\mad.exe
	2832 C:\SFU\usr\sbin\zzInterix
	3072 C:\SFU\usr\sbin\init
	3308 C:\SFU\usr\sbin\inetd
	3820 C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
	4008 C:\WINDOWS\system32\svchost.exe
	4092 svchost.exe
	 204 C:\SFU\Mapper\mapsvc.exe
	1008 C:\Program Files\Exchsrvr\bin\store.exe
	1264 C:\WINDOWS\system32\nfssvc.exe
	1164 C:\SFU\nis\nissvc.exe
	2056 wmiprvse.exe
	3008 wmiprvse.exe
	4328 C:\WINDOWS\system32\svchost.exe
	4352 EHttpSrv.exe
	4452 MSNFS
	5052 C:\WINDOWS\explorer.exe
	5196 C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
	5204 C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe
	5400 alg.exe
	2224 C:\WINDOWS\system32\cidaemon.exe
	1816 csrss.exe
	3720 C:\WINDOWS\system32\winlogon.exe
	3868 C:\WINDOWS\system32\rdpclip.exe
	5268 C:\WINDOWS\explorer.exe
	6036 C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
	3396 C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe
	3332 C:\WINDOWS\system32\ctfmon.exe
	4572 C:\WINDOWS\system32\inetsrv\w3wp.exe
	1420 C:\Program Files\Procomm Plus\programs\PW4.EXE
	7660 C:\WINDOWS\system32\mstsc.exe
	2380 csrss.exe
	6760 C:\WINDOWS\system32\winlogon.exe
	7724 C:\WINDOWS\system32\rdpclip.exe
	7264 C:\WINDOWS\explorer.exe
	1220 C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
	4748 C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe
	5868 C:\WINDOWS\system32\ctfmon.exe
	2500 C:\Program Files\Mozilla Firefox\Copy of firefox.exe
	6092 C:\Program Files\Mozilla Firefox\plugin-container.exe
	7276 C:\Program Files\Mozilla Firefox\plugin-container.exe
	3616 C:\Program Files\Mozilla Firefox\plugin-container.exe
	8004 C:\Program Files\LogMeIn\x86\LogMeIn.exe
	6340 C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
	2064 C:\Program Files\Internet Explorer\iexplore.exe
	6332 C:\Program Files\Internet Explorer\iexplore.exe
	7364 C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)
\\.\E: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00  (NTFS)

PhysicalDrive0 Model Number: ST3160812AS, Rev: 2AAA
PhysicalDrive1 Model Number: ST3160812AS, Rev: 2AAA

	  Size  Device Name		  MBR Status
  ——————————————–
	149 GB  \\.\PhysicalDrive0   RE: Unknown MBR code
			SHA1: 6A763D22A65C189FF4CF06F6AA086C96A12DF40A
	149 GB  \\.\PhysicalDrive1   RE: Windows XP MBR code detected
			SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: 

Done!

Tomk

Post #6July 24, 2012, 2:44 AM UTC

All righty…

Let's see if we can replace that MBR.

Please run MBRcheck again and when it gets to the end it will say:

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Enter Y and press enter please.

Then it should say:

Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice:

Enter 2 and press enter

Then it will say:

Enter the physical disk number to fix (0-99, -1 to cancel):

Enter 0 and press enter

Then you will get:

Available MBR codes:
[ 0] Default (Windows XP)
[ 1] Windows XP
[ 2] Windows Server 2003
[ 3] Windows Vista
[ 4] Windows 2008
[ 5] Windows 7
[-1] Cancel

Please select the MBR code to write to this drive:

Enter 2 and press enter

Then you should get:

Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue:

Please type out the whole word YES and hit enter

And finally you will see:

Done! Press ENTER to exit…

Hit enter…. a report should be produced… please post it here.

Deleted Member

Post #7July 24, 2012, 12:08 PM UTC

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Server 2003, Standard Edition
Windows Information:		Service Pack 2 (build 3790)
Logical Drives Mask:		0x0260001d

Kernel Drivers (total 123):
  0x80800000 \WINDOWS\system32\ntkrnlpa.exe
  0x80A50000 \WINDOWS\system32\hal.dll
  0xF7707000 \WINDOWS\system32\KDCOM.DLL
  0xF770F000 \WINDOWS\system32\BOOTVID.dll
  0xF7352000 ACPI.sys
  0xF7487000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
  0xF733C000 pci.sys
  0xF7497000 isapnp.sys
  0xF7717000 pciide.sys
  0xF74A7000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF74B7000 MountMgr.sys
  0xF7315000 ftdisk.sys
  0xF771F000 dmload.sys
  0xF72E9000 dmio.sys
  0xF72BB000 volsnap.sys
  0xF74C7000 PartMgr.sys
  0xF7727000 amdbusdr.sys
  0xF729E000 atapi.sys
  0xF74D7000 aic78xx.sys
  0xF727F000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
  0xF726A000 si3114.sys
  0xF74E7000 AmdEide.sys
  0xF7897000 SiWinAcc.sys
  0xF74F7000 disk.sys
  0xF7257000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF7232000 fltmgr.sys
  0xF7507000 Dfs.sys
  0xF720B000 KSecDD.sys
  0xF7B4A000 Ntfs.sys
  0xF76C8000 NDIS.sys
  0xF7878000 Mup.sys
  0xF7517000 crcdisk.sys
  0xBAF31000 edevmon.sys
  0xF780F000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xBA32C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF7697000 \SystemRoot\system32\DRIVERS\4mmdat.sys
  0xF7527000 \SystemRoot\system32\DRIVERS\TAPE.SYS
  0xBA2E1000 \SystemRoot\system32\DRIVERS\ati2mpad.sys
  0xBA2C5000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xF76A7000 \SystemRoot\system32\DRIVERS\watchdog.sys
  0xBA2B2000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xF76B7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF7537000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xBA29D000 \SystemRoot\system32\DRIVERS\serial.sys
  0xF7547000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xF7557000 \SystemRoot\system32\DRIVERS\fdc.sys
  0xBA285000 \SystemRoot\system32\DRIVERS\parport.sys
  0xBA270000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA246000 \SystemRoot\system32\DRIVERS\b57xp32.sys
  0xF7567000 \SystemRoot\system32\DRIVERS\amdk8.sys
  0xBA36E000 \SystemRoot\system32\DRIVERS\LMImirr.sys
  0xF779F000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xBA232000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xF7587000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xBA219000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xF7577000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xBA207000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xF7597000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xF75A7000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xF75B7000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xBA1D0000 \SystemRoot\system32\DRIVERS\rdpdr.sys
  0xF75C7000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xF79EB000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xBA1A9000 \SystemRoot\system32\DRIVERS\ks.sys
  0xBA15F000 \SystemRoot\system32\DRIVERS\update.sys
  0xF75E7000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xBA14A000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF79F5000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xF75F7000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xF7627000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0xBA034000 \SystemRoot\system32\DRIVERS\eamon.sys
  0xBA5BB000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xBA5C3000 \SystemRoot\System32\Drivers\Null.SYS
  0xBA5B3000 \SystemRoot\System32\Drivers\Beep.SYS
  0xBA012000 \SystemRoot\system32\DRIVERS\ehdrv.sys
  0xBA623000 \SystemRoot\System32\drivers\vga.sys
  0xF778F000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF7797000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xBA613000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xBA488000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xF77AF000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xB9FD9000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xBA603000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xB9F45000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xB9F14000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xBA468000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xB9EF7000 \SystemRoot\system32\DRIVERS\epfwtdir.sys
  0xB9ECD000 \SystemRoot\System32\drivers\afd.sys
  0xBA478000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xB9E9D000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xB9E27000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xB9E16000 \SystemRoot\System32\Drivers\Fips.SYS
  0xF7A9D000 \SystemRoot\System32\Drivers\BANTExt.sys
  0xB9DD9000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xBA448000 \SystemRoot\System32\Drivers\dump_diskdump.sys
  0xB9DC4000 \SystemRoot\System32\Drivers\dump_si3114.sys
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xBA3F8000 \SystemRoot\System32\drivers\Dxapi.sys
  0xBF9D4000 \SystemRoot\System32\drivers\dxg.sys
  0xF7767000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF9EB000 \SystemRoot\System32\ati2drad.dll
  0xBFA36000 \SystemRoot\System32\ATMFD.DLL
  0xB61BE000 \??\C:\WINDOWS\system32\drivers\exifs.sys
  0xB6039000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xB5FAD000 \SystemRoot\system32\DRIVERS\srv.sys
  0xF781F000 \SystemRoot\system32\DRIVERS\parvdm.sys
  0xB5E4A000 \??\C:\WINDOWS\system32\drivers\nfsrdr.sys
  0xB5DA9000 \SystemRoot\System32\Drivers\HTTP.sys
  0xB7CBC000 \??\C:\Program Files\LogMeIn\x86\RaInfo.sys
  0xF75D7000 \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
  0xB5D11000 \??\C:\WINDOWS\system32\drivers\rpcxdr.sys
  0xB59E7000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xB58BE000 \??\C:\Program Files\Free Ride Games\X4HSEx.Sys
  0xF79CD000 \??\C:\WINDOWS\system32\drivers\PSXDRV.SYS
  0xB562E000 \??\C:\WINDOWS\system32\drivers\portmap.sys
  0xB4A63000 \??\C:\WINDOWS\system32\drivers\nfssvr.sys
  0xB5937000 \SystemRoot\System32\Drivers\TDTCP.SYS
  0xB4998000 \SystemRoot\System32\Drivers\RDPWD.SYS
  0xBFF60000 \SystemRoot\System32\RDPDD.dll
  0xB533E000 \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aswMBR.sys
  0xBFA81000 \SystemRoot\System32\lmimirr.dll
  0xBFA86000 \SystemRoot\System32\lmimirr2.dll
  0x7C800000 \WINDOWS\system32\ntdll.dll

Processes (total 78):
	   0 System Idle Process
	   4 System
	 284 C:\WINDOWS\system32\smss.exe
	 336 csrss.exe
	 364 C:\WINDOWS\system32\winlogon.exe
	 412 C:\WINDOWS\system32\services.exe
	 424 C:\WINDOWS\system32\lsass.exe
	 640 C:\WINDOWS\system32\svchost.exe
	 784 svchost.exe
	 844 svchost.exe
	 868 svchost.exe
	 916 C:\WINDOWS\system32\svchost.exe
	1068 svchost.exe
	1204 C:\WINDOWS\system32\spoolsv.exe
	1232 msdtc.exe
	1352 C:\WINDOWS\system32\cisvc.exe
	1384 C:\WINDOWS\system32\nfsclnt.exe
	1432 C:\WINDOWS\system32\dfssvc.exe
	1456 C:\WINDOWS\system32\dns.exe
	1508 C:\Program Files\ESET\ESET Endpoint Antivirus\ekrn.exe
	1584 C:\Program Files\ESET\ESET Remote Administrator\Server\era.exe
	1644 C:\WINDOWS\system32\svchost.exe
	1692 C:\WINDOWS\system32\inetsrv\inetinfo.exe
	1712 llssrv.exe
	1792 C:\Program Files\LogMeIn\x86\LogMeIn.exe
	1848 C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
	1876 C:\Program Files\NovaStor\NovaBACKUP\NMSAccess.exe
	1896 C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
	1992 C:\WINDOWS\system32\ntfrs.exe
	2044 svchost.exe
	2144 C:\SFU\common\rshsvc.exe
	2184 sbscrexe.exe
	2356 C:\WINDOWS\system32\svchost.exe
	2440 C:\WINDOWS\system32\wins.exe
	2536 C:\WINDOWS\system32\PSXRUN.EXE
	2564 C:\WINDOWS\system32\PSXSS.EXE
	2608 C:\Program Files\Exchsrvr\bin\exmgmt.exe
	2828 C:\Program Files\Exchsrvr\bin\mad.exe
	2832 C:\SFU\usr\sbin\zzInterix
	3072 C:\SFU\usr\sbin\init
	3308 C:\SFU\usr\sbin\inetd
	3820 C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
	4008 C:\WINDOWS\system32\svchost.exe
	4092 svchost.exe
	 204 C:\SFU\Mapper\mapsvc.exe
	1008 C:\Program Files\Exchsrvr\bin\store.exe
	1264 C:\WINDOWS\system32\nfssvc.exe
	1164 C:\SFU\nis\nissvc.exe
	2056 wmiprvse.exe
	3008 wmiprvse.exe
	4328 C:\WINDOWS\system32\svchost.exe
	4352 EHttpSrv.exe
	4452 MSNFS
	5052 C:\WINDOWS\explorer.exe
	5196 C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
	5204 C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe
	5400 alg.exe
	2224 C:\WINDOWS\system32\cidaemon.exe
	1816 csrss.exe
	3720 C:\WINDOWS\system32\winlogon.exe
	3868 C:\WINDOWS\system32\rdpclip.exe
	5268 C:\WINDOWS\explorer.exe
	6036 C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
	3396 C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe
	3332 C:\WINDOWS\system32\ctfmon.exe
	1420 C:\Program Files\Procomm Plus\programs\PW4.EXE
	2380 csrss.exe
	6760 C:\WINDOWS\system32\winlogon.exe
	7724 C:\WINDOWS\system32\rdpclip.exe
	7264 C:\WINDOWS\explorer.exe
	1220 C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
	4748 C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe
	5868 C:\WINDOWS\system32\ctfmon.exe
	3644 C:\WINDOWS\system32\inetsrv\w3wp.exe
	6888 C:\WINDOWS\system32\wuauclt.exe
	1192 C:\Program Files\LogMeIn\x86\LogMeIn.exe
	8012 C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
	5444 C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)
\\.\E: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00  (NTFS)

PhysicalDrive0 Model Number: ST3160812AS, Rev: 2AAA
PhysicalDrive1 Model Number: ST3160812AS, Rev: 2AAA

	  Size  Device Name		  MBR Status
  ——————————————–
	149 GB  \\.\PhysicalDrive0   RE: Unknown MBR code
			SHA1: 6A763D22A65C189FF4CF06F6AA086C96A12DF40A
	149 GB  \\.\PhysicalDrive1   RE: Windows XP MBR code detected
			SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: 
Options:
  [1] Dump the MBR of a physical disk to file.
  [2] Restore the MBR of a physical disk with a standard boot code.
  [3] Exit.

Enter your choice: Enter the physical disk number to fix (0-99, -1 to cancel): 0Available MBR codes:
 [ 0] Default (Windows Server 2003)
 [ 1] Windows XP
 [ 2] Windows Server 2003
 [ 3] Windows Vista
 [ 4] Windows 2008
 [ 5] Windows 7
 [-1] Cancel

Please select the MBR code to write to this drive: 2
Do you want to fix the MBR code?  Type 'YES' and hit ENTER to continue: YES
RE: Successfully wrote new MBR code!
Please reboot your computer to complete the fix.


Done!

Tomk

Post #8July 24, 2012, 1:49 PM UTC

Great. Did that resolve your problem?

Deleted Member

Post #9July 24, 2012, 4:27 PM UTC

After doing the MBRCheck fix and rebooting the server, I scanned the Bootsector with ESET NOD32 Endpoint Security and this is what it reports:

Scan Log
Version of virus signature database: 7325 (20120724)
Date: 7/24/2012  Time: 12:28:46 PM
Scanned disks, folders and files: Boot sector
MBR sector of the 0. physical disk - probably unknown TSR.BOOT virus [7] - unable to clean
Number of scanned objects: 3
Number of threats found: 1
Number of cleaned objects: 0
Time of completion: 12:28:47 PM  Total scanning time: 1 sec (00:00:01)

Notes:
[7] Object is probably infected with an unknown virus.

Deleted Member

Post #10July 24, 2012, 4:34 PM UTC

This is from TDSSKiller, if it helps any…

12:34:39.0234 4288	Suspicious service (NoAccess): SBCore
12:34:39.0437 4288	SBCore		  (d73cbd3de79ab61de6a23fa1a6ee8062) C:\WINDOWS\System32\sbscrexe.exe
12:34:39.0453 4288	SBCore ( LockedService.Multi.Generic ) - warning
12:34:39.0453 4288	SBCore - detected LockedService.Multi.Generic (1)

Tomk

Post #11July 24, 2012, 7:25 PM UTC

Just for grins… please run MBRCheck again and post the log.

Then…

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Check the boxes beside LOP Check and Purity Check.

Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Deleted Member

Post #12July 26, 2012, 12:31 PM UTC

CheckMBR:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Server 2003, Standard Edition
Windows Information:		Service Pack 2 (build 3790)
Logical Drives Mask:		0x0260001d

Kernel Drivers (total 121):
  0x80800000 \WINDOWS\system32\ntkrnlpa.exe
  0x80A50000 \WINDOWS\system32\hal.dll
  0xF7707000 \WINDOWS\system32\KDCOM.DLL
  0xF770F000 \WINDOWS\system32\BOOTVID.dll
  0xF7352000 ACPI.sys
  0xF7487000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
  0xF733C000 pci.sys
  0xF7497000 isapnp.sys
  0xF7717000 pciide.sys
  0xF74A7000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF74B7000 MountMgr.sys
  0xF7315000 ftdisk.sys
  0xF771F000 dmload.sys
  0xF72E9000 dmio.sys
  0xF72BB000 volsnap.sys
  0xF74C7000 PartMgr.sys
  0xF7727000 amdbusdr.sys
  0xF729E000 atapi.sys
  0xF74D7000 aic78xx.sys
  0xF727F000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
  0xF726A000 si3114.sys
  0xF74E7000 AmdEide.sys
  0xF7897000 SiWinAcc.sys
  0xF74F7000 disk.sys
  0xF7257000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF7232000 fltmgr.sys
  0xF7507000 Dfs.sys
  0xF720B000 KSecDD.sys
  0xF7B4A000 Ntfs.sys
  0xF76C8000 NDIS.sys
  0xF7878000 Mup.sys
  0xF7517000 crcdisk.sys
  0xBAF31000 edevmon.sys
  0xF780F000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xBA355000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF7547000 \SystemRoot\system32\DRIVERS\4mmdat.sys
  0xF7527000 \SystemRoot\system32\DRIVERS\TAPE.SYS
  0xBA30A000 \SystemRoot\system32\DRIVERS\ati2mpad.sys
  0xBA2EE000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xF7537000 \SystemRoot\system32\DRIVERS\watchdog.sys
  0xBA2DB000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xF7557000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF7567000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xBA2C6000 \SystemRoot\system32\DRIVERS\serial.sys
  0xF7587000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xF75A7000 \SystemRoot\system32\DRIVERS\fdc.sys
  0xBA2AE000 \SystemRoot\system32\DRIVERS\parport.sys
  0xBA299000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA26F000 \SystemRoot\system32\DRIVERS\b57xp32.sys
  0xF7597000 \SystemRoot\system32\DRIVERS\amdk8.sys
  0xBA391000 \SystemRoot\system32\DRIVERS\LMImirr.sys
  0xF77A7000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xBA25B000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xF75B7000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xBA242000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xF75C7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xBA230000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xF75D7000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xF75E7000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xF75F7000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xBA1F9000 \SystemRoot\system32\DRIVERS\rdpdr.sys
  0xF7607000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xF79F3000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xBA1D2000 \SystemRoot\system32\DRIVERS\ks.sys
  0xBA188000 \SystemRoot\system32\DRIVERS\update.sys
  0xF7617000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xBA173000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF79FD000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xF7627000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xF7657000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0xBA05D000 \SystemRoot\system32\DRIVERS\eamon.sys
  0xBA5E4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xBA5DC000 \SystemRoot\System32\Drivers\Null.SYS
  0xF781F000 \SystemRoot\System32\Drivers\Beep.SYS
  0xBA03B000 \SystemRoot\system32\DRIVERS\ehdrv.sys
  0xBA63C000 \SystemRoot\System32\drivers\vga.sys
  0xF7797000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF77AF000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xBA62C000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xBA4A1000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xF779F000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xBA002000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xBA4B1000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xB9F6E000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xB9F3D000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xBA481000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xB9F20000 \SystemRoot\system32\DRIVERS\epfwtdir.sys
  0xB9EF6000 \SystemRoot\System32\drivers\afd.sys
  0xBA491000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xB9EC6000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xB9E50000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xB9E3F000 \SystemRoot\System32\Drivers\Fips.SYS
  0xF7A84000 \SystemRoot\System32\Drivers\BANTExt.sys
  0xB9E02000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xBA461000 \SystemRoot\System32\Drivers\dump_diskdump.sys
  0xB9DED000 \SystemRoot\System32\Drivers\dump_si3114.sys
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xF76B7000 \SystemRoot\System32\drivers\Dxapi.sys
  0xBF9D4000 \SystemRoot\System32\drivers\dxg.sys
  0xF776F000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF9EB000 \SystemRoot\System32\ati2drad.dll
  0xBFA36000 \SystemRoot\System32\ATMFD.DLL
  0xB6382000 \??\C:\WINDOWS\system32\drivers\exifs.sys
  0xB61FD000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xB6171000 \SystemRoot\system32\DRIVERS\srv.sys
  0xF775F000 \SystemRoot\system32\DRIVERS\parvdm.sys
  0xB600E000 \??\C:\WINDOWS\system32\drivers\nfsrdr.sys
  0xB5ECD000 \SystemRoot\System32\Drivers\HTTP.sys
  0xF79CB000 \??\C:\Program Files\LogMeIn\x86\RaInfo.sys
  0xB5F96000 \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
  0xB6D9E000 \??\C:\WINDOWS\system32\drivers\rpcxdr.sys
  0xB5AE3000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xB5A82000 \??\C:\Program Files\Free Ride Games\X4HSEx.Sys
  0xF79D5000 \??\C:\WINDOWS\system32\drivers\PSXDRV.SYS
  0xB57FA000 \??\C:\WINDOWS\system32\drivers\portmap.sys
  0xB5370000 \SystemRoot\System32\Drivers\TDTCP.SYS
  0xB4C79000 \SystemRoot\System32\Drivers\RDPWD.SYS
  0xBFF60000 \SystemRoot\System32\RDPDD.dll
  0xBFA81000 \SystemRoot\System32\lmimirr.dll
  0xBFA86000 \SystemRoot\System32\lmimirr2.dll
  0x7C800000 \WINDOWS\system32\ntdll.dll

Processes (total 68):
	   0 System Idle Process
	   4 System
	 284 C:\WINDOWS\system32\smss.exe
	 336 csrss.exe
	 364 C:\WINDOWS\system32\winlogon.exe
	 412 C:\WINDOWS\system32\services.exe
	 424 C:\WINDOWS\system32\lsass.exe
	 640 C:\WINDOWS\system32\svchost.exe
	 792 svchost.exe
	 848 svchost.exe
	 872 svchost.exe
	 920 C:\WINDOWS\system32\svchost.exe
	1072 svchost.exe
	1228 C:\WINDOWS\system32\spoolsv.exe
	1260 msdtc.exe
	1368 C:\WINDOWS\system32\cisvc.exe
	1400 C:\WINDOWS\system32\nfsclnt.exe
	1448 C:\WINDOWS\system32\dfssvc.exe
	1472 C:\WINDOWS\system32\dns.exe
	1524 C:\Program Files\ESET\ESET Endpoint Antivirus\ekrn.exe
	1604 C:\Program Files\ESET\ESET Remote Administrator\Server\era.exe
	1656 C:\WINDOWS\system32\svchost.exe
	1704 C:\WINDOWS\system32\inetsrv\inetinfo.exe
	1724 llssrv.exe
	1804 C:\Program Files\LogMeIn\x86\LogMeIn.exe
	1856 C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
	1996 C:\Program Files\NovaStor\NovaBACKUP\NMSAccess.exe
	2008 C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
	2088 C:\WINDOWS\system32\ntfrs.exe
	2136 svchost.exe
	2228 C:\SFU\common\rshsvc.exe
	2268 sbscrexe.exe
	2356 C:\WINDOWS\system32\svchost.exe
	2432 C:\WINDOWS\system32\wins.exe
	2508 C:\WINDOWS\system32\PSXRUN.EXE
	2528 C:\WINDOWS\system32\PSXSS.EXE
	2536 C:\Program Files\Exchsrvr\bin\exmgmt.exe
	2788 C:\Program Files\Exchsrvr\bin\mad.exe
	2804 C:\SFU\usr\sbin\zzInterix
	2996 C:\SFU\usr\sbin\init
	3012 C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
	3280 C:\SFU\usr\sbin\inetd
	3572 C:\WINDOWS\system32\svchost.exe
	3664 svchost.exe
	3732 C:\SFU\Mapper\mapsvc.exe
	 248 C:\SFU\nis\nissvc.exe
	1360 C:\Program Files\Exchsrvr\bin\store.exe
	2856 wmiprvse.exe
	3088 wmiprvse.exe
	4224 C:\WINDOWS\system32\svchost.exe
	4544 EHttpSrv.exe
	4584 alg.exe
	5328 C:\WINDOWS\explorer.exe
	5472 C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
	5480 C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe
	1152 C:\WINDOWS\system32\cidaemon.exe
	5636 csrss.exe
	3168 C:\WINDOWS\system32\winlogon.exe
	4964 C:\WINDOWS\system32\rdpclip.exe
	4992 C:\WINDOWS\explorer.exe
	5968 C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
	5160 C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe
	1800 C:\WINDOWS\system32\ctfmon.exe
	5864 C:\Program Files\Bitvise Tunnelier\Tunnelier.exe
	6084 C:\WINDOWS\system32\inetsrv\w3wp.exe
	1772 C:\Program Files\LogMeIn\x86\LogMeIn.exe
	 208 C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
	 732 C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)
\\.\E: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00  (NTFS)

PhysicalDrive0 Model Number: ST3160812AS, Rev: 2AAA
PhysicalDrive1 Model Number: ST3160812AS, Rev: 2AAA

	  Size  Device Name		  MBR Status
  ——————————————–
	149 GB  \\.\PhysicalDrive0   RE: Unknown MBR code
			SHA1: 6A763D22A65C189FF4CF06F6AA086C96A12DF40A
	149 GB  \\.\PhysicalDrive1   RE: Windows XP MBR code detected
			SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Deleted Member

Post #13July 26, 2012, 12:32 PM UTC last edited July 26, 2012, 12:33 PM UTC

OTL.txt:

OTL logfile created on: 7/26/2012 8:20:25 AM - Run 1
OTL by OldTimer - Version 3.2.54.1	 Folder = C:\Documents and Settings\Administrator\Desktop
Windows Server 2003 Standard Edition Service Pack 2 (Version = 5.2.3790) - Type = NTDomainController
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 1.19 Gb Available Physical Memory | 59.72% Memory free
3.85 Gb Paging File | 2.72 Gb Available in Paging File | 70.60% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 111.29 Gb Free Space | 74.67% Space Free | Partition Type: NTFS
Drive E: | 149.05 Gb Total Space | 104.07 Gb Free Space | 69.82% Space Free | Partition Type: NTFS
Drive V: | 149.05 Gb Total Space | 104.07 Gb Free Space | 69.82% Space Free | Partition Type: NTFS
 
Computer Name: WMH | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/07/26 08:18:53 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2012/07/23 10:57:34 | 006,325,032 | —- | M] (Bitvise) – C:\Program Files\Bitvise Tunnelier\Tunnelier.exe
PRC - [2012/07/05 18:09:30 | 000,374,184 | —- | M] (LogMeIn, Inc.) – C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
PRC - [2012/05/18 16:53:26 | 004,126,784 | —- | M] (ESET) – C:\Program Files\ESET\ESET Remote Administrator\Server\era.exe
PRC - [2012/05/18 16:53:22 | 000,089,184 | —- | M] (ESET) – C:\Program Files\ESET\ESET Remote Administrator\Server\EHttpSrv.exe
PRC - [2012/04/16 11:57:56 | 000,999,664 | —- | M] (ESET) – C:\Program Files\ESET\ESET Endpoint Antivirus\ekrn.exe
PRC - [2012/04/16 11:57:48 | 003,154,424 | —- | M] (ESET) – C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe
PRC - [2012/01/30 08:39:57 | 000,450,560 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\dns.exe
PRC - [2011/08/10 09:09:07 | 000,158,720 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\wins.exe
PRC - [2010/12/08 11:43:09 | 000,390,528 | —- | M] (LogMeIn, Inc.) – C:\Program Files\LogMeIn\x86\LogMeIn.exe
PRC - [2007/02/17 10:04:04 | 000,007,168 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\inetsrv\w3wp.exe
PRC - [2007/02/17 10:03:58 | 000,037,888 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\sbscrexe.exe
PRC - [2007/02/17 10:03:56 | 000,069,632 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\rdpclip.exe
PRC - [2007/02/17 10:03:53 | 000,792,064 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\ntfrs.exe
PRC - [2007/02/17 10:03:43 | 000,094,720 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\llssrv.exe
PRC - [2007/02/17 10:03:42 | 000,014,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\inetsrv\inetinfo.exe
PRC - [2007/02/17 10:03:39 | 001,053,184 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/02/17 10:03:35 | 000,164,864 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\dfssvc.exe
PRC - [2005/11/07 17:22:24 | 000,225,280 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
PRC - [2005/11/07 17:22:08 | 000,118,784 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
PRC - [2004/03/01 16:46:10 | 000,522,800 | R— | M] (Microsoft Corporation) – C:\WINDOWS\system32\PSXSS.EXE
PRC - [2003/11/13 12:42:32 | 000,107,008 | R— | M] (Microsoft Corporation) – C:\SFU\Mapper\mapsvc.exe
PRC - [2003/11/08 14:49:42 | 000,065,024 | —- | M] (Microsoft Corporation) – C:\SFU\usr\sbin\zzInterix
PRC - [2003/11/08 14:49:38 | 000,110,080 | —- | M] (Microsoft Corporation) – C:\SFU\usr\sbin\inetd
PRC - [2003/11/08 14:49:38 | 000,093,184 | —- | M] (Microsoft Corporation) – C:\SFU\usr\sbin\init
PRC - [2003/11/08 14:46:18 | 000,016,800 | R— | M] (Microsoft Corporation) – C:\SFU\common\rshsvc.exe
PRC - [2003/11/08 14:45:14 | 000,066,480 | R— | M] (Microsoft Corporation) – C:\WINDOWS\system32\PSXRUN.EXE
PRC - [2003/11/08 14:42:52 | 000,104,032 | R— | M] (Microsoft Corporation) – C:\SFU\nis\nissvc.exe
PRC - [2003/11/08 14:42:34 | 000,053,408 | R— | M] (Microsoft Corporation) – C:\WINDOWS\system32\nfsclnt.exe
PRC - [2003/09/10 15:27:12 | 000,069,632 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
PRC - [2003/06/20 18:24:09 | 005,028,864 | —- | M] (Microsoft Corporation) – C:\Program Files\Exchsrvr\bin\store.exe
PRC - [2003/06/03 04:14:30 | 008,735,232 | —- | M] (Microsoft Corporation) – C:\Program Files\Exchsrvr\bin\mad.exe
PRC - [2003/06/03 04:14:19 | 003,117,568 | —- | M] (Microsoft Corporation) – C:\Program Files\Exchsrvr\bin\exmgmt.exe
PRC - [2003/05/14 10:10:46 | 000,045,056 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NMSAccess.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011/01/08 23:14:52 | 000,139,776 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2005/11/07 17:32:12 | 000,368,751 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\pkgsysstate.dll
MOD - [2005/11/07 17:32:02 | 000,020,480 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\pkgsysfile.dll
MOD - [2005/11/07 17:32:00 | 000,069,743 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\pkgdatabase.dll
MOD - [2005/11/07 17:31:40 | 000,020,480 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\pkgdbffile.dll
MOD - [2005/11/07 17:22:24 | 000,225,280 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NBKCTRL.exe
MOD - [2005/11/07 17:22:14 | 000,036,864 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\BlowFish.dll
MOD - [2005/11/07 17:22:08 | 000,118,784 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
MOD - [2005/11/07 17:21:10 | 000,024,576 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NsSched.dll
MOD - [2005/11/07 17:21:06 | 000,065,536 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NsDb.dll
MOD - [2005/11/07 17:20:48 | 000,061,440 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\MailObj.dll
MOD - [2005/11/07 17:20:46 | 000,028,672 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NsUtils.dll
MOD - [2005/11/07 17:18:44 | 000,430,080 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NsDisc.dll
MOD - [2003/09/10 15:27:12 | 000,016,896 | —- | M] () – C:\WINDOWS\system32\tsd32.dll
MOD - [2003/05/14 10:10:46 | 000,045,056 | —- | M] () – C:\Program Files\NovaStor\NovaBACKUP\NMSAccess.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] – winhttp.dll – (WinHttpAutoProxySvc)
SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - [2012/07/22 21:17:56 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/17 07:36:49 | 000,935,008 | —- | M] () [Disabled | Stopped] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe – (vToolbarUpdater11.2.0)
SRV - [2012/07/05 18:09:30 | 000,374,184 | —- | M] (LogMeIn, Inc.) [Disabled | Stopped] – C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe – (LMIGuardianSvc)
SRV - [2012/06/14 18:20:14 | 000,113,120 | —- | M] (Mozilla Foundation) [Disabled | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/05/18 16:53:26 | 004,126,784 | —- | M] (ESET) [Auto | Running] – C:\Program Files\ESET\ESET Remote Administrator\Server\era.exe – (ERA_SERVER)
SRV - [2012/05/18 16:53:22 | 000,089,184 | —- | M] (ESET) [On_Demand | Running] – C:\Program Files\ESET\ESET Remote Administrator\Server\EHttpSrv.exe – (ERA_HTTP_SERVER)
SRV - [2012/04/16 15:15:44 | 000,235,008 | —- | M] () [Disabled | Stopped] – C:\Program Files\Action Alert\pgkeysrv.exe – (PGKey)
SRV - [2012/04/16 11:59:04 | 000,183,904 | —- | M] (ESET) [On_Demand | Stopped] – C:\Program Files\ESET\ESET Endpoint Antivirus\EShaSrv.exe – (ESHASRV)
SRV - [2012/04/16 11:58:44 | 000,031,024 | —- | M] (ESET) [On_Demand | Stopped] – C:\Program Files\ESET\ESET Endpoint Antivirus\EHttpSrv.exe – (EhttpSrv)
SRV - [2012/04/16 11:57:56 | 000,999,664 | —- | M] (ESET) [Auto | Running] – C:\Program Files\ESET\ESET Endpoint Antivirus\ekrn.exe – (ekrn)
SRV - [2012/01/30 08:39:57 | 000,450,560 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\dns.exe – (DNS)
SRV - [2011/08/10 09:09:07 | 000,158,720 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\wins.exe – (WINS)
SRV - [2010/12/08 11:43:09 | 000,390,528 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files\LogMeIn\x86\LogMeIn.exe – (LogMeIn)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Disabled | Stopped] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2007/02/17 10:04:02 | 000,071,168 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\WINDOWS\system32\tssdis.exe – (Tssdis)
SRV - [2007/02/17 10:03:58 | 000,067,072 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\rsopprov.exe – (RSoPProv)
SRV - [2007/02/17 10:03:58 | 000,037,888 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\sbscrexe.exe – (SBCore)
SRV - [2007/02/17 10:03:53 | 000,792,064 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\ntfrs.exe – (NtFrs)
SRV - [2007/02/17 10:03:43 | 000,094,720 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\llssrv.exe – (LicenseService)
SRV - [2007/02/17 10:03:42 | 000,040,448 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\WINDOWS\system32\ismserv.exe – (IsmServ)
SRV - [2007/02/17 10:03:42 | 000,014,336 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\inetsrv\inetinfo.exe – (SMTPSVC)
SRV - [2007/02/17 10:03:42 | 000,014,336 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\inetsrv\inetinfo.exe – (RESvc)
SRV - [2007/02/17 10:03:42 | 000,014,336 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\WINDOWS\system32\inetsrv\inetinfo.exe – (POP3Svc)
SRV - [2007/02/17 10:03:42 | 000,014,336 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\WINDOWS\system32\inetsrv\inetinfo.exe – (NntpSvc)
SRV - [2007/02/17 10:03:42 | 000,014,336 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\WINDOWS\system32\inetsrv\inetinfo.exe – (IMAP4Svc)
SRV - [2007/02/17 10:03:42 | 000,014,336 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\inetsrv\inetinfo.exe – (IISADMIN)
SRV - [2007/02/17 10:03:35 | 000,164,864 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\dfssvc.exe – (Dfs)
SRV - [2007/02/17 10:02:54 | 000,216,576 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\inetsrv\iisw3adm.dll – (W3SVC)
SRV - [2005/11/07 17:22:08 | 000,118,784 | —- | M] () [Auto | Running] – C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe – (NsEngine)
SRV - [2003/11/13 12:42:34 | 000,056,320 | R— | M] (Microsoft Corporation) [Auto | Stopped] – C:\WINDOWS\system32\nfssvc.exe – (NfsSvc)
SRV - [2003/11/13 12:42:32 | 000,107,008 | R— | M] (Microsoft Corporation) [Auto | Running] – C:\SFU\Mapper\mapsvc.exe – (Mapsvc)
SRV - [2003/11/08 14:46:18 | 000,016,800 | R— | M] (Microsoft Corporation) [Auto | Running] – C:\SFU\common\rshsvc.exe – (RshSvc)
SRV - [2003/11/08 14:46:12 | 000,047,536 | R— | M] (Microsoft Corporation) [Disabled | Stopped] – C:\SFU\common\cron.exe – (CronService)
SRV - [2003/11/08 14:45:14 | 000,066,480 | R— | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\PSXRUN.EXE – (zzInterix)
SRV - [2003/11/08 14:42:52 | 000,104,032 | R— | M] (Microsoft Corporation) [Auto | Running] – C:\SFU\nis\nissvc.exe – (NisSvc)
SRV - [2003/11/08 14:42:34 | 000,053,408 | R— | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\nfsclnt.exe – (Client for NFS)
SRV - [2003/09/10 19:43:05 | 000,025,600 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Microsoft Windows Small Business Server\Networking\POP3\imbservice.exe – (MSPOP3Connector)
SRV - [2003/09/10 15:27:12 | 000,069,632 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe – (MSSEARCH)
SRV - [2003/09/10 15:27:12 | 000,050,688 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\WINDOWS\system32\trksvr.dll – (TrkSvr)
SRV - [2003/09/10 15:27:12 | 000,012,288 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\sacsvr.dll – (sacsvr)
SRV - [2003/06/20 18:24:09 | 005,028,864 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Exchsrvr\bin\store.exe – (MSExchangeIS)
SRV - [2003/06/03 04:14:30 | 008,735,232 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Exchsrvr\bin\mad.exe – (MSExchangeSA)
SRV - [2003/06/03 04:14:19 | 003,117,568 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Exchsrvr\bin\exmgmt.exe – (MSExchangeMGMT)
SRV - [2003/06/03 03:29:59 | 003,585,536 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Exchsrvr\bin\emsmta.exe – (MSExchangeMTA)
SRV - [2003/06/03 03:23:10 | 000,339,456 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Exchsrvr\bin\srsmain.exe – (MSExchangeSRS)
SRV - [2003/06/03 03:23:09 | 000,094,720 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Exchsrvr\bin\events.exe – (MSExchangeES)
SRV - [2003/05/14 10:10:46 | 000,045,056 | —- | M] () [Auto | Running] – C:\Program Files\NovaStor\NovaBACKUP\NMSAccess.exe – (NMSAccess)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] –  – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] –  – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] –  – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] –  – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] –  – (PDCOMP)
DRV - File not found [Adapter | On_Demand | Unknown] –  – (LicenseInfo)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | System | Stopped] –  – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] –  – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\AMDPCI.sys – (AMDPCI)
DRV - [2012/07/05 18:10:02 | 000,083,392 | —- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] – C:\WINDOWS\System32\LMIRfsClientNP.dll – (LMIRfsClientNP)
DRV - [2012/06/08 12:06:24 | 000,047,640 | —- | M] (LogMeIn, Inc.) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\LMIRfsDriver.sys – (LMIRfsDriver)
DRV - [2012/06/08 12:06:24 | 000,012,856 | —- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] – C:\Program Files\LogMeIn\x86\rainfo.sys – (LMIInfo)
DRV - [2012/03/29 11:03:54 | 000,123,760 | —- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\ehdrv.sys – (ehdrv)
DRV - [2012/03/29 11:03:54 | 000,107,280 | —- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\epfwtdir.sys – (epfwtdir)
DRV - [2012/03/29 11:03:52 | 000,170,616 | —- | M] (ESET) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\edevmon.sys – (edevmon)
DRV - [2012/03/29 11:03:52 | 000,164,424 | —- | M] (ESET) [File_System | System | Running] – C:\WINDOWS\system32\drivers\eamon.sys – (eamon)
DRV - [2010/11/22 10:24:58 | 000,056,424 | —- | M] (Exent Technologies Ltd.) [Kernel | Auto | Running] – C:\Program Files\Free Ride Games\X4HSEx.sys – (X4HSEx)
DRV - [2008/04/14 20:52:28 | 000,019,240 | —- | M] (Silicon Image, Inc) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\SiWinAcc.sys – (SiWinAcc)
DRV - [2008/04/14 20:52:28 | 000,019,240 | —- | M] (Silicon Image, Inc) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\SiWinAcc.sys – (SiFilter)
DRV - [2008/04/14 20:52:10 | 000,073,768 | —- | M] (Silicon Image, Inc) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\SI3114.sys – (si3114)
DRV - [2008/02/27 13:49:00 | 000,003,840 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\BANTExt.sys – (BANTExt)
DRV - [2007/02/17 02:29:40 | 000,169,984 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wlbs.sys – (WLBS)
DRV - [2007/02/17 02:06:42 | 000,072,704 | —- | M] (Microsoft Corporation) [Kernel | Unavailable | Unknown] – C:\WINDOWS\System32\drivers\sacdrv.sys – (sacdrv)
DRV - [2007/02/17 02:02:56 | 000,069,120 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\drivers\clusdisk.sys – (ClusDisk)
DRV - [2007/02/17 01:51:18 | 000,034,816 | —- | M] (Microsoft Corporation) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\dfs.sys – (DfsDriver)
DRV - [2007/02/17 01:48:31 | 000,039,424 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\amdk8.sys – (AmdK8)
DRV - [2004/01/08 02:45:50 | 000,170,880 | R— | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\b57xp32.sys – (b57w2k)
DRV - [2003/11/13 12:42:34 | 000,422,912 | R— | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nfssvr.sys – (NfsSvr)
DRV - [2003/11/13 12:42:34 | 000,057,344 | R— | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rpcxdr.sys – (RpcXdr)
DRV - [2003/11/13 12:42:34 | 000,035,584 | R— | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\portmap.sys – (Portmap)
DRV - [2003/11/08 14:45:14 | 000,006,128 | R— | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\system32\drivers\PSXDRV.SYS – (PsxDrv)
DRV - [2003/11/08 14:42:36 | 000,305,664 | R— | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\system32\drivers\nfsrdr.sys – (NfsRdr)
DRV - [2003/06/03 02:37:52 | 000,195,744 | —- | M] (Microsoft Corporation) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\exifs.sys – (EXIFS)
DRV - [2003/03/25 11:00:20 | 000,037,760 | —- | M] (AMD Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\AmdEide.sys – (AMDEIDE)
DRV - [2003/03/25 11:00:20 | 000,022,656 | —- | M] (AMD) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\AmdBusDr.sys – (amdbusdr)
DRV - [2003/03/25 00:05:30 | 000,013,312 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\4mmdat.sys – (4mmdat)
DRV - [2001/12/21 12:10:08 | 000,303,232 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mpad.sys – (ati2mpad)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iesetup.dll/softAdmin.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = res://iesetup.dll/softAdmin.htm
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@BetterCareerSearch_2b.com/Plugin: C:\Program Files\BetterCareerSearch_2b\bar\1.bin\NP2bStub.dll File not found
FF - HKLM\Software\MozillaPlugins\@exent.com/npExentCtl,version=7.0.0.0: C:\Program Files\Free Ride Games\npExentCtl.dll (Exent Technologies Ltd.)
FF - HKLM\Software\MozillaPlugins\@MapsGalaxy_39.com/Plugin: C:\Program Files\MapsGalaxy_39\bar\1.bin\NP39Stub.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.5.109: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.5.109: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.5.109: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.5.109: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.5.109: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.1.0.12\ [2012/07/17 07:36:55 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\39ffxtbr@MapsGalaxy_39.com: C:\Program Files\MapsGalaxy_39\bar\1.bin [2012/07/19 07:06:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\2bffxtbr@BetterCareerSearch_2b.com: C:\Program Files\BetterCareerSearch_2b\bar\1.bin [2012/07/19 07:06:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/29 09:20:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/02 08:11:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET Endpoint Antivirus\Mozilla Thunderbird [2012/07/19 07:25:02 | 000,000,000 | —D | M]
 
[2010/12/11 18:33:02 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/07/17 21:39:09 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lwcphh4s.default\extensions
[2011/05/19 13:06:30 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lwcphh4s.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/14 12:55:50 | 000,000,000 | —D | M] (User Agent Switcher) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lwcphh4s.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
[2012/07/17 21:19:46 | 000,000,000 | —D | M] (BetterCareerSearch) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lwcphh4s.default\extensions\2bffxtbr@BetterCareerSearch_2b.com
[2012/07/17 21:15:35 | 000,000,000 | —D | M] (MapsGalaxy) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lwcphh4s.default\extensions\39ffxtbr@MapsGalaxy_39.com
[2012/07/20 09:16:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/06/14 18:20:49 | 000,085,472 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/03/21 14:54:00 | 003,932,160 | —- | M] () – C:\Program Files\mozilla firefox\plugins\npRACtrl.dll
[2011/01/11 18:05:00 | 000,008,592 | —- | M] () – C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll
[2012/07/17 21:02:08 | 000,000,789 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\ActionAlert.xml
[2012/07/17 07:36:46 | 000,003,750 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/17 05:33:05 | 000,002,354 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/06/14 18:19:40 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/14 18:19:40 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
 
Hosts file not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Endpoint Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [NovaBackup 7 Tray Control] C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\escortdrv.dll (EscortSoftware)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\escortdrv.dll (EscortSoftware)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\escortdrv.dll (EscortSoftware)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\escortdrv.dll (EscortSoftware)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\System32\escortdrv.dll (EscortSoftware)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = WMHFluidpower.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{935A0B30-4E03-4676-A510-39CE2D6AF97C}: NameServer = 8.8.4.4,8.8.8.8
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O27 - HKLM IFEO\alotservice.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\BearShare.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\desktopweather.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\DjMixerExpress.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\extensionupdaterservice.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\fliptoast.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\iBryteDesktop.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\iMesh.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\Iminent.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\Iminent.Messengers.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\magnify.exe: Debugger - C:\WINDOWS\Fonts\magnifys.exe ()
O27 - HKLM IFEO\osk.exe: Debugger - C:\WINDOWS\Fonts\osks.exe ()
O27 - HKLM IFEO\PCCheckupInstaller.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\recordingmanager.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\Reminderhelper.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\sethc.exe: Debugger - C:\WINDOWS\Fonts\sethcs.exe ()
O27 - HKLM IFEO\ToolbarUpdater.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\utilman.exe: Debugger - C:\WINDOWS\uti.exe ()
O27 - HKLM IFEO\VideoConverter.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\vprot.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\Wajamupdater.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\weather.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O29 - HKLM SecurityProviders - (pwdssp.dll) - C:\WINDOWS\System32\pwdssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/11/21 15:53:23 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{8fe63439-c9f9-11e1-b9ef-00e081403741}\Shell - "" = AutoRun
O33 - MountPoints2\{8fe63439-c9f9-11e1-b9ef-00e081403741}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8fe63439-c9f9-11e1-b9ef-00e081403741}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - C:\WINDOWS\System32\ias.dll (Microsoft Corporation)
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: Sacsvr - C:\WINDOWS\system32\sacsvr.dll (Microsoft Corporation)
NetSvcs: Sharedaccess -  File not found
NetSvcs: TrkSvr - C:\WINDOWS\system32\trksvr.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
 
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
 
CREATERESTOREPOINT
System Restore Service not available.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/07/26 08:18:40 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/07/25 19:28:50 | 000,091,240 | —- | C] (Initex) – C:\WINDOWS\System32\ProxifierShellExt.dll
[2012/07/25 19:28:50 | 000,070,248 | —- | C] (Initex) – C:\WINDOWS\System32\PrxerDrv.dll
[2012/07/23 10:57:34 | 000,000,000 | —D | C] – C:\Program Files\Bitvise Tunnelier
[2012/07/20 16:10:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\HWiNFO
[2012/07/20 15:27:29 | 000,000,000 | —D | C] – C:\Driver Backup!
[2012/07/20 12:47:18 | 000,012,872 | —- | C] (SurfRight B.V.) – C:\WINDOWS\System32\bootdelete.exe
[2012/07/20 10:23:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\FixTDSS
[2012/07/20 10:17:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\NPE
[2012/07/20 10:17:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton
[2012/07/20 10:03:05 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/07/18 09:24:44 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/18 09:24:37 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/07/18 08:37:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\Backups
[2012/07/17 21:39:02 | 000,000,000 | -HSD | C] – C:\Program Files\ooVoo
[2012/07/17 21:34:30 | 006,600,192 | —- | C] (Mirage Systems) – C:\WINDOWS\System32\LicProtector310.exe
[2012/07/17 21:34:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{E07EA62F-B06F-44AA-A564-5E6E7AB7DA96}
[2012/07/17 21:34:29 | 000,000,000 | -HSD | C] – C:\Program Files\Ultimate Media Player
[2012/07/17 21:32:36 | 000,000,000 | -HSD | C] – C:\Program Files\Free Offers from Freeze.com
[2012/07/17 21:32:28 | 000,000,000 | -HSD | C] – C:\Program Files\Surf Canyon
[2012/07/17 21:32:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2012/07/17 21:27:55 | 000,000,000 | -HSD | C] – C:\Program Files\iLivid
[2012/07/17 21:22:40 | 000,000,000 | -HSD | C] – C:\Program Files\IMinent Toolbar
[2012/07/17 21:21:45 | 000,000,000 | -HSD | C] – C:\Program Files\Sonic The Hedgehog
[2012/07/17 21:19:36 | 000,000,000 | -HSD | C] – C:\Program Files\BetterCareerSearch_2b
[2012/07/17 21:18:31 | 000,000,000 | -HSD | C] – C:\Program Files\BetterCareerSearch_2bEI
[2012/07/17 21:15:32 | 000,000,000 | -HSD | C] – C:\Program Files\MapsGalaxy_39
[2012/07/17 21:15:07 | 000,000,000 | -HSD | C] – C:\Program Files\MapsGalaxy_39EI
[2012/07/17 21:09:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Free Ride Games
[2012/07/17 21:09:49 | 000,053,314 | —- | C] (Exent Technologies Ltd.) – C:\WINDOWS\ExentInfo.exe
[2012/07/17 21:09:48 | 000,000,000 | -HSD | C] – C:\Program Files\Free Ride Games
[2012/07/17 21:02:03 | 000,000,000 | -HSD | C] – C:\Program Files\Action Alert
[2012/07/17 07:42:15 | 000,000,000 | -HSD | C] – C:\Program Files\GinoPlayer
[2012/07/17 07:41:48 | 000,000,000 | -HSD | C] – C:\Program Files\Wajam
[2012/07/17 07:41:30 | 000,000,000 | —D | C] – C:\Program Files\Qwiklinx
[2012/07/17 07:40:11 | 000,000,000 | —D | C] – C:\Program Files\Conduit
[2012/07/17 07:36:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2012/07/17 07:36:48 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVG Secure Search
[2012/07/17 07:36:46 | 000,000,000 | —D | C] – C:\Program Files\AVG Secure Search
[2012/07/17 07:35:41 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2012/07/17 07:34:47 | 000,000,000 | -HSD | C] – C:\Program Files\WrapApp
[2012/07/17 05:33:07 | 000,000,000 | -HSD | C] – C:\Program Files\DealPly
[2012/07/17 05:33:05 | 000,000,000 | -HSD | C] – C:\Program Files\Babylon
[2012/07/17 05:32:17 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Babylon
[2012/07/17 05:29:20 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2012/07/17 05:29:12 | 000,198,864 | —- | C] (RealNetworks, Inc.) – C:\WINDOWS\System32\rmoc3260.dll
[2012/07/17 05:29:03 | 000,272,896 | —- | C] (Progressive Networks) – C:\WINDOWS\System32\pncrt.dll
[2012/07/17 05:29:03 | 000,006,656 | —- | C] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5016.dll
[2012/07/17 05:29:03 | 000,005,632 | —- | C] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5032.dll
[2012/07/17 05:28:54 | 000,000,000 | -HSD | C] – C:\Program Files\Real
[2012/07/17 05:25:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Real
[2012/07/13 10:20:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\New Folder
[2012/07/11 14:40:55 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2012/07/11 14:06:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ESET
[2012/07/11 14:06:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\ESET
[2012/07/11 12:50:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Services for UNIX
[2012/07/11 12:50:00 | 000,000,000 | —D | C] – C:\SFU
[2012/07/11 12:44:38 | 000,000,000 | —D | C] – C:\SFU_Install
[2012/07/11 12:07:37 | 000,000,000 | —D | C] – C:\Program Files\Enlighten.Net
[2012/07/11 09:17:45 | 000,726,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jscript.dll
[2012/07/11 09:12:59 | 000,421,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aclayers.dll
[2012/07/11 01:50:05 | 001,864,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\win32k.sys
[2012/07/11 01:50:05 | 001,864,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\win32k.sys
[2012/07/10 16:56:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\FreeFileSync
[2012/07/10 16:55:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\FreeFileSync
[2012/07/10 16:55:42 | 000,000,000 | —D | C] – C:\Program Files\FreeFileSync
[2012/07/10 16:38:21 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2012/07/10 16:34:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2012/07/10 16:34:08 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2012/07/10 16:14:29 | 000,141,337 | —- | C] (Eicon Networks) – C:\WINDOWS\System32\dllcache\xlog.exe
[2012/07/10 16:14:27 | 000,016,970 | —- | C] (US Robotics MCD (Megahertz)) – C:\WINDOWS\System32\dllcache\xem336n5.sys
[2012/07/10 16:14:26 | 000,019,458 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\wvchntxx.sys
[2012/07/10 16:14:25 | 000,012,066 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\wsiintxx.sys
[2012/07/10 16:14:23 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wshirda.dll
[2012/07/10 16:13:59 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiacpi.sys
[2012/07/10 16:13:58 | 000,154,624 | —- | C] (Lucent Technologies) – C:\WINDOWS\System32\dllcache\wlluc48.sys
[2012/07/10 16:13:51 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wiafbdrv.dll
[2012/07/10 16:13:48 | 000,701,386 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\wdhaalba.sys
[2012/07/10 16:13:48 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wdmaud.sys
[2012/07/10 16:13:47 | 000,023,618 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\wch7xxnt.sys
[2012/07/10 16:13:47 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wd.sys
[2012/07/10 16:13:46 | 000,105,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wceusbsh.sys
[2012/07/10 16:13:46 | 000,035,871 | —- | C] (Winbond Electronics Corp.) – C:\WINDOWS\System32\dllcache\wbfirdma.sys
[2012/07/10 16:13:45 | 000,033,602 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\watv04nt.sys
[2012/07/10 16:13:45 | 000,025,474 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\watv10nt.sys
[2012/07/10 16:13:45 | 000,022,274 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\watv06nt.sys
[2012/07/10 16:13:44 | 000,029,314 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\watv01nt.sys
[2012/07/10 16:13:44 | 000,019,554 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\watv02nt.sys
[2012/07/10 16:13:44 | 000,011,874 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\wadv09nt.sys
[2012/07/10 16:13:44 | 000,011,298 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\wadv08nt.sys
[2012/07/10 16:13:43 | 000,012,418 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\wadv01nt.sys
[2012/07/10 16:13:43 | 000,012,130 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\wadv02nt.sys
[2012/07/10 16:13:43 | 000,011,810 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\wadv07nt.sys
[2012/07/10 16:13:43 | 000,011,778 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\wadv05nt.sys
[2012/07/10 16:13:42 | 000,019,528 | —- | C] (Winbond Electronics Corporation) – C:\WINDOWS\System32\dllcache\w840nd.sys
[2012/07/10 16:13:37 | 000,026,112 | —- | C] (VIA Technologies, Inc.) – C:\WINDOWS\System32\dllcache\viairda.sys
[2012/07/10 16:13:37 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\viaide.sys
[2012/07/10 16:13:36 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\viaagp.sys
[2012/07/10 16:13:35 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgapnp.sys
[2012/07/10 16:13:33 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vfwwdm32.dll
[2012/07/10 16:13:32 | 000,020,025 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\vch.sys
[2012/07/10 16:13:32 | 000,011,328 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\vchnt5.dll
[2012/07/10 16:13:30 | 000,020,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbuhci.sys
[2012/07/10 16:13:29 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbser.sys
[2012/07/10 16:13:28 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbscan.sys
[2012/07/10 16:13:27 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbprint.sys
[2012/07/10 16:13:26 | 000,027,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbehci.sys
[2012/07/10 16:13:25 | 000,032,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbccgp.sys
[2012/07/10 16:13:24 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbaudio.sys
[2012/07/10 16:13:21 | 000,029,184 | —- | C] (Promise Technology, Inc.) – C:\WINDOWS\System32\dllcache\ultra.sys
[2012/07/10 16:13:21 | 000,012,800 | —- | C] (IBM Corporation) – C:\WINDOWS\System32\dllcache\twotrack.sys
[2012/07/10 16:13:19 | 000,525,568 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\tridxp.dll
[2012/07/10 16:13:19 | 000,166,784 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\tridxpm.sys
[2012/07/10 16:13:19 | 000,159,232 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\tridkbm.sys
[2012/07/10 16:13:18 | 000,440,576 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\tridkb.dll
[2012/07/10 16:13:18 | 000,315,520 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\trid3d.dll
[2012/07/10 16:13:18 | 000,222,336 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\trid3dm.sys
[2012/07/10 16:13:17 | 000,042,496 | —- | C] (IBM Corporation) – C:\WINDOWS\System32\dllcache\tp4res.dll
[2012/07/10 16:13:16 | 000,036,864 | —- | C] (IBM Corporation) – C:\WINDOWS\System32\dllcache\tp4mon.exe
[2012/07/10 16:13:16 | 000,016,384 | —- | C] (IBM Corporation) – C:\WINDOWS\System32\dllcache\tp4.dll
[2012/07/10 16:13:16 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\toside.sys
[2012/07/10 16:13:15 | 000,237,824 | —- | C] (Toshiba Corporation) – C:\WINDOWS\System32\dllcache\tosdvd03.sys
[2012/07/10 16:13:14 | 000,020,480 | —- | C] (TOSHIBA Corporation) – C:\WINDOWS\System32\dllcache\tos4mo.sys
[2012/07/10 16:13:13 | 000,123,995 | —- | C] (Tiger Jet Network) – C:\WINDOWS\System32\dllcache\tjisdn.sys
[2012/07/10 16:13:10 | 000,138,528 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\tgiulnt5.sys
[2012/07/10 16:13:10 | 000,081,408 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\tgiul50.dll
[2012/07/10 16:13:09 | 000,127,488 | —- | C] (M-Systems) – C:\WINDOWS\System32\dllcache\tffsport.sys
[2012/07/10 16:13:07 | 000,030,208 | —- | C] (Toshiba Corporation) – C:\WINDOWS\System32\dllcache\tbatm155.sys
[2012/07/10 16:13:06 | 000,172,768 | —- | C] (Number Nine Visual Technology) – C:\WINDOWS\System32\dllcache\t2r4disp.dll
[2012/07/10 16:13:06 | 000,036,640 | —- | C] (Number Nine Visual Technology Corp.) – C:\WINDOWS\System32\dllcache\t2r4mini.sys
[2012/07/10 16:13:06 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tandqic.sys
[2012/07/10 16:13:01 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sysaudio.sys
[2012/07/10 16:13:01 | 000,049,664 | —- | C] (LSI Logic) – C:\WINDOWS\System32\dllcache\symmpi.sys
[2012/07/10 16:13:00 | 000,028,160 | —- | C] (LSI Logic) – C:\WINDOWS\System32\dllcache\symc8xx.sys
[2012/07/10 16:12:59 | 000,026,624 | —- | C] (LSI Logic) – C:\WINDOWS\System32\dllcache\sym_u3.sys
[2012/07/10 16:12:59 | 000,016,256 | —- | C] (Symbios Logic Inc.) – C:\WINDOWS\System32\dllcache\symc810.sys
[2012/07/10 16:12:58 | 000,024,064 | —- | C] (LSI Logic) – C:\WINDOWS\System32\dllcache\sym_hi.sys
[2012/07/10 16:12:57 | 000,103,936 | —- | C] (Perle Systems Ltd. ) – C:\WINDOWS\System32\dllcache\sx.sys
[2012/07/10 16:12:57 | 000,090,192 | —- | C] (Perle Systems Ltd. ) – C:\WINDOWS\System32\dllcache\sxports.dll
[2012/07/10 16:12:57 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\swnvram.sys
[2012/07/10 16:12:56 | 000,058,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\swmidi.sys
[2012/07/10 16:12:56 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\swkeypad.sys
[2012/07/10 16:12:55 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sw_wheel.dll
[2012/07/10 16:12:55 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sw_effct.dll
[2012/07/10 16:12:55 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\swdisp.sys
[2012/07/10 16:12:54 | 000,233,472 | —- | C] (Stallion Technologies) – C:\WINDOWS\System32\dllcache\stlnprop.dll
[2012/07/10 16:12:53 | 000,283,616 | —- | C] (Stallion Technologies) – C:\WINDOWS\System32\dllcache\stlnata.sys
[2012/07/10 16:12:53 | 000,064,512 | —- | C] (Stallion Technologies) – C:\WINDOWS\System32\dllcache\stlncoin.dll
[2012/07/10 16:12:53 | 000,019,456 | —- | C] (SCM Microsystems, Inc.) – C:\WINDOWS\System32\dllcache\stcusb.sys
[2012/07/10 16:12:51 | 000,024,660 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\dllcache\spxupchk.dll
[2012/07/10 16:12:50 | 000,065,536 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\dllcache\speed.sys
[2012/07/10 16:12:50 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\splitter.sys
[2012/07/10 16:12:49 | 000,102,483 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\dllcache\spdports.dll
[2012/07/10 16:12:48 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spctramc.sys
[2012/07/10 16:12:48 | 000,009,216 | —- | C] (Sony Corporation) – C:\WINDOWS\System32\dllcache\sonypvu1.sys
[2012/07/10 16:12:47 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sonymc.sys
[2012/07/10 16:12:46 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sonyait.sys
[2012/07/10 16:12:46 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snyaitmc.sys
[2012/07/10 16:12:40 | 000,058,368 | —- | C] (Silicon Motion Inc.) – C:\WINDOWS\System32\dllcache\smiminib.sys
[2012/07/10 16:12:39 | 000,147,200 | —- | C] (Silicon Motion Inc.) – C:\WINDOWS\System32\dllcache\smidispb.dll
[2012/07/10 16:12:38 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smef.dll
[2012/07/10 16:12:38 | 000,036,892 | —- | C] (SMC) – C:\WINDOWS\System32\dllcache\smcirda.sys
[2012/07/10 16:12:38 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smbhc.sys
[2012/07/10 16:12:37 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smbbatt.sys
[2012/07/10 16:12:37 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smbclass.sys
[2012/07/10 16:12:37 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smbali.sys
[2012/07/10 16:12:35 | 000,157,696 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sisv256.dll
[2012/07/10 16:12:35 | 000,094,879 | —- | C] (SysKonnect GmbH.) – C:\WINDOWS\System32\dllcache\sk98xwin.sys
[2012/07/10 16:12:35 | 000,091,646 | —- | C] (SysKonnect GmbH.) – C:\WINDOWS\System32\dllcache\skfpwin.sys
[2012/07/10 16:12:34 | 000,050,432 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sisv.sys
[2012/07/10 16:12:34 | 000,032,768 | —- | C] (SiS Corporation) – C:\WINDOWS\System32\dllcache\sisnic.sys
[2012/07/10 16:12:33 | 000,741,248 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sisgrv.dll
[2012/07/10 16:12:33 | 000,247,808 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sisgrp.sys
[2012/07/10 16:12:32 | 000,253,952 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sis630v.dll
[2012/07/10 16:12:32 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sisagp.sys
[2012/07/10 16:12:31 | 000,252,032 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sis300iv.dll
[2012/07/10 16:12:31 | 000,163,072 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sis630p.sys
[2012/07/10 16:12:31 | 000,150,144 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sis6306v.dll
[2012/07/10 16:12:31 | 000,068,608 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sis6306p.sys
[2012/07/10 16:12:30 | 000,101,760 | —- | C] (Silicon Integrated Systems Corporation) – C:\WINDOWS\System32\dllcache\sis300ip.sys
[2012/07/10 16:12:30 | 000,003,904 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\siint5.dll
[2012/07/10 16:12:26 | 000,386,560 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\sgiul50.dll
[2012/07/10 16:12:26 | 000,098,080 | —- | C] (Trident Microsystems Inc.) – C:\WINDOWS\System32\dllcache\sgiulnt5.sys
[2012/07/10 16:12:24 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\seva.dll
[2012/07/10 16:12:22 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\serscan.sys
[2012/07/10 16:12:21 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sermouse.sys
[2012/07/10 16:12:20 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\seaddsmc.sys
[2012/07/10 16:12:19 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scwiisext.dll
[2012/07/10 16:12:19 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scwhlp.dll
[2012/07/10 16:12:19 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scwsddlanalysis.dll
[2012/07/10 16:12:19 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scwviewer.exe
[2012/07/10 16:12:18 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scwengb.dll
[2012/07/10 16:12:18 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scwcmd.exe
[2012/07/10 16:12:18 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scwauditext.dll
[2012/07/10 16:12:17 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scss.exe
[2012/07/10 16:12:16 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scsiprnt.sys
[2012/07/10 16:12:16 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scsiscan.sys
[2012/07/10 16:12:16 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scshost.exe
[2012/07/10 16:12:14 | 000,020,480 | —- | C] (SCM Microsystems) – C:\WINDOWS\System32\dllcache\scr111.sys
[2012/07/10 16:12:14 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scmstcs.sys
[2012/07/10 16:12:12 | 000,026,240 | —- | C] (OMNIKEY AG) – C:\WINDOWS\System32\dllcache\sccmusbm.sys
[2012/07/10 16:12:11 | 000,028,160 | —- | C] (OMNIKEY AG) – C:\WINDOWS\System32\dllcache\sccmn50m.sys
[2012/07/10 16:12:10 | 000,046,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sbp2port.sys
[2012/07/10 16:12:09 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\saport.sys
[2012/07/10 16:12:08 | 000,106,880 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\dllcache\s3ssavm.sys
[2012/07/10 16:12:07 | 000,347,776 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\dllcache\s3ssav.dll
[2012/07/10 16:12:07 | 000,210,496 | —- | C] (S3 Incorporated) – C:\WINDOWS\System32\dllcache\s3mvirge.dll
[2012/07/10 16:12:07 | 000,179,264 | —- | C] (S3 Incorporated) – C:\WINDOWS\System32\dllcache\s3sav3d.dll
[2012/07/10 16:12:07 | 000,061,504 | —- | C] (S3 Incorporated) – C:\WINDOWS\System32\dllcache\s3sav3dm.sys
[2012/07/10 16:12:06 | 000,182,272 | —- | C] (S3 Incorporated) – C:\WINDOWS\System32\dllcache\s3mt3d.dll
[2012/07/10 16:12:06 | 000,166,720 | —- | C] (S3 Incorporated) – C:\WINDOWS\System32\dllcache\s3m.sys
[2012/07/10 16:12:06 | 000,062,496 | —- | C] (S3 Incorporated) – C:\WINDOWS\System32\dllcache\s3mtrio.dll
[2012/07/10 16:12:06 | 000,041,216 | —- | C] (S3 Incorporated) – C:\WINDOWS\System32\dllcache\s3mt3d.sys
[2012/07/10 16:12:05 | 000,269,184 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\dllcache\s3gsavmx.dll
[2012/07/10 16:12:05 | 000,080,384 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\dllcache\s3gsavm.sys
[2012/07/10 16:12:05 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\s3legacy.sys
[2012/07/10 16:12:04 | 000,420,096 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\dllcache\s3gsav4.dll
[2012/07/10 16:12:04 | 000,360,576 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\dllcache\s3gnb.dll
[2012/07/10 16:12:04 | 000,145,152 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\dllcache\s3gnbm.sys
[2012/07/10 16:12:04 | 000,138,880 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\dllcache\s3gsav4m.sys
[2012/07/10 16:12:02 | 000,030,720 | —- | C] (Conexant Systems Inc.) – C:\WINDOWS\System32\dllcache\rthwcls.sys
[2012/07/10 16:12:02 | 000,020,992 | —- | C] (Realtek Semiconductor Corporation) – C:\WINDOWS\System32\dllcache\rtl8139.sys
[2012/07/10 16:12:02 | 000,018,974 | —- | C] (Realtek Semiconductor Corporation) – C:\WINDOWS\System32\dllcache\rtl8029.sys
[2012/07/10 16:12:01 | 000,028,544 | —- | C] (Realtek Semiconductor Corporation	   ) – C:\WINDOWS\System32\dllcache\rt8169xp.sys
[2012/07/10 16:12:00 | 000,009,216 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\rsmgrstr.dll
[2012/07/10 16:11:59 | 000,003,840 | —- | C] (Conexant Systems Inc.) – C:\WINDOWS\System32\dllcache\rpfun.sys
[2012/07/10 16:11:57 | 000,079,872 | —- | C] (Comtrol Corporation) – C:\WINDOWS\System32\dllcache\rocket.sys
[2012/07/10 16:11:50 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rasirda.sys
[2012/07/10 16:11:49 | 000,714,762 | —- | C] (Xircom, Inc.) – C:\WINDOWS\System32\dllcache\r2mdmkxx.sys
[2012/07/10 16:11:49 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ramdisk.sys
[2012/07/10 16:11:48 | 000,899,146 | —- | C] (Xircom, Inc.) – C:\WINDOWS\System32\dllcache\r2mdkxga.sys
[2012/07/10 16:11:46 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qlstrmc.sys
[2012/07/10 16:11:46 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qntmmc.sys
[2012/07/10 16:11:45 | 000,708,608 | —- | C] (QLogic Corporation) – C:\WINDOWS\System32\dllcache\ql2300.sys
[2012/07/10 16:11:44 | 000,154,624 | —- | C] (QLogic Corporation) – C:\WINDOWS\System32\dllcache\ql2200.sys
[2012/07/10 16:11:44 | 000,130,560 | —- | C] (QLogic Corporation) – C:\WINDOWS\System32\dllcache\ql2100.sys
[2012/07/10 16:11:44 | 000,050,688 | —- | C] (QLogic Corporation) – C:\WINDOWS\System32\dllcache\ql1280.sys
[2012/07/10 16:11:43 | 000,048,640 | —- | C] (QLogic Corporation) – C:\WINDOWS\System32\dllcache\ql12160.sys
[2012/07/10 16:11:43 | 000,041,472 | —- | C] (QLogic Corporation) – C:\WINDOWS\System32\dllcache\ql1080.sys
[2012/07/10 16:11:43 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ql1240.sys
[2012/07/10 16:11:43 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ql10wnt.sys
[2012/07/10 16:11:42 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qic157.sys
[2012/07/10 16:11:40 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ptpusd.dll
[2012/07/10 16:11:39 | 000,018,432 | —- | C] (SCM Microsystems, Inc.) – C:\WINDOWS\System32\dllcache\pscr.sys
[2012/07/10 16:11:35 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ppa.sys
[2012/07/10 16:11:35 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ppa3.sys
[2012/07/10 16:11:34 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\powerfil.sys
[2012/07/10 16:11:33 | 000,147,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\portcls.sys
[2012/07/10 16:11:32 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pnrmc.sys
[2012/07/10 16:11:31 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\plasmc.sys
[2012/07/10 16:11:13 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\phvfwext.dll
[2012/07/10 16:11:12 | 000,097,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\phildec.sys
[2012/07/10 16:11:11 | 000,175,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\philcam2.sys
[2012/07/10 16:11:10 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\phdsext.ax
[2012/07/10 16:11:10 | 000,077,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\philcam1.sys
[2012/07/10 16:11:10 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\philcam1.dll
[2012/07/10 16:11:08 | 000,260,608 | —- | C] (Microsoft Corp., 3Dlabs Inc. Ltd.) – C:\WINDOWS\System32\dllcache\perm3dd.dll
[2012/07/10 16:11:08 | 000,207,872 | —- | C] (Microsoft Corp., 3Dlabs Inc. Ltd.) – C:\WINDOWS\System32\dllcache\perm2dll.dll
[2012/07/10 16:11:08 | 000,030,208 | —- | C] (Microsoft Corp., 3Dlabs Inc. Ltd.) – C:\WINDOWS\System32\dllcache\perm3.sys
[2012/07/10 16:11:07 | 000,025,088 | —- | C] (Microsoft Corp., 3Dlabs Inc. Ltd.) – C:\WINDOWS\System32\dllcache\perm2.sys
[2012/07/10 16:11:07 | 000,006,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\perc2hib.sys
[2012/07/10 16:11:06 | 000,214,016 | —- | C] (Cisco Systems) – C:\WINDOWS\System32\dllcache\pcx500.sys
[2012/07/10 16:11:06 | 000,028,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\perc2.sys
[2012/07/10 16:11:05 | 000,035,328 | —- | C] (AMD Inc.) – C:\WINDOWS\System32\dllcache\pcntpci5.sys
[2012/07/10 16:11:05 | 000,029,502 | —- | C] (Marconi Communications, Inc.) – C:\WINDOWS\System32\dllcache\pca200e.sys
[2012/07/10 16:11:05 | 000,026,153 | —- | C] (Linksys) – C:\WINDOWS\System32\dllcache\pcmlm56.sys
[2012/07/10 16:11:04 | 000,030,495 | —- | C] (Linksys) – C:\WINDOWS\System32\dllcache\pc100nds.sys
[2012/07/10 16:11:01 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovui2rc.dll
[2012/07/10 16:11:00 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovui2.dll
[2012/07/10 16:10:59 | 000,027,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovsound2.sys
[2012/07/10 16:10:58 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovcoms.exe
[2012/07/10 16:10:58 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovcomc.dll
[2012/07/10 16:10:57 | 000,355,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovcodek2.sys
[2012/07/10 16:10:57 | 000,121,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovcodec2.dll
[2012/07/10 16:10:56 | 000,036,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovce.sys
[2012/07/10 16:10:55 | 000,031,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovcd.sys
[2012/07/10 16:10:54 | 000,050,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovcam2.sys
[2012/07/10 16:10:53 | 000,054,186 | —- | C] (Ositech Communications, Inc.) – C:\WINDOWS\System32\dllcache\otcsercb.sys
[2012/07/10 16:10:53 | 000,027,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ovca.sys
[2012/07/10 16:10:52 | 000,043,689 | —- | C] (Ositech Communications, Inc.) – C:\WINDOWS\System32\dllcache\otceth5.sys
[2012/07/10 16:10:52 | 000,027,209 | —- | C] (Ositech Communications, Inc.) – C:\WINDOWS\System32\dllcache\otc06x5.sys
[2012/07/10 16:10:48 | 000,061,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ohci1394.sys
[2012/07/10 16:10:45 | 001,897,408 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\dllcache\nv4_mini.sys
[2012/07/10 16:10:44 | 004,274,816 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\dllcache\nv4_disp.dll
[2012/07/10 16:10:43 | 000,198,144 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\dllcache\nv3.sys
[2012/07/10 16:10:43 | 000,123,776 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\dllcache\nv3.dll
[2012/07/10 16:10:36 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nsmmc.sys
[2012/07/10 16:10:35 | 000,029,184 | —- | C] (National Semiconductor Corporation) – C:\WINDOWS\System32\dllcache\nscirda.sys
[2012/07/10 16:10:31 | 000,058,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nic1394.sys
[2012/07/10 16:10:31 | 000,036,352 | —- | C] (IBM Corporation) – C:\WINDOWS\System32\dllcache\nfrd960.sys
[2012/07/10 16:10:30 | 000,132,695 | —- | C] (802.11b) – C:\WINDOWS\System32\dllcache\netwlan5.sys
[2012/07/10 16:10:25 | 000,060,480 | —- | C] (NeoMagic Corporation) – C:\WINDOWS\System32\dllcache\neo20xx.dll
[2012/07/10 16:10:25 | 000,039,264 | —- | C] (NeoMagic Corporation) – C:\WINDOWS\System32\dllcache\neo20xx.sys
[2012/07/10 16:10:24 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ne2000.sys
[2012/07/10 16:10:21 | 000,091,488 | —- | C] (Number Nine Visual Technology Corp.) – C:\WINDOWS\System32\dllcache\n9i3disp.dll
[2012/07/10 16:10:20 | 000,059,104 | —- | C] (Number Nine Visual Technology Corp.) – C:\WINDOWS\System32\dllcache\n9i128v2.dll
[2012/07/10 16:10:20 | 000,033,088 | —- | C] (Number Nine Visual Technology Corp.) – C:\WINDOWS\System32\dllcache\n9i128v2.sys
[2012/07/10 16:10:20 | 000,027,936 | —- | C] (Number Nine Visual Technology Corp.) – C:\WINDOWS\System32\dllcache\n9i3d.sys
[2012/07/10 16:10:20 | 000,013,664 | —- | C] (Number Nine Visual Technology Corp.) – C:\WINDOWS\System32\dllcache\n9i128.sys
[2012/07/10 16:10:19 | 000,035,392 | —- | C] (Number Nine Visual Technology Corp.) – C:\WINDOWS\System32\dllcache\n9i128.dll
[2012/07/10 16:10:18 | 000,151,552 | —- | C] (Compaq Computer Corporation) – C:\WINDOWS\System32\dllcache\n100325.sys
[2012/07/10 16:10:18 | 000,097,792 | —- | C] (Compaq Computer Corporation) – C:\WINDOWS\System32\dllcache\n1000325.sys
[2012/07/10 16:10:18 | 000,074,752 | —- | C] (Moxa Technologies Co., Ltd.) – C:\WINDOWS\System32\dllcache\mxport.sys
[2012/07/10 16:10:17 | 000,023,040 | —- | C] (Macronix International Co., Ltd.) – C:\WINDOWS\System32\dllcache\mxnic.sys
[2012/07/10 16:10:17 | 000,013,824 | —- | C] (Moxa Technologies Co., Ltd) – C:\WINDOWS\System32\dllcache\mxport.dll
[2012/07/10 16:10:16 | 000,024,064 | —- | C] (Moxa Technologies Co., Ltd.) – C:\WINDOWS\System32\dllcache\mxcard.sys
[2012/07/10 16:10:16 | 000,022,016 | —- | C] (Moxa Technologies Co., Ltd) – C:\WINDOWS\System32\dllcache\mxicfg.dll
[2012/07/10 16:10:05 | 000,049,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstape.sys
[2012/07/10 16:10:02 | 000,005,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mspqm.sys
[2012/07/10 16:09:56 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msmpu401.sys
[2012/07/10 16:09:55 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msircomm.sys
[2012/07/10 16:09:44 | 000,035,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msgame.sys
[2012/07/10 16:09:43 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdv.sys
[2012/07/10 16:09:31 | 000,024,064 | —- | C] (LSI Logic Corporation) – C:\WINDOWS\System32\dllcache\mraid35x.sys
[2012/07/10 16:09:25 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mouhid.sys
[2012/07/10 16:09:24 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\modemcsa.sys
[2012/07/10 16:09:22 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\miniqic.sys
[2012/07/10 16:09:20 | 000,320,384 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\dllcache\mgaum.sys
[2012/07/10 16:09:19 | 000,235,648 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\dllcache\mgaud.dll
[2012/07/10 16:09:19 | 000,025,600 | —- | C] (Sony Corporation) – C:\WINDOWS\System32\dllcache\memstpci.sys
[2012/07/10 16:09:18 | 000,171,935 | —- | C] (Madge Networks Ltd) – C:\WINDOWS\System32\dllcache\mdgndis5.sys
[2012/07/10 16:09:18 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\memcard.sys
[2012/07/10 16:09:16 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mammoth.sys
[2012/07/10 16:09:15 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\m4mc.sys
[2012/07/10 16:09:14 | 000,022,848 | —- | C] (Logitech Inc.) – C:\WINDOWS\System32\dllcache\lwusbhid.sys
[2012/07/10 16:09:14 | 000,020,864 | —- | C] (Logitech Inc.) – C:\WINDOWS\System32\dllcache\lwadihid.sys
[2012/07/10 16:09:13 | 000,420,992 | —- | C] (LT) – C:\WINDOWS\System32\dllcache\ltmdmntt.sys
[2012/07/10 16:09:13 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ltotape.sys
[2012/07/10 16:09:12 | 000,727,786 | —- | C] (Xircom, Inc.) – C:\WINDOWS\System32\dllcache\ltck000c.sys
[2012/07/10 16:09:12 | 000,606,684 | —- | C] (LT) – C:\WINDOWS\System32\dllcache\ltmdmnt.sys
[2012/07/10 16:09:10 | 000,113,664 | —- | C] (Emulex Corporation) – C:\WINDOWS\System32\dllcache\lp6nds35.sys
[2012/07/10 16:09:10 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\loop.sys
[2012/07/10 16:09:08 | 000,025,065 | —- | C] (D-Link) – C:\WINDOWS\System32\dllcache\lmndis3.sys
[2012/07/10 16:09:07 | 000,018,944 | —- | C] (Litronic Industries) – C:\WINDOWS\System32\dllcache\lit220p.sys
[2012/07/10 16:09:06 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\libxprmc.sys
[2012/07/10 16:09:04 | 000,169,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kmixer.sys
[2012/07/10 16:08:56 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdkor.dll
[2012/07/10 16:08:55 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdjpn.dll
[2012/07/10 16:08:51 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhid.sys
[2012/07/10 16:08:44 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd106.dll
[2012/07/10 16:08:44 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd103.dll
[2012/07/10 16:08:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101c.dll
[2012/07/10 16:08:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101b.dll
[2012/07/10 16:08:42 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jvcmc.sys
[2012/07/10 16:08:40 | 000,617,600 | —- | C] (Intersil Americas Inc.) – C:\WINDOWS\System32\dllcache\islp2nds.sys
[2012/07/10 16:08:40 | 000,030,208 | —- | C] (SigmaTel, Inc.) – C:\WINDOWS\System32\dllcache\irstusb.sys
[2012/07/10 16:08:39 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irprops.cpl
[2012/07/10 16:08:39 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irsir.sys
[2012/07/10 16:08:39 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irmon.dll
[2012/07/10 16:08:38 | 000,168,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irftp.exe
[2012/07/10 16:08:38 | 000,093,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irda.sys
[2012/07/10 16:08:38 | 000,023,552 | —- | C] (MKNet Corporation) – C:\WINDOWS\System32\dllcache\irmk7.sys
[2012/07/10 16:08:37 | 000,027,648 | —- | C] (IBM Corporation) – C:\WINDOWS\System32\dllcache\ipsraidn.sys
[2012/07/10 16:08:35 | 000,086,099 | —- | C] (Perle Systems Ltd. ) – C:\WINDOWS\System32\dllcache\io8ports.dll
[2012/07/10 16:08:35 | 000,045,632 | —- | C] (Interphase (R) Corporation a Windows (R) 2000 DDK Driver Provider) – C:\WINDOWS\System32\dllcache\ip5515.sys
[2012/07/10 16:08:34 | 000,040,960 | —- | C] (Perle Systems Ltd. ) – C:\WINDOWS\System32\dllcache\io8.sys
[2012/07/10 16:08:33 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\intelide.sys
[2012/07/10 16:08:03 | 000,031,744 | —- | C] (Intel Corp./ICP vortex GmbH) – C:\WINDOWS\System32\dllcache\iirsp.sys
[2012/07/10 16:07:58 | 000,103,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icam5usb.sys
[2012/07/10 16:07:58 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icam5ext.dll
[2012/07/10 16:07:57 | 000,156,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icam4usb.sys
[2012/07/10 16:07:57 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icam4ext.dll
[2012/07/10 16:07:57 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icam5com.dll
[2012/07/10 16:07:56 | 000,143,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icam3.sys
[2012/07/10 16:07:56 | 000,101,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icam4com.dll
[2012/07/10 16:07:56 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icam3ext.dll
[2012/07/10 16:07:55 | 000,100,936 | —- | C] (IBM Corporation) – C:\WINDOWS\System32\dllcache\ibmtok.sys
[2012/07/10 16:07:55 | 000,098,304 | —- | C] (IBM Corporation) – C:\WINDOWS\System32\dllcache\ibmtrp.sys
[2012/07/10 16:07:54 | 000,009,216 | —- | C] (IBM Corporation) – C:\WINDOWS\System32\dllcache\ibmsgnet.dll
[2012/07/10 16:07:53 | 000,091,394 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ialmsbw.sys
[2012/07/10 16:07:53 | 000,080,447 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ialmnt5.sys
[2012/07/10 16:07:53 | 000,031,299 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ialmrnt5.dll
[2012/07/10 16:07:52 | 000,077,376 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ialmdnt5.dll
[2012/07/10 16:07:52 | 000,071,262 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ialmkchw.sys
[2012/07/10 16:07:51 | 000,518,726 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ialmdd5.dll
[2012/07/10 16:07:51 | 000,161,983 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ialmdev5.dll
[2012/07/10 16:07:51 | 000,161,023 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\i81xnt5.sys
[2012/07/10 16:07:50 | 000,702,848 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\i81xdnt5.dll
[2012/07/10 16:07:50 | 000,353,184 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\i740dnt5.dll
[2012/07/10 16:07:50 | 000,058,592 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\i740nt5.sys
[2012/07/10 16:07:49 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\i2omp.sys
[2012/07/10 16:07:49 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\i2omgmt.sys
[2012/07/10 16:07:14 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hpt4qic.sys
[2012/07/10 16:07:13 | 000,329,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hpojwia.dll
[2012/07/10 16:07:13 | 000,039,424 | —- | C] (HighPoint Technologies, Inc.) – C:\WINDOWS\System32\dllcache\hpt3xx.sys
[2012/07/10 16:07:13 | 000,026,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hpn.sys
[2012/07/10 16:07:12 | 000,130,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hpdigwia.dll
[2012/07/10 16:07:12 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hpmc.sys
[2012/07/10 16:07:10 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hidserv.dll
[2012/07/10 16:07:10 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hidusb.sys
[2012/07/10 16:07:10 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hidgame.sys
[2012/07/10 16:07:09 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hidbatt.sys
[2012/07/10 16:07:07 | 000,907,456 | —- | C] (Conexant) – C:\WINDOWS\System32\dllcache\hcf_msft.sys
[2012/07/10 16:07:06 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hccoin.dll
[2012/07/10 16:07:04 | 000,028,672 | —- | C] (Gemplus) – C:\WINDOWS\System32\dllcache\grserial.sys
[2012/07/10 16:07:03 | 000,020,480 | —- | C] (Gemplus) – C:\WINDOWS\System32\dllcache\gpr400.sys
[2012/07/10 16:06:59 | 000,010,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\gameenum.sys
[2012/07/10 16:06:58 | 002,848,512 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\dllcache\g550dhd.dll
[2012/07/10 16:06:58 | 000,317,696 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\dllcache\g550dhm.sys
[2012/07/10 16:06:57 | 002,310,144 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\dllcache\g400dhd.dll
[2012/07/10 16:06:57 | 000,320,384 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\dllcache\g200m.sys
[2012/07/10 16:06:57 | 000,319,360 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\dllcache\g400dhm.sys
[2012/07/10 16:06:56 | 000,470,144 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\dllcache\g200d.dll
[2012/07/10 16:06:40 | 000,033,597 | —- | C] (Marconi Communications, Inc.) – C:\WINDOWS\System32\dllcache\forehe.sys
[2012/07/10 16:06:38 | 000,040,448 | —- | C] (VIA Technologies, Inc.			  ) – C:\WINDOWS\System32\dllcache\fetnd5.sys
[2012/07/10 16:06:37 | 000,053,760 | —- | C] (Brooktrout Technology) – C:\WINDOWS\System32\dllcache\faxinit.exe
[2012/07/10 16:06:37 | 000,022,090 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\fem556n5.sys
[2012/07/10 16:06:36 | 000,024,618 | —- | C] (NETGEAR) – C:\WINDOWS\System32\dllcache\fa410nd5.sys
[2012/07/10 16:06:34 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\examc.sys
[2012/07/10 16:06:34 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\exabyte2.sys
[2012/07/10 16:06:31 | 000,047,616 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esunib.dll
[2012/07/10 16:06:30 | 000,047,616 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esuni.dll
[2012/07/10 16:06:30 | 000,045,568 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esucm.dll
[2012/07/10 16:06:30 | 000,037,888 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esuimg.dll
[2012/07/10 16:06:29 | 000,137,088 | —- | C] (ESS Technology, Inc.) – C:\WINDOWS\System32\dllcache\essm2e.sys
[2012/07/10 16:06:28 | 000,174,464 | —- | C] (ESS Technology, Inc.) – C:\WINDOWS\System32\dllcache\es198x.sys
[2012/07/10 16:06:27 | 000,053,760 | —- | C] (Equinox Systems Inc.) – C:\WINDOWS\System32\dllcache\eqnloop.exe
[2012/07/10 16:06:27 | 000,041,472 | —- | C] (Equinox Systems Inc.) – C:\WINDOWS\System32\dllcache\eqnlogr.exe
[2012/07/10 16:06:26 | 000,451,840 | —- | C] (Equinox Systems Inc.) – C:\WINDOWS\System32\dllcache\eqn.sys
[2012/07/10 16:06:26 | 000,043,520 | —- | C] (Equinox Systems Inc.) – C:\WINDOWS\System32\dllcache\eqndiag.exe
[2012/07/10 16:06:25 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\epstw2k.sys
[2012/07/10 16:06:24 | 000,202,880 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\dllcache\emu10k1b.sys
[2012/07/10 16:06:24 | 000,145,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\epcfw2k.sys
[2012/07/10 16:06:24 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\enum1394.sys
[2012/07/10 16:06:23 | 000,019,996 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\em556n4.sys
[2012/07/10 16:06:22 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\elmsmc.sys
[2012/07/10 16:06:21 | 000,568,351 | —- | C] (3Com Corporation.) – C:\WINDOWS\System32\dllcache\el985n51.sys
[2012/07/10 16:06:21 | 000,139,776 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el99xn51.sys
[2012/07/10 16:06:21 | 000,070,686 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el98xn5.sys
[2012/07/10 16:06:20 | 000,153,631 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el90xnd5.sys
[2012/07/10 16:06:20 | 000,070,687 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el90xbc5.sys
[2012/07/10 16:06:19 | 000,241,206 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el656se5.sys
[2012/07/10 16:06:19 | 000,077,386 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el656nd5.sys
[2012/07/10 16:06:18 | 000,634,134 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el656ct5.sys
[2012/07/10 16:06:18 | 000,069,663 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el575nd5.sys
[2012/07/10 16:06:18 | 000,069,194 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el656cd5.sys
[2012/07/10 16:06:18 | 000,055,039 | —- | C] (3Com Corporation) – C:\WINDOWS\System32\dllcache\el556nd5.sys
[2012/07/10 16:06:14 | 000,101,376 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\e1000325.sys
[2012/07/10 16:06:11 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dshowext.ax
[2012/07/10 16:06:10 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmkaud.sys
[2012/07/10 16:06:09 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmk.sys
[2012/07/10 16:06:09 | 000,024,064 | —- | C] (Adaptec, Inc.) – C:\WINDOWS\System32\dllcache\dpti2o.sys
[2012/07/10 16:06:08 | 000,032,606 | —- | C] (National Semiconductor Coproration) – C:\WINDOWS\System32\dllcache\dp83820.sys
[2012/07/10 16:06:08 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dot4usb.sys
[2012/07/10 16:06:08 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dot4scan.sys
[2012/07/10 16:06:07 | 000,207,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dot4.sys
[2012/07/10 16:06:07 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dot4prt.sys
[2012/07/10 16:06:05 | 000,054,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dmusic.sys
[2012/07/10 16:06:04 | 000,029,696 | —- | C] (CNet Technology, Inc.													) – C:\WINDOWS\System32\dllcache\dm9pci5.sys
[2012/07/10 16:06:03 | 000,369,085 | —- | C] (Eicon Networks) – C:\WINDOWS\System32\dllcache\diwansrv.sys
[2012/07/10 16:06:03 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dlttape.sys
[2012/07/10 16:06:02 | 000,282,140 | —- | C] (Eicon Networks) – C:\WINDOWS\System32\dllcache\ditrace.exe
[2012/07/10 16:06:02 | 000,040,990 | —- | C] (Eicon Networks) – C:\WINDOWS\System32\dllcache\disrvsu.dll
[2012/07/10 16:06:02 | 000,034,334 | —- | C] (Eicon Networks) – C:\WINDOWS\System32\dllcache\disrvpp.dll
[2012/07/10 16:06:01 | 000,006,686 | —- | C] (Eicon Networks) – C:\WINDOWS\System32\dllcache\disrvci.dll
[2012/07/10 16:06:00 | 000,094,140 | —- | C] (Eicon Networks) – C:\WINDOWS\System32\dllcache\dimaint.sys
[2012/07/10 16:05:59 | 000,614,400 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digiview.exe
[2012/07/10 16:05:59 | 000,098,304 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digirlpt.dll
[2012/07/10 16:05:59 | 000,047,872 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digirlpt.sys
[2012/07/10 16:05:59 | 000,021,504 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digiisdn.sys
[2012/07/10 16:05:58 | 000,159,744 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digihlc.dll
[2012/07/10 16:05:58 | 000,102,400 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digiinf.dll
[2012/07/10 16:05:58 | 000,029,184 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digiisdn.dll
[2012/07/10 16:05:57 | 000,229,376 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digifwrk.dll
[2012/07/10 16:05:57 | 000,092,928 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digifep5.sys
[2012/07/10 16:05:57 | 000,070,272 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digidxb.sys
[2012/07/10 16:05:56 | 000,131,072 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digidbp.dll
[2012/07/10 16:05:56 | 000,051,712 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digiasyn.dll
[2012/07/10 16:05:56 | 000,037,888 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\digiasyn.sys
[2012/07/10 16:05:55 | 000,270,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dhcpssvc.dll
[2012/07/10 16:05:54 | 000,963,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dhcpsnap.dll
[2012/07/10 16:05:54 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dhcpmib.dll
[2012/07/10 16:05:53 | 000,212,992 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\dgconfig.dll
[2012/07/10 16:05:53 | 000,029,056 | —- | C] (Digi International Inc.) – C:\WINDOWS\System32\dllcache\dgapci.sys
[2012/07/10 16:05:52 | 000,024,649 | —- | C] (D-Link) – C:\WINDOWS\System32\dllcache\dfe650d.sys
[2012/07/10 16:05:52 | 000,024,648 | —- | C] (D-Link) – C:\WINDOWS\System32\dllcache\dfe650.sys
[2012/07/10 16:05:51 | 000,022,016 | —- | C] (LSI Logic Corporation) – C:\WINDOWS\System32\dllcache\dellcerc.sys
[2012/07/10 16:05:51 | 000,021,632 | —- | C] (Digital Networks, LLC) – C:\WINDOWS\System32\dllcache\defpa.sys
[2012/07/10 16:05:50 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ddsmc.sys
[2012/07/10 16:05:49 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dc260usd.dll
[2012/07/10 16:05:49 | 000,087,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dc240usd.dll
[2012/07/10 16:05:49 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dc21x4.sys
[2012/07/10 16:05:47 | 000,054,272 | —- | C] (Mylex Corporation) – C:\WINDOWS\System32\dllcache\dac2w2k.sys
[2012/07/10 16:05:47 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dac960nt.sys
[2012/07/10 16:05:45 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cyzport.sys
[2012/07/10 16:05:45 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cyzports.dll
[2012/07/10 16:05:45 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cyzcoins.dll
[2012/07/10 16:05:44 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cyyport.sys
[2012/07/10 16:05:44 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cyycoins.dll
[2012/07/10 16:05:44 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cyyports.dll
[2012/07/10 16:05:44 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cyclom-y.sys
[2012/07/10 16:05:43 | 000,111,872 | —- | C] (Crystal Semiconductor Corp.) – C:\WINDOWS\System32\dllcache\cwcspud.sys
[2012/07/10 16:05:43 | 000,096,256 | —- | C] (Crystal Semiconductor Corp.) – C:\WINDOWS\System32\dllcache\cwcwdm.sys
[2012/07/10 16:05:43 | 000,047,616 | —- | C] (Crystal Semiconductor Corp.) – C:\WINDOWS\System32\dllcache\cwrwdm.sys
[2012/07/10 16:05:43 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cyclad-z.sys
[2012/07/10 16:05:42 | 000,250,880 | —- | C] (Comtrol® Corporation) – C:\WINDOWS\System32\dllcache\ctmasetp.dll
[2012/07/10 16:05:42 | 000,003,712 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\dllcache\ctljystk.sys
[2012/07/10 16:05:42 | 000,003,584 | —- | C] (Crystal Semiconductor Corp.) – C:\WINDOWS\System32\dllcache\cwcosnt5.sys
[2012/07/10 16:05:40 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\csamsp.dll
[2012/07/10 16:05:40 | 000,042,112 | —- | C] (Conexant Systems Inc.) – C:\WINDOWS\System32\dllcache\crtaud.sys
[2012/07/10 16:05:39 | 000,069,632 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\dllcache\cpqfcalm.sys
[2012/07/10 16:05:39 | 000,060,970 | —- | C] (Compaq Computer Corp.) – C:\WINDOWS\System32\dllcache\cpqtrnd5.sys
[2012/07/10 16:05:39 | 000,018,432 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\dllcache\cpqcissm.sys
[2012/07/10 16:05:38 | 000,016,384 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\dllcache\cpqarray.sys
[2012/07/10 16:05:38 | 000,015,360 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\dllcache\cpqarry2.sys
[2012/07/10 16:05:35 | 000,092,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\complianceextensions.dll
[2012/07/10 16:05:35 | 000,010,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\compbatt.sys
[2012/07/10 16:05:34 | 000,039,936 | —- | C] (Conexant Systems, Inc.) – C:\WINDOWS\System32\dllcache\cnxt1803.sys
[2012/07/10 16:05:33 | 000,009,216 | —- | C] (CMD Technology, Inc.) – C:\WINDOWS\System32\dllcache\cmdide.sys
[2012/07/10 16:05:32 | 000,021,376 | —- | C] (OMNIKEY AG) – C:\WINDOWS\System32\dllcache\cmbp0wdm.sys
[2012/07/10 16:05:32 | 000,014,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cmbatt.sys
[2012/07/10 16:05:27 | 000,249,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cl546xm.sys
[2012/07/10 16:05:27 | 000,172,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cl546x.dll
[2012/07/10 16:05:27 | 000,112,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cl5465.dll
[2012/07/10 16:05:26 | 000,093,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cirrus.dll
[2012/07/10 16:05:26 | 000,047,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cirrus.sys
[2012/07/10 16:05:17 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\changer.sys
[2012/07/10 16:05:16 | 000,015,426 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\ch7xxnt5.dll
[2012/07/10 16:05:14 | 000,049,182 | —- | C] (Xircom, Inc.) – C:\WINDOWS\System32\dllcache\cem56n5.sys
[2012/07/10 16:05:14 | 000,027,164 | —- | C] (Xircom, Inc.) – C:\WINDOWS\System32\dllcache\ce3n5.sys
[2012/07/10 16:05:14 | 000,022,044 | —- | C] (Xircom, Inc.) – C:\WINDOWS\System32\dllcache\cem33n5.sys
[2012/07/10 16:05:14 | 000,022,044 | —- | C] (Xircom, Inc.) – C:\WINDOWS\System32\dllcache\cem28n5.sys
[2012/07/10 16:05:12 | 000,714,698 | —- | C] (Xircom, Inc.) – C:\WINDOWS\System32\dllcache\cbmdmkxx.sys
[2012/07/10 16:05:12 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cd20xrnt.sys
[2012/07/10 16:05:11 | 000,046,108 | —- | C] (Xircom, Inc.) – C:\WINDOWS\System32\dllcache\cben5.sys
[2012/07/10 16:05:11 | 000,035,132 | —- | C] (CARDBUSs) – C:\WINDOWS\System32\dllcache\cb102.sys
[2012/07/10 16:05:10 | 000,186,736 | —- | C] (Eicon Networks) – C:\WINDOWS\System32\dllcache\diapi2.sys
[2012/07/10 16:05:10 | 000,034,304 | —- | C] (Eicon Networks Corporation) – C:\WINDOWS\System32\dllcache\diapi2NT.dll
[2012/07/10 16:05:09 | 000,239,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\camext20.dll
[2012/07/10 16:05:09 | 000,121,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\camext30.dll
[2012/07/10 16:05:09 | 000,119,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\camext30.ax
[2012/07/10 16:05:08 | 000,245,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\camext20.ax
[2012/07/10 16:05:08 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\camexo20.dll
[2012/07/10 16:05:07 | 000,317,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\camdro21.sys
[2012/07/10 16:05:07 | 000,226,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\camdrv21.sys
[2012/07/10 16:05:07 | 000,181,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\camdrv30.sys
[2012/07/10 16:05:07 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\camexo20.ax
[2012/07/10 16:04:57 | 000,254,464 | —- | C] (Brooktrout Technology) – C:\WINDOWS\System32\dllcache\btdlld.dll
[2012/07/10 16:04:57 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bulltlp3.sys
[2012/07/10 16:04:56 | 000,060,032 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brserwdm.sys
[2012/07/10 16:04:56 | 000,012,288 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brserif.dll
[2012/07/10 16:04:56 | 000,011,264 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brusbmdm.sys
[2012/07/10 16:04:56 | 000,010,880 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brusbscn.sys
[2012/07/10 16:04:55 | 000,039,424 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brparwdm.sys
[2012/07/10 16:04:55 | 000,006,656 | —- | C] (Brother Industries,Ltd.) – C:\WINDOWS\System32\dllcache\brscnrsm.dll
[2012/07/10 16:04:54 | 000,003,712 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brparimg.sys
[2012/07/10 16:04:53 | 000,046,080 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brmfusb.dll
[2012/07/10 16:04:52 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\brmfcwia.dll
[2012/07/10 16:04:52 | 000,049,664 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brmflpt.dll
[2012/07/10 16:04:52 | 000,040,960 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brmfrsmg.exe
[2012/07/10 16:04:51 | 000,022,528 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brmfbidi.dll
[2012/07/10 16:04:51 | 000,012,416 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brfiltlo.sys
[2012/07/10 16:04:51 | 000,004,608 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brfiltup.sys
[2012/07/10 16:04:50 | 000,022,016 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brevif.dll
[2012/07/10 16:04:50 | 000,003,456 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brfilt.sys
[2012/07/10 16:04:49 | 000,023,040 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brbidiif.dll
[2012/07/10 16:04:49 | 000,013,824 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brcoinst.dll
[2012/07/10 16:04:49 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\breecemc.sys
[2012/07/10 16:04:47 | 000,268,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\binlsvc.dll
[2012/07/10 16:04:46 | 000,188,416 | —- | C] (Brooktrout Technology Inc.) – C:\WINDOWS\System32\dllcache\bfaxsnp.dll
[2012/07/10 16:04:46 | 000,073,728 | —- | C] (Brooktrout Technology) – C:\WINDOWS\System32\dllcache\bfaxtsp.tsp
[2012/07/10 16:04:45 | 000,077,824 | —- | C] (Brooktrout Technology Inc.) – C:\WINDOWS\System32\dllcache\bfaxdev.dll
[2012/07/10 16:04:45 | 000,061,440 | —- | C] (Brooktrout Technology) – C:\WINDOWS\System32\dllcache\bfaxfsp.dll
[2012/07/10 16:04:45 | 000,054,400 | —- | C] (Brooktrout Technology) – C:\WINDOWS\System32\dllcache\bfax.sys
[2012/07/10 16:04:44 | 001,078,656 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\bcmdm.sys
[2012/07/10 16:04:44 | 000,026,568 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\bcm4e5.sys
[2012/07/10 16:04:44 | 000,014,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\battc.sys
[2012/07/10 16:04:43 | 000,342,336 | —- | C] (3Dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\banshee.dll
[2012/07/10 16:04:43 | 000,036,128 | —- | C] (3Dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\banshee.sys
[2012/07/10 16:04:42 | 000,144,384 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmenum.dll
[2012/07/10 16:04:42 | 000,092,800 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\b1cbase.sys
[2012/07/10 16:04:42 | 000,037,888 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmwan.sys
[2012/07/10 16:04:41 | 000,087,552 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmcoxp.dll
[2012/07/10 16:04:40 | 000,040,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avcaudio.sys
[2012/07/10 16:04:40 | 000,039,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avc.sys
[2012/07/10 16:04:40 | 000,014,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avcstrm.sys
[2012/07/10 16:04:39 | 000,025,474 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\atv04nt5.dll
[2012/07/10 16:04:39 | 000,017,282 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\atv10nt5.dll
[2012/07/10 16:04:39 | 000,014,146 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\atv06nt5.dll
[2012/07/10 16:04:38 | 000,021,186 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\atv01nt5.dll
[2012/07/10 16:04:38 | 000,011,362 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\atv02nt5.dll
[2012/07/10 16:04:37 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atlmc.sys
[2012/07/10 16:04:35 | 000,031,263 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ativmvxx.ax
[2012/07/10 16:04:35 | 000,012,831 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ativdaxx.ax
[2012/07/10 16:04:33 | 000,105,472 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atiraged.dll
[2012/07/10 16:04:33 | 000,070,656 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atiragem.sys
[2012/07/10 16:04:33 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atinxsxx.sys
[2012/07/10 16:04:33 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atinxbxx.sys
[2012/07/10 16:04:32 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atinrvxx.sys
[2012/07/10 16:04:32 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atintuxx.sys
[2012/07/10 16:04:32 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atinsnxx.sys
[2012/07/10 16:04:32 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atinttxx.sys
[2012/07/10 16:04:31 | 000,056,591 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atinbtxx.sys
[2012/07/10 16:04:31 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atinraxx.sys
[2012/07/10 16:04:31 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atinpdxx.sys
[2012/07/10 16:04:31 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atinmdxx.sys
[2012/07/10 16:04:30 | 000,309,888 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimtag.sys
[2012/07/10 16:04:30 | 000,289,664 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimpab.sys
[2012/07/10 16:04:30 | 000,281,600 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimtai.sys
[2012/07/10 16:04:30 | 000,075,264 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimpae.sys
[2012/07/10 16:04:29 | 000,382,592 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidrab.dll
[2012/07/10 16:04:29 | 000,379,520 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidvag.dll
[2012/07/10 16:04:29 | 000,268,160 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidvai.dll
[2012/07/10 16:04:29 | 000,137,728 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidrae.dll
[2012/07/10 16:04:28 | 000,921,475 | —- | C] (ATI Technologies Inc. ) – C:\WINDOWS\System32\dllcache\ati3d2ag.dll
[2012/07/10 16:04:28 | 000,844,675 | —- | C] (ATI Technologies Inc. ) – C:\WINDOWS\System32\dllcache\ati3d1ag.dll
[2012/07/10 16:04:28 | 000,450,176 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati2mtag.sys
[2012/07/10 16:04:27 | 000,377,984 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati2dvaa.dll
[2012/07/10 16:04:27 | 000,327,040 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati2mtaa.sys
[2012/07/10 16:04:27 | 000,202,496 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati2dvag.dll
[2012/07/10 16:04:26 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ati.dll
[2012/07/10 16:04:26 | 000,066,560 | —- | C] (ATI Technologies, Inc.) – C:\WINDOWS\System32\dllcache\ati.sys
[2012/07/10 16:04:23 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\arp1394.sys
[2012/07/10 16:04:22 | 000,038,528 | —- | C] (ADMtek Incorporated.) – C:\WINDOWS\System32\dllcache\an983.sys
[2012/07/10 16:04:21 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\alim1541.sys
[2012/07/10 16:04:21 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\amdagp.sys
[2012/07/10 16:04:20 | 000,027,678 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\ali5261.sys
[2012/07/10 16:04:20 | 000,022,016 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\alifir.sys
[2012/07/10 16:04:20 | 000,007,168 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\aliide.sys
[2012/07/10 16:04:19 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aic78u2.sys
[2012/07/10 15:55:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Procomm Plus
[2012/07/09 16:13:36 | 000,000,000 | —D | C] – C:\TO_DECRYPT
[2012/07/09 16:00:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\NovaStor
[2012/07/09 16:00:19 | 000,000,000 | —D | C] – C:\Program Files\NovaStor
[2012/07/09 15:17:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Western Digital
[2012/07/09 13:49:01 | 000,837,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vssvc.exe
[2012/07/09 13:49:01 | 000,134,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vssadmin.exe
[2012/07/09 13:49:01 | 000,134,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vssadmin.exe
[2012/07/09 13:49:01 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eventcls.dll
[2012/07/09 13:49:01 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\eventcls.dll
[2012/07/09 13:49:01 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vss_ps.dll
[2012/07/09 13:49:01 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vss_ps.dll
[2012/07/09 13:49:00 | 000,567,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vssapi.dll
[2012/07/09 13:49:00 | 000,285,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\swprv.dll
[2012/07/09 13:34:01 | 000,046,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agpcpq.sys
[2012/07/09 13:34:01 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agp440.sys
[2012/07/09 13:34:00 | 000,221,696 | —- | C] (Agilent Technologies) – C:\WINDOWS\System32\dllcache\afcnt.sys
[2012/07/09 13:34:00 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agcgauge.ax
[2012/07/09 13:33:59 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aec.sys
[2012/07/09 13:33:59 | 000,003,714 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\adv09nt5.dll
[2012/07/09 13:33:59 | 000,003,138 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\adv08nt5.dll
[2012/07/09 13:33:58 | 000,004,258 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\adv01nt5.dll
[2012/07/09 13:33:58 | 000,003,970 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\adv02nt5.dll
[2012/07/09 13:33:58 | 000,003,650 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\adv07nt5.dll
[2012/07/09 13:33:58 | 000,003,618 | —- | C] (Intel(R) Corporation) – C:\WINDOWS\System32\dllcache\adv05nt5.dll
[2012/07/09 13:33:57 | 000,134,144 | —- | C] (Adaptec, Inc.) – C:\WINDOWS\System32\dllcache\adpu320.sys
[2012/07/09 13:33:57 | 000,102,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adpu160m.sys
[2012/07/09 13:33:56 | 000,048,896 | —- | C] (Adaptec, Inc ) – C:\WINDOWS\System32\dllcache\adptsf50.sys
[2012/07/09 13:33:56 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adicvls.sys
[2012/07/09 13:33:55 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adicsc.sys
[2012/07/09 13:33:53 | 000,297,728 | —- | C] (Silicon Integrated Systems Corp.) – C:\WINDOWS\System32\dllcache\ac97sis.sys
[2012/07/09 13:33:53 | 000,231,552 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\ac97ali.sys
[2012/07/09 13:33:53 | 000,097,152 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ac97intc.sys
[2012/07/09 13:33:53 | 000,086,912 | —- | C] (VIA Technologies, Inc.) – C:\WINDOWS\System32\dllcache\ac97via.sys
[2012/07/09 13:33:52 | 000,033,339 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a310.sys
[2012/07/09 13:33:52 | 000,029,755 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a311.sys
[2012/07/09 13:33:52 | 000,025,147 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a309.sys
[2012/07/09 13:33:52 | 000,010,299 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a312.sys
[2012/07/09 13:33:52 | 000,010,299 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a308.sys
[2012/07/09 13:33:51 | 000,026,171 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a303.sys
[2012/07/09 13:33:51 | 000,025,659 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a304.sys
[2012/07/09 13:33:51 | 000,020,027 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a307.sys
[2012/07/09 13:33:51 | 000,015,931 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a306.sys
[2012/07/09 13:33:51 | 000,011,323 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a305.sys
[2012/07/09 13:33:50 | 000,048,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\61883.sys
[2012/07/09 13:33:50 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\8514a.dll
[2012/07/09 13:33:50 | 000,010,299 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\a302.sys
[2012/07/09 13:33:49 | 000,673,728 | —- | C] (3dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2012/07/09 13:33:49 | 000,148,352 | —- | C] (3dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2012/07/09 13:32:46 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\1394bus.sys
[2012/07/09 13:32:38 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\s3legacy.dll
[2012/07/09 13:29:38 | 000,426,184 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/07/09 13:29:38 | 000,070,344 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/07/09 13:06:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Downloads
[2012/07/09 13:05:13 | 000,123,904 | —- | C] (Systemintegrasjon AS) – C:\WINDOWS\System32\MbrFix.exe
[2012/07/09 12:38:29 | 000,083,392 | —- | C] (LogMeIn, Inc.) – C:\WINDOWS\System32\LMIRfsClientNP.dll
[2012/07/09 12:38:29 | 000,047,640 | —- | C] (LogMeIn, Inc.) – C:\WINDOWS\System32\drivers\LMIRfsDriver.sys
[2012/07/09 12:38:29 | 000,030,624 | —- | C] (LogMeIn, Inc.) – C:\WINDOWS\System32\LMIport.dll
[2012/07/09 12:38:20 | 000,087,456 | —- | C] (LogMeIn, Inc.) – C:\WINDOWS\System32\LMIinit.dll
[2012/07/09 12:35:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Deployment
[2012/07/09 11:59:02 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/07/08 13:28:51 | 000,155,936 | —- | C] (Sysinternals) – C:\WINDOWS\System32\sdelete.dll
[2012/07/08 13:28:51 | 000,000,000 | -H-D | C] – C:\ProgramData
[2012/06/29 09:20:16 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/06/29 09:20:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Mozilla
[20 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/07/26 08:22:00 | 000,000,986 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3220500341-3293285165-540646846-1185UA.job
[2012/07/26 08:18:53 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/07/26 08:11:00 | 000,001,014 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3220500341-3293285165-540646846-1182UA.job
[2012/07/26 08:01:25 | 000,002,586 | —- | M] () – C:\WINDOWS\System32\licstr.cpa
[2012/07/26 08:00:00 | 000,000,324 | —- | M] () – C:\WINDOWS\tasks\ArcadeWeb Update.job
[2012/07/26 07:59:00 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3220500341-3293285165-540646846-1166UA.job
[2012/07/26 07:57:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/07/26 07:50:00 | 000,000,990 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3220500341-3293285165-540646846-1181UA.job
[2012/07/26 07:00:08 | 000,000,488 | —- | M] () – C:\WINDOWS\tasks\ShadowCopyVolume{cc0acce3-5b79-11da-849a-505054503030}.job
[2012/07/26 07:00:07 | 000,000,492 | —- | M] () – C:\WINDOWS\tasks\ShadowCopyVolume{164749b9-c9eb-11e1-87c8-806e6f6e6963}.job
[2012/07/26 07:00:03 | 000,000,492 | —- | M] () – C:\WINDOWS\tasks\ShadowCopyVolume{164749b8-c9eb-11e1-87c8-806e6f6e6963}.job
[2012/07/26 07:00:01 | 000,000,764 | —- | M] () – C:\WINDOWS\tasks\ShadowCopyVolume{054aee15-fe4d-11d5-bfce-806e6f6e6963}.job
[2012/07/26 06:00:43 | 000,003,094 | —- | M] () – C:\WINDOWS\System32\mapisvc.inf
[2012/07/26 05:33:30 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\DealPlyUpdate.job
[2012/07/25 19:56:57 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/07/25 19:27:13 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/07/25 14:59:00 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3220500341-3293285165-540646846-1166Core.job
[2012/07/25 14:53:57 | 000,000,278 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3220500341-3293285165-540646846-1166.job
[2012/07/25 14:48:46 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/07/25 13:22:00 | 000,000,934 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3220500341-3293285165-540646846-1185Core.job
[2012/07/25 12:05:24 | 000,000,284 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\WMH-SQL Server.url
[2012/07/25 11:52:11 | 000,002,356 | —- | M] () – C:\WINDOWS\pw4.ini
[2012/07/25 11:50:00 | 000,000,938 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3220500341-3293285165-540646846-1181Core.job
[2012/07/25 11:11:00 | 000,000,962 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3220500341-3293285165-540646846-1182Core.job
[2012/07/24 10:12:06 | 001,059,218 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/07/24 10:12:06 | 000,288,000 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/07/24 05:31:00 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3220500341-3293285165-540646846-1166.job
[2012/07/23 16:13:35 | 000,001,730 | -H– | M] () – C:\Documents and Settings\Administrator\My Documents\Default.rdp
[2012/07/23 16:11:04 | 000,080,384 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe
[2012/07/22 21:17:56 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/07/22 21:17:56 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/07/20 12:47:18 | 000,012,872 | —- | M] (SurfRight B.V.) – C:\WINDOWS\System32\bootdelete.exe
[2012/07/20 11:46:44 | 000,208,458 | —- | M] () – C:\WINDOWS\System32\.crusader
[2012/07/20 10:03:08 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/07/19 16:15:11 | 000,000,669 | —- | M] () – C:\Documents and Settings\All Users\Desktop\ESET Remote Administrator Console.lnk
[2012/07/18 09:24:45 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/17 21:09:54 | 000,000,064 | —- | M] () – C:\WINDOWS\GPlrLanc.dat
[2012/07/17 05:29:12 | 000,198,864 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\rmoc3260.dll
[2012/07/17 05:29:03 | 000,272,896 | —- | M] (Progressive Networks) – C:\WINDOWS\System32\pncrt.dll
[2012/07/17 05:29:03 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5016.dll
[2012/07/17 05:29:03 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5032.dll
[2012/07/17 05:22:09 | 000,000,000 | —- | M] () – C:\Documents and Settings\All Users\Application Data\291bb51a3534b252e4d1a1a6fc0dadc9_c
[2012/07/17 05:19:16 | 000,004,624 | RHS- | M] () – C:\Documents and Settings\All Users\ntuser.pol
[2012/07/12 12:43:07 | 000,000,496 | —- | M] () – C:\Documents and Settings\Administrator\drives.xml
[2012/07/12 12:43:07 | 000,000,018 | —- | M] () – C:\Documents and Settings\Administrator\TapInfo.set
[2012/07/11 11:25:52 | 000,060,304 | —- | M] () – C:\Documents and Settings\Administrator\g2mdlhlpx.exe
[2012/07/11 10:43:14 | 000,111,784 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/07/10 16:55:48 | 000,000,730 | —- | M] () – C:\Documents and Settings\All Users\Desktop\File Sync.lnk
[2012/07/10 16:34:09 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2012/07/09 16:00:20 | 000,000,817 | —- | M] () – C:\Documents and Settings\All Users\Desktop\NovaBACKUP.lnk
[2012/07/09 12:38:18 | 000,001,024 | —- | M] () – C:\.rnd
[2012/07/09 09:21:27 | 000,011,638 | —- | M] () – C:\WINDOWS\System32\MbrFix.htm
[2012/07/09 04:04:39 | 000,000,227 | -HS- | M] () – C:\boot.ini
[2012/07/09 03:58:08 | 000,000,582 | —- | M] () – C:\how to decrypt files.lnk
[2012/07/09 02:08:32 | 000,098,996 | —- | M] () – C:\Documents and Settings\Administrator\TapInfo.set(!! to decrypt email id 2065496298 to [removed] !!).exe
[2012/07/08 14:42:43 | 000,099,156 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat(!! to decrypt email id 2065496298 to [removed] !!).exe
[2012/07/08 14:42:41 | 000,099,460 | —- | M] () – C:\Documents and Settings\Administrator\drives.xml(!! to decrypt email id 2065496298 to [removed] !!).exe
[2012/07/05 18:10:02 | 000,083,392 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\System32\LMIRfsClientNP.dll
[2012/07/05 18:09:46 | 000,030,624 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\System32\LMIport.dll
[2012/07/05 18:09:44 | 000,087,456 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\System32\LMIinit.dll
[2012/07/03 13:46:44 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[20 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/07/25 19:28:50 | 000,056,424 | —- | C] () – C:\WINDOWS\System32\PrxerNsp.dll
[2012/07/23 16:11:01 | 000,080,384 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe
[2012/07/19 16:15:11 | 000,000,669 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ESET Remote Administrator Console.lnk
[2012/07/18 09:24:45 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/17 21:09:54 | 000,000,064 | —- | C] () – C:\WINDOWS\GPlrLanc.dat
[2012/07/17 21:02:04 | 000,489,472 | —- | C] () – C:\WINDOWS\System32\UninstallWebsiteBlocking.exe
[2012/07/17 05:41:09 | 000,000,324 | —- | C] () – C:\WINDOWS\tasks\ArcadeWeb Update.job
[2012/07/17 05:33:09 | 000,000,290 | —- | C] () – C:\WINDOWS\tasks\DealPlyUpdate.job
[2012/07/17 05:30:07 | 000,000,286 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3220500341-3293285165-540646846-1166.job
[2012/07/17 05:30:07 | 000,000,278 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3220500341-3293285165-540646846-1166.job
[2012/07/17 05:22:09 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\291bb51a3534b252e4d1a1a6fc0dadc9_c
[2012/07/12 12:55:00 | 000,001,730 | -H– | C] () – C:\Documents and Settings\Administrator\My Documents\Default.rdp
[2012/07/12 12:43:07 | 000,000,496 | —- | C] () – C:\Documents and Settings\Administrator\drives.xml
[2012/07/12 12:43:04 | 000,000,018 | —- | C] () – C:\Documents and Settings\Administrator\TapInfo.set
[2012/07/11 11:25:51 | 000,060,304 | —- | C] () – C:\Documents and Settings\Administrator\g2mdlhlpx.exe
[2012/07/11 09:12:59 | 000,735,440 | —- | C] () – C:\WINDOWS\System32\dllcache\msimain.sdb
[2012/07/10 16:55:47 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Desktop\File Sync.lnk
[2012/07/10 16:34:09 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2012/07/10 16:04:36 | 000,026,880 | —- | C] () – C:\WINDOWS\System32\dllcache\ativxbar.sys
[2012/07/10 16:04:36 | 000,024,064 | —- | C] () – C:\WINDOWS\System32\dllcache\atixbar.sys
[2012/07/10 16:04:35 | 000,019,456 | —- | C] () – C:\WINDOWS\System32\dllcache\ativttxx.sys
[2012/07/10 16:04:35 | 000,009,472 | —- | C] () – C:\WINDOWS\System32\dllcache\ativmdcd.sys
[2012/07/10 16:04:34 | 000,050,304 | —- | C] () – C:\WINDOWS\System32\dllcache\atirtcap.sys
[2012/07/10 16:04:34 | 000,027,136 | —- | C] () – C:\WINDOWS\System32\dllcache\atirtsnd.sys
[2012/07/10 16:04:34 | 000,017,536 | —- | C] () – C:\WINDOWS\System32\dllcache\atitvsnd.sys
[2012/07/10 16:04:34 | 000,017,536 | —- | C] () – C:\WINDOWS\System32\dllcache\atitunep.sys
[2012/07/10 16:04:33 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\dllcache\atipcxxx.sys
[2012/07/10 16:04:28 | 000,046,848 | —- | C] () – C:\WINDOWS\System32\dllcache\atibt829.sys
[2012/07/09 16:00:20 | 000,000,817 | —- | C] () – C:\Documents and Settings\All Users\Desktop\NovaBACKUP.lnk
[2012/07/09 14:53:29 | 000,000,492 | —- | C] () – C:\WINDOWS\tasks\ShadowCopyVolume{164749b8-c9eb-11e1-87c8-806e6f6e6963}.job
[2012/07/09 14:53:20 | 000,000,492 | —- | C] () – C:\WINDOWS\tasks\ShadowCopyVolume{164749b9-c9eb-11e1-87c8-806e6f6e6963}.job
[2012/07/09 13:29:39 | 000,000,830 | —- | C] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/07/09 12:38:06 | 000,000,719 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\LogMeIn.lnk
[2012/07/09 09:21:27 | 000,011,638 | —- | C] () – C:\WINDOWS\System32\MbrFix.htm
[2012/07/09 03:58:08 | 000,000,582 | —- | C] () – C:\how to decrypt files.lnk
[2012/07/09 02:08:31 | 000,098,996 | —- | C] () – C:\Documents and Settings\Administrator\TapInfo.set(!! to decrypt email id 2065496298 to [removed] !!).exe
[2012/07/08 18:49:57 | 000,401,320 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2012/07/08 14:42:43 | 000,099,156 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat(!! to decrypt email id 2065496298 to [removed] !!).exe
[2012/07/08 14:42:41 | 000,099,460 | —- | C] () – C:\Documents and Settings\Administrator\drives.xml(!! to decrypt email id 2065496298 to [removed] !!).exe
[2012/07/08 13:28:51 | 000,403,968 | —- | C] () – C:\WINDOWS\System32\cfwin32.dll
[2011/06/10 14:28:58 | 000,000,010 | —- | C] () – C:\WINDOWS\WININIT.INI
[2011/06/06 21:39:10 | 000,001,262 | —- | C] () – C:\WINDOWS\mozver.dat
[2011/06/02 00:44:43 | 000,002,356 | —- | C] () – C:\WINDOWS\pw4.ini
[2011/02/07 07:43:33 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/01/30 11:04:25 | 000,093,059 | RHS- | C] () – C:\WINDOWS\uti.exe
[2011/01/10 20:28:47 | 000,016,968 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/11/26 22:38:36 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/08/20 13:22:21 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2007/11/08 09:54:53 | 000,005,632 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/11/22 10:45:11 | 000,004,624 | RHS- | C] () – C:\Documents and Settings\All Users\ntuser.pol
 
========== LOP Check ==========
 
[2012/07/20 10:23:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FixTDSS
[2012/07/11 12:29:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FreeFileSync
[2012/07/17 07:37:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2012/07/17 05:35:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Babylon
[2012/07/17 07:35:41 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2012/07/19 07:24:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ESET
[2012/07/17 21:09:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Free Ride Games
[2011/01/10 20:28:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2012/07/20 11:46:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HitmanPro
[2012/07/26 08:16:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LogMeIn
[2012/07/17 21:34:30 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{E07EA62F-B06F-44AA-A564-5E6E7AB7DA96}
[2012/07/26 08:00:00 | 000,000,324 | —- | M] () – C:\WINDOWS\Tasks\ArcadeWeb Update.job
[2012/07/26 05:33:30 | 000,000,290 | —- | M] () – C:\WINDOWS\Tasks\DealPlyUpdate.job
[2012/07/26 05:59:00 | 000,032,628 | —- | M] () – C:\WINDOWS\Tasks\SchedLgU.Txt
[2012/07/26 07:00:01 | 000,000,764 | —- | M] () – C:\WINDOWS\Tasks\ShadowCopyVolume{054aee15-fe4d-11d5-bfce-806e6f6e6963}.job
[2012/07/26 07:00:03 | 000,000,492 | —- | M] () – C:\WINDOWS\Tasks\ShadowCopyVolume{164749b8-c9eb-11e1-87c8-806e6f6e6963}.job
[2012/07/26 07:00:07 | 000,000,492 | —- | M] () – C:\WINDOWS\Tasks\ShadowCopyVolume{164749b9-c9eb-11e1-87c8-806e6f6e6963}.job
[2012/07/26 07:00:08 | 000,000,488 | —- | M] () – C:\WINDOWS\Tasks\ShadowCopyVolume{cc0acce3-5b79-11da-849a-505054503030}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*.* >
[2012/07/09 12:38:18 | 000,001,024 | —- | M] () – C:\.rnd
[2010/08/20 13:21:34 | 002,338,312 | —- | M] () – C:\advisor.exe
[1998/03/12 12:45:00 | 000,244,736 | R— | M] () – C:\as-4p.exe
[1998/03/16 12:10:00 | 000,000,327 | R— | M] () – C:\as4p.ini
[1998/03/16 12:11:00 | 000,000,961 | R— | M] () – C:\as4setup.inf
[2005/11/21 15:53:23 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2012/07/09 04:04:39 | 000,000,227 | -HS- | M] () – C:\boot.ini
[2005/11/21 15:53:23 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2012/07/09 03:58:08 | 000,000,582 | —- | M] () – C:\how to decrypt files.lnk
[2005/11/21 15:53:23 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/08/27 16:30:07 | 006,153,352 | —- | M] (Malwarebytes Corporation									) – C:\mbam-setup.exe
[2005/11/21 15:53:23 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/02/17 10:03:48 | 000,094,720 | —- | M] (Microsoft Corporation) – C:\msizap.exe
[2011/01/13 09:08:13 | 000,047,772 | RHS- | M] () – C:\NTDETECT.COM
[2011/01/13 09:08:13 | 000,297,072 | RHS- | M] () – C:\ntldr
[2012/07/25 14:48:35 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2012/07/09 13:10:29 | 000,080,194 | —- | M] () – C:\TDSSKiller.2.7.45.0_09.07.2012_13.06.49_log.txt
[2012/07/24 12:39:31 | 000,084,952 | —- | M] () – C:\TDSSKiller.2.7.48.0_24.07.2012_12.32.31_log.txt
 
< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2005/11/21 15:53:12 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\Fonts\*.exe >
[2010/12/16 17:27:38 | 000,161,885 | RHS- | M] () – C:\WINDOWS\Fonts\magnifys.exe
[2010/12/16 17:26:48 | 000,138,811 | RHS- | M] () – C:\WINDOWS\Fonts\osks.exe
[2010/12/16 17:23:43 | 000,036,864 | RHS- | M] () – C:\WINDOWS\Fonts\sethcs.exe
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2012/07/05 18:09:54 | 000,052,128 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\LMIproc.dll
[2008/07/06 06:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
[2007/02/17 10:03:12 | 000,008,704 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\sfmpsprt.dll
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.jpg >
 
< %systemroot%\*.png >
 
< %systemroot%\*.scr >
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\System32\config\*.sav >
[2001/12/31 20:22:19 | 000,090,112 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2001/12/31 20:22:19 | 000,700,416 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2001/12/31 20:22:19 | 000,475,136 | —- | M] () – C:\WINDOWS\System32\config\system.sav
 
< %PROGRAMFILES%\bak. /s >
 
< %systemroot%\system32\bak. /s >
 
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2005/11/21 15:53:24 | 000,000,214 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
 
< %systemroot%\system32\config\systemprofile\*.dat /x >
[2001/12/31 20:26:07 | 000,000,000 | —- | M] () – C:\WINDOWS\system32\config\systemprofile\Sti_Trace.log
 
< %systemroot%\*.config >
 
< %systemroot%\system32\*.db >
 
< %PROGRAMFILES%\Internet Explorer\*.dat >
 
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/01/14 09:01:45 | 000,000,117 | -HS- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/11/21 16:06:14 | 000,000,079 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
 
< %USERPROFILE%\Desktop\*.exe >
[2012/07/20 10:03:08 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/02/15 12:00:46 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Administrator\Desktop\HijackThis.exe
[2012/07/23 16:11:04 | 000,080,384 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe
[2012/07/26 08:18:53 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2003/08/16 11:07:00 | 000,172,032 | —- | M] (Jorgen Bosman) – C:\Documents and Settings\Administrator\Desktop\Power Off.exe
 
< %PROGRAMFILES%\Common Files\*.* >
 
< %systemroot%\*.src >
 
< %systemroot%\install\*.* >
 
< %systemroot%\system32\DLL\*.* >
 
< %systemroot%\system32\HelpFiles\*.* >
 
< %systemroot%\system32\rundll\*.* >
 
< %systemroot%\winn32\*.* >
 
< %systemroot%\Java\*.* >
 
< %systemroot%\system32\test\*.* >
 
< %systemroot%\system32\Rundll32\*.* >
 
< %systemroot%\AppPatch\Custom\*.* >
[2003/09/10 15:27:12 | 000,001,536 | —- | M] () – C:\WINDOWS\AppPatch\Custom\{425516c2-f76f-4a49-b8eb-83fc24f40599}.sdb
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-07-24 13:37:28

< End of report >

Deleted Member

Post #14July 26, 2012, 12:33 PM UTC

Extras.txt:

OTL Extras logfile created on: 7/26/2012 8:20:31 AM - Run 1
OTL by OldTimer - Version 3.2.54.1	 Folder = C:\Documents and Settings\Administrator\Desktop
Windows Server 2003 Standard Edition Service Pack 2 (Version = 5.2.3790) - Type = NTDomainController
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 1.19 Gb Available Physical Memory | 59.72% Memory free
3.85 Gb Paging File | 2.72 Gb Available in Paging File | 70.60% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 111.29 Gb Free Space | 74.67% Space Free | Partition Type: NTFS
Drive E: | 149.05 Gb Total Space | 104.07 Gb Free Space | 69.82% Space Free | Partition Type: NTFS
Drive V: | 149.05 Gb Total Space | 104.07 Gb Free Space | 69.82% Space Free | Partition Type: NTFS
 
Computer Name: WMH | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Extra Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== File Associations ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found
 
[color=#E56717]========== Shell Spawning ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile [edit] – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[color=#E56717]========== Security Center Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[color=#E56717]========== Firewall Settings ==========[/color]
 
[color=#E56717]========== Authorized Applications List ==========[/color]
 
 
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0C753D2F-C64A-44B9-8FF4-A7752D8F2EC7}" = Windows Small Business Server Admin
"{22461A1C-BD68-4D90-9897-1DB146D55ECB}" = LogMeIn
"{2734011B-3709-45B2-A946-5A1ADB1AFCFE}" = Windows Small Business Server Documents
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2E497885-E60B-420A-832D-0148B392E058}_is1" = Qwiklinx
"{31271095-CD3A-4C9F-89F6-B5F6F3B35636}" = Windows Small Business Server Remote Portal
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{51065952-A485-4AA5-8884-2E093B3C6206}" = Microsoft Windows Services for UNIX
"{53BE2241-531B-49FB-B03D-06C377179548}" = Windows Small Business Server IE Client App
"{557B8D28-4DF2-4537-8493-DA17230B7E4D}" = ESET Endpoint Antivirus
"{59FDA560-532B-4282-9AD4-1F47A33A72E1}" = AMD Driver Pack
"{5D622FC5-B037-4505-AD5A-60555C2A05E9}" = Microsoft Connector for POP3 Mailboxes
"{64A411C9-DB09-4F01-A8D4-2D5227D7A074}" = Windows Small Business Server Licensing
"{65657C59-23A8-4974-B8E0-BA04EBD04E4F}" = Microsoft SQL Server Desktop Engine (SHAREPOINT)
"{66C8DA1B-9156-44B6-B222-2219BC6F21A9}" = Windows Small Business Server Client Setup
"{671E4E4D-4798-4F66-9C9E-C5762E73179E}" = Microsoft XML Parser
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{806E3F82-072F-4C30-AE47-34B06FE908B8}" = NovaBACKUP
"{8681E826-9DC6-4EAC-84B7-971EA795BD36}" = Microsoft Group Policy Management Console
"{884F6891-633B-4BCA-B08E-A702EDF038E4}" = ESET Remote Administrator Server
"{88A6C12D-DED9-412B-9CC2-643F03674EDF}" = Windows Small Business Server Fax Cfg
"{8EFE8B68-29E3-4F11-980B-1CDC9E21B258}" = Windows Small Business Server Connectivity
"{90120000-001C-0409-0000-0000000FF1CE}" = Microsoft Office Access Runtime (English) 2007
"{91140409-7000-11D3-8CFE-0150048383C9}" = Microsoft Windows SharePoint Services 2.0
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}" = IMinent Toolbar
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{ACCB890A-C291-4157-92A1-5A56D71AB047}" = Windows Small Business Server Fax
"{ACE0B250-0370-42D3-B137-16BB4BC0BD61}" = Windows Small Business Server ActiveSync
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B7300824-E68F-45F1-BAC1-5F15636C346F}" = Microsoft SQL Server Desktop Engine (SBSMONITORING)
"{BB533746-CF08-11D7-BCF1-005004748D87}" = Java SATARaid
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E3DD8B4D-D2B2-457A-B5D6-66B5031535A2}" = Windows Small Business Server Backup
"{EB132F7D-C614-40F5-952C-ED7391638A1B}" = Windows Small Business Server Client Experience
"{FD9832CE-6761-4126-95F2-1FD7E1E9E74F}" = ESET Remote Administrator Console
"{FFA7FFAB-EEFA-4FA3-BDE9-28A478ED027C}" = Prophet 21
"{FFFFED3C-5E7E-4C6C-A7B9-8BAB6181852B}" = Windows Small Business Server Monitoring
"5717D53E-DD6D-4d1e-8A1F-C7BE620F65AA" = Windows Small Business Server 2003
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ATI Display Driver" = ATI Display Driver
"Belarc Advisor" = Belarc Advisor 8.1
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"FreeFileSync" = FreeFileSync 5.5
"ie8" = Windows Internet Explorer 8
"InstallShield_{FFA7FFAB-EEFA-4FA3-BDE9-28A478ED027C}" = Activant Prophet 21 12.1
"Kernel For PDF Repair Evaluation version_is1" = Kernel For PDF Repair Evaluation ver 9.11.01
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Health Monitor 2.1" = Microsoft Health Monitor 2.1
"Mozilla Firefox 13.0.1 (x86 en-US)" = Mozilla Firefox 13.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PDF Recovery Toolbox_is1" = PDF Recovery Toolbox 1.0
"Procomm Plus" = Procomm Plus 4.70
"PROSet" = Intel(R) Network Connections Drivers
"Tunnelier" = Bitvise Tunnelier 4.40 (remove only)
"WIC" = Windows Imaging Component
"Windows Server 2003 Service Pack" = Windows Server 2003 Service Pack 2
"WinRAR archiver" = WinRAR 4.00 beta 4 (32-bit)
 
[color=#E56717]========== Last 20 Event Log Errors ==========[/color]
 
[ Application Events ]
Error - 7/26/2012 8:06:36 AM | Computer Name = WMH | Source = Userenv | ID = 1030
Description = Windows cannot query for the list of Group Policy objects. Check the
 event log for possible messages previously logged by the policy engine that describes
 the reason for this.
 
Error - 7/26/2012 8:11:36 AM | Computer Name = WMH | Source = Userenv | ID = 1005
Description = Windows cannot connect to WMHFluidpower.local domain. (Operations 
Error). Group Policy processing aborted. 
 
Error - 7/26/2012 8:11:36 AM | Computer Name = WMH | Source = Userenv | ID = 1030
Description = Windows cannot query for the list of Group Policy objects. Check the
 event log for possible messages previously logged by the policy engine that describes
 the reason for this.
 
Error - 7/26/2012 8:16:36 AM | Computer Name = WMH | Source = Userenv | ID = 1005
Description = Windows cannot connect to WMHFluidpower.local domain. (Operations 
Error). Group Policy processing aborted. 
 
Error - 7/26/2012 8:16:36 AM | Computer Name = WMH | Source = Userenv | ID = 1030
Description = Windows cannot query for the list of Group Policy objects. Check the
 event log for possible messages previously logged by the policy engine that describes
 the reason for this.
 
Error - 7/26/2012 8:21:36 AM | Computer Name = WMH | Source = Userenv | ID = 1005
Description = Windows cannot connect to WMHFLUIDPOWER.LOCAL domain. (Operations 
Error). Group Policy processing aborted. 
 
Error - 7/26/2012 8:21:36 AM | Computer Name = WMH | Source = Userenv | ID = 1030
Description = Windows cannot query for the list of Group Policy objects. Check the
 event log for possible messages previously logged by the policy engine that describes
 the reason for this.
 
Error - 7/26/2012 8:21:41 AM | Computer Name = WMH | Source = Userenv | ID = 1005
Description = Windows cannot connect to WMHFluidpower.local domain. (Operations 
Error). Group Policy processing aborted. 
 
Error - 7/26/2012 8:21:41 AM | Computer Name = WMH | Source = Userenv | ID = 1030
Description = Windows cannot query for the list of Group Policy objects. Check the
 event log for possible messages previously logged by the policy engine that describes
 the reason for this.
 
Error - 7/26/2012 8:26:52 AM | Computer Name = WMH | Source = Userenv | ID = 1005
Description = Windows cannot connect to WMHFluidpower.local domain. (Operations 
Error). Group Policy processing aborted. 
 
[ Directory Service Events ]
Error - 2/14/2012 3:15:50 PM | Computer Name = WMH | Source = NTDS Backup | ID = 1913
Description = Internal error: The Active Directory backup and restore operation 
encountered an unexpected error.		Backup or restore will not succeed until this is
 corrected.		  Additional Data	Error value:   1084 This service cannot be started in 
Safe Mode	Internal ID:   160200fa
 
Error - 2/14/2012 3:30:06 PM | Computer Name = WMH | Source = NTDS General | ID = 1126
Description = Active Directory was unable to establish a connection with the global
 catalog.		Additional Data	Error value:  8430 The directory service encountered an internal
 failure.	Internal ID:  3200c89		User Action:	Make sure a global catalog is available 
in the forest, and is reachable from this domain controller.   You may use the nltest
 utility to diagnose this problem.
 
Error - 2/14/2012 4:30:07 PM | Computer Name = WMH | Source = NTDS General | ID = 1126
Description = Active Directory was unable to establish a connection with the global
 catalog.		Additional Data	Error value:  8430 The directory service encountered an internal
 failure.	Internal ID:  3200c89		User Action:	Make sure a global catalog is available 
in the forest, and is reachable from this domain controller.   You may use the nltest
 utility to diagnose this problem.
 
[ DNS Server Events ]
Error - 7/18/2012 8:25:51 AM | Computer Name = WMH | Source = DNS | ID = 7055
Description = The DNS server accept() function failed.  The event data contains the
 error.
 
Error - 7/18/2012 9:25:52 AM | Computer Name = WMH | Source = DNS | ID = 7055
Description = The DNS server accept() function failed.  The event data contains the
 error.
 
Error - 7/18/2012 10:25:53 AM | Computer Name = WMH | Source = DNS | ID = 7055
Description = The DNS server accept() function failed.  The event data contains the
 error.
 
Error - 7/18/2012 11:25:54 AM | Computer Name = WMH | Source = DNS | ID = 7055
Description = The DNS server accept() function failed.  The event data contains the
 error.
 
Error - 7/20/2012 4:16:10 PM | Computer Name = WMH | Source = DNS | ID = 4015
Description = The DNS server has encountered a critical error from the Active Directory.
Check
 that the Active Directory is functioning properly.  The extended error debug information
 (which may be empty) is "".  The event data contains the error.
 
Error - 7/20/2012 4:16:10 PM | Computer Name = WMH | Source = DNS | ID = 4004
Description = The DNS server was unable to complete directory service enumeration
 of zone  ..  This DNS server is configured to use information obtained from Active
Directory
 for this zone and is unable to load the zone without it.  Check  that the Active 
Directory is functioning properly and repeat enumeration  of the zone.  The extended
 error debug information (which may be empty) is "".  The event data contains the 
error.
 
Error - 7/20/2012 4:16:10 PM | Computer Name = WMH | Source = DNS | ID = 4004
Description = The DNS server was unable to complete directory service enumeration
 of zone  _msdcs.WMHFluidpower.local.  This DNS server is configured to use information
 obtained from Active  Directory for this zone and is unable to load the zone without
 it.  Check  that the Active Directory is functioning properly and repeat enumeration
of
 the zone.  The extended error debug information (which may be empty) is "".  The event
 data contains the error.
 
Error - 7/20/2012 4:16:10 PM | Computer Name = WMH | Source = DNS | ID = 4004
Description = The DNS server was unable to complete directory service enumeration
 of zone  0.168.192.in-addr.arpa.  This DNS server is configured to use information
 obtained from Active  Directory for this zone and is unable to load the zone without
 it.  Check  that the Active Directory is functioning properly and repeat enumeration
of
 the zone.  The extended error debug information (which may be empty) is "".  The event
 data contains the error.
 
Error - 7/20/2012 4:16:10 PM | Computer Name = WMH | Source = DNS | ID = 4004
Description = The DNS server was unable to complete directory service enumeration
 of zone  wmh.  This DNS server is configured to use information obtained from Active
Directory
 for this zone and is unable to load the zone without it.  Check  that the Active 
Directory is functioning properly and repeat enumeration  of the zone.  The extended
 error debug information (which may be empty) is "".  The event data contains the 
error.
 
Error - 7/20/2012 4:16:10 PM | Computer Name = WMH | Source = DNS | ID = 4004
Description = The DNS server was unable to complete directory service enumeration
 of zone  WMHFluidpower.local.  This DNS server is configured to use information obtained
 from Active  Directory for this zone and is unable to load the zone without it.  
Check  that the Active Directory is functioning properly and repeat enumeration  of 
the zone.  The extended error debug information (which may be empty) is "".  The event
 data contains the error.
 
[ File Replication Service Events ]
Error - 7/19/2012 7:13:25 AM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
Error - 7/20/2012 10:40:42 AM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
Error - 7/20/2012 12:08:18 PM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
Error - 7/20/2012 3:23:42 PM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
Error - 7/20/2012 4:05:16 PM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
Error - 7/20/2012 4:42:32 PM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
Error - 7/20/2012 4:59:06 PM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
Error - 7/20/2012 5:20:28 PM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
Error - 7/24/2012 12:26:08 PM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
Error - 7/25/2012 11:57:16 AM | Computer Name = WMH | Source = NtFrs | ID = 13568
Description = 
 
[ System Events ]
Error - 7/23/2012 3:28:54 PM | Computer Name = WMH | Source = TermDD | ID = 655410
Description = The RDP protocol component X.224 detected an error in the protocol
 stream and has disconnected the client.
 
Error - 7/23/2012 7:16:10 PM | Computer Name = WMH | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service LMIGuardianSvc
 with arguments ""  in order to run the server:  {D4258A22-CF85-489D-83AE-49FCD0DFAD29}
 
Error - 7/24/2012 12:25:10 PM | Computer Name = WMH | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service LMIGuardianSvc
 with arguments ""  in order to run the server:  {D4258A22-CF85-489D-83AE-49FCD0DFAD29}
 
Error - 7/24/2012 12:26:11 PM | Computer Name = WMH | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error: 
  %%1060
 
Error - 7/25/2012 11:56:19 AM | Computer Name = WMH | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service LMIGuardianSvc
 with arguments ""  in order to run the server:  {D4258A22-CF85-489D-83AE-49FCD0DFAD29}
 
Error - 7/25/2012 11:57:20 AM | Computer Name = WMH | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error: 
  %%1060
 
Error - 7/25/2012 11:57:20 AM | Computer Name = WMH | Source = Service Control Manager | ID = 7000
Description = The World Wide Web Publishing Service service failed to start due 
to the following error:   %%1083
 
Error - 7/25/2012 2:49:58 PM | Computer Name = WMH | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service LMIGuardianSvc
 with arguments ""  in order to run the server:  {D4258A22-CF85-489D-83AE-49FCD0DFAD29}
 
Error - 7/25/2012 2:51:04 PM | Computer Name = WMH | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error: 
  %%1060
 
Error - 7/25/2012 2:52:05 PM | Computer Name = WMH | Source = Service Control Manager | ID = 7000
Description = The NfsSvr service failed to start due to the following error:   %%31
 
 
< End of report >

Tomk

Post #15July 26, 2012, 4:43 PM UTC

Actually… everything looks OK there. I've verified that aswMBR works with server 2003. Please try to run a scan again and post the log (don't do any fixing yet).

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Ransomware leads to MBR virus! [Closed]

✨ Ask AI

Ask AI