Spyware / Malware / Virus Removal

logfile

18 min read

Looking for the outcome? Ask AI

PatRick B Topic Starter

Post #1December 17, 2006, 10:04 PM UTC

HI,
This is my first time posting anywhere so I hope I'm doing this right.
Here is my logfile

Logfile of HijackThis v1.99.1
Scan saved at 3:29:00 PM, on 12/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\dlcqcoms.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe
C:\Program Files\Dell Photo AIO Printer 966\memcard.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\iexplore.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Morpheus\Morpheus.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Patrick Boyle\Desktop\hijackthis\HijackThis.exe
C:\Program Files\Common Files\Real\Update_OB\rndal.exe
C:\Program Files\Common Files\Real\Update_OB\rndal.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {B9D0C4C5-0B72-05F1-76F6-7045077A7393} - C:\WINDOWS\system32\trla.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [uwctnew] c:\windows\system32\uifzwhz.exe
O4 - HKLM\..\Run: [mlbaeu] c:\windows\system32\diqtygq.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [dlcqmon.exe] "C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 966\memcard.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Dell PC Fax\fm3032.exe" /s
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Explorer] C:\WINDOWS\iexplore.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Startup: Morpheus.lnk = C:\Program Files\Morpheus\Morpheus.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk.disabled
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: dlcq_device - - C:\WINDOWS\system32\dlcqcoms.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

My main problem is I have IE pages opening seemingly at random ( I use Firefox). It started when I installed a new Dell Printer. I ended up getting the driver on line as the disc wouldn't play
Ever since, when i open my desk top or anybody elses (shared puter, family of 5) office 2000 tries to install,
asks for the disc which I don't have since I have a newer version. I cancel all the download dialog boxes
then rightaway an IE popunder opens, sometimes 2 or 3.
I have AVG Free, Ad-aware SE, Spybot S&D, & hijackthis, all are up to date.
I found out about this forum when I updated My HJT

Can anyone help me?
Thanks in advance
Patrick

OldTimer

Post #2December 17, 2006, 11:54 PM UTC

Hi PatRick B and welcome to the TC HijackThis forum. I'd like to try a different scanner on this that we are testing to see if there are any additional files involved with this.

Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
- In the Files Created Within group click 30 days
- In the Files Modified Within group select 30 days
- In the File String Search group select Non-Microsoft
Now click the Run Scan button on the toolbar.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and Copy/Paste the information back here. I will review it when it comes in.

Cheers.

OT

PatRick B

Post #3December 18, 2006, 4:32 AM UTC

WinPFind3 logfile created on: 12/17/2006 10:09:57 PM
WinPFind3U by OldTimer - Pre-Release 1i Folder = C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 6.0.2900.2180)

[Processes - Non-Microsoft Only]
avgamsvr.exe -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgcc.exe -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgemc.exe -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgupsvc.exe -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
ctsvccda.exe -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
damon.exe -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
devldr32.exe -> C:\WINDOWS\SYSTEM32\devldr32.exe -> Creative Technology Ltd. [Ver = 1, 0, 0, 22 | Size = 25600 bytes | Modified Date = 8/31/2001 12:44:30 PM | Attr = ]
dlcqcoms.exe -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
easyshare.exe -> C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe -> [Ver = 5, 0, 25, 230 | Size = 151552 bytes | Modified Date = 7/22/2005 3:47:22 AM | Attr = ]
evntsvc.exe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
ezsp_px.exe -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
firefox.exe -> C:\Program Files\Mozilla Firefox\firefox.exe -> Mozilla [Ver = 1.0.7 | Size = 6637156 bytes | Modified Date = 9/15/2005 6:26:00 PM | Attr = ]
googletoolbarnotifier.exe -> C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe -> Google Inc. [Ver = 1, 2, 908, 5008 | Size = 163576 bytes | Modified Date = 10/27/2006 9:41:44 PM | Attr = ]
iexplore.exe -> C:\WINDOWS\iexplore.exe -> Windows XP [Ver = 3.00 | Size = 199900 bytes | Modified Date = 12/5/2006 1:04:52 PM | Attr = ]
ipodservice.exe -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
ituneshelper.exe -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
jusched.exe -> C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 49263 bytes | Modified Date = 10/12/2006 3:10:54 AM | Attr = ]
kodak software updater.exe -> C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe -> [Ver = | Size = 16423 bytes | Modified Date = 2/13/2004 2:12:08 PM | Attr = ]
mediadetect.exe -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
memcard.exe -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
mm_tray.exe -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
morpheus.exe -> C:\Program Files\Morpheus\Morpheus.exe -> Streamcast Networks, Inc [Ver = 1.0.0.1 | Size = 721408 bytes | Modified Date = 9/12/2006 1:17:26 PM | Attr = ]
nvsvc32.exe -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
qttask.exe -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
sagent2.exe -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
viewmgr.exe -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
winpfind3u.exe -> C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\WinPFind3U.exe -> File not found
wkufind.exe -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
ymsgr_tray.exe -> C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe -> Yahoo! Inc. [Ver = 8,1,0,0 | Size = 103928 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(Avg7Alrt) AVG7 Alert Manager Server [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Avg7UpdSvc) AVG7 Update Service [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
(AVGEMS) AVG E-mail Scanner [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Creative Service for CDROM Access) Creative Service for CDROM Access [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
(dlcq_device) dlcq_device [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 1:56:48 AM | Attr = ]
(EPSONStatusAgent2) EPSON Printer Status Agent2 [Win32_Own | Auto | Running] -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
(KodakCCS) Kodak Camera Connection Software [Win32_Own | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe -> Eastman Kodak Company [Ver = 1.1.5100.4 | Size = 411920 bytes | Modified Date = 3/30/2005 4:46:56 PM | Attr = ]
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
(PACSPTISVR) PACSPTISVR [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 53337 bytes | Modified Date = 5/27/2004 1:14:58 AM | Attr = ]
(SPTISRV) Sony SPTI Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 69718 bytes | Modified Date = 5/27/2004 1:13:00 AM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_CC -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
Corel Photo Downloader -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
Dell|Alert -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
DLCQCATS -> C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\dlcqtime.dll [rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16] -> [Ver = 1.20.0.0 | Size = 106496 bytes | Modified Date = 6/7/2006 12:17:18 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
Explorer -> C:\WINDOWS\iexplore.exe -> Windows XP [Ver = 3.00 | Size = 199900 bytes | Modified Date = 12/5/2006 1:04:52 PM | Attr = ]
ezShieldProtector for Px -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
FaxCenterServer -> C:\Program Files\Dell PC Fax\fm3032.exe -> [Ver = 0.1.35.8 | Size = 307200 bytes | Modified Date = 6/15/2006 4:03:30 AM | Attr = ]
ISUSPM Startup -> C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 249856 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
ISUSScheduler -> C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 81920 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
iTunesHelper -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
MemoryCardManager -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
Microsoft Works Update Detection -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
mlbaeu -> c:\windows\system32\diqtygq.exe -> File not found
MMTray -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
NvCplDaemon -> C:\WINDOWS\SYSTEM32\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 5058560 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
QuickTime Task -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
SunJavaUpdateSched -> C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 49263 bytes | Modified Date = 10/12/2006 3:10:54 AM | Attr = ]
TkBellExe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
uwctnew -> c:\windows\system32\uifzwhz.exe -> File not found
ViewMgr -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
< RunOnceEx [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
-> -> File not found
< OptionalComponents [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\
IMAIL -> Installed = 1 ->
MAPI -> Installed = 1 ->
MSFS -> Installed = 1 ->
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Works Update Detection -> C:\Program Files\Microsoft Works\WkDetect.exe -> File not found
MoneyAgent -> C:\Program Files\Microsoft Money\System\Money Express.exe -> File not found
swg -> C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe -> File not found
Yahoo! Pager -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet ->
Control_RunDLL -> -> File not found
< Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->
< Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 95 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\ -> ->
< HOSTS File > -> C:\WINDOWS\System32\drivers\etc\Hosts
< Internet Explorer Settings > ->
HKLM: Default_Page_URL -> http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome ->
HKLM: Main\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Start Page -> http://www.dellnet.com ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: Search\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: SearchAssistant -> http://www.google.com/ie ->
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm ->
HKCU: Search Bar -> http://www.google.com/ie ->
HKCU: Search Page -> http://www.google.com ->
HKCU: Start Page -> http://www.npr.org/ ->
HKCU: SearchAssistant -> http://www.google.com/ie ->
HKCU: ProxyEnable -> 0 ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [AcroIEHlprObj Class] -> [Ver = 1, 0, 0, 1 | Size = 37808 bytes | Modified Date = 4/16/2001 3:39:02 PM | Attr = ]
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [] -> Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Modified Date = 5/31/2005 1:04:00 AM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 434279 bytes | Modified Date = 10/12/2006 3:25:44 AM | Attr = ]
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKLM] -> c:\program files\Google\googletoolbar3.dll [Google Toolbar Helper] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
{B9D0C4C5-0B72-05F1-76F6-7045077A7393} [HKLM] -> C:\WINDOWS\SYSTEM32\trla.dll [Reg Data - Value does not exist] -> [Ver = | Size = 58880 bytes | Modified Date = 12/11/2006 7:44:28 AM | Attr = ]
< Internet Explorer Bars [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer ToolBars [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
{2318C2B1-4965-11d4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [HKLM] -> C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll [MSN] -> File not found
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
ShellBrowser\\{5CBE2611-C31B-401F-89BC-4CBB25E853D7} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
WebBrowser\\{3F3714A9-89A4-46BE-8AF3-D0C9D1FB03F9} [HKLM] -> C:\Program Files\MorpheusBar\bar\2.bin\MORPHBAR.DLL [Morpheus Toolbar] -> File not found
WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer CmdMapping [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping
{000007C6-17DF-4438-92A4-DE5537471BA3} -> 8195 - Reg Data - Key not found ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -> 8198 - Sun Java Console ->
{6685509E-B47B-4f47-8E16-9A5F3A62F683} -> 8199 - Reg Data - Key not found ->
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -> 8196 - Reg Data - Key not found ->
{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} -> 8197 - Reg Data - Key not found ->
{E023F504-0C5A-4750-A1E7-A9046DEA8A21} -> 8193 - Reg Data - Key not found ->
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> 8200 - Yahoo! Messenger ->
{FB5F1910-F110-11d2-BB9E-00C04F795683} -> 8194 - Windows Messenger ->
NextId -> 8201 ->
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll [MenuText: Sun Java Console] ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 434279 bytes | Modified Date = 10/12/2006 3:25:44 AM | Attr = ]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [ButtonText: Yahoo! Messenger] -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< Internet Explorer Plugins [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\
.spop -> C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll [Reg Data - Value does not exist] -> Intertrust Technologies, Inc. [Ver = 1.0.0.32 | Size = 270336 bytes | Modified Date = 8/1/2001 4:05:42 PM | Attr = ]
< Approved Shell Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
{0DF44EAA-FF21-4412-828E-260A8728E7F1} [HKLM] -> Reg Data - Key not found [Taskbar and Start Menu] -> File not found
{1CDB2949-8F65-4355-8456-263E7C208A5D} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer Menu] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Media Band] -> File not found
{42071714-76d4-11d1-8b24-00a0c9068ff3} [HKLM] -> deskpan.dll [Display Panning CPL Extension] -> File not found
{5E44E225-A408-11CF-B581-008029601108} [HKLM] -> C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Shellex.dll [Adaptec DirectCD Shell Extension] -> Roxio [Ver = 5.2.0.91 | Size = 180224 bytes | Modified Date = 4/10/2002 3:41:50 PM | Attr = ]
{764BF0E1-F219-11ce-972D-00AA00A14F56} [HKLM] -> Reg Data - Key not found [Shell extensions for file compression] -> File not found
{7A9D77BD-5403-11d2-8785-2E0420524153} [HKLM] -> Reg Data - Key not found [User Accounts] -> File not found
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} [HKLM] -> Reg Data - Key not found [Encryption Context Menu] -> File not found
{88895560-9AA2-1069-930E-00AA0030EBC8} [HKLM] -> C:\WINDOWS\SYSTEM32\HTICONS.DLL [HyperTerminal Icon Ext] -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
{8FF88D21-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D23-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Property Sheet Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D25-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) DragDrop Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Find Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{acb4a560-3606-11d3-aef4-00104bd0f92d} [HKLM] -> C:\Program Files\Common Files\Kodak\ifscore\KodakShX.dll [KodakShellExtension] -> Eastman Kodak Company [Ver = 2.0.2300.3 | Size = 183296 bytes | Modified Date = 3/31/2005 7:53:42 AM | Attr = ]
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} [HKLM] -> C:\Program Files\iTunes\iTunesMiniPlayer.dll [iTunes] -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 132672 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} [HKLM] -> C:\Program Files\Real\RealOne Player\rpplugins\ierpplug.dll [Shell Extensions for RealOne Player] -> RealNetworks [Ver = 1.0.0.301 | Size = 180736 bytes | Modified Date = 6/22/2002 7:20:56 AM | Attr = ]
< ContextMenuHandlers - * [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Directory [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Folder [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
< User Agent Post Platform [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
SV1 -> ->
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{F22F6660-02CA-4B75-AAC4-260C7BD2EBEA} -> (GVC-REALTEK Ethernet 10/100 PCI Adapter) ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found

[Files - Created Wihin 30 days]
setupfax.log -> C:\setupfax.log -> [Ver = | Size = 172 bytes | Created Date = 12/4/2006 10:23:08 PM | Attr = ]
YServer.txt -> C:\YServer.txt -> [Ver = | Size = 146 bytes | Created Date = 11/22/2006 8:57:39 PM | Attr = ]
iexplore.exe -> C:\WINDOWS\iexplore.exe -> Windows XP [Ver = 3.00 | Size = 199900 bytes | Created Date = 12/5/2006 1:04:38 PM | Attr = ]
iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt -> [Ver = | Size = 1855 bytes | Created Date = 12/5/2006 3:21:44 PM | Attr = ]
KB923689.log -> C:\WINDOWS\KB923689.log -> [Ver = | Size = 10942 bytes | Created Date = 12/17/2006 3:04:47 AM | Attr = ]
KB923694.log -> C:\WINDOWS\KB923694.log -> [Ver = | Size = 11904 bytes | Created Date = 12/16/2006 3:48:04 PM | Attr = ]
KB925398.log -> C:\WINDOWS\KB925398.log -> [Ver = | Size = 9413 bytes | Created Date = 12/17/2006 3:06:21 AM | Attr = ]
KB925454.log -> C:\WINDOWS\KB925454.log -> [Ver = | Size = 21129 bytes | Created Date = 12/16/2006 3:52:29 PM | Attr = ]
KB926255.log -> C:\WINDOWS\KB926255.log -> [Ver = | Size = 11927 bytes | Created Date = 12/16/2006 3:48:17 PM | Attr = ]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = H ]
yacs.log -> C:\WINDOWS\yacs.log -> [Ver = | Size = 28457 bytes | Created Date = 11/22/2006 10:21:50 PM | Attr = ]
333D2DC9AE.sys -> C:\WINDOWS\System32\333D2DC9AE.sys -> [Ver = | Size = 56 bytes | Created Date = 12/5/2006 1:37:41 PM | Attr = RHS]
ClickToFindandFixErrors_Intl.ico -> C:\WINDOWS\System32\ClickToFindandFixErrors_Intl.ico -> [Ver = | Size = 2238 bytes | Created Date = 12/11/2006 2:23:38 PM | Attr = ]
DLCQinst.dll -> C:\WINDOWS\System32\DLCQinst.dll -> [Ver = | Size = 274432 bytes | Created Date = 12/4/2006 10:20:18 PM | Attr = ]
DLPMONUI.DLL -> C:\WINDOWS\System32\DLPMONUI.DLL -> [Ver = 0.1.35.8 | Size = 32768 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
DLPRMON.DLL -> C:\WINDOWS\System32\DLPRMON.DLL -> [Ver = 0.1.35.8 | Size = 40960 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
IM31IMG.DIL -> C:\WINDOWS\System32\IM31IMG.DIL -> Data Techniques, Inc. [Ver = 7.20 | Size = 49152 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XPNG.DEL -> C:\WINDOWS\System32\IM31XPNG.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98304 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XTIF.DEL -> C:\WINDOWS\System32\IM31XTIF.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 69632 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMGMAN32.DLL -> C:\WINDOWS\System32\IMGMAN32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 339968 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMHOST32.DLL -> C:\WINDOWS\System32\IMHOST32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98345 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
java.exe -> C:\WINDOWS\System32\java.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 49248 bytes | Created Date = 11/22/2006 12:49:25 PM | Attr = ]
javaw.exe -> C:\WINDOWS\System32\javaw.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 53346 bytes | Created Date = 11/22/2006 12:49:25 PM | Attr = ]
javaws.exe -> C:\WINDOWS\System32\javaws.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 127078 bytes | Created Date = 11/22/2006 12:49:25 PM | Attr = ]
jupdate-1.5.0_09-b03.log -> C:\WINDOWS\System32\jupdate-1.5.0_09-b03.log -> [Ver = | Size = 8428 bytes | Created Date = 11/22/2006 12:48:27 PM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Created Date = 12/5/2006 1:37:28 PM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Created Date = 12/4/2006 10:19:02 PM | Attr = ]
MobileSidewalkRON_2.ico -> C:\WINDOWS\System32\MobileSidewalkRON_2.ico -> [Ver = | Size = 72566 bytes | Created Date = 12/8/2006 10:37:01 AM | Attr = ]
TitanPokerIconDropTRA108.ico -> C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico -> [Ver = | Size = 9158 bytes | Created Date = 12/5/2006 9:37:58 PM | Attr = ]
TrafficSales_Casino_3.ico -> C:\WINDOWS\System32\TrafficSales_Casino_3.ico -> [Ver = | Size = 22486 bytes | Created Date = 12/5/2006 11:50:56 PM | Attr = ]
trla.dll -> C:\WINDOWS\System32\trla.dll -> [Ver = | Size = 58880 bytes | Created Date = 12/14/2006 7:13:28 AM | Attr = ]
wnscpsv.exe -> C:\WINDOWS\System32\wnscpsv.exe -> [Ver = | Size = 2 bytes | Created Date = 12/11/2006 12:20:49 PM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/17/2006 8:37:49 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Created Date = 12/17/2006 8:37:48 AM | Attr = ]

[Files - Modified Wihin 30 days]
hiberfil.sys -> C:\hiberfil.sys -> [Ver = | Size = 267468800 bytes | Modified Date = 12/17/2006 8:57:38 AM | Attr = HS]
setupfax.log -> C:\setupfax.log -> [Ver = | Size = 172 bytes | Modified Date = 12/4/2006 10:28:40 PM | Attr = ]
YServer.txt -> C:\YServer.txt -> [Ver = | Size = 146 bytes | Modified Date = 11/22/2006 8:57:40 PM | Attr = ]
0.LOG -> C:\WINDOWS\0.LOG -> [Ver = | Size = 0 bytes | Modified Date = 12/17/2006 8:58:34 AM | Attr = ]
BOOTSTAT.DAT -> C:\WINDOWS\BOOTSTAT.DAT -> [Ver = | Size = 2048 bytes | Modified Date = 12/17/2006 8:57:40 AM | Attr = S]
comsetup.log -> C:\WINDOWS\comsetup.log -> [Ver = | Size = 56926 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
FaxSetup.log -> C:\WINDOWS\FaxSetup.log -> [Ver = | Size = 1105807 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
iexplore.exe -> C:\WINDOWS\iexplore.exe -> Windows XP [Ver = 3.00 | Size = 199900 bytes | Modified Date = 12/5/2006 1:04:52 PM | Attr = ]
iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt -> [Ver = | Size = 1855 bytes | Modified Date = 12/5/2006 3:21:46 PM | Attr = ]
IIS6.LOG -> C:\WINDOWS\IIS6.LOG -> [Ver = | Size = 174573 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
imsins.BAK -> C:\WINDOWS\imsins.BAK -> [Ver = | Size = 1393 bytes | Modified Date = 12/17/2006 3:07:04 AM | Attr = ]
imsins.log -> C:\WINDOWS\imsins.log -> [Ver = | Size = 1393 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
KB923689.log -> C:\WINDOWS\KB923689.log -> [Ver = | Size = 10942 bytes | Modified Date = 12/17/2006 3:06:20 AM | Attr = ]
KB923694.log -> C:\WINDOWS\KB923694.log -> [Ver = | Size = 11904 bytes | Modified Date = 12/17/2006 3:04:36 AM | Attr = ]
KB925398.log -> C:\WINDOWS\KB925398.log -> [Ver = | Size = 9413 bytes | Modified Date = 12/17/2006 3:07:04 AM | Attr = ]
KB925454.log -> C:\WINDOWS\KB925454.log -> [Ver = | Size = 21129 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
KB926255.log -> C:\WINDOWS\KB926255.log -> [Ver = | Size = 11927 bytes | Modified Date = 12/17/2006 3:04:48 AM | Attr = ]
mozver.dat -> C:\WINDOWS\mozver.dat -> [Ver = | Size = 8622 bytes | Modified Date = 11/29/2006 7:11:34 PM | Attr = ]
MSGSOCM.LOG -> C:\WINDOWS\MSGSOCM.LOG -> [Ver = | Size = 55680 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
ntdtcsetup.log -> C:\WINDOWS\ntdtcsetup.log -> [Ver = | Size = 228847 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
ocgen.log -> C:\WINDOWS\ocgen.log -> [Ver = | Size = 84417 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
OCMSN.LOG -> C:\WINDOWS\OCMSN.LOG -> [Ver = | Size = 52304 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Modified Date = 12/17/2006 4:58:10 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Modified Date = 12/17/2006 4:58:10 PM | Attr = H ]
SchedLgU.Txt -> C:\WINDOWS\SchedLgU.Txt -> [Ver = | Size = 32388 bytes | Modified Date = 12/17/2006 8:56:52 AM | Attr = ]
setupapi.log -> C:\WINDOWS\setupapi.log -> [Ver = | Size = 287629 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
SIERRA.INI -> C:\WINDOWS\SIERRA.INI -> [Ver = | Size = 512 bytes | Modified Date = 11/29/2006 5:32:34 PM | Attr = ]
TSOC.LOG -> C:\WINDOWS\TSOC.LOG -> [Ver = | Size = 431506 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
UninstallFirefox.exe -> C:\WINDOWS\UninstallFirefox.exe -> [Ver = | Size = 99965 bytes | Modified Date = 11/29/2006 7:11:42 PM | Attr = ]
updspapi.log -> C:\WINDOWS\updspapi.log -> [Ver = | Size = 48276 bytes | Modified Date = 12/17/2006 3:07:30 AM | Attr = ]
WIADEBUG.LOG -> C:\WINDOWS\WIADEBUG.LOG -> [Ver = | Size = 159 bytes | Modified Date = 12/17/2006 8:58:04 AM | Attr = ]
WIASERVC.LOG -> C:\WINDOWS\WIASERVC.LOG -> [Ver = | Size = 50 bytes | Modified Date = 12/17/2006 8:57:58 AM | Attr = ]
WindowsUpdate.log -> C:\WINDOWS\WindowsUpdate.log -> [Ver = | Size = 1052252 bytes | Modified Date = 12/17/2006 6:05:24 PM | Attr = ]
wmsetup.log -> C:\WINDOWS\wmsetup.log -> [Ver = | Size = 22741 bytes | Modified Date = 12/10/2006 2:37:02 PM | Attr = ]
yacs.log -> C:\WINDOWS\yacs.log -> [Ver = | Size = 28457 bytes | Modified Date = 11/28/2006 8:48:02 PM | Attr = ]
333D2DC9AE.sys -> C:\WINDOWS\System32\333D2DC9AE.sys -> [Ver = | Size = 56 bytes | Modified Date = 12/14/2006 10:39:24 PM | Attr = RHS]
ClickToFindandFixErrors_Intl.ico -> C:\WINDOWS\System32\ClickToFindandFixErrors_Intl.ico -> [Ver = | Size = 2238 bytes | Modified Date = 12/11/2006 2:23:40 PM | Attr = ]
jupdate-1.5.0_09-b03.log -> C:\WINDOWS\System32\jupdate-1.5.0_09-b03.log -> [Ver = | Size = 8428 bytes | Modified Date = 11/22/2006 12:49:24 PM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Modified Date = 12/14/2006 10:39:32 PM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Modified Date = 12/4/2006 10:32:50 PM | Attr = ]
MobileSidewalkRON_2.ico -> C:\WINDOWS\System32\MobileSidewalkRON_2.ico -> [Ver = | Size = 72566 bytes | Modified Date = 12/8/2006 10:37:02 AM | Attr = ]
TitanPokerIconDropTRA108.ico -> C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico -> [Ver = | Size = 9158 bytes | Modified Date = 12/8/2006 11:06:00 AM | Attr = ]
TrafficSales_Casino_3.ico -> C:\WINDOWS\System32\TrafficSales_Casino_3.ico -> [Ver = | Size = 22486 bytes | Modified Date = 12/13/2006 12:06:22 AM | Attr = ]
trla.dll -> C:\WINDOWS\System32\trla.dll -> [Ver = | Size = 58880 bytes | Modified Date = 12/11/2006 7:44:28 AM | Attr = ]
wnscpsv.exe -> C:\WINDOWS\System32\wnscpsv.exe -> [Ver = | Size = 2 bytes | Modified Date = 12/14/2006 7:13:44 AM | Attr = ]
WPA.DBL -> C:\WINDOWS\System32\WPA.DBL -> [Ver = | Size = 1170 bytes | Modified Date = 12/17/2006 5:58:32 PM | Attr = ]
avg7core.sys -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsw.sys -> C:\WINDOWS\System32\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsxp.sys -> C:\WINDOWS\System32\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7,1,0,398 | Size = 28416 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgtdi.sys -> C:\WINDOWS\System32\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]

[File String Scan - Non-Microsoft Only]
UPX0 , -> C:\ar505enu.exe -> InstallShield Software Corporation [Ver = 2.02.001 | Size = 8981440 bytes | Modified Date = 7/9/2002 6:18:42 PM | Attr = ]
UPX0 , -> C:\avg6386fu_free.exe -> [Ver = | Size = 5433344 bytes | Modified Date = 9/17/2002 9:28:30 PM | Attr = ]
UPX! , UPX0 , -> C:\thin-85-1-x-x.exe -> BetterInternet, Inc. [Ver = 1, 0, 0, 12 | Size = 71168 bytes | Modified Date = 2/23/2005 4:23:00 PM | Attr = ]
Thawte Consulting , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip -> [Ver = | Size = 3290841 bytes | Modified Date = 12/6/2004 10:57:36 PM | Attr = ]
USERTRUST , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\patch-jre1.5.0_09.b03\patchjre.exe -> Sun Microsystems, Inc. [Ver = 1, 0, 0, 1 | Size = 4490872 bytes | Modified Date = 10/12/2006 3:41:58 AM | Attr = ]
FSG! , -> C:\Program Files\Common Files\Microsoft Shared\Shoebox\STANDARD.SBT -> [Ver = | Size = 19954310 bytes | Modified Date = 6/21/2000 3:59:14 AM | Attr = ]
PEC2 , -> C:\Program Files\Common Files\Sony Shared\AVLib\Metallic.dll -> Sony Corporation [Ver = 2.7.00.14160 | Size = 229376 bytes | Modified Date = 2/17/2004 8:16:12 AM | Attr = ]
buddy.exe , abetterinternet.com , -> C:\WINDOWS\Buddy.exe -> Direct Revenue [Ver = 1.0.0.18 | Size = 155648 bytes | Modified Date = 3/5/2005 5:15:38 PM | Attr = ]
UPX! , UPX0 , -> C:\WINDOWS\extract.exe -> Mimar Sinan International [Ver = 5.0.2001.10043 | Size = 232324 bytes | Modified Date = 12/18/2003 10:28:02 PM | Attr = ]
UPX! , UPX0 , -> C:\WINDOWS\msbbi.exe -> Mimar Sinan International [Ver = 5.0.2001.10043 | Size = 154272 bytes | Modified Date = 12/18/2003 10:29:52 PM | Attr = ]
UPX! , UPX0 , -> C:\WINDOWS\Zambelli Fireworks Screensaver.scr -> [Ver = | Size = 671744 bytes | Modified Date = 9/27/2001 2:04:28 PM | Attr = ]
PEC2 , -> C:\WINDOWS\System32\DFRG.MSC -> [Ver = | Size = 41397 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
UPX! , UPX0 , -> C:\WINDOWS\System32\in10b6s.dll -> [Ver = 1, 0, 0, 1 | Size = 205312 bytes | Modified Date = 2/24/2004 6:44:06 PM | Attr = ]
PEC2 , PECompact2 , -> C:\WINDOWS\System32\trla.dll -> [Ver = | Size = 58880 bytes | Modified Date = 12/11/2006 7:44:28 AM | Attr = ]
winsync , -> C:\WINDOWS\System32\WBDBASE.DEU -> [Ver = | Size = 1309184 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
Thawte Consulting , -> C:\WINDOWS\System32\XceedFtp.dll -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 1.1.129.0 | Size = 279392 bytes | Modified Date = 8/31/2005 10:35:40 AM | Attr = ]
UPX! , FSG! , PEC2 , aspack , -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
PTech , -> C:\WINDOWS\System32\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Modified Date = 8/3/2004 11:41:38 PM | Attr = ]

< End of report >

OldTimer

Post #4December 18, 2006, 10:37 AM UTC

Hi PatRick B. Ok, let's get started. First, please print these directions so they will be available to you (we will be rebooting into Safe Mode during the fix).

Next, Please follow the steps below in order:

Step #1

Download CCleaner and install it but do not run it yet.

Step #2

Download AVG anti-spyware from HERE and save that file to your desktop.

Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete you will need to run AVG Anti-Spyware and update the definition files.
On the main screen select the icon "Update" then select the "Update now" link.
- Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
Once in the Settings screen, under "How to act" select "Quarantine".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.

Step #3

Now start WinPFind3U. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Processes - Non-Microsoft Only]
YY -> iexplore.exe -> C:\WINDOWS\iexplore.exe
[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> Explorer -> C:\WINDOWS\iexplore.exe
YY -> mlbaeu -> c:\windows\system32\diqtygq.exe
YY -> uwctnew -> c:\windows\system32\uifzwhz.exe
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YY -> {B9D0C4C5-0B72-05F1-76F6-7045077A7393} [HKLM] -> C:\WINDOWS\SYSTEM32\trla.dll [Reg Data - Value does not exist]
[Files - Created Wihin 30 days]
NY -> iexplore.exe -> C:\WINDOWS\iexplore.exe
NY -> iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt
NY -> 333D2DC9AE.sys -> C:\WINDOWS\System32\333D2DC9AE.sys
NY -> ClickToFindandFixErrors_Intl.ico -> C:\WINDOWS\System32\ClickToFindandFixErrors_Intl.ico
NY -> MobileSidewalkRON_2.ico -> C:\WINDOWS\System32\MobileSidewalkRON_2.ico
NY -> TitanPokerIconDropTRA108.ico -> C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico
NY -> TrafficSales_Casino_3.ico -> C:\WINDOWS\System32\TrafficSales_Casino_3.ico
NY -> trla.dll -> C:\WINDOWS\System32\trla.dll
NY -> wnscpsv.exe -> C:\WINDOWS\System32\wnscpsv.exe
[Files - Modified Wihin 30 days]
NY -> iexplore.exe -> C:\WINDOWS\iexplore.exe
NY -> iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt
NY -> 333D2DC9AE.sys -> C:\WINDOWS\System32\333D2DC9AE.sys
NY -> ClickToFindandFixErrors_Intl.ico -> C:\WINDOWS\System32\ClickToFindandFixErrors_Intl.ico
NY -> MobileSidewalkRON_2.ico -> C:\WINDOWS\System32\MobileSidewalkRON_2.ico
NY -> TitanPokerIconDropTRA108.ico -> C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico
NY -> TrafficSales_Casino_3.ico -> C:\WINDOWS\System32\TrafficSales_Casino_3.ico
NY -> trla.dll -> C:\WINDOWS\System32\trla.dll
NY -> wnscpsv.exe -> C:\WINDOWS\System32\wnscpsv.exe
[File String Scan - Non-Microsoft Only]
NY -> buddy.exe , abetterinternet.com , -> C:\WINDOWS\Buddy.exe
NY -> UPX! , UPX0 , -> C:\WINDOWS\extract.exe
NY -> UPX! , UPX0 , -> C:\WINDOWS\msbbi.exe
NY -> UPX! , UPX0 , -> C:\WINDOWS\System32\in10b6s.dll
NY -> PEC2 , PECompact2 , -> C:\WINDOWS\System32\trla.dll
[Reboot]

The fix should only take a very short time and then you will be asked if you want to reboot. Choose Yes.

Reboot into Safe Mode by doing the following:

As soon as the BIOS is loaded begin tapping the F8 key until the boot menu appears.
Use the arrow keys to select the Safe Mode menu item.
Press the Enter key.

Step #4

Start CCleaner and click on the Run Cleaner button in the lower right-hand corner. When it is finished close CCleaner.

Step #5

Launch AVG Anti-Spyware by double-clicking the icon on your desktop.

IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:

Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
- IMake sure that Set all elements to: shows Quarantine, if not click on the link and choose Quarantine from the popup menu.
- At the bottom of the window click on the "Apply all actions" button
Note: Don't save the report before you hit the Apply action button.
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.

Step #6

Post the following back here:

a new WinPFind3U report
the AVG Anti-Spyware report
the latest .log file from the WinPFind3u folder (it will have a name in the format mmddyyyy_hhmmss.log)

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Cheers.

OT

PatRick B

Post #5December 19, 2006, 1:38 AM UTC

OT help something is not right when I try to start WinPFind3U & got an error message I/O error 103 clicked ok & program came up pasted fix & started but program was unresponsive ended program and restarted same thing again what happened? whats next ? Thanks Patrick

OldTimer

Post #6December 19, 2006, 2:18 AM UTC

Hi PatRick B. Have the files/folders been extracted to the desktop? Cheers. OT

PatRick B

Post #7December 19, 2006, 3:16 AM UTC

OT Yes, it worked fine first time you had me run it. should I try uninstall / reinstall?

OldTimer

Post #8December 19, 2006, 9:38 AM UTC

Hi PatRick B. Yes, go ahead and extract the files again (right to the same folder). That error usually means a file that is needed is missing. Cheers. OT

PatRick B

Post #9December 20, 2006, 12:48 AM UTC

OT, Sorry I haven't gotten back sooner but I work long days. So, I deleted WinPFind3U and re-extracted Came up OK, no error massage Set it back up as you said in earler post pasted fix & hit runfix nothing happened & I got a system busy cursor opened task manager & it shows as not responding what should I try next Patiently yours, Patrick

OldTimer

Post #10December 20, 2006, 1:34 AM UTC

Hi PatRick B. I think maybe the iexplore.exe process is blocking the fix. It is not the legitimate iexplore file. Try booting to Safe Mode first and then running the fix from there and then continuing with the rest of the instructions. Cheers. OT

PatRick B

Post #11December 20, 2006, 3:14 AM UTC

OT, Started in safe mode pasted fix, but still won't run checked program manager, still came up as not responsive. Next? Thank's Patrick PS will stay in safe mode till I hear back.

OldTimer

Post #12December 20, 2006, 10:05 AM UTC

Hi PatRick B. Skip the WinPFind fix and run the AVG scan. Post that log back here and we'll see what it finds. Cheers. OT

PatRick B

Post #13December 21, 2006, 1:12 AM UTC

OT Sorry, but I made a few mistakes,here goes 1) Forgot that my wife took it out of safe mode. 2) set all elements was set to custom not quarantine AVG logfile is over 200,000 characters & will not post Patrick

OldTimer

Post #14December 21, 2006, 10:44 AM UTC

Hi PatRick B. That's Ok. Just re-run the scan with the quarantine option selected so that any infected files do get quarantined.

After that, delete all WinPFind3u files/folders from your desktop and download the latest version. Let's try running a new scan.

Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
- In the Files Created Within group click 30 days
- In the Files Modified Within group select 30 days
- In the File String Search group select Non-Microsoft
Now click the Run Scan button on the toolbar.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and Copy/Paste the information back here. I will review it when it comes in.

Cheers.

OT

PatRick B

Post #15December 23, 2006, 1:55 AM UTC

OT,

Thank you for all your help & patience so far.
below is both the AVG & WindPFind3u logfiles
because of the holidays I wont be able to get back to my computer for a couple of days
Heres hoping you have a wonderful Christmas

AVG logfile

+ Created at: 7:24:22 PM 12/22/2006

+ Scan result:

C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182024.exe -> Adware.BetterInternet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182025.exe -> Adware.BetterInternet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182026.exe -> Adware.BetterInternet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182034.DLL -> Adware.MediaPops : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182027.exe -> Adware.Midaddle : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182023.exe -> Adware.Midadle : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182032.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182037.exe -> Adware.Sahat : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182033.exe/VVSN.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182035.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182036.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182038.exe -> Adware.WildMedia : Cleaned with backup (quarantined).
C:\Documents and Settings\The Sims\Cookies\the sims@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the [removed][1].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the [removed][1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the [removed][1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the [removed][1].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the [removed][1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the [removed][1].txt -> TrackingCookie.Valuead : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the [removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\The Sims\Cookies\the sims@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182020.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182021.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182022.dll -> Trojan.Revop.c : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1638\A0182019.exe -> Trojan.Small : Cleaned with backup (quarantined).

::Report end

WinPFind3 logfile created on: 12/22/2006 7:29:58 PM
WinPFind3U by OldTimer - Version 1.0.1 Folder = C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 6.0.2900.2180)

WinPFind3u logfile

[Processes - Non-Microsoft Only]
avgamsvr.exe -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgas.exe -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 10/7/2006 6:20:00 AM | Attr = ]
avgcc.exe -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgemc.exe -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
avgupsvc.exe -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
ctsvccda.exe -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
damon.exe -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
devldr32.exe -> C:\WINDOWS\SYSTEM32\devldr32.exe -> Creative Technology Ltd. [Ver = 1, 0, 0, 22 | Size = 25600 bytes | Modified Date = 8/31/2001 12:44:30 PM | Attr = ]
dlcqcoms.exe -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
easyshare.exe -> C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe -> [Ver = 5, 0, 25, 230 | Size = 151552 bytes | Modified Date = 7/22/2005 3:47:22 AM | Attr = ]
evntsvc.exe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
ezsp_px.exe -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
firefox.exe -> C:\Program Files\Mozilla Firefox\firefox.exe -> Mozilla [Ver = 1.0.7 | Size = 6637156 bytes | Modified Date = 9/15/2005 6:26:00 PM | Attr = ]
guard.exe -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 8:13:20 AM | Attr = ]
ipodservice.exe -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
ituneshelper.exe -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
jucheck.exe -> C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 241775 bytes | Modified Date = 10/12/2006 3:10:54 AM | Attr = ]
jusched.exe -> C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 49263 bytes | Modified Date = 10/12/2006 3:10:54 AM | Attr = ]
kodak software updater.exe -> C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe -> [Ver = | Size = 16423 bytes | Modified Date = 2/13/2004 2:12:08 PM | Attr = ]
mediadetect.exe -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
memcard.exe -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
mm_tray.exe -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
morpheus.exe -> C:\Program Files\Morpheus\Morpheus.exe -> Streamcast Networks, Inc [Ver = 1.0.0.1 | Size = 721408 bytes | Modified Date = 9/12/2006 1:17:26 PM | Attr = ]
nvsvc32.exe -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
qttask.exe -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
sagent2.exe -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
thunderbird.exe -> C:\Program Files\Mozilla Thunderbird\thunderbird.exe -> Mozilla.org [Ver = 1.0.2 | Size = 7541349 bytes | Modified Date = 3/17/2005 12:20:00 PM | Attr = ]
viewmgr.exe -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
winpfind3u.exe -> C:\Documents and Settings\Patrick Boyle\Desktop\WinPFind3u\WinPFind3U.exe -> Oldtimer Tools [Ver = 1.0.1.0 | Size = 302592 bytes | Modified Date = 12/21/2006 8:20:08 PM | Attr = ]
wkufind.exe -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
ymsgr_tray.exe -> C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe -> Yahoo! Inc. [Ver = 8,1,0,0 | Size = 103928 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 8:13:20 AM | Attr = ]
(Avg7Alrt) AVG7 Alert Manager Server [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Avg7UpdSvc) AVG7 Update Service [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/17/2006 8:37:48 AM | Attr = ]
(AVGEMS) AVG E-mail Scanner [Win32_Own | Auto | Running] -> C:\Program Files\Grisoft\AVG Free\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
(Creative Service for CDROM Access) Creative Service for CDROM Access [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE -> Creative Technology Ltd [Ver = 1.0.1.0 | Size = 44032 bytes | Modified Date = 12/13/1999 12:01:00 AM | Attr = ]
(dlcq_device) dlcq_device [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\dlcqcoms.exe -> [Ver = 6.3.22.0 | Size = 528384 bytes | Modified Date = 7/13/2006 5:27:16 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 1:56:48 AM | Attr = ]
(EPSONStatusAgent2) EPSON Printer Status Agent2 [Win32_Own | Auto | Running] -> C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -> SEIKO EPSON CORPORATION [Ver = 2, 2, 0, 0 | Size = 90112 bytes | Modified Date = 10/25/2001 1:02:00 AM | Attr = ]
(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> C:\Program Files\iPod\bin\iPodService.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 492608 bytes | Modified Date = 10/30/2006 9:36:32 AM | Attr = ]
(KodakCCS) Kodak Camera Connection Software [Win32_Own | On_Demand | Stopped] -> C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe -> Eastman Kodak Company [Ver = 1.1.5100.4 | Size = 411920 bytes | Modified Date = 3/30/2005 4:46:56 PM | Attr = ]
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> C:\WINDOWS\SYSTEM32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 81920 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
(PACSPTISVR) PACSPTISVR [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 53337 bytes | Modified Date = 5/27/2004 1:14:58 AM | Attr = ]
(SPTISRV) Sony SPTI Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -> Sony Corporation [Ver = 4.0.00.05270 | Size = 69718 bytes | Modified Date = 5/27/2004 1:13:00 AM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
!AVG Anti-Spyware -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 50 | Size = 6266880 bytes | Modified Date = 10/7/2006 6:20:00 AM | Attr = ]
AVG7_CC -> C:\Program Files\Grisoft\AVG Free\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 12/17/2006 8:37:40 AM | Attr = ]
Corel Photo Downloader -> C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe -> Corel, Inc. [Ver = 6.0.0 (20050831.10) | Size = 106496 bytes | Modified Date = 8/31/2005 11:06:18 AM | Attr = ]
Dell|Alert -> C:\Program Files\Dell\Support\Alert\bin\DAMon.exe -> [Ver = 1, 0, 0, 1 | Size = 282624 bytes | Modified Date = 4/3/2002 5:06:18 PM | Attr = ]
DLCQCATS -> C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\dlcqtime.dll [rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16] -> [Ver = 1.20.0.0 | Size = 106496 bytes | Modified Date = 6/7/2006 12:17:18 PM | Attr = ]
dlcqmon.exe -> C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe -> [Ver = 0.1.25.0 | Size = 286720 bytes | Modified Date = 6/20/2006 11:37:42 AM | Attr = ]
ezShieldProtector for Px -> C:\WINDOWS\SYSTEM32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 10:29:26 AM | Attr = ]
FaxCenterServer -> C:\Program Files\Dell PC Fax\fm3032.exe -> [Ver = 0.1.35.8 | Size = 307200 bytes | Modified Date = 6/15/2006 4:03:30 AM | Attr = ]
ISUSPM Startup -> C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 249856 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
ISUSScheduler -> C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -> InstallShield Software Corporation [Ver = 4, 50, 100, 33433 | Size = 81920 bytes | Modified Date = 6/10/2005 10:44:02 AM | Attr = ]
iTunesHelper -> C:\Program Files\iTunes\iTunesHelper.exe -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 256576 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
MemoryCardManager -> C:\Program Files\Dell Photo AIO Printer 966\memcard.exe -> [Ver = 1.0.18.1 | Size = 299008 bytes | Modified Date = 6/27/2006 5:34:50 AM | Attr = ]
Microsoft Works Update Detection -> C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 6.00.3215.0 | Size = 28738 bytes | Modified Date = 8/16/2001 9:41:58 PM | Attr = ]
mlbaeu -> c:\windows\system32\diqtygq.exe -> File not found
MMTray -> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe -> MUSICMATCH, Inc. [Ver = 7.10.0053 | Size = 90112 bytes | Modified Date = 2/27/2002 12:17:08 PM | Attr = ]
NvCplDaemon -> C:\WINDOWS\SYSTEM32\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 5058560 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
QuickTime Task -> C:\Program Files\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 7.1.3 | Size = 282624 bytes | Modified Date = 10/25/2006 6:58:18 PM | Attr = ]
SunJavaUpdateSched -> C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 49263 bytes | Modified Date = 10/12/2006 3:10:54 AM | Attr = ]
TkBellExe -> C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -> RealNetworks, Inc. [Ver = 0.1.0.880 | Size = 146432 bytes | Modified Date = 6/22/2002 7:20:54 AM | Attr = ]
uwctnew -> c:\windows\system32\uifzwhz.exe -> File not found
ViewMgr -> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe -> Viewpoint Corporation [Ver = 2, 0, 0, 42 | Size = 111816 bytes | Modified Date = 11/10/2004 10:15:32 PM | Attr = ]
< RunOnceEx [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
-> -> File not found
< OptionalComponents [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\
IMAIL -> Installed = 1 ->
MAPI -> Installed = 1 ->
MSFS -> Installed = 1 ->
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Works Update Detection -> C:\Program Files\Microsoft Works\WkDetect.exe -> File not found
MoneyAgent -> C:\Program Files\Microsoft Money\System\Money Express.exe -> File not found
swg -> C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe -> File not found
Yahoo! Pager -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{57B86673-276A-48B2-BAE7-C6DBB3020EB8} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 73728 bytes | Modified Date = 9/28/2006 8:13:28 AM | Attr = ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet ->
Control_RunDLL -> -> File not found
< Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->
< Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 95 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools -> 0 ->
< HOSTS File > -> C:\WINDOWS\System32\drivers\etc\Hosts
< Internet Explorer Settings > ->
HKLM: Default_Page_URL -> http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome ->
HKLM: Main\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Start Page -> http://www.dellnet.com ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: Search\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: SearchAssistant -> http://www.google.com/ie ->
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm ->
HKCU: Search Bar -> http://www.google.com/ie ->
HKCU: Search Page -> http://www.google.com ->
HKCU: Start Page -> http://www.npr.org/ ->
HKCU: SearchAssistant -> http://www.google.com/ie ->
HKCU: ProxyEnable -> 0 ->
< Trusted Sites > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
msn.com [ - ] -> ->
< Trusted Sites > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
aol.com [ - ] -> ->
free_aol.com [ - ] -> ->
free_aol.com [http] -> ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [AcroIEHlprObj Class] -> [Ver = 1, 0, 0, 1 | Size = 37808 bytes | Modified Date = 4/16/2001 3:39:02 PM | Attr = ]
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [] -> Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Modified Date = 5/31/2005 1:04:00 AM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 434279 bytes | Modified Date = 10/12/2006 3:25:44 AM | Attr = ]
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKLM] -> c:\program files\Google\googletoolbar3.dll [Google Toolbar Helper] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
{B9D0C4C5-0B72-05F1-76F6-7045077A7393} [HKLM] -> C:\WINDOWS\system32\trla.dll [Reg Data - Value does not exist] -> File not found
< Internet Explorer Bars [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer ToolBars [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
{2318C2B1-4965-11d4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [HKLM] -> C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll [MSN] -> File not found
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
ShellBrowser\\{5CBE2611-C31B-401F-89BC-4CBB25E853D7} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] -> c:\program files\Google\googletoolbar3.dll [&Google] -> Google Inc. [Ver = 4, 0, 1020, 3054 | Size = 2120768 bytes | Modified Date = 10/17/2006 2:04:08 PM | Attr = R ]
WebBrowser\\{3F3714A9-89A4-46BE-8AF3-D0C9D1FB03F9} [HKLM] -> C:\Program Files\MorpheusBar\bar\2.bin\MORPHBAR.DLL [Morpheus Toolbar] -> File not found
WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer CmdMapping [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping
{000007C6-17DF-4438-92A4-DE5537471BA3} -> 8195 - Reg Data - Key not found ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -> 8198 - Sun Java Console ->
{6685509E-B47B-4f47-8E16-9A5F3A62F683} -> 8199 - Reg Data - Key not found ->
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -> 8196 - Reg Data - Key not found ->
{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} -> 8197 - Reg Data - Key not found ->
{E023F504-0C5A-4750-A1E7-A9046DEA8A21} -> 8193 - Reg Data - Key not found ->
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> 8200 - Yahoo! Messenger ->
{FB5F1910-F110-11d2-BB9E-00C04F795683} -> 8194 - Windows Messenger ->
NextId -> 8201 ->
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll [MenuText: Sun Java Console] ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.90.3 | Size = 434279 bytes | Modified Date = 10/12/2006 3:25:44 AM | Attr = ]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [ButtonText: Yahoo! Messenger] -> Yahoo! Inc. [Ver = 8,1,0,195 | Size = 4662776 bytes | Modified Date = 10/24/2006 4:10:18 PM | Attr = ]
< Internet Explorer Plugins [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\
.spop -> C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll [Reg Data - Value does not exist] -> Intertrust Technologies, Inc. [Ver = 1.0.0.32 | Size = 270336 bytes | Modified Date = 8/1/2001 4:05:42 PM | Attr = ]
< Approved Shell Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
{0DF44EAA-FF21-4412-828E-260A8728E7F1} [HKLM] -> Reg Data - Key not found [Taskbar and Start Menu] -> File not found
{1CDB2949-8F65-4355-8456-263E7C208A5D} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} [HKLM] -> C:\WINDOWS\SYSTEM32\nvshell.dll [Desktop Explorer Menu] -> NVIDIA Corporation [Ver = 6.14.10.5216 | Size = 430152 bytes | Modified Date = 10/6/2003 2:16:00 PM | Attr = ]
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Media Band] -> File not found
{42071714-76d4-11d1-8b24-00a0c9068ff3} [HKLM] -> deskpan.dll [Display Panning CPL Extension] -> File not found
{5E44E225-A408-11CF-B581-008029601108} [HKLM] -> C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Shellex.dll [Adaptec DirectCD Shell Extension] -> Roxio [Ver = 5.2.0.91 | Size = 180224 bytes | Modified Date = 4/10/2002 3:41:50 PM | Attr = ]
{764BF0E1-F219-11ce-972D-00AA00A14F56} [HKLM] -> Reg Data - Key not found [Shell extensions for file compression] -> File not found
{7A9D77BD-5403-11d2-8785-2E0420524153} [HKLM] -> Reg Data - Key not found [User Accounts] -> File not found
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} [HKLM] -> Reg Data - Key not found [Encryption Context Menu] -> File not found
{88895560-9AA2-1069-930E-00AA0030EBC8} [HKLM] -> C:\WINDOWS\SYSTEM32\HTICONS.DLL [HyperTerminal Icon Ext] -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
{8FF88D21-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D23-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Property Sheet Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D25-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) DragDrop Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [WinAce Archiver 2.6b4 (beta test) Context Menu Shell Extension] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Find Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{acb4a560-3606-11d3-aef4-00104bd0f92d} [HKLM] -> C:\Program Files\Common Files\Kodak\ifscore\KodakShX.dll [KodakShellExtension] -> Eastman Kodak Company [Ver = 2.0.2300.3 | Size = 183296 bytes | Modified Date = 3/31/2005 7:53:42 AM | Attr = ]
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} [HKLM] -> C:\Program Files\iTunes\iTunesMiniPlayer.dll [iTunes] -> Apple Computer, Inc. [Ver = 7.0.2.16 | Size = 132672 bytes | Modified Date = 10/30/2006 9:36:36 AM | Attr = ]
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} [HKLM] -> C:\Program Files\Real\RealOne Player\rpplugins\ierpplug.dll [Shell Extensions for RealOne Player] -> RealNetworks [Ver = 1.0.0.301 | Size = 180736 bytes | Modified Date = 6/22/2002 7:20:56 AM | Attr = ]
< ContextMenuHandlers - * [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll [AVG Anti-Spyware] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 49 | Size = 98304 bytes | Modified Date = 10/6/2006 5:40:48 AM | Attr = ]
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Directory [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll [AVG Anti-Spyware] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 49 | Size = 98304 bytes | Modified Date = 10/6/2006 5:40:48 AM | Attr = ]
{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} [HKLM] -> C:\Program Files\WinAce\arcext.dll [ZFAdd] -> e-merge GmbH [Ver = 2.5.1.0 | Size = 166912 bytes | Modified Date = 12/3/2004 2:06:00 AM | Attr = ]
< ContextMenuHandlers - Folder [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\
{1E2CDF40-419B-11D2-A5A1-002018648BA7} [HKLM] -> Reg Data - Key not found [AVG Shell Extension] -> File not found
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} [HKLM] -> C:\Program Files\Grisoft\AVG Free\avgse.dll [AVG7 Shell Extension] -> GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Modified Date = 12/17/2006 8:37:44 AM | Attr = ]
{7DBF2913-1F89-4104-B1F4-932A29945C13} [HKLM] -> C:\Program Files\Morpheus\MorphShellExt.dll [MorpheusShellExt] -> TODO: [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 9/11/2006 4:21:40 PM | Attr = ]
< User Agent Post Platform [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
SV1 -> ->
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{F22F6660-02CA-4B75-AAC4-260C7BD2EBEA} -> (GVC-REALTEK Ethernet 10/100 PCI Adapter) ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found

[Files - Created Wihin 30 days]
hiberfil.sys -> C:\hiberfil.sys -> [Ver = | Size = 267468800 bytes | Created Date = 1/1/1601 6:00:00 AM | Attr = HS]
setupfax.log -> C:\setupfax.log -> [Ver = | Size = 172 bytes | Created Date = 12/4/2006 10:23:08 PM | Attr = ]
ie7_main.log -> C:\WINDOWS\ie7_main.log -> [Ver = | Size = 1151 bytes | Created Date = 12/20/2006 12:04:33 PM | Attr = ]
iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt -> [Ver = | Size = 1855 bytes | Created Date = 12/5/2006 3:21:44 PM | Attr = ]
KB923689.log -> C:\WINDOWS\KB923689.log -> [Ver = | Size = 10942 bytes | Created Date = 12/17/2006 3:04:47 AM | Attr = ]
KB923694.log -> C:\WINDOWS\KB923694.log -> [Ver = | Size = 11904 bytes | Created Date = 12/16/2006 3:48:04 PM | Attr = ]
KB925398.log -> C:\WINDOWS\KB925398.log -> [Ver = | Size = 9413 bytes | Created Date = 12/17/2006 3:06:21 AM | Attr = ]
KB925454.log -> C:\WINDOWS\KB925454.log -> [Ver = | Size = 21129 bytes | Created Date = 12/16/2006 3:52:29 PM | Attr = ]
KB926255.log -> C:\WINDOWS\KB926255.log -> [Ver = | Size = 11927 bytes | Created Date = 12/16/2006 3:48:17 PM | Attr = ]
ntbtlog.txt -> C:\WINDOWS\ntbtlog.txt -> [Ver = | Size = 124486 bytes | Created Date = 12/19/2006 8:42:35 PM | Attr = ]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Created Date = 12/17/2006 4:58:08 PM | Attr = H ]
333D2DC9AE.sys -> C:\WINDOWS\System32\333D2DC9AE.sys -> [Ver = | Size = 56 bytes | Created Date = 12/5/2006 1:37:41 PM | Attr = RHS]
ClickToFindandFixErrors_Intl.ico -> C:\WINDOWS\System32\ClickToFindandFixErrors_Intl.ico -> [Ver = | Size = 2238 bytes | Created Date = 12/11/2006 2:23:38 PM | Attr = ]
d3d8caps.dat -> C:\WINDOWS\System32\d3d8caps.dat -> [Ver = | Size = 552 bytes | Created Date = 12/20/2006 10:07:09 AM | Attr = ]
DLCQinst.dll -> C:\WINDOWS\System32\DLCQinst.dll -> [Ver = | Size = 274432 bytes | Created Date = 12/4/2006 10:20:18 PM | Attr = ]
DLPMONUI.DLL -> C:\WINDOWS\System32\DLPMONUI.DLL -> [Ver = 0.1.35.8 | Size = 32768 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
DLPRMON.DLL -> C:\WINDOWS\System32\DLPRMON.DLL -> [Ver = 0.1.35.8 | Size = 40960 bytes | Created Date = 12/4/2006 10:21:54 PM | Attr = ]
IM31IMG.DIL -> C:\WINDOWS\System32\IM31IMG.DIL -> Data Techniques, Inc. [Ver = 7.20 | Size = 49152 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XPNG.DEL -> C:\WINDOWS\System32\IM31XPNG.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98304 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IM31XTIF.DEL -> C:\WINDOWS\System32\IM31XTIF.DEL -> Data Techniques, Inc. [Ver = 7.20 | Size = 69632 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMGMAN32.DLL -> C:\WINDOWS\System32\IMGMAN32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 339968 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
IMHOST32.DLL -> C:\WINDOWS\System32\IMHOST32.DLL -> Data Techniques, Inc. [Ver = 7.20 | Size = 98345 bytes | Created Date = 12/4/2006 10:21:34 PM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Created Date = 12/5/2006 1:37:28 PM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Created Date = 12/4/2006 10:19:02 PM | Attr = ]
MobileSidewalkRON_2.ico -> C:\WINDOWS\System32\MobileSidewalkRON_2.ico -> [Ver = | Size = 72566 bytes | Created Date = 12/8/2006 10:37:01 AM | Attr = ]
TitanPokerIconDropTRA108.ico -> C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico -> [Ver = | Size = 9158 bytes | Created Date = 12/5/2006 9:37:58 PM | Attr = ]
TrafficSales_Casino_3.ico -> C:\WINDOWS\System32\TrafficSales_Casino_3.ico -> [Ver = | Size = 22486 bytes | Created Date = 12/5/2006 11:50:56 PM | Attr = ]
AvgAsCln.sys -> C:\WINDOWS\System32\drivers\AvgAsCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/18/2006 7:10:04 PM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/17/2006 8:37:49 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Created Date = 12/17/2006 8:37:48 AM | Attr = ]

[Files - Modified Wihin 30 days]
hiberfil.sys -> C:\hiberfil.sys -> [Ver = | Size = 267468800 bytes | Modified Date = 12/20/2006 11:43:12 AM | Attr = HS]
setupfax.log -> C:\setupfax.log -> [Ver = | Size = 172 bytes | Modified Date = 12/4/2006 10:28:40 PM | Attr = ]
0.LOG -> C:\WINDOWS\0.LOG -> [Ver = | Size = 0 bytes | Modified Date = 12/20/2006 11:44:26 AM | Attr = ]
BOOTSTAT.DAT -> C:\WINDOWS\BOOTSTAT.DAT -> [Ver = | Size = 2048 bytes | Modified Date = 12/20/2006 11:43:14 AM | Attr = S]
comsetup.log -> C:\WINDOWS\comsetup.log -> [Ver = | Size = 56926 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
FaxSetup.log -> C:\WINDOWS\FaxSetup.log -> [Ver = | Size = 1105807 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
ie7_main.log -> C:\WINDOWS\ie7_main.log -> [Ver = | Size = 1151 bytes | Modified Date = 12/20/2006 12:06:28 PM | Attr = ]
iexplore.exe-up.txt -> C:\WINDOWS\iexplore.exe-up.txt -> [Ver = | Size = 1855 bytes | Modified Date = 12/5/2006 3:21:46 PM | Attr = ]
IIS6.LOG -> C:\WINDOWS\IIS6.LOG -> [Ver = | Size = 174573 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
imsins.BAK -> C:\WINDOWS\imsins.BAK -> [Ver = | Size = 1393 bytes | Modified Date = 12/17/2006 3:07:04 AM | Attr = ]
imsins.log -> C:\WINDOWS\imsins.log -> [Ver = | Size = 1393 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
KB923689.log -> C:\WINDOWS\KB923689.log -> [Ver = | Size = 10942 bytes | Modified Date = 12/17/2006 3:06:20 AM | Attr = ]
KB923694.log -> C:\WINDOWS\KB923694.log -> [Ver = | Size = 11904 bytes | Modified Date = 12/17/2006 3:04:36 AM | Attr = ]
KB925398.log -> C:\WINDOWS\KB925398.log -> [Ver = | Size = 9413 bytes | Modified Date = 12/17/2006 3:07:04 AM | Attr = ]
KB925454.log -> C:\WINDOWS\KB925454.log -> [Ver = | Size = 21129 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
KB926255.log -> C:\WINDOWS\KB926255.log -> [Ver = | Size = 11927 bytes | Modified Date = 12/17/2006 3:04:48 AM | Attr = ]
mozver.dat -> C:\WINDOWS\mozver.dat -> [Ver = | Size = 8622 bytes | Modified Date = 11/29/2006 7:11:34 PM | Attr = ]
MSGSOCM.LOG -> C:\WINDOWS\MSGSOCM.LOG -> [Ver = | Size = 55680 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
ntbtlog.txt -> C:\WINDOWS\ntbtlog.txt -> [Ver = | Size = 124486 bytes | Modified Date = 12/19/2006 8:58:46 PM | Attr = ]
ntdtcsetup.log -> C:\WINDOWS\ntdtcsetup.log -> [Ver = | Size = 228847 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
ocgen.log -> C:\WINDOWS\ocgen.log -> [Ver = | Size = 84417 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
OCMSN.LOG -> C:\WINDOWS\OCMSN.LOG -> [Ver = | Size = 52304 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
QTFont.for -> C:\WINDOWS\QTFont.for -> [Ver = | Size = 1409 bytes | Modified Date = 12/17/2006 4:58:10 PM | Attr = ]
QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [Ver = | Size = 54156 bytes | Modified Date = 12/21/2006 10:22:30 PM | Attr = H ]
SchedLgU.Txt -> C:\WINDOWS\SchedLgU.Txt -> [Ver = | Size = 32388 bytes | Modified Date = 12/19/2006 8:56:50 PM | Attr = ]
setupapi.log -> C:\WINDOWS\setupapi.log -> [Ver = | Size = 288093 bytes | Modified Date = 12/21/2006 6:29:42 PM | Attr = ]
SIERRA.INI -> C:\WINDOWS\SIERRA.INI -> [Ver = | Size = 512 bytes | Modified Date = 11/29/2006 5:32:34 PM | Attr = ]
TSOC.LOG -> C:\WINDOWS\TSOC.LOG -> [Ver = | Size = 431506 bytes | Modified Date = 12/17/2006 3:07:44 AM | Attr = ]
UninstallFirefox.exe -> C:\WINDOWS\UninstallFirefox.exe -> [Ver = | Size = 99965 bytes | Modified Date = 11/29/2006 7:11:42 PM | Attr = ]
updspapi.log -> C:\WINDOWS\updspapi.log -> [Ver = | Size = 48276 bytes | Modified Date = 12/17/2006 3:07:30 AM | Attr = ]
WIADEBUG.LOG -> C:\WINDOWS\WIADEBUG.LOG -> [Ver = | Size = 159 bytes | Modified Date = 12/20/2006 11:43:52 AM | Attr = ]
WIASERVC.LOG -> C:\WINDOWS\WIASERVC.LOG -> [Ver = | Size = 50 bytes | Modified Date = 12/20/2006 11:43:40 AM | Attr = ]
WindowsUpdate.log -> C:\WINDOWS\WindowsUpdate.log -> [Ver = | Size = 1192745 bytes | Modified Date = 12/22/2006 12:10:48 PM | Attr = ]
wmsetup.log -> C:\WINDOWS\wmsetup.log -> [Ver = | Size = 24364 bytes | Modified Date = 12/18/2006 3:49:22 PM | Attr = ]
yacs.log -> C:\WINDOWS\yacs.log -> [Ver = | Size = 28457 bytes | Modified Date = 11/28/2006 8:48:02 PM | Attr = ]
333D2DC9AE.sys -> C:\WINDOWS\System32\333D2DC9AE.sys -> [Ver = | Size = 56 bytes | Modified Date = 12/22/2006 11:49:54 AM | Attr = RHS]
ClickToFindandFixErrors_Intl.ico -> C:\WINDOWS\System32\ClickToFindandFixErrors_Intl.ico -> [Ver = | Size = 2238 bytes | Modified Date = 12/11/2006 2:23:40 PM | Attr = ]
d3d8caps.dat -> C:\WINDOWS\System32\d3d8caps.dat -> [Ver = | Size = 552 bytes | Modified Date = 12/20/2006 10:07:10 AM | Attr = ]
KGyGaAvL.sys -> C:\WINDOWS\System32\KGyGaAvL.sys -> [Ver = | Size = 3350 bytes | Modified Date = 12/22/2006 11:49:54 AM | Attr = HS]
LexFiles.ulf -> C:\WINDOWS\System32\LexFiles.ulf -> [Ver = | Size = 26211 bytes | Modified Date = 12/4/2006 10:32:50 PM | Attr = ]
MobileSidewalkRON_2.ico -> C:\WINDOWS\System32\MobileSidewalkRON_2.ico -> [Ver = | Size = 72566 bytes | Modified Date = 12/19/2006 10:22:46 AM | Attr = ]
TitanPokerIconDropTRA108.ico -> C:\WINDOWS\System32\TitanPokerIconDropTRA108.ico -> [Ver = | Size = 9158 bytes | Modified Date = 12/8/2006 11:06:00 AM | Attr = ]
TrafficSales_Casino_3.ico -> C:\WINDOWS\System32\TrafficSales_Casino_3.ico -> [Ver = | Size = 22486 bytes | Modified Date = 12/21/2006 2:57:32 PM | Attr = ]
WPA.DBL -> C:\WINDOWS\System32\WPA.DBL -> [Ver = | Size = 1170 bytes | Modified Date = 12/22/2006 12:40:20 PM | Attr = ]
avg7core.sys -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsw.sys -> C:\WINDOWS\System32\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avg7rsxp.sys -> C:\WINDOWS\System32\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7,1,0,398 | Size = 28416 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgclean.sys -> C:\WINDOWS\System32\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgmfx86.sys -> C:\WINDOWS\System32\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
avgtdi.sys -> C:\WINDOWS\System32\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]

[File String Scan - Non-Microsoft Only]
UPX0 , -> C:\ar505enu.exe -> InstallShield Software Corporation [Ver = 2.02.001 | Size = 8981440 bytes | Modified Date = 7/9/2002 6:18:42 PM | Attr = ]
UPX0 , -> C:\avg6386fu_free.exe -> [Ver = | Size = 5433344 bytes | Modified Date = 9/17/2002 9:28:30 PM | Attr = ]
Thawte Consulting , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip -> [Ver = | Size = 3290841 bytes | Modified Date = 12/6/2004 10:57:36 PM | Attr = ]
USERTRUST , -> C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\patch-jre1.5.0_09.b03\patchjre.exe -> Sun Microsystems, Inc. [Ver = 1, 0, 0, 1 | Size = 4490872 bytes | Modified Date = 10/12/2006 3:41:58 AM | Attr = ]
FSG! , -> C:\Program Files\Common Files\Microsoft Shared\Shoebox\STANDARD.SBT -> [Ver = | Size = 19954310 bytes | Modified Date = 6/21/2000 3:59:14 AM | Attr = ]
PEC2 , -> C:\Program Files\Common Files\Sony Shared\AVLib\Metallic.dll -> Sony Corporation [Ver = 2.7.00.14160 | Size = 229376 bytes | Modified Date = 2/17/2004 8:16:12 AM | Attr = ]
UPX! , UPX0 , -> C:\WINDOWS\Zambelli Fireworks Screensaver.scr -> [Ver = | Size = 671744 bytes | Modified Date = 9/27/2001 2:04:28 PM | Attr = ]
PEC2 , -> C:\WINDOWS\System32\DFRG.MSC -> [Ver = | Size = 41397 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
winsync , -> C:\WINDOWS\System32\WBDBASE.DEU -> [Ver = | Size = 1309184 bytes | Modified Date = 8/18/2001 5:00:00 AM | Attr = ]
Thawte Consulting , -> C:\WINDOWS\System32\XceedFtp.dll -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 1.1.129.0 | Size = 279392 bytes | Modified Date = 8/31/2005 10:35:40 AM | Attr = ]
UPX! , FSG! , PEC2 , aspack , -> C:\WINDOWS\System32\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 12/17/2006 8:37:50 AM | Attr = ]
PTech , -> C:\WINDOWS\System32\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Modified Date = 8/3/2004 11:41:38 PM | Attr = ]

< End of report >

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

logfile

✨ Ask AI

Ask AI