Please help - web redirecting me - OTL [Solved]

Web browser redirects me to random sites. Please help. SOmetimes it lets me go where I want, sometimes it doesnt.

OTL results:
_______________________________________________________________________________




OTL logfile created on: 4/10/2012 5:29:27 PM - Run 1
OTL by OldTimer - Version 3.2.70.2 Folder = C:\Users\user\Downloads
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

2.99 Gb Total Physical Memory | 1.63 Gb Available Physical Memory | 54.51% Memory free
6.16 Gb Paging File | 4.80 Gb Available in Paging File | 77.83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.19 Gb Total Space | 70.52 Gb Free Space | 63.42% Space Free | Partition Type: NTFS
Drive D: | 107.69 Gb Total Space | 98.86 Gb Free Space | 91.80% Space Free | Partition Type: NTFS

Computer Name: USER-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\user\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe ()
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe (Adobe Systems, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
PRC - C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
PRC - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\AVG Secure Search\DNTInstaller\12.2.6\avgdttbx.dll ()
MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\SiteSafety.dll ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - \\.\globalroot\systemroot\system32\mswsock.dll ()


========== Services (SafeList) ==========

SRV - (vToolbarUpdater12.2.6) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe ()
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (McAfee SiteAdvisor Service) – c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\3.0.207\McCHSvc.exe (McAfee, Inc.)
SRV - (InCDsrv) – C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)


========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (EstRtwIFDrvTemp) – c:\program files\estsoft\alyac\plugin\realtime\EstRtw.sys File not found
DRV - (blbdrive) – C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (avgtp) – C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (winbondcir) – C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation)
DRV - (incdrm) – C:\Windows\System32\drivers\InCDRm.sys (Nero AG)
DRV - (InCDPass) – C:\Windows\System32\drivers\InCDPass.sys (Nero AG)
DRV - (InCDrec) – C:\Windows\System32\drivers\InCDrec.sys (Nero AG)
DRV - (InCDfs) – C:\Windows\System32\drivers\InCDfs.sys (Nero AG)
DRV - (NETw3v32) – C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (risdptsk) – C:\Windows\System32\drivers\risdptsk.sys (REDC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2453}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2453}: "URL" = http://search.fantastigames.com/web?src=ie…q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={41F3A34E-99EE…mp;d=2012-10-01 22:46:54&v=12.2.5.34&sap=hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={41F3A34…mp;d=2012-10-01 22:46:54&v=12.2.5.34&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2453}: "URL" = http://search.fantastigames.com/web?src=ie…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.10
FF - prefs.js..keyword.URL: "http://search.fantastigames.com/web?src=ffb&appid=106&systemid=453&sr=0&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@mozilla.zeniko.ch/PDFlite_Browser_Plugin: C:\Program Files\PDFlite\npPdfViewer.dll File not found
FF - HKCU\Software\MozillaPlugins\@mozilla.zeniko.ch/PDFlite_Browser_Plugin: C:\Program Files\PDFlite\npPdfViewer.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/09/23 08:25:25 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.2.5.34\ [2012/10/01 22:47:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/09/09 16:53:54 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/09/10 07:43:55 | 000,000,000 | —D | M] (No name found) – C:\Users\user\AppData\Roaming\Mozilla\Extensions
[2012/09/30 18:19:07 | 000,000,000 | —D | M] (No name found) – C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yibcvie5.default\extensions
[2012/09/30 18:19:07 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yibcvie5.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/09/10 07:36:18 | 000,002,522 | —- | M] () – C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yibcvie5.default\searchplugins\Search_Results.xml
[2012/09/10 07:43:55 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/09/06 11:27:05 | 000,266,720 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/10/01 22:46:49 | 000,003,752 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/09/06 11:26:22 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/09/10 07:36:18 | 000,002,522 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012/09/06 11:26:22 | 000,002,253 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2006/09/19 07:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll ()
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (FantastiGames Toolbar) - {b4de90bb-150d-4b33-95fe-6baac97e1c21} - C:\PROGRA~1\FANTAS~1\Datamngr\ToolBar\fantastigamesdtx.dll File not found
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (FantastiGames Toolbar) - {b4de90bb-150d-4b33-95fe-6baac97e1c21} - C:\PROGRA~1\FANTAS~1\Datamngr\ToolBar\fantastigamesdtx.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [ROC_ROC_NT] C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe ()
O4 - HKLM..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [Ofakagpiif] C:\Users\user\AppData\Roaming\Ilow\weux.exe File not found
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - %SystemRoot%\system32\pnrpnsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - %SystemRoot%\system32\pnrpnsp.dll File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{162C51AE-FA4B-429A-B9EB-7A26A5952B0D}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/19 07:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Sharedaccess - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: wuauserv - File not found
NetSvcs: BITS - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.imc - C:\Windows\System32\IMC32.acm (Intel Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: msacm.voxacm160 - C:\Windows\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.I263 - C:\Windows\System32\I263_32.drv (Intel Corporation)
Drivers32: vidc.i420 - C:\Windows\System32\I263_32.drv (Intel Corporation)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/10/01 22:47:23 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\AVG Secure Search
[2012/10/01 22:47:11 | 000,000,000 | —D | C] – C:\ProgramData\AVG Secure Search
[2012/10/01 22:46:53 | 000,027,496 | —- | C] (AVG Technologies) – C:\Windows\System32\drivers\avgtpx86.sys
[2012/10/01 22:46:51 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVG Secure Search
[2012/10/01 22:46:50 | 000,000,000 | —D | C] – C:\Program Files\AVG Secure Search
[2012/10/01 22:46:30 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2012/10/01 22:39:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012/10/01 22:38:56 | 000,000,000 | —D | C] – C:\Program Files\DVDVideoSoft
[2012/10/01 22:38:56 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DVDVideoSoft
[2012/10/01 22:37:46 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\DVDVideoSoft
[2012/09/30 18:25:51 | 000,000,000 | —D | C] – C:\Program Files\ConvertHelper
[2012/09/30 18:22:35 | 000,000,000 | —D | C] – C:\Users\user\dwhelper
[2012/09/21 18:33:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2012/09/21 18:33:37 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2012/09/17 08:09:51 | 000,000,000 | —D | C] – C:\Users\user\Desktop\re
[2012/09/14 17:57:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012/09/12 08:11:36 | 000,000,000 | —D | C] – C:\Users\user\Desktop\Australian Doctor Medical Negligence Injury Compensation Claims_files
[2012/09/12 07:52:36 | 000,000,000 | —D | C] – C:\Users\user\Documents\GomPlayer
[2012/09/11 21:23:26 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Ilow
[2012/09/11 21:23:26 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Duani
[2012/09/11 21:23:26 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Asinxu
[2012/09/10 07:49:32 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2012/09/10 07:40:06 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2012/09/10 07:36:09 | 000,000,000 | —D | C] – C:\Program Files\PDFlite
[2012/09/10 07:35:57 | 000,000,000 | —D | C] – C:\Program Files\Free Offers from Freeze.com
[2012/09/09 16:57:19 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\Macromedia
[2012/09/09 16:56:59 | 000,000,000 | —D | C] – C:\ProgramData\McAfee Security Scan
[2012/09/09 16:56:57 | 000,000,000 | —D | C] – C:\ProgramData\McAfee
[2012/09/09 16:56:56 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2012/09/09 16:56:54 | 000,696,240 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/09/09 16:56:54 | 000,073,136 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/09/09 16:56:53 | 000,000,000 | —D | C] – C:\Windows\System32\Macromed
[2012/09/09 16:54:00 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Mozilla
[2012/09/09 16:54:00 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\Mozilla
[2012/09/09 16:53:55 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/09/09 16:53:55 | 000,000,000 | —D | C] – C:\ProgramData\Mozilla
[2012/09/09 16:53:47 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/09/09 08:42:33 | 000,000,000 | —D | C] – C:\Windows\Panther
[2012/09/09 08:42:19 | 000,000,000 | -HSD | C] – C:\Boot
[2012/09/09 07:46:07 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2012/09/09 07:45:12 | 000,000,000 | —D | C] – C:\Windows\Debug
[2012/09/09 07:43:44 | 000,000,000 | —D | C] – C:\Windows\Prefetch
[2012/09/09 07:43:32 | 000,000,000 | -HSD | C] – C:\System Volume Information
[2012/09/08 20:21:48 | 000,237,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2012/09/08 20:21:12 | 000,374,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mcupdate_GenuineIntel.dll
[2012/09/08 20:17:11 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netcfg.exe
[2012/09/08 20:15:56 | 001,808,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0046.dll
[2012/09/08 20:15:56 | 001,793,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0045.dll
[2012/09/08 20:15:55 | 001,558,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0049.dll
[2012/09/08 20:15:55 | 001,411,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0047.dll
[2012/09/08 20:15:55 | 001,236,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0020.dll
[2012/09/08 20:15:54 | 005,499,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0022.dll
[2012/09/08 20:15:54 | 002,136,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0021.dll
[2012/09/08 20:15:54 | 001,782,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0039.dll
[2012/09/08 20:15:53 | 007,964,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0024.dll
[2012/09/08 20:15:53 | 006,224,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0027.dll
[2012/09/08 20:15:53 | 005,791,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0026.dll
[2012/09/08 20:15:52 | 004,981,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0013.dll
[2012/09/08 20:15:52 | 004,175,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0010.dll
[2012/09/08 20:15:52 | 002,466,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0011.dll
[2012/09/08 20:15:51 | 006,781,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0019.dll
[2012/09/08 20:15:51 | 003,331,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0018.dll
[2012/09/08 20:15:50 | 011,722,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0001.dll
[2012/09/08 20:15:50 | 004,164,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0002.dll
[2012/09/08 20:15:49 | 012,240,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0007.dll
[2012/09/08 20:15:49 | 002,644,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0009.dll
[2012/09/08 20:15:49 | 001,452,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0003.dll
[2012/09/08 20:15:48 | 004,093,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons004c.dll
[2012/09/08 20:15:48 | 003,419,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons004a.dll
[2012/09/08 20:15:48 | 001,702,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons004b.dll
[2012/09/08 20:15:47 | 004,045,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons003e.dll
[2012/09/08 20:15:47 | 001,972,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons004e.dll
[2012/09/08 20:15:47 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons002a.dll
[2012/09/08 20:15:46 | 006,585,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons001b.dll
[2012/09/08 20:15:46 | 006,014,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons001a.dll
[2012/09/08 20:15:45 | 009,892,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons000a.dll
[2012/09/08 20:15:45 | 006,346,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons001d.dll
[2012/09/08 20:15:44 | 006,237,696 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons000c.dll
[2012/09/08 20:15:44 | 005,654,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons000f.dll
[2012/09/08 20:15:44 | 001,722,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons000d.dll
[2012/09/08 20:15:43 | 005,090,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0416.dll
[2012/09/08 20:15:43 | 005,031,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0816.dll
[2012/09/08 20:15:43 | 004,616,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0414.dll
[2012/09/08 20:15:42 | 007,042,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons081a.dll
[2012/09/08 20:15:42 | 005,071,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsModels0011.dll
[2012/09/08 20:15:42 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0045.dll
[2012/09/08 20:15:41 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0049.dll
[2012/09/08 20:15:41 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0047.dll
[2012/09/08 20:15:41 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0046.dll
[2012/09/08 20:15:40 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0039.dll
[2012/09/08 20:15:40 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0020.dll
[2012/09/08 20:15:40 | 001,799,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0022.dll
[2012/09/08 20:15:40 | 001,799,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0021.dll
[2012/09/08 20:15:39 | 001,965,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0027.dll
[2012/09/08 20:15:39 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0026.dll
[2012/09/08 20:15:39 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0024.dll
[2012/09/08 20:15:38 | 004,493,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0010.dll
[2012/09/08 20:15:38 | 003,464,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0013.dll
[2012/09/08 20:15:38 | 002,655,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0011.dll
[2012/09/08 20:15:38 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0018.dll
[2012/09/08 20:15:37 | 004,495,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0019.dll
[2012/09/08 20:15:37 | 002,597,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0001.dll
[2012/09/08 20:15:37 | 001,523,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0000.dll
[2012/09/08 20:15:36 | 002,241,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0007.dll
[2012/09/08 20:15:36 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0003.dll
[2012/09/08 20:15:36 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0002.dll
[2012/09/08 20:15:35 | 004,874,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0009.dll
[2012/09/08 20:15:35 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData004c.dll
[2012/09/08 20:15:35 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData004b.dll
[2012/09/08 20:15:35 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData004a.dll
[2012/09/08 20:15:34 | 003,102,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData004e.dll
[2012/09/08 20:15:34 | 001,799,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData003e.dll
[2012/09/08 20:15:34 | 001,799,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData002a.dll
[2012/09/08 20:15:33 | 004,493,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData001d.dll
[2012/09/08 20:15:33 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData001b.dll
[2012/09/08 20:15:33 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData001a.dll
[2012/09/08 20:15:32 | 009,845,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData000a.dll
[2012/09/08 20:15:32 | 002,641,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData000c.dll
[2012/09/08 20:15:32 | 002,340,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData000d.dll
[2012/09/08 20:15:32 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData000f.dll
[2012/09/08 20:15:31 | 004,493,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0416.dll
[2012/09/08 20:15:31 | 004,493,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0414.dll
[2012/09/08 20:15:31 | 000,797,696 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NaturalLanguage6.dll
[2012/09/08 20:15:30 | 006,917,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0c1a.dll
[2012/09/08 20:15:30 | 004,493,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0816.dll
[2012/09/08 20:15:30 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData0c1a.dll
[2012/09/08 20:15:30 | 001,963,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsData081a.dll
[2012/09/08 20:11:02 | 000,371,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srcore.dll
[2012/09/08 20:11:02 | 000,313,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rstrui.exe
[2012/09/08 20:11:02 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srdelayed.exe
[2012/09/08 20:11:01 | 000,944,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winload.exe
[2012/09/08 20:11:01 | 000,905,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winresume.exe
[2012/09/08 20:11:01 | 000,620,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ci.dll
[2012/09/08 20:11:01 | 000,613,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wpd_ci.dll
[2012/09/08 20:11:01 | 000,019,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kd1394.dll
[2012/09/08 20:11:00 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drvinst.exe
[2012/09/08 20:10:59 | 000,260,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dpx.dll
[2012/09/08 20:10:59 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lodctr.exe
[2012/09/08 20:10:59 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kbd106n.dll
[2012/09/08 20:10:58 | 000,115,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\loadperf.dll
[2012/09/08 20:10:58 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\unlodctr.exe
[2012/09/08 20:10:58 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prflbmsg.dll
[2012/09/08 20:10:57 | 000,035,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\WdfLdr.sys
[2012/09/08 20:10:57 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\batt.dll
[2012/09/08 20:10:57 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\f3ahvoas.dll
[2012/09/08 20:10:56 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dispci.dll
[2012/09/08 20:10:56 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kbd106.dll
[2012/09/08 20:09:34 | 000,654,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelinesvc.exe
[2012/09/08 20:09:34 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelineprxy.dll
[2012/09/08 20:09:32 | 000,158,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sdohlp.dll
[2012/09/08 20:09:32 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasads.dll
[2012/09/08 20:09:32 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasdatastore.dll
[2012/09/08 20:09:31 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasrecst.dll
[2012/09/08 20:08:46 | 000,220,672 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\System32\l3codecp.acm
[2012/09/08 20:08:46 | 000,062,464 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\System32\l3codeca.acm
[2012/09/08 20:07:24 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tcpipcfg.dll
[2012/09/08 20:07:24 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netiougc.exe
[2012/09/08 20:06:02 | 000,223,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMASF.DLL
[2012/09/08 20:06:02 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\System32\LAPRXY.DLL
[2012/09/08 20:06:02 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\asferror.dll
[2012/09/08 20:05:27 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\amxread.dll
[2012/09/08 20:05:27 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\apilogen.dll
[2012/09/08 20:04:47 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printcom.dll
[2012/09/08 20:04:08 | 002,031,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/09/08 20:03:28 | 000,113,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\rmcast.sys
[2012/09/08 20:03:28 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wshrm.dll
[2012/09/08 20:02:41 | 008,147,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2012/09/08 20:02:39 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwmp.dll
[2012/09/08 20:02:39 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdxm.ocx
[2012/09/08 20:02:39 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxmasf.dll
[2012/09/08 20:02:36 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdxm.tlb
[2012/09/08 20:02:36 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\amcompat.tlb
[2012/09/08 20:01:31 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sbunattend.exe
[2012/09/08 20:00:11 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2012/09/08 19:56:12 | 000,622,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\icardagt.exe
[2012/09/08 19:56:11 | 000,097,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\infocardapi.dll
[2012/09/08 19:56:11 | 000,037,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\infocardcpl.cpl
[2012/09/08 19:56:11 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\icardres.dll
[2012/09/08 19:56:04 | 000,105,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
[2012/09/08 19:56:03 | 000,781,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationNative_v0300.dll
[2012/09/08 19:56:03 | 000,326,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2012/09/08 19:56:03 | 000,043,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2012/09/08 19:35:47 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2012/09/08 19:35:45 | 000,158,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscorier.dll
[2012/09/08 19:35:45 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscories.dll
[2012/09/08 19:20:53 | 000,996,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMNetMgr.dll
[2012/09/08 19:20:53 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logagent.exe
[2012/09/08 19:20:15 | 000,084,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\INETRES.dll
[2012/09/08 19:18:51 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nshhttp.dll
[2012/09/08 19:16:42 | 000,321,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSDApi.dll
[2012/09/08 19:16:30 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\poqexec.exe
[2012/09/08 19:15:56 | 001,327,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2012/09/08 19:15:55 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2012/09/08 19:15:55 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\avicap32.dll
[2012/09/08 19:15:09 | 000,604,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMSPDMOD.DLL
[2012/09/08 18:34:56 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\Ahead
[2012/09/08 18:34:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero 7 Essentials
[2012/09/08 17:33:24 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Ahead
[2012/09/08 17:32:24 | 000,000,000 | —D | C] – C:\ProgramData\Nero
[2012/09/08 17:32:24 | 000,000,000 | —D | C] – C:\Program Files\Nero
[2012/09/08 17:32:24 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Ahead
[2012/09/08 17:30:48 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\ECRSC
[2012/09/08 17:30:22 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\ESTsoft
[2012/09/08 17:30:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\À̽ºÆ®¼ÒÇÁÆ®
[2012/09/08 17:30:13 | 000,000,000 | —D | C] – C:\Program Files\ESTsoft
[2012/09/08 17:30:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2012/09/08 17:30:01 | 000,000,000 | —D | C] – C:\ProgramData\CyberLink
[2012/09/08 17:29:59 | 000,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2012/09/08 17:29:59 | 000,000,000 | —D | C] – C:\Program Files\CyberLink
[2012/09/08 17:29:47 | 000,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2012/09/08 17:18:50 | 000,289,792 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2012/09/08 17:18:50 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2012/09/08 17:18:50 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fontsub.dll
[2012/09/08 17:18:50 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2012/09/08 17:18:50 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dciman32.dll
[2012/09/08 17:17:52 | 002,452,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2012/09/08 17:17:52 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2012/09/08 17:17:52 | 000,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/09/08 17:17:52 | 000,230,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2012/09/08 17:17:52 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2012/09/08 17:17:52 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2012/09/08 17:17:51 | 000,347,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2012/09/08 17:17:51 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2012/09/08 17:17:51 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/09/08 17:17:50 | 000,459,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/09/08 17:17:50 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/09/08 17:17:48 | 000,389,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/09/08 17:17:48 | 000,078,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieencode.dll
[2012/09/08 17:17:48 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2012/09/08 17:17:47 | 001,383,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/09/08 17:17:46 | 001,830,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/09/08 17:17:46 | 000,671,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2012/09/08 17:17:44 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/09/08 17:17:43 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2012/09/08 17:17:43 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2012/09/08 17:17:43 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2012/09/08 17:17:43 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2012/09/08 17:16:17 | 000,920,088 | —- | C] (Intel® Corporation) – C:\Windows\System32\igxpun.exe
[2012/09/08 17:16:17 | 000,319,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\difxapi.dll
[2012/09/08 17:16:17 | 000,000,000 | —D | C] – C:\Windows\System32\Lang
[2012/09/08 17:16:09 | 000,272,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\polstore.dll
[2012/09/08 17:16:09 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FwRemoteSvr.dll
[2012/09/08 17:15:40 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\riched32.dll
[2012/09/08 17:15:39 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rascfg.dll
[2012/09/08 17:15:39 | 000,052,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rasdiag.dll
[2012/09/08 17:15:39 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rasser.dll
[2012/09/08 17:15:38 | 000,564,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msftedit.dll
[2012/09/08 17:15:38 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rasmxs.dll
[2012/09/08 17:15:38 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\icsunattend.exe
[2012/09/08 17:15:37 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2012/09/08 17:15:37 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\traffic.dll
[2012/09/08 17:15:37 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pacerprf.dll
[2012/09/08 17:15:37 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wshqos.dll
[2012/09/08 17:14:42 | 000,241,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceApi.dll
[2012/09/08 17:14:42 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceTypes.dll
[2012/09/08 17:14:42 | 000,095,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceClassExtension.dll
[2012/09/08 17:14:17 | 000,205,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msoeacct.dll
[2012/09/08 17:14:17 | 000,087,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msoert2.dll
[2012/09/08 17:14:17 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ACCTRES.dll
[2012/09/08 17:13:32 | 000,103,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netiohlp.dll
[2012/09/08 17:13:32 | 000,027,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NETSTAT.EXE
[2012/09/08 17:13:32 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ARP.EXE
[2012/09/08 17:13:32 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ROUTE.EXE
[2012/09/08 17:13:32 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netevent.dll
[2012/09/08 17:13:32 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MRINFO.EXE
[2012/09/08 17:13:32 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\finger.exe
[2012/09/08 17:13:32 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\HOSTNAME.EXE
[2012/09/08 17:13:31 | 000,213,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\netio.sys
[2012/09/08 17:12:48 | 000,704,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PhotoScreensaver.scr
[2012/09/08 17:12:47 | 000,028,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\battc.sys
[2012/09/08 17:12:03 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\L2SecHC.dll
[2012/09/08 17:12:03 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanapi.dll
[2012/09/08 17:12:02 | 000,297,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlansec.dll
[2012/09/08 17:12:02 | 000,290,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanmsm.dll
[2012/09/08 17:12:02 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanhlp.dll
[2012/09/08 17:11:31 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml6r.dll
[2012/09/08 17:11:31 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml3r.dll
[2012/09/08 17:10:13 | 000,376,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2012/09/08 17:10:13 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2012/09/08 17:09:50 | 002,855,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2012/09/08 17:09:50 | 000,098,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfps.dll
[2012/09/08 17:09:50 | 000,052,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rrinstaller.exe
[2012/09/08 17:09:50 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfpmp.exe
[2012/09/08 17:09:50 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mferror.dll
[2012/09/08 17:09:49 | 002,433,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVCORE.DLL
[2012/09/08 17:09:19 | 003,502,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2012/09/08 17:09:19 | 003,468,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2012/09/08 17:05:36 | 000,500,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdtcprx.dll
[2012/09/08 17:05:36 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xolehlp.dll
[2012/09/08 17:04:53 | 000,116,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aaclient.dll
[2012/09/08 17:04:53 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tsgqec.dll
[2012/09/08 17:04:23 | 000,303,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpeffects.dll
[2012/09/08 17:04:14 | 000,000,000 | —D | C] – C:\Windows\Driver Cache
[2012/09/08 17:04:13 | 000,000,000 | —D | C] – C:\Program Files\AVerMedia
[2012/09/08 17:03:40 | 000,414,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msscp.dll
[2012/09/08 17:03:23 | 000,713,728 | —- | C] (Microsoft Corporation) – C:\Windows\System32\timedate.cpl
[2012/09/08 17:03:01 | 000,356,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MediaMetadataHandler.dll
[2012/09/08 17:02:44 | 000,392,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FirewallAPI.dll
[2012/09/08 17:02:43 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\icfupgd.dll
[2012/09/08 17:02:43 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cmifw.dll
[2012/09/08 17:02:43 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wfapigp.dll
[2012/09/08 17:01:03 | 001,244,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mcmde.dll
[2012/09/08 17:01:03 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2012/09/08 17:01:03 | 000,292,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2012/09/08 17:01:03 | 000,217,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisrndr.ax
[2012/09/08 17:01:03 | 000,177,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2012/09/08 17:01:03 | 000,080,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSNP.ax
[2012/09/08 17:01:03 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Mpeg2Data.ax
[2012/09/08 17:01:03 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSDvbNP.ax
[2012/09/08 16:59:26 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2012/09/08 16:58:01 | 000,109,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ataport.sys
[2012/09/08 16:58:01 | 000,045,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\pciidex.sys
[2012/09/08 16:57:51 | 000,104,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWWIN.EXE
[2012/09/08 16:57:34 | 000,000,000 | —D | C] – C:\Program Files\Synaptics
[2012/09/08 16:57:27 | 002,923,520 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2012/09/08 16:52:16 | 000,000,000 | —D | C] – C:\Program Files\Intel
[2012/09/08 16:52:01 | 000,000,000 | —D | C] – C:\Intel
[2012/09/08 16:08:43 | 000,000,000 | —D | C] – C:\Program Files\CONEXANT
[2012/09/08 16:05:49 | 000,000,000 | —D | C] – C:\Users\user\Documents\a
[2012/09/08 15:36:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012/09/08 15:36:07 | 000,032,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msonpmon.dll
[2012/09/08 15:35:17 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2012/09/08 15:34:49 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2012/09/08 15:34:49 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2012/09/08 15:34:32 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2012/09/08 15:34:32 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2012/09/08 15:33:22 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio 8
[2012/09/08 15:32:45 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\Microsoft Help
[2012/09/08 15:32:42 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2012/09/08 15:32:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2012/09/08 15:32:19 | 000,000,000 | RH-D | C] – C:\MSOCache
[2012/09/08 15:29:51 | 000,306,688 | —- | C] (InstallShield Software Corporation) – C:\Windows\IsUninst.exe
[2012/09/08 15:29:17 | 000,000,000 | —D | C] – C:\Program Files\GRETECH
[2012/09/08 15:26:47 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2012/09/08 15:26:46 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Macromedia
[2012/09/08 15:26:45 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Adobe
[2012/09/08 15:26:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVD Region-Free
[2012/09/08 15:26:29 | 000,000,000 | —D | C] – C:\Program Files\DVD Region-Free
[2012/09/08 15:26:26 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\Adobe
[2012/09/08 15:26:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCodec
[2012/09/08 15:26:20 | 000,000,000 | —D | C] – C:\Program Files\StarCodec
[2012/09/08 15:26:02 | 000,000,000 | —D | C] – C:\ProgramData\Adobe
[2012/09/08 15:25:48 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2012/09/08 15:25:48 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2012/09/08 15:25:30 | 000,000,000 | -HSD | C] – C:\Windows\Installer
[2012/09/08 15:25:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
[2012/09/08 15:24:50 | 000,000,000 | —D | C] – C:\Program Files\WinZip
[2012/09/08 15:03:10 | 002,643,968 | —- | C] (Intel Corporation) – C:\Windows\System32\igxpdx32.dll
[2012/09/08 15:03:10 | 001,670,144 | —- | C] (Intel Corporation) – C:\Windows\System32\igxpdv32.dll
[2012/09/08 15:03:10 | 000,155,648 | —- | C] (Intel Corporation) – C:\Windows\System32\igfxCoIn_v5029.dll
[2012/09/08 15:03:10 | 000,151,040 | —- | C] (Intel Corporation) – C:\Windows\System32\igxpgd32.dll
[2012/09/08 15:03:10 | 000,057,344 | —- | C] (Intel Corporation) – C:\Windows\System32\igxprd32.dll
[2012/09/08 15:03:08 | 003,293,184 | —- | C] (Intel Corporation) – C:\Windows\System32\igfxress.dll
[2012/09/08 15:03:08 | 000,241,664 | —- | C] (Intel Corporation) – C:\Windows\System32\igfxTMM.dll
[2012/09/08 15:03:08 | 000,048,128 | —- | C] (Intel Corporation) – C:\Windows\System32\igfxsrvc.dll
[2012/09/08 15:03:07 | 002,580,480 | —- | C] (Intel Corporation) – C:\Windows\System32\igdumd32.dll
[2012/09/08 15:03:07 | 000,102,400 | —- | C] (Intel Corporation) – C:\Windows\System32\hccutils.dll
[2012/09/08 15:03:03 | 000,172,032 | —- | C] (Ricoh Company,Ltd) – C:\Windows\System32\rixdicon.dll
[2012/09/08 15:03:03 | 000,090,112 | —- | C] (Sony Corporation) – C:\Windows\System32\snymsico.dll
[2012/09/08 15:03:03 | 000,046,592 | —- | C] (REDC) – C:\Windows\System32\drivers\rimmptsk.sys
[2012/09/08 15:03:03 | 000,043,008 | —- | C] (REDC) – C:\Windows\System32\drivers\rimsptsk.sys
[2012/09/08 15:03:03 | 000,038,400 | —- | C] (REDC) – C:\Windows\System32\drivers\rixdptsk.sys
[2012/09/08 15:03:03 | 000,027,904 | —- | C] (REDC) – C:\Windows\System32\drivers\risdptsk.sys
[2012/09/08 14:51:48 | 000,000,000 | R–D | C] – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012/09/08 14:51:48 | 000,000,000 | R–D | C] – C:\Users\user\Searches
[2012/09/08 14:51:48 | 000,000,000 | R–D | C] – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012/09/08 14:51:40 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Identities
[2012/09/08 14:51:38 | 000,000,000 | R–D | C] – C:\Users\user\Contacts
[2012/09/08 14:51:37 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\VirtualStore
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\AppData\Local\Temporary Internet Files
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\Templates
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\Start Menu
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\SendTo
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\Recent
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\PrintHood
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\NetHood
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\Documents\My Videos
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\Documents\My Pictures
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\Documents\My Music
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\My Documents
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\Local Settings
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\AppData\Local\History
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\Cookies
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\Application Data
[2012/09/08 14:51:33 | 000,000,000 | -HSD | C] – C:\Users\user\AppData\Local\Application Data
[2012/09/08 14:51:32 | 000,000,000 | –SD | C] – C:\Users\user\AppData\Roaming\Microsoft
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\Videos
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\Saved Games
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\Pictures
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\Music
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\Links
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\Favorites
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\Downloads
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\Documents
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\Desktop
[2012/09/08 14:51:32 | 000,000,000 | R–D | C] – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012/09/08 14:51:32 | 000,000,000 | -H-D | C] – C:\Users\user\AppData
[2012/09/08 14:51:32 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\Temp
[2012/09/08 14:51:32 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\Microsoft
[2012/09/08 14:51:32 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Media Center Programs

========== Files - Modified Within 30 Days ==========

[2012/10/04 17:23:28 | 000,618,648 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/10/04 17:23:28 | 000,104,024 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/10/04 17:16:58 | 000,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/04 17:16:58 | 000,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/04 17:16:54 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/10/04 17:16:51 | 3211,190,272 | -HS- | M] () – C:\hiberfil.sys
[2012/10/03 10:10:05 | 000,057,474 | —- | M] () – C:\Users\user\Desktop\Cover Letter.pdf
[2012/10/02 15:07:15 | 000,696,240 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/10/02 15:07:15 | 000,073,136 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/10/01 22:46:53 | 000,027,496 | —- | M] (AVG Technologies) – C:\Windows\System32\drivers\avgtpx86.sys
[2012/10/01 16:45:48 | 000,000,294 | —- | M] () – C:\Windows\System32\ayboot.ini
[2012/10/01 13:21:41 | 000,008,192 | —- | M] () – C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/10/01 12:44:13 | 000,023,096 | —- | M] () – C:\Users\user\Desktop\Monument-to-Victorious-Fatherland-Liberation-War-with-Ryugyong-Hotel-in-the-background.-Pyongyang-North-Korea-2011.-e1331705822257-301x399.jpg
[2012/10/01 11:11:11 | 000,071,226 | —- | M] () – C:\Users\user\Desktop\black.jpg
[2012/10/01 11:08:51 | 003,322,760 | —- | M] () – C:\Users\user\Desktop\SNV30853.JPG
[2012/09/30 18:40:34 | 000,000,938 | —- | M] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/09/30 18:08:52 | 000,031,937 | —- | M] () – C:\Users\user\Desktop\4185410-Monument_to_Victorious_Fatherland_Liberation_War_North_Korea.jpg
[2012/09/30 17:19:30 | 000,014,002 | —- | M] () – C:\Users\user\Desktop\7ee2d050dc29616e7432fae4628c659bda37a47d_full.jpg
[2012/09/27 21:12:57 | 000,046,715 | —- | M] () – C:\Users\user\Desktop\Statue2647.jpg
[2012/09/20 22:37:53 | 000,035,297 | —- | M] () – C:\Users\user\Desktop\Curriculum Vitae MacDonalds.pdf
[2012/09/16 14:48:46 | 000,103,830 | —- | M] () – C:\Users\user\Desktop\Curriculum Vitae.pdf
[2012/09/14 17:57:07 | 000,001,947 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012/09/14 17:57:07 | 000,001,947 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/09/13 08:19:10 | 000,033,698 | —- | M] () – C:\Users\user\Desktop\Governmentlisting6.pdf
[2012/09/12 08:38:45 | 000,048,964 | —- | M] () – C:\Users\user\Desktop\PK Cover.pdf
[2012/09/12 08:11:37 | 000,013,313 | —- | M] () – C:\Users\user\Desktop\Australian Doctor Medical Negligence Injury Compensation Claims.htm
[2012/09/12 07:02:04 | 000,044,762 | —- | M] () – C:\Users\user\Desktop\Peoples Cover Letter.pdf
[2012/09/12 06:37:56 | 000,008,566 | —- | M] () – C:\Users\user\Desktop\Won Cover Letter.pdf
[2012/09/10 07:36:41 | 000,000,064 | —- | M] () – C:\Windows\GPlrLanc.dat
[2012/09/09 16:53:57 | 000,000,870 | —- | M] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/09/09 16:53:56 | 000,000,846 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/09/09 09:22:12 | 000,370,960 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/09/09 08:42:20 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2012/09/09 07:47:00 | 000,041,176 | —- | M] () – C:\Windows\System32\license.rtf
[2012/09/08 20:21:12 | 000,374,456 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mcupdate_GenuineIntel.dll
[2012/09/08 20:17:11 | 000,024,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netcfg.exe
[2012/09/08 20:15:56 | 001,808,896 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0046.dll
[2012/09/08 20:15:56 | 001,793,536 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0045.dll
[2012/09/08 20:15:55 | 001,782,272 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0039.dll
[2012/09/08 20:15:55 | 001,558,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0049.dll
[2012/09/08 20:15:55 | 001,411,072 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0047.dll
[2012/09/08 20:15:55 | 001,236,992 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0020.dll
[2012/09/08 20:15:54 | 007,964,672 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0024.dll
[2012/09/08 20:15:54 | 005,499,904 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0022.dll
[2012/09/08 20:15:54 | 002,136,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0021.dll
[2012/09/08 20:15:53 | 006,224,896 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0027.dll
[2012/09/08 20:15:53 | 005,791,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0026.dll
[2012/09/08 20:15:52 | 004,981,248 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0013.dll
[2012/09/08 20:15:52 | 004,175,872 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0010.dll
[2012/09/08 20:15:52 | 002,466,816 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0011.dll
[2012/09/08 20:15:51 | 006,781,440 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0019.dll
[2012/09/08 20:15:51 | 003,331,072 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0018.dll
[2012/09/08 20:15:50 | 011,722,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0001.dll
[2012/09/08 20:15:50 | 004,164,096 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0002.dll
[2012/09/08 20:15:50 | 001,452,544 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0003.dll
[2012/09/08 20:15:49 | 012,240,896 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0007.dll
[2012/09/08 20:15:49 | 002,644,480 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0009.dll
[2012/09/08 20:15:48 | 004,093,440 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons004c.dll
[2012/09/08 20:15:48 | 003,419,136 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons004a.dll
[2012/09/08 20:15:48 | 001,702,912 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons004b.dll
[2012/09/08 20:15:47 | 006,014,976 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons001a.dll
[2012/09/08 20:15:47 | 004,045,824 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons003e.dll
[2012/09/08 20:15:47 | 001,972,736 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons004e.dll
[2012/09/08 20:15:47 | 000,004,096 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons002a.dll
[2012/09/08 20:15:46 | 006,585,856 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons001b.dll
[2012/09/08 20:15:46 | 006,346,240 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons001d.dll
[2012/09/08 20:15:45 | 009,892,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons000a.dll
[2012/09/08 20:15:44 | 006,237,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons000c.dll
[2012/09/08 20:15:44 | 005,654,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons000f.dll
[2012/09/08 20:15:44 | 004,616,192 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0414.dll
[2012/09/08 20:15:44 | 001,722,368 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons000d.dll
[2012/09/08 20:15:43 | 007,042,560 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons081a.dll
[2012/09/08 20:15:43 | 005,090,816 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0416.dll
[2012/09/08 20:15:43 | 005,031,936 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0816.dll
[2012/09/08 20:15:42 | 005,071,872 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsModels0011.dll
[2012/09/08 20:15:42 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0046.dll
[2012/09/08 20:15:42 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0045.dll
[2012/09/08 20:15:41 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0049.dll
[2012/09/08 20:15:41 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0047.dll
[2012/09/08 20:15:40 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0039.dll
[2012/09/08 20:15:40 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0020.dll
[2012/09/08 20:15:40 | 001,799,168 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0022.dll
[2012/09/08 20:15:40 | 001,799,168 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0021.dll
[2012/09/08 20:15:39 | 001,965,056 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0027.dll
[2012/09/08 20:15:39 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0026.dll
[2012/09/08 20:15:39 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0024.dll
[2012/09/08 20:15:38 | 004,493,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0010.dll
[2012/09/08 20:15:38 | 003,464,704 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0013.dll
[2012/09/08 20:15:38 | 002,655,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0011.dll
[2012/09/08 20:15:38 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0018.dll
[2012/09/08 20:15:37 | 004,495,360 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0019.dll
[2012/09/08 20:15:37 | 002,597,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0001.dll
[2012/09/08 20:15:37 | 001,523,200 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0000.dll
[2012/09/08 20:15:36 | 004,874,240 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0009.dll
[2012/09/08 20:15:36 | 002,241,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0007.dll
[2012/09/08 20:15:36 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0003.dll
[2012/09/08 20:15:36 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0002.dll
[2012/09/08 20:15:35 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData004c.dll
[2012/09/08 20:15:35 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData004b.dll
[2012/09/08 20:15:35 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData004a.dll
[2012/09/08 20:15:34 | 003,102,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData004e.dll
[2012/09/08 20:15:34 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData001a.dll
[2012/09/08 20:15:34 | 001,799,168 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData003e.dll
[2012/09/08 20:15:34 | 001,799,168 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData002a.dll
[2012/09/08 20:15:33 | 009,845,248 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData000a.dll
[2012/09/08 20:15:33 | 004,493,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData001d.dll
[2012/09/08 20:15:33 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData001b.dll
[2012/09/08 20:15:32 | 002,641,408 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData000c.dll
[2012/09/08 20:15:32 | 002,340,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData000d.dll
[2012/09/08 20:15:32 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData000f.dll
[2012/09/08 20:15:31 | 004,493,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0816.dll
[2012/09/08 20:15:31 | 004,493,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0416.dll
[2012/09/08 20:15:31 | 004,493,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0414.dll
[2012/09/08 20:15:31 | 000,797,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NaturalLanguage6.dll
[2012/09/08 20:15:30 | 006,917,120 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0c1a.dll
[2012/09/08 20:15:30 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData0c1a.dll
[2012/09/08 20:15:30 | 001,963,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NlsData081a.dll
[2012/09/08 20:11:05 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\en-US\i8042prt.sys.mui
[2012/09/08 20:11:05 | 000,005,632 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\en-US\sermouse.sys.mui
[2012/09/08 20:11:05 | 000,004,608 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\en-US\mouclass.sys.mui
[2012/09/08 20:11:05 | 000,004,608 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\en-US\kbdclass.sys.mui
[2012/09/08 20:11:05 | 000,003,072 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\en-US\mouhid.sys.mui
[2012/09/08 20:11:05 | 000,003,072 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\en-US\kbdhid.sys.mui
[2012/09/08 20:11:02 | 000,613,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wpd_ci.dll
[2012/09/08 20:11:02 | 000,371,712 | —- | M] (Microsoft Corporation) – C:\Windows\System32\srcore.dll
[2012/09/08 20:11:02 | 000,313,856 | —- | M] (Microsoft Corporation) – C:\Windows\System32\rstrui.exe
[2012/09/08 20:11:02 | 000,016,384 | —- | M] (Microsoft Corporation) – C:\Windows\System32\srdelayed.exe
[2012/09/08 20:11:01 | 000,944,184 | —- | M] (Microsoft Corporation) – C:\Windows\System32\winload.exe
[2012/09/08 20:11:01 | 000,905,400 | —- | M] (Microsoft Corporation) – C:\Windows\System32\winresume.exe
[2012/09/08 20:11:01 | 000,620,088 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ci.dll
[2012/09/08 20:11:01 | 000,019,000 | —- | M] (Microsoft Corporation) – C:\Windows\System32\kd1394.dll
[2012/09/08 20:11:00 | 000,101,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drvinst.exe
[2012/09/08 20:10:59 | 000,260,096 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dpx.dll
[2012/09/08 20:10:59 | 000,039,424 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lodctr.exe
[2012/09/08 20:10:59 | 000,006,656 | —- | M] (Microsoft Corporation) – C:\Windows\System32\kbd106n.dll
[2012/09/08 20:10:58 | 000,115,200 | —- | M] (Microsoft Corporation) – C:\Windows\System32\loadperf.dll
[2012/09/08 20:10:58 | 000,032,256 | —- | M] (Microsoft Corporation) – C:\Windows\System32\unlodctr.exe
[2012/09/08 20:10:58 | 000,017,408 | —- | M] (Microsoft Corporation) – C:\Windows\System32\prflbmsg.dll
[2012/09/08 20:10:57 | 000,035,384 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\WdfLdr.sys
[2012/09/08 20:10:57 | 000,012,800 | —- | M] (Microsoft Corporation) – C:\Windows\System32\batt.dll
[2012/09/08 20:10:57 | 000,007,168 | —- | M] (Microsoft Corporation) – C:\Windows\System32\f3ahvoas.dll
[2012/09/08 20:10:56 | 000,035,328 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dispci.dll
[2012/09/08 20:10:56 | 000,006,656 | —- | M] (Microsoft Corporation) – C:\Windows\System32\kbd106.dll
[2012/09/08 20:09:34 | 000,654,336 | —- | M] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelinesvc.exe
[2012/09/08 20:09:34 | 000,024,576 | —- | M] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelineprxy.dll
[2012/09/08 20:09:32 | 000,158,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sdohlp.dll
[2012/09/08 20:09:32 | 000,097,280 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iasrecst.dll
[2012/09/08 20:09:32 | 000,053,248 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iasads.dll
[2012/09/08 20:09:32 | 000,037,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iasdatastore.dll
[2012/09/08 20:08:46 | 000,220,672 | —- | M] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\System32\l3codecp.acm
[2012/09/08 20:08:46 | 000,062,464 | —- | M] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\System32\l3codeca.acm
[2012/09/08 20:07:24 | 000,167,424 | —- | M] (Microsoft Corporation) – C:\Windows\System32\tcpipcfg.dll
[2012/09/08 20:07:24 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netiougc.exe
[2012/09/08 20:06:02 | 000,223,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\WMASF.DLL
[2012/09/08 20:06:02 | 000,009,728 | —- | M] (Microsoft Corporation) – C:\Windows\System32\LAPRXY.DLL
[2012/09/08 20:06:02 | 000,002,048 | —- | M] (Microsoft Corporation) – C:\Windows\System32\asferror.dll
[2012/09/08 20:05:27 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\Windows\System32\amxread.dll
[2012/09/08 20:05:27 | 000,014,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\apilogen.dll
[2012/09/08 20:04:47 | 000,037,376 | —- | M] (Microsoft Corporation) – C:\Windows\System32\printcom.dll
[2012/09/08 20:04:08 | 002,031,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/09/08 20:03:28 | 000,113,664 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\rmcast.sys
[2012/09/08 20:03:28 | 000,014,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wshrm.dll
[2012/09/08 20:02:41 | 008,147,968 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2012/09/08 20:02:39 | 000,007,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spwmp.dll
[2012/09/08 20:02:39 | 000,004,096 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msdxm.ocx
[2012/09/08 20:02:36 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msdxm.tlb
[2012/09/08 20:02:36 | 000,018,432 | —- | M] (Microsoft Corporation) – C:\Windows\System32\amcompat.tlb
[2012/09/08 20:01:31 | 000,011,776 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sbunattend.exe
[2012/09/08 20:00:11 | 000,024,576 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2012/09/08 19:56:12 | 000,622,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\icardagt.exe
[2012/09/08 19:56:11 | 000,097,800 | —- | M] (Microsoft Corporation) – C:\Windows\System32\infocardapi.dll
[2012/09/08 19:56:11 | 000,037,384 | —- | M] (Microsoft Corporation) – C:\Windows\System32\infocardcpl.cpl
[2012/09/08 19:56:11 | 000,011,264 | —- | M] (Microsoft Corporation) – C:\Windows\System32\icardres.dll
[2012/09/08 19:56:04 | 000,105,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
[2012/09/08 19:56:03 | 000,781,344 | —- | M] (Microsoft Corporation) – C:\Windows\System32\PresentationNative_v0300.dll
[2012/09/08 19:56:03 | 000,326,160 | —- | M] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2012/09/08 19:56:03 | 000,043,544 | —- | M] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2012/09/08 19:48:31 | 027,590,656 | —- | M] () – C:\Windows\ocsetup_install_NetFx3.etl
[2012/09/08 19:48:31 | 000,196,608 | —- | M] () – C:\Windows\ocsetup_cbs_install_NetFx3.perf
[2012/09/08 19:48:31 | 000,065,536 | —- | M] () – C:\Windows\ocsetup_cbs_install_NetFx3.dpx
[2012/09/08 19:35:47 | 000,041,984 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2012/09/08 19:35:45 | 000,158,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mscorier.dll
[2012/09/08 19:35:45 | 000,083,968 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mscories.dll
[2012/09/08 19:20:54 | 000,094,720 | —- | M] (Microsoft Corporation) – C:\Windows\System32\logagent.exe
[2012/09/08 19:20:53 | 000,996,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\WMNetMgr.dll
[2012/09/08 19:20:15 | 000,084,480 | —- | M] (Microsoft Corporation) – C:\Windows\System32\INETRES.dll
[2012/09/08 19:18:51 | 000,024,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\nshhttp.dll
[2012/09/08 19:16:42 | 000,321,536 | —- | M] (Microsoft Corporation) – C:\Windows\System32\WSDApi.dll
[2012/09/08 19:16:30 | 000,099,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\poqexec.exe
[2012/09/08 19:15:55 | 000,082,944 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2012/09/08 19:15:55 | 000,065,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\avicap32.dll
[2012/09/08 19:15:09 | 000,604,672 | —- | M] (Microsoft Corporation) – C:\Windows\System32\WMSPDMOD.DLL
[2012/09/08 18:34:53 | 000,002,543 | —- | M] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart Essentials.lnk
[2012/09/08 18:34:53 | 000,002,519 | —- | M] () – C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
[2012/09/08 18:34:53 | 000,002,037 | —- | M] () – C:\Users\Public\Desktop\Nero Online Upgrade.lnk
[2012/09/08 17:30:20 | 000,001,043 | —- | M] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\¾Ë¾à.lnk
[2012/09/08 17:30:20 | 000,000,925 | —- | M] () – C:\Users\Public\Desktop\antivirus.lnk
[2012/09/08 17:30:02 | 000,001,824 | —- | M] () – C:\Users\Public\Desktop\PowerDVD.lnk
[2012/09/08 17:25:29 | 000,000,943 | —- | M] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/09/08 17:25:24 | 000,016,066 | —- | M] () – C:\Windows\System32\results.xml
[2012/09/08 17:18:50 | 000,289,792 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2012/09/08 17:18:50 | 000,156,672 | —- | M] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2012/09/08 17:18:50 | 000,072,704 | —- | M] (Microsoft Corporation) – C:\Windows\System32\fontsub.dll
[2012/09/08 17:18:50 | 000,034,304 | —- | M] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2012/09/08 17:18:50 | 000,010,240 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dciman32.dll
[2012/09/08 17:17:52 | 002,452,872 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2012/09/08 17:17:52 | 000,385,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2012/09/08 17:17:52 | 000,380,928 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/09/08 17:17:52 | 000,230,400 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2012/09/08 17:17:52 | 000,161,792 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2012/09/08 17:17:52 | 000,072,704 | —- | M] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2012/09/08 17:17:51 | 000,459,264 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/09/08 17:17:51 | 000,347,136 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2012/09/08 17:17:51 | 000,214,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2012/09/08 17:17:51 | 000,027,648 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/09/08 17:17:50 | 000,180,736 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/09/08 17:17:49 | 000,389,120 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/09/08 17:17:48 | 000,078,336 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieencode.dll
[2012/09/08 17:17:48 | 000,048,128 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2012/09/08 17:17:47 | 001,383,424 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/09/08 17:17:46 | 001,830,912 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/09/08 17:17:46 | 000,671,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2012/09/08 17:17:44 | 000,026,624 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/09/08 17:17:43 | 000,070,656 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2012/09/08 17:17:43 | 000,056,320 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2012/09/08 17:17:43 | 000,044,544 | —- | M] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2012/09/08 17:17:43 | 000,044,544 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2012/09/08 17:17:42 | 000,000,390 | —- | M] () – C:\Users\user\Desktop\recovery from C - Shortcut.lnk
[2012/09/08 17:16:09 | 000,272,896 | —- | M] (Microsoft Corporation) – C:\Windows\System32\polstore.dll
[2012/09/08 17:16:09 | 000,028,672 | —- | M] (Microsoft Corporation) – C:\Windows\System32\FwRemoteSvr.dll
[2012/09/08 17:15:40 | 000,008,192 | —- | M] (Microsoft Corporation) – C:\Windows\System32\riched32.dll
[2012/09/08 17:15:39 | 000,077,824 | —- | M] (Microsoft Corporation) – C:\Windows\System32\rascfg.dll
[2012/09/08 17:15:39 | 000,052,736 | —- | M] (Microsoft Corporation) – C:\Windows\System32\rasdiag.dll
[2012/09/08 17:15:39 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\rasser.dll
[2012/09/08 17:15:38 | 000,564,736 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msftedit.dll
[2012/09/08 17:15:38 | 000,032,768 | —- | M] (Microsoft Corporation) – C:\Windows\System32\rasmxs.dll
[2012/09/08 17:15:38 | 000,013,824 | —- | M] (Microsoft Corporation) – C:\Windows\System32\icsunattend.exe
[2012/09/08 17:15:38 | 000,001,820 | —- | M] () – C:\Windows\System32\rasctrnm.h
[2012/09/08 17:15:37 | 000,036,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2012/09/08 17:15:37 | 000,033,280 | —- | M] (Microsoft Corporation) – C:\Windows\System32\traffic.dll
[2012/09/08 17:15:37 | 000,015,360 | —- | M] (Microsoft Corporation) – C:\Windows\System32\pacerprf.dll
[2012/09/08 17:15:37 | 000,013,824 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wshqos.dll
[2012/09/08 17:14:42 | 000,241,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceApi.dll
[2012/09/08 17:14:42 | 000,160,768 | —- | M] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceTypes.dll
[2012/09/08 17:14:42 | 000,095,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceClassExtension.dll
[2012/09/08 17:14:17 | 000,205,824 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msoeacct.dll
[2012/09/08 17:14:17 | 000,087,040 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msoert2.dll
[2012/09/08 17:14:17 | 000,039,424 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ACCTRES.dll
[2012/09/08 17:13:32 | 000,103,936 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netiohlp.dll
[2012/09/08 17:13:32 | 000,027,136 | —- | M] (Microsoft Corporation) – C:\Windows\System32\NETSTAT.EXE
[2012/09/08 17:13:32 | 000,019,968 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ARP.EXE
[2012/09/08 17:13:32 | 000,017,920 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ROUTE.EXE
[2012/09/08 17:13:32 | 000,015,360 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netevent.dll
[2012/09/08 17:13:32 | 000,011,264 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MRINFO.EXE
[2012/09/08 17:13:32 | 000,010,240 | —- | M] (Microsoft Corporation) – C:\Windows\System32\finger.exe
[2012/09/08 17:13:32 | 000,008,704 | —- | M] (Microsoft Corporation) – C:\Windows\System32\HOSTNAME.EXE
[2012/09/08 17:13:31 | 000,213,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\netio.sys
[2012/09/08 17:12:48 | 000,704,000 | —- | M] (Microsoft Corporation) – C:\Windows\System32\PhotoScreensaver.scr
[2012/09/08 17:12:47 | 000,028,344 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\battc.sys
[2012/09/08 17:12:03 | 001,657,350 | —- | M] () – C:\Windows\System32\wlan.tmf
[2012/09/08 17:12:03 | 000,123,904 | —- | M] (Microsoft Corporation) – C:\Windows\System32\L2SecHC.dll
[2012/09/08 17:12:03 | 000,047,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wlanapi.dll
[2012/09/08 17:12:02 | 000,297,984 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wlansec.dll
[2012/09/08 17:12:02 | 000,290,816 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wlanmsm.dll
[2012/09/08 17:12:02 | 000,067,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wlanhlp.dll
[2012/09/08 17:11:31 | 000,002,048 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msxml6r.dll
[2012/09/08 17:11:31 | 000,002,048 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msxml3r.dll
[2012/09/08 17:10:13 | 000,376,320 | —- | M] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2012/09/08 17:10:13 | 000,049,664 | —- | M] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2012/09/08 17:09:50 | 002,855,424 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2012/09/08 17:09:50 | 000,098,816 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mfps.dll
[2012/09/08 17:09:50 | 000,052,736 | —- | M] (Microsoft Corporation) – C:\Windows\System32\rrinstaller.exe
[2012/09/08 17:09:50 | 000,024,576 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mfpmp.exe
[2012/09/08 17:09:50 | 000,002,048 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mferror.dll
[2012/09/08 17:09:49 | 002,433,536 | —- | M] (Microsoft Corporation) – C:\Windows\System32\WMVCORE.DLL
[2012/09/08 17:09:19 | 003,502,480 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2012/09/08 17:09:19 | 003,468,168 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2012/09/08 17:05:36 | 000,500,736 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msdtcprx.dll
[2012/09/08 17:05:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\System32\xolehlp.dll
[2012/09/08 17:04:53 | 000,116,736 | —- | M] (Microsoft Corporation) – C:\Windows\System32\aaclient.dll
[2012/09/08 17:04:53 | 000,036,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\tsgqec.dll
[2012/09/08 17:04:23 | 000,303,616 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wmpeffects.dll
[2012/09/08 17:03:40 | 000,414,208 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscp.dll
[2012/09/08 17:03:23 | 000,713,728 | —- | M] (Microsoft Corporation) – C:\Windows\System32\timedate.cpl
[2012/09/08 17:03:01 | 000,356,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MediaMetadataHandler.dll
[2012/09/08 17:02:44 | 000,392,192 | —- | M] (Microsoft Corporation) – C:\Windows\System32\FirewallAPI.dll
[2012/09/08 17:02:43 | 000,086,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\icfupgd.dll
[2012/09/08 17:02:43 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cmifw.dll
[2012/09/08 17:02:43 | 000,016,896 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wfapigp.dll
[2012/09/08 17:01:03 | 001,244,672 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mcmde.dll
[2012/09/08 17:01:03 | 000,292,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2012/09/08 17:01:03 | 000,217,088 | —- | M] (Microsoft Corporation) – C:\Windows\System32\psisrndr.ax
[2012/09/08 17:01:03 | 000,177,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2012/09/08 17:01:03 | 000,080,896 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MSNP.ax
[2012/09/08 17:01:03 | 000,068,608 | —- | M] (Microsoft Corporation) – C:\Windows\System32\Mpeg2Data.ax
[2012/09/08 17:01:03 | 000,057,856 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MSDvbNP.ax
[2012/09/08 16:59:26 | 000,002,048 | —- | M] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2012/09/08 16:58:01 | 000,109,624 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\ataport.sys
[2012/09/08 16:58:01 | 000,045,112 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\pciidex.sys
[2012/09/08 16:57:51 | 000,104,448 | —- | M] (Microsoft Corporation) – C:\Windows\System32\DWWIN.EXE
[2012/09/08 16:57:27 | 002,923,520 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
[2012/09/08 15:39:51 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\UMDF\Msft_User_WpdFs_01_00_00.Wdf
[2012/09/08 15:30:26 | 000,001,150 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
[2012/09/08 15:26:54 | 000,000,874 | —- | M] () – C:\Users\Public\Desktop\Acrobat.com.lnk
[2012/09/08 15:26:29 | 000,000,812 | —- | M] () – C:\Users\user\Desktop\DVD Region-Free.lnk
[2012/09/08 15:26:06 | 000,001,887 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/09/08 15:25:22 | 000,001,646 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2012/09/08 15:25:22 | 000,000,858 | —- | M] () – C:\Users\Public\Desktop\WinZip.lnk
[2012/09/08 15:02:29 | 000,000,680 | —- | M] () – C:\Users\user\AppData\Local\d3d9caps.dat

========== Files Created - No Company Name ==========

[2012/10/01 12:44:12 | 000,023,096 | —- | C] () – C:\Users\user\Desktop\Monument-to-Victorious-Fatherland-Liberation-War-with-Ryugyong-Hotel-in-the-background.-Pyongyang-North-Korea-2011.-e1331705822257-301x399.jpg
[2012/10/01 11:11:11 | 000,071,226 | —- | C] () – C:\Users\user\Desktop\black.jpg
[2012/10/01 11:08:49 | 003,322,760 | —- | C] () – C:\Users\user\Desktop\SNV30853.JPG
[2012/09/30 18:40:34 | 000,000,938 | —- | C] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/09/30 18:08:52 | 000,031,937 | —- | C] () – C:\Users\user\Desktop\4185410-Monument_to_Victorious_Fatherland_Liberation_War_North_Korea.jpg
[2012/09/30 17:19:27 | 000,014,002 | —- | C] () – C:\Users\user\Desktop\7ee2d050dc29616e7432fae4628c659bda37a47d_full.jpg
[2012/09/27 21:12:55 | 000,046,715 | —- | C] () – C:\Users\user\Desktop\Statue2647.jpg
[2012/09/20 22:37:52 | 000,035,297 | —- | C] () – C:\Users\user\Desktop\Curriculum Vitae MacDonalds.pdf
[2012/09/20 08:13:34 | 000,057,474 | —- | C] () – C:\Users\user\Desktop\Cover Letter.pdf
[2012/09/13 08:19:10 | 000,033,698 | —- | C] () – C:\Users\user\Desktop\Governmentlisting6.pdf
[2012/09/12 08:20:18 | 000,048,964 | —- | C] () – C:\Users\user\Desktop\PK Cover.pdf
[2012/09/12 08:11:36 | 000,013,313 | —- | C] () – C:\Users\user\Desktop\Australian Doctor Medical Negligence Injury Compensation Claims.htm
[2012/09/12 06:57:23 | 000,044,762 | —- | C] () – C:\Users\user\Desktop\Peoples Cover Letter.pdf
[2012/09/12 06:37:55 | 000,008,566 | —- | C] () – C:\Users\user\Desktop\Won Cover Letter.pdf
[2012/09/10 07:50:06 | 000,103,830 | —- | C] () – C:\Users\user\Desktop\Curriculum Vitae.pdf
[2012/09/10 07:36:41 | 000,000,064 | —- | C] () – C:\Windows\GPlrLanc.dat
[2012/09/10 07:36:24 | 000,045,056 | —- | C] () – C:\Windows\System32\unredmon.exe
[2012/09/10 07:36:23 | 000,116,224 | —- | C] () – C:\Windows\System32\redmonnt.dll
[2012/09/09 16:56:57 | 000,001,947 | —- | C] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012/09/09 16:56:57 | 000,001,947 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/09/09 16:53:56 | 000,000,870 | —- | C] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/09/09 16:53:56 | 000,000,858 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/09/09 16:53:56 | 000,000,846 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/09/09 16:52:55 | 000,008,192 | —- | C] () – C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/09 08:42:20 | 000,008,192 | R-S- | C] () – C:\BOOTSECT.BAK
[2012/09/09 08:42:19 | 000,438,840 | RHS- | C] () – C:\bootmgr
[2012/09/08 19:38:07 | 027,590,656 | —- | C] () – C:\Windows\ocsetup_install_NetFx3.etl
[2012/09/08 19:38:07 | 000,196,608 | —- | C] () – C:\Windows\ocsetup_cbs_install_NetFx3.perf
[2012/09/08 19:38:07 | 000,065,536 | —- | C] () – C:\Windows\ocsetup_cbs_install_NetFx3.dpx
[2012/09/08 18:34:53 | 000,002,543 | —- | C] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart Essentials.lnk
[2012/09/08 18:34:53 | 000,002,519 | —- | C] () – C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
[2012/09/08 18:34:53 | 000,002,037 | —- | C] () – C:\Users\Public\Desktop\Nero Online Upgrade.lnk
[2012/09/08 17:31:02 | 000,000,294 | —- | C] () – C:\Windows\System32\ayboot.ini
[2012/09/08 17:30:20 | 000,001,043 | —- | C] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\¾Ë¾à.lnk
[2012/09/08 17:30:20 | 000,000,925 | —- | C] () – C:\Users\Public\Desktop\antivirus.lnk
[2012/09/08 17:30:02 | 000,001,824 | —- | C] () – C:\Users\Public\Desktop\PowerDVD.lnk
[2012/09/08 17:25:24 | 000,016,066 | —- | C] () – C:\Windows\System32\results.xml
[2012/09/08 17:17:42 | 000,000,390 | —- | C] () – C:\Users\user\Desktop\recovery from C - Shortcut.lnk
[2012/09/08 17:15:38 | 000,001,820 | —- | C] () – C:\Windows\System32\rasctrnm.h
[2012/09/08 17:12:03 | 001,657,350 | —- | C] () – C:\Windows\System32\wlan.tmf
[2012/09/08 15:30:26 | 000,001,150 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
[2012/09/08 15:30:25 | 000,000,965 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ImageReady 7.0.lnk
[2012/09/08 15:30:25 | 000,000,960 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 7.0.lnk
[2012/09/08 15:29:23 | 000,000,943 | —- | C] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/09/08 15:26:54 | 000,000,886 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat.com.lnk
[2012/09/08 15:26:54 | 000,000,874 | —- | C] () – C:\Users\Public\Desktop\Acrobat.com.lnk
[2012/09/08 15:26:29 | 000,000,812 | —- | C] () – C:\Users\user\Desktop\DVD Region-Free.lnk
[2012/09/08 15:26:06 | 000,001,887 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/09/08 15:26:06 | 000,001,804 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012/09/08 15:25:22 | 000,001,646 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2012/09/08 15:25:22 | 000,000,858 | —- | C] () – C:\Users\Public\Desktop\WinZip.lnk
[2012/09/08 15:09:13 | 3211,190,272 | -HS- | C] () – C:\hiberfil.sys
[2012/09/08 15:03:10 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v4926.dll
[2012/09/08 15:03:10 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2012/09/08 15:03:10 | 000,027,024 | —- | C] () – C:\Windows\System32\igxpxs32.vp
[2012/09/08 15:03:10 | 000,002,096 | —- | C] () – C:\Windows\System32\igxpxk32.vp
[2012/09/08 15:03:08 | 001,498,560 | —- | C] () – C:\Windows\System32\igkrng400.bin
[2012/09/08 15:03:08 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1504.dll
[2012/09/08 15:03:02 | 002,215,364 | —- | C] () – C:\Windows\System32\igklg400.bin
[2012/09/08 15:03:02 | 001,971,732 | —- | C] () – C:\Windows\System32\igklg450.bin
[2012/09/08 15:03:02 | 000,029,932 | —- | C] () – C:\Windows\System32\igmedcompkrn.bin
[2012/09/08 15:03:02 | 000,002,096 | —- | C] () – C:\Windows\System32\iglhxo32.vp
[2012/09/08 15:03:02 | 000,002,096 | —- | C] () – C:\Windows\System32\iglhxc32.vp
[2012/09/08 14:51:49 | 000,000,949 | —- | C] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012/09/08 14:51:47 | 000,000,944 | —- | C] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/09/08 14:51:38 | 000,000,915 | —- | C] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2012/09/08 14:51:35 | 000,000,680 | —- | C] () – C:\Users\user\AppData\Local\d3d9caps.dat
[2012/09/08 14:51:32 | 000,000,258 | —- | C] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/09/08 14:51:32 | 000,000,240 | —- | C] () – C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

========== ZeroAccess Check ==========

[2012/10/02 15:06:59 | 000,002,048 | -HS- | M] () – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\@
[2012/10/02 15:06:59 | 000,076,288 | -HS- | M] () – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\n
[2012/09/13 19:33:11 | 000,000,000 | -HSD | M] – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\L
[2012/10/04 08:39:24 | 000,000,000 | -HSD | M] – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\U
[2012/10/04 17:17:27 | 000,000,804 | —- | M] () – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\L\00000004.@
[2012/10/04 08:39:21 | 000,002,048 | —- | M] () – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\U\00000004.@
[2012/10/04 08:39:24 | 000,232,960 | —- | M] () – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\U\00000008.@
[2012/10/04 08:39:21 | 000,001,632 | —- | M] () – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\U\000000cb.@
[2012/10/04 08:39:22 | 000,013,312 | —- | M] () – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\U\80000000.@
[2012/10/04 08:39:23 | 000,087,040 | —- | M] () – C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\U\80000032.@
[2006/11/02 22:54:22 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini
[2012/10/04 17:17:26 | 000,005,120 | -HS- | M] () – C:\Windows\assembly\GAC\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
"ThreadingModel" = Both
"" = C:\$Recycle.Bin\S-1-5-21-3019451588-4077001812-2615468558-1000\$1fa0b2e3d082d2205ba700fe0c3dd246\n. – File not found

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/09/08 17:00:05 | 011,315,712 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\$Recycle.Bin\S-1-5-18\$1fa0b2e3d082d2205ba700fe0c3dd246\n. – [2012/10/02 15:06:59 | 000,076,288 | -HS- | M] ()
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2006/11/02 19:46:13 | 000,348,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/09/11 21:23:26 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\Asinxu
[2012/09/18 08:29:16 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\Duani
[2012/10/01 22:39:10 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\DVDVideoSoft
[2012/09/18 08:08:25 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\Ilow

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EXE >
[2012/09/08 16:57:27 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\explorer.exe
[2008/10/29 16:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\SoftwareDistribution\Download\7061d8bdfc6a60f6588941d7a2c304c7\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2012/09/08 16:57:27 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 16:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\SoftwareDistribution\Download\7061d8bdfc6a60f6588941d7a2c304c7\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2012/09/08 16:57:27 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/30 13:59:17 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\SoftwareDistribution\Download\7061d8bdfc6a60f6588941d7a2c304c7\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2012/09/08 16:57:26 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2007/08/27 13:10:03 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 – C:\Windows\SoftwareDistribution\Download\f411dcb0df2de951a1b7d68be5b8fec7\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2012/09/08 17:12:47 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2007/08/27 12:01:58 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 – C:\Windows\SoftwareDistribution\Download\f411dcb0df2de951a1b7d68be5b8fec7\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2012/09/08 17:12:47 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2008/10/28 12:15:02 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\SoftwareDistribution\Download\7061d8bdfc6a60f6588941d7a2c304c7\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2012/09/08 16:57:27 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006/11/02 19:45:07 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2006/11/02 22:41:18 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\en-US\explorer.exe.mui
[2006/11/02 22:41:18 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_03bbc52176b6ba20\explorer.exe.mui

< MD5 for: EXPLORER.ZIP >
[2006/03/06 22:48:08 | 000,020,394 | —- | M] () MD5=B469409C2B2A33C542190B720E11BD79 – C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip

< MD5 for: IEXPLORE.EXE >
[2009/12/18 22:28:58 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=115076DAD84312F3A51698C15BC39D39 – C:\Windows\SoftwareDistribution\Download\fe59f940c1f33c624a58e6cb58d47b4d\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21184_none_2db2bdca3632ff3d\iexplore.exe
[2012/09/08 17:17:44 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=115076DAD84312F3A51698C15BC39D39 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21184_none_2db2bdca3632ff3d\iexplore.exe
[2009/12/19 01:42:45 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=6C8AC3469BBEFE194BB18B2D84D98252 – C:\Windows\SoftwareDistribution\Download\fe59f940c1f33c624a58e6cb58d47b4d\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18385_none_2f1087cd1a3ad679\iexplore.exe
[2012/09/08 17:17:31 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=6C8AC3469BBEFE194BB18B2D84D98252 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18385_none_2f1087cd1a3ad679\iexplore.exe
[2006/11/02 19:45:14 | 000,623,616 | —- | M] (Microsoft Corporation) MD5=8308F01F27DF839E0010B0F72F855E35 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16386_none_2d2b3e0d1d136ff5\iexplore.exe
[2012/09/08 17:17:45 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=C071905121F6DE5F399550FC70138FEC – C:\Program Files\Internet Explorer\iexplore.exe
[2009/12/18 22:56:05 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=C071905121F6DE5F399550FC70138FEC – C:\Windows\SoftwareDistribution\Download\fe59f940c1f33c624a58e6cb58d47b4d\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16982_none_2d2748491d16f983\iexplore.exe
[2012/09/08 17:17:45 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=C071905121F6DE5F399550FC70138FEC – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16982_none_2d2748491d16f983\iexplore.exe
[2009/12/18 22:27:08 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=F47755101C622AF18EE669ECEB3A97AD – C:\Windows\SoftwareDistribution\Download\fe59f940c1f33c624a58e6cb58d47b4d\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22585_none_2f9a267e3358736a\iexplore.exe
[2012/09/08 17:17:31 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=F47755101C622AF18EE669ECEB3A97AD – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22585_none_2f9a267e3358736a\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2006/11/02 22:41:15 | 000,016,384 | —- | M] (Microsoft Corporation) MD5=3CCDDDBC49DEACA370F39A9F0E146A1B – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2006/11/02 22:41:15 | 000,016,384 | —- | M] (Microsoft Corporation) MD5=3CCDDDBC49DEACA370F39A9F0E146A1B – C:\Windows\winsxs\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_3b55b11a57da5590\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-908C99F8.PF >
[2012/09/19 20:45:36 | 000,301,652 | —- | M] () MD5=70747ECD889B4F4C5CF20F4552940B4A – C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf

< MD5 for: SERVICES >
[2006/09/19 07:41:30 | 000,017,244 | —- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 – C:\Windows\System32\drivers\etc\services
[2006/09/19 07:41:30 | 000,017,244 | —- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 – C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.0.6000.16386_none_024e4071fa6fea95\services

< MD5 for: SERVICES.EXE >
[2006/11/02 19:45:40 | 000,279,552 | —- | M] (Microsoft Corporation) MD5=329CF3C97CE4C19375C8ABCABAE258B0 – C:\Windows\System32\services.exe
[2006/11/02 19:45:40 | 000,279,552 | —- | M] (Microsoft Corporation) MD5=329CF3C97CE4C19375C8ABCABAE258B0 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2006/11/02 22:40:53 | 000,017,920 | —- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C – C:\Windows\System32\en-US\services.exe.mui
[2006/11/02 22:40:53 | 000,017,920 | —- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C – C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_67c6851b290a1ced\services.exe.mui

< MD5 for: SERVICES.LNK >
[2006/11/02 22:53:55 | 000,001,688 | —- | M] () MD5=CD37AF3AB3916666198BFFC8C0C611EB – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2006/11/02 22:53:55 | 000,001,688 | —- | M] () MD5=CD37AF3AB3916666198BFFC8C0C611EB – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOCHIADS.COM.SOL >
[2012/10/02 15:01:56 | 000,000,427 | —- | M] () MD5=BB0C072649356AB782E31D54031B4365 – C:\Users\user\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\B35TQWSW\mochiads.com\services.mochiads.com.sol

< MD5 for: SERVICES.MOF >
[2006/09/19 07:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\System32\wbem\services.mof
[2006/09/19 07:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.mof

< MD5 for: SERVICES.MSC >
[2006/11/02 22:41:29 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\System32\en-US\services.msc
[2006/09/19 07:29:40 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\System32\services.msc
[2006/11/02 22:41:29 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a2085506ff73b6e0\services.msc
[2006/09/19 07:29:40 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6000.16386_none_cd2d20a848cfd40f\services.msc

< MD5 for: WINLOGON.EXE >
[2006/11/02 19:45:57 | 000,308,224 | —- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD – C:\Windows\System32\winlogon.exe
[2006/11/02 19:45:57 | 000,308,224 | —- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2006/11/02 22:40:50 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=A1D2856F3EC3C86EBBF1442B0245A8B3 – C:\Windows\System32\en-US\winlogon.exe.mui
[2006/11/02 22:40:50 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=A1D2856F3EC3C86EBBF1442B0245A8B3 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c8c1cf8f072b6166\winlogon.exe.mui

< MD5 for: WINLOGON.MOF >
[2006/09/19 07:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\System32\wbem\winlogon.mof
[2006/09/19 07:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.0.6000.16386_none_7e0207d478fccc94\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2006/09/19 07:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2006/11/02 19:53:57 | 000,438,840 | RHS- | M] () – C:\bootmgr
[2012/09/09 08:42:20 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/19 07:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2012/10/04 17:16:51 | 3211,190,272 | -HS- | M] () – C:\hiberfil.sys
[2012/10/04 17:16:51 | 3525,115,904 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/11/02 22:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 22:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 22:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 22:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/19 07:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 22:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2012/09/08 17:24:44 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 20:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 20:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 20:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 20:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 20:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/09/30 18:40:34 | 000,000,286 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-09-08 10:23:08

< End of report >

oh dayam, sounds serious. Here are the test results.

____________________________________

ComboFix 12-10-04.02 - user 05/10/2012 8:59.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3062.1994 [GMT 10:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\Desktop\Antivirus.lnk
c:\windows\assembly\GAC\Desktop.ini
.
.
((((((((((((((((((((((((( Files Created from 2012-09-04 to 2012-10-04 )))))))))))))))))))))))))))))))
.
.
2012-10-04 23:02 . 2012-10-04 23:02 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-10-01 12:47 . 2012-10-04 22:48 ——– d—–w- c:\programdata\AVG Secure Search
2012-10-01 12:46 . 2012-10-01 12:46 27496 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-10-01 12:46 . 2012-10-01 12:46 ——– d—–w- c:\program files\Common Files\AVG Secure Search
2012-10-01 12:46 . 2012-10-01 12:47 ——– d—–w- c:\program files\AVG Secure Search
2012-10-01 12:46 . 2012-10-01 12:46 ——– d–h–w- c:\programdata\Common Files
2012-10-01 12:38 . 2012-10-01 12:38 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2012-10-01 12:38 . 2012-10-01 12:38 ——– d—–w- c:\program files\DVDVideoSoft
2012-09-30 08:25 . 2012-09-30 08:25 ——– d—–w- c:\program files\ConvertHelper
2012-09-21 08:33 . 2012-09-21 08:33 ——– d—–w- c:\program files\Common Files\McAfee
2012-09-21 08:33 . 2012-09-22 22:22 ——– d—–w- c:\program files\McAfee
2012-09-09 21:49 . 2012-09-09 21:49 ——– d—–w- c:\program files\MSECache
2012-09-09 21:40 . 2012-09-09 21:40 ——– d—–w- c:\programdata\boost_interprocess
2012-09-09 21:36 . 2001-10-28 16:42 45056 —-a-w- c:\windows\system32\unredmon.exe
2012-09-09 21:36 . 2001-10-28 16:42 116224 —-a-w- c:\windows\system32\redmonnt.dll
2012-09-09 21:36 . 2012-09-09 21:42 ——– d—–w- c:\program files\PDFlite
2012-09-09 21:35 . 2012-09-09 21:45 ——– d—–w- c:\program files\Free Offers from Freeze.com
2012-09-09 06:56 . 2012-09-09 06:56 ——– d—–w- c:\programdata\McAfee Security Scan
2012-09-09 06:56 . 2012-09-21 08:33 ——– d—–w- c:\programdata\McAfee
2012-09-09 06:56 . 2012-09-14 07:57 ——– d—–w- c:\program files\McAfee Security Scan
2012-09-09 06:56 . 2012-10-02 05:07 73136 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-09 06:56 . 2012-10-02 05:07 696240 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-09 06:56 . 2012-09-09 06:56 ——– d—–w- c:\windows\system32\Macromed
2012-09-09 06:53 . 2012-09-09 06:53 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-09-08 22:42 . 2012-09-08 21:47 ——– d—–w- c:\windows\Panther
2012-09-08 22:42 . 2012-09-08 22:42 ——– d—–w- C:\Boot
2012-09-08 21:45 . 2012-09-08 10:22 ——– d—–w- c:\windows\Debug
2012-09-08 10:21 . 2012-08-27 15:50 7022536 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{836D23F3-B2B0-4835-AA21-907F4CA7C9EE}\mpengine.dll
2012-09-08 10:21 . 2012-05-31 02:25 237072 ——w- c:\windows\system32\MpSigStub.exe
2012-09-08 10:21 . 2012-09-08 10:21 374456 —-a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2012-09-08 10:20 . 2012-09-08 10:20 268800 —-a-w- c:\windows\system32\es.dll
2012-09-08 10:18 . 2012-09-08 10:18 494592 —-a-w- c:\windows\system32\kerberos.dll
2012-09-08 10:18 . 2012-09-08 10:18 272384 —-a-w- c:\windows\system32\schannel.dll
2012-09-08 10:17 . 2012-09-08 10:17 24064 —-a-w- c:\windows\system32\netcfg.exe
2012-09-08 10:11 . 2012-09-08 10:11 1585664 —-a-w- c:\windows\system32\setupapi.dll
2012-09-08 10:10 . 2012-09-08 10:10 6656 —-a-w- c:\windows\system32\kbd106n.dll
2012-09-08 10:09 . 2012-09-08 10:09 549888 —-a-w- c:\windows\system32\rpcss.dll
2012-09-08 10:09 . 2012-09-08 10:09 654336 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2012-09-08 10:09 . 2012-09-08 10:09 24576 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2012-09-08 10:09 . 2012-09-08 10:09 614912 —-a-w- c:\windows\system32\wbem\fastprox.dll
2012-09-08 10:09 . 2012-09-08 10:09 501760 —-a-w- c:\windows\system32\wbem\WmiPrvSD.dll
2012-09-08 10:09 . 2012-09-08 10:09 247296 —-a-w- c:\windows\system32\wbem\WmiPrvSE.exe
2012-09-08 10:09 . 2012-09-08 10:09 130560 —-a-w- c:\windows\system32\wbem\WmiDcPrv.dll
2012-09-08 10:09 . 2012-09-08 10:09 53248 —-a-w- c:\windows\system32\iasads.dll
2012-09-08 10:09 . 2012-09-08 10:09 37888 —-a-w- c:\windows\system32\iasdatastore.dll
2012-09-08 10:09 . 2012-09-08 10:09 158720 —-a-w- c:\windows\system32\sdohlp.dll
2012-09-08 10:09 . 2012-09-08 10:09 97280 —-a-w- c:\windows\system32\iasrecst.dll
2012-09-08 10:08 . 2012-09-08 10:08 62464 —-a-w- c:\windows\system32\l3codeca.acm
2012-09-08 10:08 . 2012-09-08 10:08 220672 —-a-w- c:\windows\system32\l3codecp.acm
2012-09-08 10:07 . 2012-09-08 10:07 25088 —-a-w- c:\windows\system32\drivers\tunnel.sys
2012-09-08 10:07 . 2012-09-08 10:07 22016 —-a-w- c:\windows\system32\netiougc.exe
2012-09-08 10:07 . 2012-09-08 10:07 179712 —-a-w- c:\windows\system32\iphlpsvc.dll
2012-09-08 10:07 . 2012-09-08 10:07 167424 —-a-w- c:\windows\system32\tcpipcfg.dll
2012-09-08 10:07 . 2012-09-08 10:07 15360 —-a-w- c:\windows\system32\drivers\TUNMP.SYS
2012-09-08 10:07 . 2012-09-08 10:07 815104 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-08 10:06 . 2012-09-08 10:06 454656 —-a-w- c:\program files\Common Files\System\msadc\msadce.dll
2012-09-08 10:06 . 2012-09-08 10:06 9728 —-a-w- c:\windows\system32\LAPRXY.DLL
2012-09-08 10:06 . 2012-09-08 10:06 223232 —-a-w- c:\windows\system32\WMASF.DLL
2012-09-08 10:06 . 2012-09-08 10:06 2048 —-a-w- c:\windows\system32\asferror.dll
2012-09-08 10:05 . 2012-09-08 10:05 25600 —-a-w- c:\windows\system32\amxread.dll
2012-09-08 10:05 . 2012-09-08 10:05 14848 —-a-w- c:\windows\system32\apilogen.dll
2012-09-08 10:04 . 2012-09-08 10:04 441856 —-a-w- c:\windows\system32\win32spl.dll
2012-09-08 10:04 . 2012-09-08 10:04 37376 —-a-w- c:\windows\system32\printcom.dll
2012-09-08 10:04 . 2012-09-08 10:04 2031104 —-a-w- c:\windows\system32\win32k.sys
2012-09-08 10:03 . 2012-09-08 10:03 14848 —-a-w- c:\windows\system32\wshrm.dll
2012-09-08 10:03 . 2012-09-08 10:03 113664 —-a-w- c:\windows\system32\drivers\rmcast.sys
2012-09-08 10:02 . 2012-09-08 10:02 8147968 —-a-w- c:\windows\system32\wmploc.DLL
2012-09-08 10:02 . 2012-09-08 10:02 7680 —-a-w- c:\windows\system32\spwmp.dll
2012-09-08 10:02 . 2012-09-08 10:02 4096 —-a-w- c:\windows\system32\msdxm.ocx
2012-09-08 10:02 . 2012-09-08 10:02 4096 —-a-w- c:\windows\system32\dxmasf.dll
2012-09-08 10:02 . 2012-09-08 10:02 168960 —-a-w- c:\program files\Windows Media Player\wmplayer.exe
2012-09-08 10:02 . 2012-09-08 10:02 107520 —-a-w- c:\program files\Windows Media Player\wmpshare.exe
2012-09-08 10:02 . 2012-09-08 10:02 107520 —-a-w- c:\program files\Windows Media Player\wmpconfig.exe
2012-09-08 10:02 . 2012-09-08 10:02 43520 —-a-w- c:\windows\system32\msdxm.tlb
2012-09-08 10:02 . 2012-09-08 10:02 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2012-09-08 10:02 . 2012-09-08 10:02 18432 —-a-w- c:\windows\system32\amcompat.tlb
2012-09-08 10:01 . 2012-09-08 10:01 66048 —-a-w- c:\program files\Windows Sidebar\sbdrop.dll
2012-09-08 10:01 . 2012-09-08 10:01 1232896 —-a-w- c:\program files\Windows Sidebar\sidebar.exe
2012-09-08 10:01 . 2012-09-08 10:01 11776 —-a-w- c:\windows\system32\sbunattend.exe
2012-09-08 10:00 . 2012-09-08 10:00 83968 —-a-w- c:\windows\system32\dnsrslvr.dll
2012-09-08 10:00 . 2012-09-08 10:00 24576 —-a-w- c:\windows\system32\dnscacheugc.exe
2012-09-08 09:56 . 2012-09-08 09:56 622080 —-a-w- c:\windows\system32\icardagt.exe
2012-09-08 09:56 . 2012-09-08 09:56 97800 —-a-w- c:\windows\system32\infocardapi.dll
2012-09-08 09:56 . 2012-09-08 09:56 37384 —-a-w- c:\windows\system32\infocardcpl.cpl
2012-09-08 09:56 . 2012-09-08 09:56 11264 —-a-w- c:\windows\system32\icardres.dll
2012-09-08 09:56 . 2012-09-08 09:56 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2012-09-08 09:56 . 2012-09-08 09:56 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2012-09-08 09:56 . 2012-09-08 09:56 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2012-09-08 09:56 . 2012-09-08 09:56 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2012-09-08 09:35 . 2012-09-08 09:35 96760 —-a-w- c:\windows\system32\dfshim.dll
2012-09-08 09:35 . 2012-09-08 09:35 41984 —-a-w- c:\windows\system32\netfxperf.dll
2012-09-08 09:35 . 2012-09-08 09:35 83968 —-a-w- c:\windows\system32\mscories.dll
2012-09-08 09:35 . 2012-09-08 09:35 282112 —-a-w- c:\windows\system32\mscoree.dll
2012-09-08 09:35 . 2012-09-08 09:35 158720 —-a-w- c:\windows\system32\mscorier.dll
2012-09-08 09:20 . 2012-09-08 09:20 94720 —-a-w- c:\windows\system32\logagent.exe
2012-09-08 09:20 . 2012-09-08 09:20 996352 —-a-w- c:\windows\system32\WMNetMgr.dll
2012-09-08 09:20 . 2012-09-08 09:20 765952 —-a-w- c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
2012-09-08 09:20 . 2012-09-08 09:20 84480 —-a-w- c:\windows\system32\INETRES.dll
2012-09-08 09:20 . 2012-09-08 09:20 737792 —-a-w- c:\windows\system32\inetcomm.dll
2012-09-08 09:19 . 2012-09-08 09:19 60928 —-a-w- c:\windows\system32\msasn1.dll
2012-09-08 09:19 . 2012-09-08 09:19 5120 —-a-w- c:\windows\system32\wmi.dll
2012-09-08 09:19 . 2012-09-08 09:19 152576 —-a-w- c:\windows\system32\imagehlp.dll
2012-09-08 09:19 . 2012-09-08 09:19 12800 —-a-w- c:\windows\system32\drivers\fs_rec.sys
2012-09-08 09:19 . 2012-09-08 09:19 788992 —-a-w- c:\windows\system32\rpcrt4.dll
2012-09-08 09:18 . 2012-09-08 09:18 396800 —-a-w- c:\windows\system32\drivers\http.sys
2012-09-08 09:18 . 2012-09-08 09:18 31232 —-a-w- c:\windows\system32\httpapi.dll
2012-09-08 09:18 . 2012-09-08 09:18 24064 —-a-w- c:\windows\system32\nshhttp.dll
2012-09-08 09:17 . 2012-09-08 09:17 130048 —-a-w- c:\windows\system32\drivers\srv2.sys
2012-09-08 09:17 . 2012-09-08 09:17 274432 —-a-w- c:\windows\system32\raschap.dll
2012-09-08 09:17 . 2012-09-08 09:17 232960 —-a-w- c:\windows\system32\rastls.dll
2012-09-08 09:16 . 2012-09-08 09:16 321536 —-a-w- c:\windows\system32\WSDApi.dll
2012-09-08 09:16 . 2012-09-08 09:16 99840 —-a-w- c:\windows\system32\poqexec.exe
2012-09-08 09:16 . 2012-09-08 09:16 633856 —-a-w- c:\windows\system32\user32.dll
2012-09-08 09:15 . 2012-09-08 09:15 50176 —-a-w- c:\windows\system32\iyuv_32.dll
2012-09-08 09:15 . 2012-09-08 09:15 22528 —-a-w- c:\windows\system32\msyuv.dll
2012-09-08 09:15 . 2012-09-08 09:15 1327616 —-a-w- c:\windows\system32\quartz.dll
2012-09-08 09:15 . 2012-09-08 09:15 11776 —-a-w- c:\windows\system32\tsbyuv.dll
2012-09-08 09:15 . 2012-09-08 09:15 88576 —-a-w- c:\windows\system32\avifil32.dll
2012-09-08 09:15 . 2012-09-08 09:15 82944 —-a-w- c:\windows\system32\mciavi32.dll
2012-09-08 09:15 . 2012-09-08 09:15 65024 —-a-w- c:\windows\system32\avicap32.dll
2012-09-08 09:15 . 2012-09-08 09:15 31232 —-a-w- c:\windows\system32\msvidc32.dll
2012-09-08 09:15 . 2012-09-08 09:15 13312 —-a-w- c:\windows\system32\msrle32.dll
2012-09-08 09:15 . 2012-09-08 09:15 123904 —-a-w- c:\windows\system32\msvfw32.dll
2012-09-08 09:15 . 2012-09-08 09:15 750080 —-a-w- c:\windows\system32\qmgr.dll
2012-09-08 09:15 . 2012-09-08 09:15 604672 —-a-w- c:\windows\system32\WMSPDMOD.DLL
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-08 10:11 . 2012-09-08 10:11 5632 —-a-w- c:\windows\system32\drivers\en-US\sermouse.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 4608 —-a-w- c:\windows\system32\drivers\en-US\mouclass.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 4608 —-a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 3072 —-a-w- c:\windows\system32\drivers\en-US\mouhid.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 3072 —-a-w- c:\windows\system32\drivers\en-US\kbdhid.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 10752 —-a-w- c:\windows\system32\drivers\en-US\i8042prt.sys.mui
2012-09-08 10:05 . 2012-09-08 10:05 40960 —-a-w- c:\windows\apppatch\apihex86.dll
2012-09-08 07:17 . 2012-09-08 07:17 52736 —-a-w- c:\windows\apppatch\iebrshim.dll
2012-09-06 01:27 . 2012-09-09 06:53 266720 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-10-01 12:46 1734240 —-a-w- c:\program files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll" [2012-10-01 1734240]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2012-09-08 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-22 133656]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-02-12 1620480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-02-12 1050112]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-10-01 947808]
"ROC_ROC_NT"="c:\program files\AVG Secure Search\ROC_ROC_NT.exe" [2012-10-01 856160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-9-8 113664]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-18 272528]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2012-9-8 106560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
.
——- Supplementary Scan ——-
.
uStart Page = https://isearch.avg.com/?cid={41F3A34E-99EE…mp;d=2012-10-01 22:46&v;=12.2.5.34&sap;=hp
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yibcvie5.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://search.fantastigames.com/web?src=ffb&appid;=106&systemid;=453&sr;=0&q;=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
HKCU-Run-Ofakagpiif - c:\users\user\AppData\Roaming\Ilow\weux.exe
AddRemove-AVerMedia A310 (MiniCard, DVB-T) - c:\program files\AVerMedia\AVerMedia A310 (MiniCard
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-05 09:05
Windows 6.0.6000 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
———————— Other Running Processes ————————
.
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\progra~1\mcafee\SITEAD~1\mcsacore.exe
c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\conime.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2012-10-05 09:09:20 - machine was rebooted
ComboFix-quarantined-files.txt 2012-10-04 23:09
.
Pre-Run: 78,242,332,672 bytes free
Post-Run: 78,193,881,088 bytes free
.
- - End Of File - - 569E1BAC6745C170DA1D21510EC8FB1E

Hi Jeffce,

I ran the combofix as instructed. My computer seems to be running ok. The redirecting has currently stopped. Does this mean people are no longer accessing my personal info and passwords??

Here are the results:

__________________________________

ComboFix 12-10-04.02 - user 06/10/2012 10:41:34.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3062.2062 [GMT 10:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\user\Desktop\CFScript.txt
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Free Offers from Freeze.com
.
.
((((((((((((((((((((((((( Files Created from 2012-09-06 to 2012-10-06 )))))))))))))))))))))))))))))))
.
.
2012-10-06 00:45 . 2012-10-06 00:45 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-10-01 12:47 . 2012-10-04 22:48 ——– d—–w- c:\programdata\AVG Secure Search
2012-10-01 12:46 . 2012-10-01 12:46 27496 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-10-01 12:46 . 2012-10-01 12:46 ——– d—–w- c:\program files\Common Files\AVG Secure Search
2012-10-01 12:46 . 2012-10-01 12:47 ——– d—–w- c:\program files\AVG Secure Search
2012-10-01 12:46 . 2012-10-01 12:46 ——– d–h–w- c:\programdata\Common Files
2012-10-01 12:38 . 2012-10-01 12:38 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2012-10-01 12:38 . 2012-10-01 12:38 ——– d—–w- c:\program files\DVDVideoSoft
2012-09-30 08:25 . 2012-09-30 08:25 ——– d—–w- c:\program files\ConvertHelper
2012-09-21 08:33 . 2012-09-21 08:33 ——– d—–w- c:\program files\Common Files\McAfee
2012-09-21 08:33 . 2012-09-22 22:22 ——– d—–w- c:\program files\McAfee
2012-09-09 21:49 . 2012-09-09 21:49 ——– d—–w- c:\program files\MSECache
2012-09-09 21:40 . 2012-09-09 21:40 ——– d—–w- c:\programdata\boost_interprocess
2012-09-09 21:36 . 2001-10-28 16:42 45056 —-a-w- c:\windows\system32\unredmon.exe
2012-09-09 21:36 . 2001-10-28 16:42 116224 —-a-w- c:\windows\system32\redmonnt.dll
2012-09-09 21:36 . 2012-09-09 21:42 ——– d—–w- c:\program files\PDFlite
2012-09-09 06:56 . 2012-09-09 06:56 ——– d—–w- c:\programdata\McAfee Security Scan
2012-09-09 06:56 . 2012-09-21 08:33 ——– d—–w- c:\programdata\McAfee
2012-09-09 06:56 . 2012-09-14 07:57 ——– d—–w- c:\program files\McAfee Security Scan
2012-09-09 06:56 . 2012-10-02 05:07 73136 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-09 06:56 . 2012-10-02 05:07 696240 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-09 06:56 . 2012-09-09 06:56 ——– d—–w- c:\windows\system32\Macromed
2012-09-09 06:53 . 2012-09-09 06:53 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-09-08 22:42 . 2012-09-08 21:47 ——– d—–w- c:\windows\Panther
2012-09-08 22:42 . 2012-09-08 22:42 ——– d—–w- C:\Boot
2012-09-08 21:45 . 2012-09-08 10:22 ——– d—–w- c:\windows\Debug
2012-09-08 10:21 . 2012-08-27 15:50 7022536 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{836D23F3-B2B0-4835-AA21-907F4CA7C9EE}\mpengine.dll
2012-09-08 10:21 . 2012-05-31 02:25 237072 ——w- c:\windows\system32\MpSigStub.exe
2012-09-08 10:21 . 2012-09-08 10:21 374456 —-a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2012-09-08 10:20 . 2012-09-08 10:20 268800 —-a-w- c:\windows\system32\es.dll
2012-09-08 10:18 . 2012-09-08 10:18 494592 —-a-w- c:\windows\system32\kerberos.dll
2012-09-08 10:18 . 2012-09-08 10:18 272384 —-a-w- c:\windows\system32\schannel.dll
2012-09-08 10:17 . 2012-09-08 10:17 24064 —-a-w- c:\windows\system32\netcfg.exe
2012-09-08 10:11 . 2012-09-08 10:11 1585664 —-a-w- c:\windows\system32\setupapi.dll
2012-09-08 10:10 . 2012-09-08 10:10 6656 —-a-w- c:\windows\system32\kbd106n.dll
2012-09-08 10:09 . 2012-09-08 10:09 549888 —-a-w- c:\windows\system32\rpcss.dll
2012-09-08 10:09 . 2012-09-08 10:09 654336 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2012-09-08 10:09 . 2012-09-08 10:09 24576 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2012-09-08 10:09 . 2012-09-08 10:09 614912 —-a-w- c:\windows\system32\wbem\fastprox.dll
2012-09-08 10:09 . 2012-09-08 10:09 501760 —-a-w- c:\windows\system32\wbem\WmiPrvSD.dll
2012-09-08 10:09 . 2012-09-08 10:09 247296 —-a-w- c:\windows\system32\wbem\WmiPrvSE.exe
2012-09-08 10:09 . 2012-09-08 10:09 130560 —-a-w- c:\windows\system32\wbem\WmiDcPrv.dll
2012-09-08 10:09 . 2012-09-08 10:09 53248 —-a-w- c:\windows\system32\iasads.dll
2012-09-08 10:09 . 2012-09-08 10:09 37888 —-a-w- c:\windows\system32\iasdatastore.dll
2012-09-08 10:09 . 2012-09-08 10:09 158720 —-a-w- c:\windows\system32\sdohlp.dll
2012-09-08 10:09 . 2012-09-08 10:09 97280 —-a-w- c:\windows\system32\iasrecst.dll
2012-09-08 10:08 . 2012-09-08 10:08 62464 —-a-w- c:\windows\system32\l3codeca.acm
2012-09-08 10:08 . 2012-09-08 10:08 220672 —-a-w- c:\windows\system32\l3codecp.acm
2012-09-08 10:07 . 2012-09-08 10:07 25088 —-a-w- c:\windows\system32\drivers\tunnel.sys
2012-09-08 10:07 . 2012-09-08 10:07 22016 —-a-w- c:\windows\system32\netiougc.exe
2012-09-08 10:07 . 2012-09-08 10:07 179712 —-a-w- c:\windows\system32\iphlpsvc.dll
2012-09-08 10:07 . 2012-09-08 10:07 167424 —-a-w- c:\windows\system32\tcpipcfg.dll
2012-09-08 10:07 . 2012-09-08 10:07 15360 —-a-w- c:\windows\system32\drivers\TUNMP.SYS
2012-09-08 10:07 . 2012-09-08 10:07 815104 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-08 10:06 . 2012-09-08 10:06 454656 —-a-w- c:\program files\Common Files\System\msadc\msadce.dll
2012-09-08 10:06 . 2012-09-08 10:06 9728 —-a-w- c:\windows\system32\LAPRXY.DLL
2012-09-08 10:06 . 2012-09-08 10:06 223232 —-a-w- c:\windows\system32\WMASF.DLL
2012-09-08 10:06 . 2012-09-08 10:06 2048 —-a-w- c:\windows\system32\asferror.dll
2012-09-08 10:05 . 2012-09-08 10:05 25600 —-a-w- c:\windows\system32\amxread.dll
2012-09-08 10:05 . 2012-09-08 10:05 14848 —-a-w- c:\windows\system32\apilogen.dll
2012-09-08 10:04 . 2012-09-08 10:04 441856 —-a-w- c:\windows\system32\win32spl.dll
2012-09-08 10:04 . 2012-09-08 10:04 37376 —-a-w- c:\windows\system32\printcom.dll
2012-09-08 10:04 . 2012-09-08 10:04 2031104 —-a-w- c:\windows\system32\win32k.sys
2012-09-08 10:03 . 2012-09-08 10:03 14848 —-a-w- c:\windows\system32\wshrm.dll
2012-09-08 10:03 . 2012-09-08 10:03 113664 —-a-w- c:\windows\system32\drivers\rmcast.sys
2012-09-08 10:02 . 2012-09-08 10:02 8147968 —-a-w- c:\windows\system32\wmploc.DLL
2012-09-08 10:02 . 2012-09-08 10:02 7680 —-a-w- c:\windows\system32\spwmp.dll
2012-09-08 10:02 . 2012-09-08 10:02 4096 —-a-w- c:\windows\system32\msdxm.ocx
2012-09-08 10:02 . 2012-09-08 10:02 4096 —-a-w- c:\windows\system32\dxmasf.dll
2012-09-08 10:02 . 2012-09-08 10:02 168960 —-a-w- c:\program files\Windows Media Player\wmplayer.exe
2012-09-08 10:02 . 2012-09-08 10:02 107520 —-a-w- c:\program files\Windows Media Player\wmpshare.exe
2012-09-08 10:02 . 2012-09-08 10:02 107520 —-a-w- c:\program files\Windows Media Player\wmpconfig.exe
2012-09-08 10:02 . 2012-09-08 10:02 43520 —-a-w- c:\windows\system32\msdxm.tlb
2012-09-08 10:02 . 2012-09-08 10:02 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2012-09-08 10:02 . 2012-09-08 10:02 18432 —-a-w- c:\windows\system32\amcompat.tlb
2012-09-08 10:01 . 2012-09-08 10:01 66048 —-a-w- c:\program files\Windows Sidebar\sbdrop.dll
2012-09-08 10:01 . 2012-09-08 10:01 1232896 —-a-w- c:\program files\Windows Sidebar\sidebar.exe
2012-09-08 10:01 . 2012-09-08 10:01 11776 —-a-w- c:\windows\system32\sbunattend.exe
2012-09-08 10:00 . 2012-09-08 10:00 83968 —-a-w- c:\windows\system32\dnsrslvr.dll
2012-09-08 10:00 . 2012-09-08 10:00 24576 —-a-w- c:\windows\system32\dnscacheugc.exe
2012-09-08 09:56 . 2012-09-08 09:56 622080 —-a-w- c:\windows\system32\icardagt.exe
2012-09-08 09:56 . 2012-09-08 09:56 97800 —-a-w- c:\windows\system32\infocardapi.dll
2012-09-08 09:56 . 2012-09-08 09:56 37384 —-a-w- c:\windows\system32\infocardcpl.cpl
2012-09-08 09:56 . 2012-09-08 09:56 11264 —-a-w- c:\windows\system32\icardres.dll
2012-09-08 09:56 . 2012-09-08 09:56 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2012-09-08 09:56 . 2012-09-08 09:56 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2012-09-08 09:56 . 2012-09-08 09:56 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2012-09-08 09:56 . 2012-09-08 09:56 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2012-09-08 09:35 . 2012-09-08 09:35 96760 —-a-w- c:\windows\system32\dfshim.dll
2012-09-08 09:35 . 2012-09-08 09:35 41984 —-a-w- c:\windows\system32\netfxperf.dll
2012-09-08 09:35 . 2012-09-08 09:35 83968 —-a-w- c:\windows\system32\mscories.dll
2012-09-08 09:35 . 2012-09-08 09:35 282112 —-a-w- c:\windows\system32\mscoree.dll
2012-09-08 09:35 . 2012-09-08 09:35 158720 —-a-w- c:\windows\system32\mscorier.dll
2012-09-08 09:20 . 2012-09-08 09:20 94720 —-a-w- c:\windows\system32\logagent.exe
2012-09-08 09:20 . 2012-09-08 09:20 996352 —-a-w- c:\windows\system32\WMNetMgr.dll
2012-09-08 09:20 . 2012-09-08 09:20 765952 —-a-w- c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
2012-09-08 09:20 . 2012-09-08 09:20 84480 —-a-w- c:\windows\system32\INETRES.dll
2012-09-08 09:20 . 2012-09-08 09:20 737792 —-a-w- c:\windows\system32\inetcomm.dll
2012-09-08 09:19 . 2012-09-08 09:19 60928 —-a-w- c:\windows\system32\msasn1.dll
2012-09-08 09:19 . 2012-09-08 09:19 5120 —-a-w- c:\windows\system32\wmi.dll
2012-09-08 09:19 . 2012-09-08 09:19 152576 —-a-w- c:\windows\system32\imagehlp.dll
2012-09-08 09:19 . 2012-09-08 09:19 12800 —-a-w- c:\windows\system32\drivers\fs_rec.sys
2012-09-08 09:19 . 2012-09-08 09:19 788992 —-a-w- c:\windows\system32\rpcrt4.dll
2012-09-08 09:18 . 2012-09-08 09:18 396800 —-a-w- c:\windows\system32\drivers\http.sys
2012-09-08 09:18 . 2012-09-08 09:18 31232 —-a-w- c:\windows\system32\httpapi.dll
2012-09-08 09:18 . 2012-09-08 09:18 24064 —-a-w- c:\windows\system32\nshhttp.dll
2012-09-08 09:17 . 2012-09-08 09:17 130048 —-a-w- c:\windows\system32\drivers\srv2.sys
2012-09-08 09:17 . 2012-09-08 09:17 274432 —-a-w- c:\windows\system32\raschap.dll
2012-09-08 09:17 . 2012-09-08 09:17 232960 —-a-w- c:\windows\system32\rastls.dll
2012-09-08 09:16 . 2012-09-08 09:16 321536 —-a-w- c:\windows\system32\WSDApi.dll
2012-09-08 09:16 . 2012-09-08 09:16 99840 —-a-w- c:\windows\system32\poqexec.exe
2012-09-08 09:16 . 2012-09-08 09:16 633856 —-a-w- c:\windows\system32\user32.dll
2012-09-08 09:15 . 2012-09-08 09:15 50176 —-a-w- c:\windows\system32\iyuv_32.dll
2012-09-08 09:15 . 2012-09-08 09:15 22528 —-a-w- c:\windows\system32\msyuv.dll
2012-09-08 09:15 . 2012-09-08 09:15 1327616 —-a-w- c:\windows\system32\quartz.dll
2012-09-08 09:15 . 2012-09-08 09:15 11776 —-a-w- c:\windows\system32\tsbyuv.dll
2012-09-08 09:15 . 2012-09-08 09:15 88576 —-a-w- c:\windows\system32\avifil32.dll
2012-09-08 09:15 . 2012-09-08 09:15 82944 —-a-w- c:\windows\system32\mciavi32.dll
2012-09-08 09:15 . 2012-09-08 09:15 65024 —-a-w- c:\windows\system32\avicap32.dll
2012-09-08 09:15 . 2012-09-08 09:15 31232 —-a-w- c:\windows\system32\msvidc32.dll
2012-09-08 09:15 . 2012-09-08 09:15 13312 —-a-w- c:\windows\system32\msrle32.dll
2012-09-08 09:15 . 2012-09-08 09:15 123904 —-a-w- c:\windows\system32\msvfw32.dll
2012-09-08 09:15 . 2012-09-08 09:15 750080 —-a-w- c:\windows\system32\qmgr.dll
2012-09-08 09:15 . 2012-09-08 09:15 604672 —-a-w- c:\windows\system32\WMSPDMOD.DLL
2012-09-08 07:32 . 2012-09-08 08:34 ——– d—–w- c:\program files\Common Files\Ahead
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-08 10:11 . 2012-09-08 10:11 5632 —-a-w- c:\windows\system32\drivers\en-US\sermouse.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 4608 —-a-w- c:\windows\system32\drivers\en-US\mouclass.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 4608 —-a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 3072 —-a-w- c:\windows\system32\drivers\en-US\mouhid.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 3072 —-a-w- c:\windows\system32\drivers\en-US\kbdhid.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 10752 —-a-w- c:\windows\system32\drivers\en-US\i8042prt.sys.mui
2012-09-08 10:05 . 2012-09-08 10:05 40960 —-a-w- c:\windows\apppatch\apihex86.dll
2012-09-08 07:17 . 2012-09-08 07:17 52736 —-a-w- c:\windows\apppatch\iebrshim.dll
2012-09-06 01:27 . 2012-09-09 06:53 266720 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-10-01 12:46 1734240 —-a-w- c:\program files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll" [2012-10-01 1734240]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2012-09-08 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-22 133656]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-02-12 1620480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-02-12 1050112]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-10-01 947808]
"ROC_ROC_NT"="c:\program files\AVG Secure Search\ROC_ROC_NT.exe" [2012-10-01 856160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-9-8 113664]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-18 272528]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2012-9-8 106560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
.
——- Supplementary Scan ——-
.
uStart Page = https://isearch.avg.com/?cid={41F3A34E-99EE…mp;d=2012-10-01 22:46&v;=12.2.5.34&sap;=hp
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yibcvie5.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-06 10:45
Windows 6.0.6000 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-10-06 10:46:27
ComboFix-quarantined-files.txt 2012-10-06 00:46
ComboFix2.txt 2012-10-04 23:09
.
Pre-Run: 78,191,255,552 bytes free
Post-Run: 77,961,441,280 bytes free
.
- - End Of File - - D51802E9305C9D2A52092ECA774541EF

Here they are jeffce. When the new window popped up after I clicked on the DDS links to access the programs but I noticed the new pop up window title said "bleepingcomputer" something. I think that was the same title the re-directions would have when they redirected me, however I was still allowed to go to the DDS page.


The DDS.txt:
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6000.16982
Run by [removed] at 10:57:41 on 2012-10-07
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3062.1957 [GMT 11:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe
C:\Windows\system32\rundll32.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://isearch.avg.com/?cid={41F3A34E-99EE…mp;d=2012-10-01 22:46:54&v=12.2.5.34&sap=hp
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\12.2.5.34\AVG Secure Search_toolbar.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\12.2.5.34\AVG Secure Search_toolbar.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [SecurDisc] c:\program files\nero\nero 7\incd\NBHGui.exe
mRun: [InCD] c:\program files\nero\nero 7\incd\InCD.exe
mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
mRun: [ROC_ROC_NT] "c:\program files\avg secure search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.207\SSScheduler.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{162C51AE-FA4B-429A-B9EB-7A26A5952B0D} : DhcpNameServer = 192.168.1.1
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\12.2.6\ViProtocol.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\user\appdata\roaming\mozilla\firefox\profiles\yibcvie5.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\program files\common files\avg secure search\sitesafetyinstaller\12.2.6\npsitesafety.dll
FF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_265.dll
.
—- FIREFOX POLICIES —-
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-10-1 27496]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\mcsacore.exe [2012-9-22 95232]
R2 vToolbarUpdater12.2.6;vToolbarUpdater12.2.6;c:\program files\common files\avg secure search\vtoolbarupdater\12.2.6\ToolbarUpdater.exe [2012-10-1 722528]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2006-11-2 167936]
R3 winbondcir;Winbond IR Transceiver;c:\windows\system32\drivers\winbondcir.sys [2007-3-28 43008]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.207\McCHSvc.exe [2011-6-18 237008]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-9-9 114144]
.
=============== Created Last 30 ================
.
2012-10-06 00:46:28 ——– d—–w- c:\users\user\appdata\local\temp
2012-10-06 00:45:47 ——– d-sh–w- C:\$RECYCLE.BIN
2012-10-06 00:39:58 ——– d—–w- C:\ComboFix
2012-10-04 22:42:44 98816 —-a-w- c:\windows\sed.exe
2012-10-04 22:42:44 518144 —-a-w- c:\windows\SWREG.exe
2012-10-04 22:42:44 256000 —-a-w- c:\windows\PEV.exe
2012-10-04 22:42:44 208896 —-a-w- c:\windows\MBR.exe
2012-10-01 12:47:23 ——– d—–w- c:\users\user\appdata\local\AVG Secure Search
2012-10-01 12:47:11 ——– d—–w- c:\programdata\AVG Secure Search
2012-10-01 12:46:53 27496 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-10-01 12:46:51 ——– d—–w- c:\program files\common files\AVG Secure Search
2012-10-01 12:46:50 ——– d—–w- c:\program files\AVG Secure Search
2012-10-01 12:46:30 ——– d–h–w- c:\programdata\Common Files
2012-10-01 12:38:56 ——– d—–w- c:\program files\DVDVideoSoft
2012-10-01 12:38:56 ——– d—–w- c:\program files\common files\DVDVideoSoft
2012-10-01 12:37:46 ——– d—–w- c:\users\user\appdata\roaming\DVDVideoSoft
2012-09-30 08:25:51 ——– d—–w- c:\program files\ConvertHelper
2012-09-30 08:22:35 ——– d—–w- c:\users\user\dwhelper
2012-09-21 08:33:41 ——– d—–w- c:\program files\common files\McAfee
2012-09-21 08:33:37 ——– d—–w- c:\program files\McAfee
2012-09-11 11:23:26 ——– d—–w- c:\users\user\appdata\roaming\Ilow
2012-09-11 11:23:26 ——– d—–w- c:\users\user\appdata\roaming\Duani
2012-09-11 11:23:26 ——– d—–w- c:\users\user\appdata\roaming\Asinxu
2012-09-09 21:49:32 ——– d—–w- c:\program files\MSECache
2012-09-09 21:40:06 ——– d—–w- c:\programdata\boost_interprocess
2012-09-09 21:36:24 45056 —-a-w- c:\windows\system32\unredmon.exe
2012-09-09 21:36:23 116224 —-a-w- c:\windows\system32\redmonnt.dll
2012-09-09 21:36:09 ——– d—–w- c:\program files\PDFlite
2012-09-09 06:57:19 ——– d—–w- c:\users\user\appdata\local\Macromedia
2012-09-09 06:56:59 ——– d—–w- c:\programdata\McAfee Security Scan
2012-09-09 06:56:56 ——– d—–w- c:\program files\McAfee Security Scan
2012-09-09 06:56:54 73136 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-09 06:56:54 696240 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-09 06:54:00 ——– d—–w- c:\users\user\appdata\local\Mozilla
2012-09-08 22:42:33 ——– d—–w- c:\windows\Panther
2012-09-08 22:42:19 ——– d—–w- C:\Boot
2012-09-08 10:21:53 2565432 —-a-w- c:\programdata\microsoft\windows defender\definition updates\backup\mpengine.dll
2012-09-08 10:21:48 7022536 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{836d23f3-b2b0-4835-aa21-907f4ca7c9ee}\mpengine.dll
2012-09-08 10:21:48 237072 ——w- c:\windows\system32\MpSigStub.exe
2012-09-08 10:21:12 374456 —-a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2012-09-08 10:20:22 268800 —-a-w- c:\windows\system32\es.dll
2012-09-08 10:18:11 494592 —-a-w- c:\windows\system32\kerberos.dll
2012-09-08 10:18:09 272384 —-a-w- c:\windows\system32\schannel.dll
2012-09-08 10:17:11 24064 —-a-w- c:\windows\system32\netcfg.exe
2012-09-08 10:11:35 1585664 —-a-w- c:\windows\system32\setupapi.dll
2012-09-08 10:10:59 6656 —-a-w- c:\windows\system32\kbd106n.dll
2012-09-08 10:09:35 549888 —-a-w- c:\windows\system32\rpcss.dll
2012-09-08 10:09:34 654336 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2012-09-08 10:09:34 24576 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2012-09-08 10:09:33 614912 —-a-w- c:\windows\system32\wbem\fastprox.dll
2012-09-08 10:09:33 501760 —-a-w- c:\windows\system32\wbem\WmiPrvSD.dll
2012-09-08 10:09:33 247296 —-a-w- c:\windows\system32\wbem\WmiPrvSE.exe
2012-09-08 10:09:33 130560 —-a-w- c:\windows\system32\wbem\WmiDcPrv.dll
2012-09-08 10:09:32 53248 —-a-w- c:\windows\system32\iasads.dll
2012-09-08 10:09:32 37888 —-a-w- c:\windows\system32\iasdatastore.dll
2012-09-08 10:09:32 158720 —-a-w- c:\windows\system32\sdohlp.dll
2012-09-08 10:09:31 97280 —-a-w- c:\windows\system32\iasrecst.dll
2012-09-08 10:08:46 62464 —-a-w- c:\windows\system32\l3codeca.acm
2012-09-08 10:08:46 220672 —-a-w- c:\windows\system32\l3codecp.acm
2012-09-08 10:07:24 25088 —-a-w- c:\windows\system32\drivers\tunnel.sys
2012-09-08 10:07:24 22016 —-a-w- c:\windows\system32\netiougc.exe
2012-09-08 10:07:24 179712 —-a-w- c:\windows\system32\iphlpsvc.dll
2012-09-08 10:07:24 167424 —-a-w- c:\windows\system32\tcpipcfg.dll
2012-09-08 10:07:24 15360 —-a-w- c:\windows\system32\drivers\TUNMP.SYS
2012-09-08 10:07:23 815104 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-08 10:06:39 454656 —-a-w- c:\program files\common files\system\msadc\msadce.dll
2012-09-08 10:06:02 9728 —-a-w- c:\windows\system32\LAPRXY.DLL
2012-09-08 10:06:02 223232 —-a-w- c:\windows\system32\WMASF.DLL
2012-09-08 10:06:02 2048 —-a-w- c:\windows\system32\asferror.dll
2012-09-08 10:05:27 25600 —-a-w- c:\windows\system32\amxread.dll
2012-09-08 10:05:27 14848 —-a-w- c:\windows\system32\apilogen.dll
2012-09-08 10:04:47 441856 —-a-w- c:\windows\system32\win32spl.dll
2012-09-08 10:04:47 37376 —-a-w- c:\windows\system32\printcom.dll
2012-09-08 10:04:08 2031104 —-a-w- c:\windows\system32\win32k.sys
2012-09-08 10:03:28 14848 —-a-w- c:\windows\system32\wshrm.dll
2012-09-08 10:03:28 113664 —-a-w- c:\windows\system32\drivers\rmcast.sys
2012-09-08 10:02:41 8147968 —-a-w- c:\windows\system32\wmploc.DLL
2012-09-08 10:02:39 7680 —-a-w- c:\windows\system32\spwmp.dll
2012-09-08 10:02:39 4096 —-a-w- c:\windows\system32\msdxm.ocx
2012-09-08 10:02:39 4096 —-a-w- c:\windows\system32\dxmasf.dll
2012-09-08 10:02:39 168960 —-a-w- c:\program files\windows media player\wmplayer.exe
2012-09-08 10:02:39 107520 —-a-w- c:\program files\windows media player\wmpshare.exe
2012-09-08 10:02:39 107520 —-a-w- c:\program files\windows media player\wmpconfig.exe
2012-09-08 10:02:36 43520 —-a-w- c:\windows\system32\msdxm.tlb
2012-09-08 10:02:36 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2012-09-08 10:02:36 18432 —-a-w- c:\windows\system32\amcompat.tlb
2012-09-08 10:01:31 66048 —-a-w- c:\program files\windows sidebar\sbdrop.dll
2012-09-08 10:01:31 1232896 —-a-w- c:\program files\windows sidebar\sidebar.exe
2012-09-08 10:01:31 11776 —-a-w- c:\windows\system32\sbunattend.exe
2012-09-08 10:00:11 83968 —-a-w- c:\windows\system32\dnsrslvr.dll
2012-09-08 10:00:11 24576 —-a-w- c:\windows\system32\dnscacheugc.exe
2012-09-08 09:56:12 622080 —-a-w- c:\windows\system32\icardagt.exe
2012-09-08 09:56:11 97800 —-a-w- c:\windows\system32\infocardapi.dll
2012-09-08 09:56:11 37384 —-a-w- c:\windows\system32\infocardcpl.cpl
2012-09-08 09:56:11 11264 —-a-w- c:\windows\system32\icardres.dll
2012-09-08 09:56:04 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2012-09-08 09:56:03 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2012-09-08 09:56:03 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2012-09-08 09:56:03 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2012-09-08 09:35:48 96760 —-a-w- c:\windows\system32\dfshim.dll
2012-09-08 09:35:47 41984 —-a-w- c:\windows\system32\netfxperf.dll
2012-09-08 09:35:45 83968 —-a-w- c:\windows\system32\mscories.dll
2012-09-08 09:35:45 282112 —-a-w- c:\windows\system32\mscoree.dll
2012-09-08 09:35:45 158720 —-a-w- c:\windows\system32\mscorier.dll
2012-09-08 09:20:53 996352 —-a-w- c:\windows\system32\WMNetMgr.dll
2012-09-08 09:20:53 94720 —-a-w- c:\windows\system32\logagent.exe
2012-09-08 09:20:26 765952 —-a-w- c:\program files\common files\microsoft shared\vgx\VGX.dll
2012-09-08 09:20:15 84480 —-a-w- c:\windows\system32\INETRES.dll
2012-09-08 09:20:15 737792 —-a-w- c:\windows\system32\inetcomm.dll
2012-09-08 09:19:58 60928 —-a-w- c:\windows\system32\msasn1.dll
2012-09-08 09:19:42 5120 —-a-w- c:\windows\system32\wmi.dll
2012-09-08 09:19:42 152576 —-a-w- c:\windows\system32\imagehlp.dll
2012-09-08 09:19:42 12800 —-a-w- c:\windows\system32\drivers\fs_rec.sys
2012-09-08 09:19:28 788992 —-a-w- c:\windows\system32\rpcrt4.dll
2012-09-08 09:18:51 396800 —-a-w- c:\windows\system32\drivers\http.sys
2012-09-08 09:18:51 31232 —-a-w- c:\windows\system32\httpapi.dll
2012-09-08 09:18:51 24064 —-a-w- c:\windows\system32\nshhttp.dll
2012-09-08 09:17:19 130048 —-a-w- c:\windows\system32\drivers\srv2.sys
2012-09-08 09:17:01 274432 —-a-w- c:\windows\system32\raschap.dll
2012-09-08 09:17:01 232960 —-a-w- c:\windows\system32\rastls.dll
2012-09-08 09:16:42 321536 —-a-w- c:\windows\system32\WSDApi.dll
2012-09-08 09:16:30 99840 —-a-w- c:\windows\system32\poqexec.exe
2012-09-08 09:16:24 633856 —-a-w- c:\windows\system32\user32.dll
2012-09-08 09:15:56 50176 —-a-w- c:\windows\system32\iyuv_32.dll
2012-09-08 09:15:56 22528 —-a-w- c:\windows\system32\msyuv.dll
2012-09-08 09:15:56 1327616 —-a-w- c:\windows\system32\quartz.dll
2012-09-08 09:15:56 11776 —-a-w- c:\windows\system32\tsbyuv.dll
2012-09-08 09:15:55 88576 —-a-w- c:\windows\system32\avifil32.dll
2012-09-08 09:15:55 82944 —-a-w- c:\windows\system32\mciavi32.dll
2012-09-08 09:15:55 65024 —-a-w- c:\windows\system32\avicap32.dll
2012-09-08 09:15:55 31232 —-a-w- c:\windows\system32\msvidc32.dll
2012-09-08 09:15:55 13312 —-a-w- c:\windows\system32\msrle32.dll
2012-09-08 09:15:55 123904 —-a-w- c:\windows\system32\msvfw32.dll
2012-09-08 09:15:26 750080 —-a-w- c:\windows\system32\qmgr.dll
2012-09-08 09:15:09 604672 —-a-w- c:\windows\system32\WMSPDMOD.DLL
2012-09-08 08:34:56 ——– d—–w- c:\users\user\appdata\local\Ahead
2012-09-08 07:32:24 ——– d—–w- c:\programdata\Nero
2012-09-08 07:32:24 ——– d—–w- c:\program files\Nero
2012-09-08 07:30:48 ——– d—–w- c:\users\user\appdata\local\ECRSC
2012-09-08 07:30:22 ——– d—–w- c:\users\user\appdata\roaming\ESTsoft
2012-09-08 07:30:13 ——– d—–w- c:\program files\ESTsoft
2012-09-08 07:29:53 225280 —-a-w- c:\program files\common files\installshield\iscript\iscript.dll
2012-09-08 07:29:52 176128 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2012-09-08 07:29:51 77824 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2012-09-08 07:29:51 32768 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2012-09-08 07:29:47 614532 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
2012-09-08 07:18:50 72704 —-a-w- c:\windows\system32\fontsub.dll
2012-09-08 07:18:50 34304 —-a-w- c:\windows\system32\atmlib.dll
2012-09-08 07:18:50 289792 —-a-w- c:\windows\system32\atmfd.dll
2012-09-08 07:18:50 24064 —-a-w- c:\windows\system32\lpk.dll
2012-09-08 07:18:50 156672 —-a-w- c:\windows\system32\t2embed.dll
2012-09-08 07:18:50 10240 —-a-w- c:\windows\system32\dciman32.dll
2012-09-08 07:16:17 920088 —-a-w- c:\windows\system32\igxpun.exe
2012-09-08 07:16:17 319456 —-a-w- c:\windows\system32\difxapi.dll
2012-09-08 07:16:17 ——– d—–w- c:\windows\system32\Lang
2012-09-08 07:16:09 61440 —-a-w- c:\windows\system32\winipsec.dll
2012-09-08 07:16:09 361984 —-a-w- c:\windows\system32\IPSECSVC.DLL
2012-09-08 07:16:09 28672 —-a-w- c:\windows\system32\FwRemoteSvr.dll
2012-09-08 07:16:09 272896 —-a-w- c:\windows\system32\polstore.dll
2012-09-08 07:14:42 95232 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2012-09-08 07:13:32 9728 —-a-w- c:\windows\system32\TCPSVCS.EXE
2012-09-08 07:13:32 8704 —-a-w- c:\windows\system32\HOSTNAME.EXE
2012-09-08 07:13:32 27136 —-a-w- c:\windows\system32\NETSTAT.EXE
2012-09-08 07:13:32 19968 —-a-w- c:\windows\system32\ARP.EXE
2012-09-08 07:13:32 17920 —-a-w- c:\windows\system32\ROUTE.EXE
2012-09-08 07:13:32 15360 —-a-w- c:\windows\system32\netevent.dll
2012-09-08 07:13:32 11264 —-a-w- c:\windows\system32\MRINFO.EXE
2012-09-08 07:13:32 103936 —-a-w- c:\windows\system32\netiohlp.dll
2012-09-08 07:13:32 10240 —-a-w- c:\windows\system32\finger.exe
2012-09-08 07:13:31 213592 —-a-w- c:\windows\system32\drivers\netio.sys
2012-09-08 07:11:31 2048 —-a-w- c:\windows\system32\msxml6r.dll
2012-09-08 07:11:31 2048 —-a-w- c:\windows\system32\msxml3r.dll
2012-09-08 07:11:31 1406464 —-a-w- c:\windows\system32\msxml6.dll
2012-09-08 07:11:31 1260032 —-a-w- c:\windows\system32\msxml3.dll
2012-09-08 07:11:00 7680 —-a-w- c:\windows\system32\lsass.exe
2012-09-08 07:11:00 72704 —-a-w- c:\windows\system32\secur32.dll
2012-09-08 07:11:00 408136 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2012-09-08 07:11:00 216576 —-a-w- c:\windows\system32\msv1_0.dll
2012-09-08 07:11:00 175104 —-a-w- c:\windows\system32\wdigest.dll
2012-09-08 07:11:00 1233920 —-a-w- c:\windows\system32\lsasrv.dll
2012-09-08 07:10:33 58368 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2012-09-08 07:10:33 211968 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-09-08 07:10:33 102400 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-09-08 07:10:13 49664 —-a-w- c:\windows\system32\csrsrv.dll
2012-09-08 07:10:13 376320 —-a-w- c:\windows\system32\winsrv.dll
2012-09-08 07:09:50 98816 —-a-w- c:\windows\system32\mfps.dll
2012-09-08 07:09:50 52736 —-a-w- c:\windows\system32\rrinstaller.exe
2012-09-08 07:09:50 2855424 —-a-w- c:\windows\system32\mf.dll
2012-09-08 07:09:50 24576 —-a-w- c:\windows\system32\mfpmp.exe
2012-09-08 07:09:50 2048 —-a-w- c:\windows\system32\mferror.dll
2012-09-08 07:09:19 3502480 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-09-08 07:09:19 3468168 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-09-08 07:07:55 434176 —-a-w- c:\windows\system32\vbscript.dll
2012-09-08 07:07:31 71680 —-a-w- c:\windows\system32\atl.dll
2012-09-08 07:06:53 297472 —-a-w- c:\windows\system32\gdi32.dll
2012-09-08 07:06:32 41984 —-a-w- c:\windows\system32\drivers\monitor.sys
2012-09-08 07:06:32 1060920 —-a-w- c:\windows\system32\drivers\ntfs.sys
2012-09-08 07:05:36 500736 —-a-w- c:\windows\system32\msdtcprx.dll
2012-09-08 07:05:36 30208 —-a-w- c:\windows\system32\xolehlp.dll
2012-09-08 07:05:15 156160 —-a-w- c:\windows\system32\wkssvc.dll
2012-09-08 07:04:53 36352 —-a-w- c:\windows\system32\tsgqec.dll
2012-09-08 07:04:53 116736 —-a-w- c:\windows\system32\aaclient.dll
2012-09-08 07:04:52 1871872 —-a-w- c:\windows\system32\mstscax.dll
2012-09-08 07:04:23 303616 —-a-w- c:\windows\system32\wmpeffects.dll
2012-09-08 07:04:14 ——– d—–w- c:\windows\Driver Cache
2012-09-08 07:04:13 ——– d—–w- c:\program files\AVerMedia
2012-09-08 07:03:40 414208 —-a-w- c:\windows\system32\msscp.dll
2012-09-08 07:03:23 713728 —-a-w- c:\windows\system32\timedate.cpl
2012-09-08 07:03:01 356864 —-a-w- c:\windows\system32\MediaMetadataHandler.dll
2012-09-08 07:02:44 63488 —-a-w- c:\windows\system32\drivers\mpsdrv.sys
2012-09-08 07:02:44 392192 —-a-w- c:\windows\system32\FirewallAPI.dll
2012-09-08 07:02:43 86016 —-a-w- c:\windows\system32\icfupgd.dll
2012-09-08 07:02:43 61952 —-a-w- c:\windows\system32\cmifw.dll
2012-09-08 07:02:43 396800 —-a-w- c:\windows\system32\MPSSVC.dll
2012-09-08 07:02:43 16896 —-a-w- c:\windows\system32\wfapigp.dll
2012-09-08 07:02:02 23040 —-a-w- c:\program files\movie maker\WMM2EXT.dll
2012-09-08 07:02:02 195072 —-a-w- c:\program files\movie maker\WMM2AE.dll
2012-09-08 07:02:02 150016 —-a-w- c:\program files\movie maker\MOVIEMK.exe
2012-09-08 07:02:02 10922496 —-a-w- c:\program files\movie maker\MOVIEMK.dll
2012-09-08 07:01:03 80896 —-a-w- c:\windows\system32\MSNP.ax
2012-09-08 07:01:03 68608 —-a-w- c:\windows\system32\Mpeg2Data.ax
2012-09-08 07:01:03 57856 —-a-w- c:\windows\system32\MSDvbNP.ax
2012-09-08 07:01:03 428032 —-a-w- c:\windows\system32\EncDec.dll
2012-09-08 07:01:03 292352 —-a-w- c:\windows\system32\psisdecd.dll
2012-09-08 07:01:03 217088 —-a-w- c:\windows\system32\psisrndr.ax
2012-09-08 07:01:03 177152 —-a-w- c:\windows\system32\mpg2splt.ax
2012-09-08 07:01:03 1244672 —-a-w- c:\windows\system32\mcmde.dll
2012-09-08 06:59:26 2048 —-a-w- c:\windows\system32\tzres.dll
2012-09-08 06:58:51 696832 —-a-w- c:\windows\system32\localspl.dll
2012-09-08 06:58:01 45112 —-a-w- c:\windows\system32\drivers\pciidex.sys
2012-09-08 06:58:01 25656 —-a-w- c:\windows\system32\drivers\msahci.sys
2012-09-08 06:58:01 21560 —-a-w- c:\windows\system32\drivers\atapi.sys
2012-09-08 06:58:01 211000 —-a-w- c:\windows\system32\drivers\volsnap.sys
2012-09-08 06:58:01 17464 —-a-w- c:\windows\system32\drivers\intelide.sys
2012-09-08 06:58:01 154624 —-a-w- c:\windows\system32\drivers\nwifi.sys
2012-09-08 06:58:01 109624 —-a-w- c:\windows\system32\drivers\ataport.sys
2012-09-08 06:57:51 104448 —-a-w- c:\windows\system32\DWWIN.EXE
2012-09-08 06:57:34 ——– d—–w- c:\program files\Synaptics
2012-09-08 06:57:27 2923520 —-a-w- c:\windows\explorer.exe
2012-09-08 06:56:42 97792 —-a-w- c:\windows\system32\cabview.dll
2012-09-08 06:56:19 171520 —-a-w- c:\windows\system32\wintrust.dll
2012-09-08 06:52:01 ——– d—–w- C:\Intel
2012-09-08 06:08:43 ——– d—–w- c:\program files\CONEXANT
2012-09-08 05:36:07 33104 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll
2012-09-08 05:36:07 32592 —-a-w- c:\windows\system32\msonpmon.dll
2012-09-08 05:34:32 ——– d—–w- c:\windows\PCHEALTH
2012-09-08 05:33:22 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-09-08 05:32:45 ——– d—–w- c:\users\user\appdata\local\Microsoft Help
2012-09-08 05:29:51 306688 —-a-w- c:\windows\IsUninst.exe
2012-09-08 05:29:17 ——– d—–w- c:\program files\GRETECH
2012-09-08 05:26:29 ——– d—–w- c:\program files\DVD Region-Free
2012-09-08 05:26:26 ——– d—–w- c:\users\user\appdata\local\Adobe
2012-09-08 05:26:20 ——– d—–w- c:\program files\StarCodec
2012-09-08 05:25:30 ——– d-sh–w- c:\windows\Installer
.
==================== Find3M ====================
.
2012-09-08 10:11:05 5632 —-a-w- c:\windows\system32\drivers\en-us\sermouse.sys.mui
2012-09-08 10:10:59 558080 —-a-w- c:\windows\system32\oleaut32.dll
2012-09-08 10:05:27 40960 —-a-w- c:\windows\apppatch\apihex86.dll
2012-09-08 07:17:52 72704 —-a-w- c:\windows\system32\admparse.dll
2012-09-08 07:17:52 52736 —-a-w- c:\windows\apppatch\iebrshim.dll
2012-09-08 07:17:51 832512 —-a-w- c:\windows\system32\wininet.dll
2012-09-08 07:17:49 389120 —-a-w- c:\windows\system32\html.iec
2012-09-08 07:17:48 78336 —-a-w- c:\windows\system32\ieencode.dll
2012-09-08 07:17:48 48128 —-a-w- c:\windows\system32\mshtmler.dll
2012-09-08 07:17:47 1383424 —-a-w- c:\windows\system32\mshtml.tlb
2012-09-08 07:17:46 1830912 —-a-w- c:\windows\system32\inetcpl.cpl
2012-09-08 07:17:44 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2012-09-08 07:17:43 56320 —-a-w- c:\windows\system32\iesetup.dll
2012-09-08 07:14:42 241152 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2012-09-08 07:14:42 160768 —-a-w- c:\windows\system32\PortableDeviceTypes.dll
2012-09-08 07:14:17 87040 —-a-w- c:\windows\system32\msoert2.dll
2012-09-08 07:14:17 39424 —-a-w- c:\windows\system32\ACCTRES.dll
2012-09-08 07:14:17 205824 —-a-w- c:\windows\system32\msoeacct.dll
2012-09-08 07:08:18 376832 —-a-w- c:\windows\system32\winhttp.dll
.
============= FINISH: 10:58:11.92 ===============


________________________________________________________________________________
_

Here is the Attach.txt:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 9/09/2012 7:47:03 AM
System Uptime: 7/10/2012 9:31:38 AM (1 hours ago)
.
Motherboard: Acer, Inc. | | Chapala
Processor: Intel® Core™2 Duo CPU T7500 @ 2.20GHz | U2E1 | 2200/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 111 GiB total, 74.879 GiB free.
D: is FIXED (NTFS) - 108 GiB total, 103.043 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP34: 28/09/2012 12:01:33 PM - Scheduled Checkpoint
RP35: 30/09/2012 12:09:37 AM - Scheduled Checkpoint
RP36: 30/09/2012 2:03:19 PM - Scheduled Checkpoint
RP37: 1/10/2012 5:53:13 PM - Scheduled Checkpoint
RP38: 4/10/2012 5:30:52 PM - OTL Restore Point - 4/10/2012 5:30:52 PM
RP39: 5/10/2012 9:35:10 AM - Scheduled Checkpoint
RP40: 6/10/2012 10:40:22 AM - ComboFix created restore point
.
==== Installed Programs ======================
.
Acrobat.com
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Photoshop 7.0
Adobe Reader 9
AVG Security Toolbar
ConvertHelper 2.2
DVD Region-Free 3.20
Free YouTube Uploader version 3.3.36.903
HDAUDIO Soft Data Fax Modem with SmartCP
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel® Graphics Media Accelerator Driver
McAfee Security Scan Plus
McAfee SiteAdvisor
Microsoft .NET Framework 3.5 SP1
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox 15.0.1 (x86 en-US)
Mozilla Maintenance Service
Nero 7 Essentials
PowerDVD
RedMon - Redirection Port Monitor
StarCodec
WinZip
.
==== Event Viewer Messages From Past Week ========
.
6/10/2012 3:02:40 PM, Error: EventLog [6008] - The previous system shutdown at 3:01:22 PM on 10/6/2012 was unexpected.
6/10/2012 12:27:52 PM, Error: PlugPlayManager [12] - The device 'Ricoh xD-Picture Card Controller' (PCI\VEN_1180&DEV_0852&SUBSYS_01211025&REV_12\4&1549efe7&0&4BF0) disappeared from the system without first being prepared for removal.
6/10/2012 12:27:52 PM, Error: PlugPlayManager [12] - The device 'Ricoh Memory Stick Controller' (PCI\VEN_1180&DEV_0592&SUBSYS_01211025&REV_12\4&1549efe7&0&4AF0) disappeared from the system without first being prepared for removal.
6/10/2012 10:13:20 AM, Error: EventLog [6008] - The previous system shutdown at 11:18:47 PM on 10/5/2012 was unexpected.
5/10/2012 8:59:03 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
5/10/2012 8:58:07 AM, Error: Service Control Manager [7034] - The XAudioService service terminated unexpectedly. It has done this 1 time(s).
5/10/2012 8:57:59 AM, Error: Service Control Manager [7034] - The McAfee SiteAdvisor Service service terminated unexpectedly. It has done this 1 time(s).
4/10/2012 1:18:00 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 001E68450609 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
30/09/2012 9:50:15 PM, Error: PlugPlayManager [12] - The device 'Ricoh xD-Picture Card Controller' (PCI\VEN_1180&DEV_0852&SUBSYS_01211025&REV_12\4&1549efe7&0&4CF0) disappeared from the system without first being prepared for removal.
30/09/2012 9:50:15 PM, Error: PlugPlayManager [12] - The device 'Ricoh Memory Stick Controller' (PCI\VEN_1180&DEV_0592&SUBSYS_01211025&REV_12\4&1549efe7&0&4BF0) disappeared from the system without first being prepared for removal.
30/09/2012 9:48:45 PM, Error: PlugPlayManager [12] - The device 'Ricoh SD/MMC Host Controller' (PCI\VEN_1180&DEV_0843&SUBSYS_01211025&REV_12\4&1549efe7&0&4AF0) disappeared from the system without first being prepared for removal.
30/09/2012 9:28:08 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
30/09/2012 9:28:08 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
30/09/2012 9:28:08 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
30/09/2012 9:28:08 AM, Error: Service Control Manager [7000] - The rimmptsk service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
30/09/2012 9:28:08 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
30/09/2012 3:17:45 PM, Error: Schannel [36874] - An SSL connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
30/09/2012 3:07:26 PM, Error: EventLog [6008] - The previous system shutdown at 3:03:24 PM on 9/30/2012 was unexpected.
1/10/2012 10:28:06 PM, Error: Service Control Manager [7034] - The ALYac RealTime Service service terminated unexpectedly. It has done this 1 time(s).
.
==== End Of File ===========================

jeffce,

here is my report


______________________________________________________________________


ComboFix 12-10-08.03 - user 09/10/2012 19:52:15.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3062.1848 [GMT 11:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\user\Desktop\CFScript.txt
.
FILE ::
"c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yibcvie5.default\user.js"
"c:\users\user\Downloads\FreeYouTubeUploader.exe"
"d:\non law\EVERYT\LION\New Folder\New Folder (2)\New Folder (4)\AdwarePro_Setup.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yibcvie5.default\user.js
c:\users\user\Downloads\FreeYouTubeUploader.exe
d:\non law\EVERYT\LION\New Folder\New Folder (2)\New Folder (4)\AdwarePro_Setup.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-09-09 to 2012-10-09 )))))))))))))))))))))))))))))))
.
.
2012-10-09 08:56 . 2012-10-09 08:56 ——– d—–w- c:\users\user\AppData\Local\temp
2012-10-09 08:56 . 2012-10-09 08:56 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-10-07 06:18 . 2012-10-07 06:18 ——– d—–w- c:\program files\ESET
2012-10-07 06:06 . 2012-10-07 06:06 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-10-07 06:06 . 2012-09-07 06:04 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-10-07 05:46 . 2012-10-07 05:46 ——– d—–w- c:\users\user\AppData\Roaming\Malwarebytes
2012-10-07 05:46 . 2012-10-07 05:46 ——– d—–w- c:\programdata\Malwarebytes
2012-10-01 12:47 . 2012-10-01 12:47 ——– d—–w- c:\users\user\AppData\Local\AVG Secure Search
2012-10-01 12:47 . 2012-10-04 22:48 ——– d—–w- c:\programdata\AVG Secure Search
2012-10-01 12:46 . 2012-10-01 12:46 27496 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-10-01 12:46 . 2012-10-01 12:46 ——– d—–w- c:\program files\Common Files\AVG Secure Search
2012-10-01 12:46 . 2012-10-01 12:47 ——– d—–w- c:\program files\AVG Secure Search
2012-10-01 12:46 . 2012-10-01 12:46 ——– d–h–w- c:\programdata\Common Files
2012-10-01 12:38 . 2012-10-01 12:38 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2012-10-01 12:38 . 2012-10-01 12:38 ——– d—–w- c:\program files\DVDVideoSoft
2012-10-01 12:37 . 2012-10-01 12:39 ——– d—–w- c:\users\user\AppData\Roaming\DVDVideoSoft
2012-09-30 08:25 . 2012-09-30 08:25 ——– d—–w- c:\program files\ConvertHelper
2012-09-30 08:22 . 2012-10-01 03:09 ——– d—–w- c:\users\user\dwhelper
2012-09-21 08:33 . 2012-09-21 08:33 ——– d—–w- c:\program files\Common Files\McAfee
2012-09-21 08:33 . 2012-09-22 22:22 ——– d—–w- c:\program files\McAfee
2012-09-11 11:23 . 2012-09-17 22:29 ——– d—–w- c:\users\user\AppData\Roaming\Duani
2012-09-11 11:23 . 2012-09-17 22:08 ——– d—–w- c:\users\user\AppData\Roaming\Ilow
2012-09-11 11:23 . 2012-09-11 11:23 ——– d—–w- c:\users\user\AppData\Roaming\Asinxu
2012-09-09 21:49 . 2012-09-09 21:49 ——– d—–w- c:\program files\MSECache
2012-09-09 21:40 . 2012-09-09 21:40 ——– d—–w- c:\programdata\boost_interprocess
2012-09-09 21:36 . 2001-10-28 16:42 45056 —-a-w- c:\windows\system32\unredmon.exe
2012-09-09 21:36 . 2001-10-28 16:42 116224 —-a-w- c:\windows\system32\redmonnt.dll
2012-09-09 21:36 . 2012-09-09 21:42 ——– d—–w- c:\program files\PDFlite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-02 05:07 . 2012-09-09 06:56 73136 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-02 05:07 . 2012-09-09 06:56 696240 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-08 10:21 . 2012-09-08 10:21 374456 —-a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2012-09-08 10:20 . 2012-09-08 10:20 268800 —-a-w- c:\windows\system32\es.dll
2012-09-08 10:18 . 2012-09-08 10:18 494592 —-a-w- c:\windows\system32\kerberos.dll
2012-09-08 10:18 . 2012-09-08 10:18 272384 —-a-w- c:\windows\system32\schannel.dll
2012-09-08 10:17 . 2012-09-08 10:17 24064 —-a-w- c:\windows\system32\netcfg.exe
2012-09-08 10:15 . 2012-09-08 10:15 1808896 —-a-w- c:\windows\system32\NlsLexicons0046.dll
2012-09-08 10:15 . 2012-09-08 10:15 1793536 —-a-w- c:\windows\system32\NlsLexicons0045.dll
2012-09-08 10:15 . 2012-09-08 10:15 1558016 —-a-w- c:\windows\system32\NlsLexicons0049.dll
2012-09-08 10:15 . 2012-09-08 10:15 1411072 —-a-w- c:\windows\system32\NlsLexicons0047.dll
2012-09-08 10:15 . 2012-09-08 10:15 1236992 —-a-w- c:\windows\system32\NlsLexicons0020.dll
2012-09-08 10:15 . 2012-09-08 10:15 1782272 —-a-w- c:\windows\system32\NlsLexicons0039.dll
2012-09-08 10:15 . 2012-09-08 10:15 5499904 —-a-w- c:\windows\system32\NlsLexicons0022.dll
2012-09-08 10:15 . 2012-09-08 10:15 2136064 —-a-w- c:\windows\system32\NlsLexicons0021.dll
2012-09-08 10:15 . 2012-09-08 10:15 7964672 —-a-w- c:\windows\system32\NlsLexicons0024.dll
2012-09-08 10:15 . 2012-09-08 10:15 6224896 —-a-w- c:\windows\system32\NlsLexicons0027.dll
2012-09-08 10:15 . 2012-09-08 10:15 5791232 —-a-w- c:\windows\system32\NlsLexicons0026.dll
2012-09-08 10:15 . 2012-09-08 10:15 4981248 —-a-w- c:\windows\system32\NlsLexicons0013.dll
2012-09-08 10:15 . 2012-09-08 10:15 4175872 —-a-w- c:\windows\system32\NlsLexicons0010.dll
2012-09-08 10:15 . 2012-09-08 10:15 2466816 —-a-w- c:\windows\system32\NlsLexicons0011.dll
2012-09-08 10:15 . 2012-09-08 10:15 6781440 —-a-w- c:\windows\system32\NlsLexicons0019.dll
2012-09-08 10:15 . 2012-09-08 10:15 3331072 —-a-w- c:\windows\system32\NlsLexicons0018.dll
2012-09-08 10:15 . 2012-09-08 10:15 4164096 —-a-w- c:\windows\system32\NlsLexicons0002.dll
2012-09-08 10:15 . 2012-09-08 10:15 11722752 —-a-w- c:\windows\system32\NlsLexicons0001.dll
2012-09-08 10:15 . 2012-09-08 10:15 1452544 —-a-w- c:\windows\system32\NlsLexicons0003.dll
2012-09-08 10:15 . 2012-09-08 10:15 2644480 —-a-w- c:\windows\system32\NlsLexicons0009.dll
2012-09-08 10:15 . 2012-09-08 10:15 12240896 —-a-w- c:\windows\system32\NlsLexicons0007.dll
2012-09-08 10:15 . 2012-09-08 10:15 4093440 —-a-w- c:\windows\system32\NlsLexicons004c.dll
2012-09-08 10:15 . 2012-09-08 10:15 3419136 —-a-w- c:\windows\system32\NlsLexicons004a.dll
2012-09-08 10:15 . 2012-09-08 10:15 1702912 —-a-w- c:\windows\system32\NlsLexicons004b.dll
2012-09-08 10:15 . 2012-09-08 10:15 4096 —-a-w- c:\windows\system32\NlsLexicons002a.dll
2012-09-08 10:15 . 2012-09-08 10:15 4045824 —-a-w- c:\windows\system32\NlsLexicons003e.dll
2012-09-08 10:15 . 2012-09-08 10:15 1972736 —-a-w- c:\windows\system32\NlsLexicons004e.dll
2012-09-08 10:15 . 2012-09-08 10:15 6014976 —-a-w- c:\windows\system32\NlsLexicons001a.dll
2012-09-08 10:15 . 2012-09-08 10:15 6585856 —-a-w- c:\windows\system32\NlsLexicons001b.dll
2012-09-08 10:15 . 2012-09-08 10:15 6346240 —-a-w- c:\windows\system32\NlsLexicons001d.dll
2012-09-08 10:15 . 2012-09-08 10:15 9892864 —-a-w- c:\windows\system32\NlsLexicons000a.dll
2012-09-08 10:15 . 2012-09-08 10:15 6237696 —-a-w- c:\windows\system32\NlsLexicons000c.dll
2012-09-08 10:15 . 2012-09-08 10:15 5654528 —-a-w- c:\windows\system32\NlsLexicons000f.dll
2012-09-08 10:15 . 2012-09-08 10:15 1722368 —-a-w- c:\windows\system32\NlsLexicons000d.dll
2012-09-08 10:15 . 2012-09-08 10:15 4616192 —-a-w- c:\windows\system32\NlsLexicons0414.dll
2012-09-08 10:15 . 2012-09-08 10:15 5090816 —-a-w- c:\windows\system32\NlsLexicons0416.dll
2012-09-08 10:15 . 2012-09-08 10:15 5031936 —-a-w- c:\windows\system32\NlsLexicons0816.dll
2012-09-08 10:15 . 2012-09-08 10:15 7042560 —-a-w- c:\windows\system32\NlsLexicons081a.dll
2012-09-08 10:15 . 2012-09-08 10:15 5071872 —-a-w- c:\windows\system32\NlsModels0011.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData0045.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData0046.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData0049.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData0047.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData0039.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData0020.dll
2012-09-08 10:15 . 2012-09-08 10:15 1799168 —-a-w- c:\windows\system32\NlsData0022.dll
2012-09-08 10:15 . 2012-09-08 10:15 1799168 —-a-w- c:\windows\system32\NlsData0021.dll
2012-09-08 10:15 . 2012-09-08 10:15 1965056 —-a-w- c:\windows\system32\NlsData0027.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData0026.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData0024.dll
2012-09-08 10:15 . 2012-09-08 10:15 4493312 —-a-w- c:\windows\system32\NlsData0010.dll
2012-09-08 10:15 . 2012-09-08 10:15 3464704 —-a-w- c:\windows\system32\NlsData0013.dll
2012-09-08 10:15 . 2012-09-08 10:15 2655232 —-a-w- c:\windows\system32\NlsData0011.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData0018.dll
2012-09-08 10:15 . 2012-09-08 10:15 4495360 —-a-w- c:\windows\system32\NlsData0019.dll
2012-09-08 10:15 . 2012-09-08 10:15 2597888 —-a-w- c:\windows\system32\NlsData0001.dll
2012-09-08 10:15 . 2012-09-08 10:15 1523200 —-a-w- c:\windows\system32\NlsData0000.dll
2012-09-08 10:15 . 2012-09-08 10:15 2241024 —-a-w- c:\windows\system32\NlsData0007.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData0003.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData0002.dll
2012-09-08 10:15 . 2012-09-08 10:15 4874240 —-a-w- c:\windows\system32\NlsData0009.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData004c.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData004b.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData004a.dll
2012-09-08 10:15 . 2012-09-08 10:15 3102720 —-a-w- c:\windows\system32\NlsData004e.dll
2012-09-08 10:15 . 2012-09-08 10:15 1799168 —-a-w- c:\windows\system32\NlsData003e.dll
2012-09-08 10:15 . 2012-09-08 10:15 1799168 —-a-w- c:\windows\system32\NlsData002a.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData001a.dll
2012-09-08 10:15 . 2012-09-08 10:15 4493312 —-a-w- c:\windows\system32\NlsData001d.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData001b.dll
2012-09-08 10:15 . 2012-09-08 10:15 9845248 —-a-w- c:\windows\system32\NlsData000a.dll
2012-09-08 10:15 . 2012-09-08 10:15 2641408 —-a-w- c:\windows\system32\NlsData000c.dll
2012-09-08 10:15 . 2012-09-08 10:15 2340864 —-a-w- c:\windows\system32\NlsData000d.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData000f.dll
2012-09-08 10:15 . 2012-09-08 10:15 797696 —-a-w- c:\windows\system32\NaturalLanguage6.dll
2012-09-08 10:15 . 2012-09-08 10:15 4493312 —-a-w- c:\windows\system32\NlsData0416.dll
2012-09-08 10:15 . 2012-09-08 10:15 4493312 —-a-w- c:\windows\system32\NlsData0414.dll
2012-09-08 10:15 . 2012-09-08 10:15 4493312 —-a-w- c:\windows\system32\NlsData0816.dll
2012-09-08 10:15 . 2012-09-08 10:15 6917120 —-a-w- c:\windows\system32\NlsLexicons0c1a.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData0c1a.dll
2012-09-08 10:15 . 2012-09-08 10:15 1963520 —-a-w- c:\windows\system32\NlsData081a.dll
2012-09-08 10:11 . 2012-09-08 10:11 1585664 —-a-w- c:\windows\system32\setupapi.dll
2012-09-08 10:11 . 2012-09-08 10:11 5632 —-a-w- c:\windows\system32\drivers\en-US\sermouse.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 4608 —-a-w- c:\windows\system32\drivers\en-US\mouclass.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 4608 —-a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 3072 —-a-w- c:\windows\system32\drivers\en-US\mouhid.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 3072 —-a-w- c:\windows\system32\drivers\en-US\kbdhid.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 10752 —-a-w- c:\windows\system32\drivers\en-US\i8042prt.sys.mui
2012-09-08 10:11 . 2012-09-08 10:11 40960 —-a-w- c:\windows\system32\srclient.dll
2012-09-08 10:11 . 2012-09-08 10:11 371712 —-a-w- c:\windows\system32\srcore.dll
2012-09-08 10:11 . 2012-09-08 10:11 313856 —-a-w- c:\windows\system32\rstrui.exe
2012-09-08 10:11 . 2012-09-08 10:11 16384 —-a-w- c:\windows\system32\srdelayed.exe
2012-09-08 10:11 . 2012-09-08 10:11 613888 —-a-w- c:\windows\system32\wpd_ci.dll
2012-09-06 01:27 . 2012-09-09 06:53 266720 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-10-01 12:46 1734240 —-a-w- c:\program files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll" [2012-10-01 1734240]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2012-09-08 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-22 133656]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-02-12 1620480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-02-12 1050112]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-10-01 947808]
"ROC_ROC_NT"="c:\program files\AVG Secure Search\ROC_ROC_NT.exe" [2012-10-01 856160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-9-8 113664]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-18 272528]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2012-9-8 106560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
.
——- Supplementary Scan ——-
.
uStart Page = https://isearch.avg.com/?cid={41F3A34E-99EE…mp;d=2012-10-01 22:46&v;=12.2.5.34&sap;=hp
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yibcvie5.default\
FF - prefs.js: browser.startup.homepage - www.google.com
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-09 19:56
Windows 6.0.6000 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-10-09 19:57:29
ComboFix-quarantined-files.txt 2012-10-09 08:57
ComboFix2.txt 2012-10-06 00:46
ComboFix3.txt 2012-10-04 23:09
.
Pre-Run: 78,918,430,720 bytes free
Post-Run: 78,896,488,448 bytes free
.
- - End Of File - - B64099A7B9C9C81BA21072C84A5F61B4