Spyware / Malware / Virus Removal

[Resolved] Infected with Win32:Agent-QNI[Trj]

11 min read

Looking for the outcome? Ask AI

-Maverick- Topic Starter

Post #1October 17, 2008, 7:12 PM UTC

Avast has just popped up a warning that I have the following Win32:Agent-QNI[Trj] which it said was located in C:\WINDOWS\system32\dllcache\figaro.sys. I chose to delete it and immediately my laptop shut down and rebooted itself. As soon as it was rebooted I got the following popup from my taskbar telling me: "Your computer is infected! Windows has detected spyware infection!"

I also had a popup from Outpost Firewall letting me know that BRASTK.EXE was trying to make a connection and I created a rule to never allow it to make a connection.

Below is my HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:37:25 PM, on 17/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\brastk.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://pc.support.global.toshiba.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shoptoshiba.ca/welcome
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] launchapp
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Toshiba Hotkey Utility] "C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" /lang en
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'SYSTEM')
O4 - .DEFAULT Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
O4 - .DEFAULT User Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1197965572375
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsubleepa Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

–
End of file - 8248 bytes

This is my work laptop and I'm in desperate need to get it cleaned up A.S.A.P.

Any help/guidance would be greatly appreciated.

Rorschach112

Post #2October 17, 2008, 7:21 PM UTC

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.

Please download SmitfraudFix (by S!Ri) to your Desktop.

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.

Open the OTScanIt2 folder and double-click on OTScanIt.exe to start the program.
Under File Age at the top, change it from 30 days to 90 days
Under Additional Scans check the boxes beside Reg - App Paths, Reg - Desktop Components, Reg - Disabled MS Config Items, Reg - File Associations, File - Lop Check, File - Purity Scan, and Evnt - EventViewer Logs ( Last 10 Errors).
Under Rootkit Search change it to Yes
Now click the Run Scan button on the toolbar.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and post the information back here in an attachment. I will review it when it comes in. The last line is < End of Report >, so make sure that is the last line in the attached report.

Make sure you attach the report in your reply. If it is too big to upload, then zip the text file and upload it that way

-Maverick-

Post #3October 17, 2008, 8:43 PM UTC last edited October 17, 2008, 8:45 PM UTC

Thanks for the quick reply and help Rorschach112. I've followed your instructions for the SmitfraudFix and here's the content of the rapport.txt:

SmitFraudFix v2.363

Scan done at 16:13:11.18, 17/10/2008
Run from C:\Documents and Settings\Christine\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\brastk.exe Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{34382EBC-EE5E-4987-BA12-FE719C8027C2}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{34382EBC-EE5E-4987-BA12-FE719C8027C2}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{34382EBC-EE5E-4987-BA12-FE719C8027C2}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

I also followed your instruction for the OTScanIt2.exe program and while it was scanning Avast popped up the following alert 3 times:

C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\idobehsn.dll

Win32-Inject-EV[Trj]

The first time the alert came up I moved in to the chest. The second and third time I ignored it.

Here's the content of the OTScanIt.Txt file:

OTScanIt2 logfile created on: 17/10/2008 4:28:32 PM - Run 1
OTScanIt2 by OldTimer - Version 1.0.0.15b	 Folder = C:\Documents and Settings\Christine\Desktop\OTScanIt2
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy
 
2.00 Gb Total Physical Memory | 1.53 Gb Available Physical Memory | 76.74% Memory free
3.85 Gb Paging File | 3.50 Gb Available in Paging File | 91.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092;
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 101.54 Gb Total Space | 87.52 Gb Free Space | 86.19% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 9.95 Gb Free Space | 99.47% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: SP
Current User Name: Christine
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Whitelist: On
File Age = 90 Days
 
[Processes - Safe List]
evteng.exe -> %ProgramFiles%\Intel\Wireless\Bin\EvtEng.exe -> [2005/11/28 12:29:00 | 00,114,753 | —- | M] (Intel Corporation)
s24evmon.exe -> %ProgramFiles%\Intel\Wireless\Bin\S24EvMon.exe -> [2005/11/28 12:31:32 | 00,540,745 | —- | M] (Intel Corporation )
aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> [2007/12/04 10:36:33 | 00,017,272 | —- | M] (ALWIL Software)
ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> [2007/12/04 09:00:16 | 00,140,664 | —- | M] (ALWIL Software)
ehtray.exe -> %SystemRoot%\ehome\ehtray.exe -> [2005/08/05 17:56:34 | 00,064,512 | —- | M] (Microsoft Corporation)
ndstray.exe -> %ProgramFiles%\TOSHIBA\ConfigFree\NDSTray.exe -> [2005/11/02 13:41:00 | 00,978,944 | —- | M] (TOSHIBA CORPORATION)
dlactrlw.exe -> %SystemRoot%\system32\DLA\DLACTRLW.EXE -> [2005/10/06 09:20:00 | 00,122,940 | —- | M] (Sonic Solutions)
smoothview.exe -> %ProgramFiles%\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe -> [2005/04/26 20:13:20 | 00,122,880 | —- | M] (TOSHIBA Corporation)
hotkey.exe -> %ProgramFiles%\TOSHIBA\Windows Utilities\Hotkey.exe -> [2006/03/14 15:12:24 | 01,769,472 | —- | M] (TOSHIBA Inc.)
syntpenh.exe -> %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe -> [2006/03/02 04:02:08 | 00,761,948 | —- | M] (Synaptics, Inc.)
toshiba.exe -> %ProgramFiles%\Synaptics\SynTP\Toshiba.exe -> [2006/03/02 03:50:52 | 00,151,552 | —- | M] (Synaptics, Inc.)
zcfgsvc.exe -> %ProgramFiles%\Intel\Wireless\Bin\ZCfgSvc.exe -> [2005/12/05 13:37:40 | 00,667,718 | —- | M] (Intel Corporation)
ifrmewrk.exe -> %ProgramFiles%\Intel\Wireless\Bin\iFrmewrk.exe -> [2005/11/28 12:41:50 | 00,602,182 | —- | M] (Intel Corporation)
jusched.exe -> %ProgramFiles%\Java\jre1.6.0_03\bin\jusched.exe -> [2007/09/25 02:11:35 | 00,132,496 | —- | M] (Sun Microsystems, Inc.)
ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> [2007/12/04 09:00:23 | 00,079,224 | —- | M] (ALWIL Software)
toscdspd.exe -> %ProgramFiles%\TOSHIBA\TOSCDSPD\TOSCDSPD.exe -> [2004/12/30 04:32:20 | 00,065,536 | —- | M] (TOSHIBA)
ramasst.exe -> %SystemRoot%\system32\RAMASST.exe -> [2004/08/27 21:37:00 | 00,155,648 | —- | M] (Matsushita Electric Industrial Co., Ltd.)
a2service.exe -> %ProgramFiles%\a-squared Free\a2service.exe -> [2008/08/17 02:29:48 | 00,380,536 | —- | M] (Emsi Software GmbH)
mdnsresponder.exe -> %ProgramFiles%\Bonjour\mDNSResponder.exe -> [2006/02/28 13:42:38 | 00,229,376 | —- | M] (Apple Computer, Inc.)
cfsvcs.exe -> %ProgramFiles%\TOSHIBA\ConfigFree\CFSvcs.exe -> [2005/01/17 13:38:00 | 00,040,960 | —- | M] (TOSHIBA CORPORATION)
dvdramsv.exe -> %SystemRoot%\system32\DVDRAMSV.exe -> [2004/08/27 21:33:00 | 00,110,592 | —- | M] (Matsushita Electric Industrial Co., Ltd.)
ehrecvr.exe -> %SystemRoot%\ehome\ehrecvr.exe -> [2005/10/11 12:40:32 | 00,237,568 | —- | M] (Microsoft Corporation)
ehsched.exe -> %SystemRoot%\ehome\ehSched.exe -> [2005/08/05 17:56:32 | 00,102,912 | —- | M] (Microsoft Corporation)
nvsvc32.exe -> %SystemRoot%\system32\nvsvc32.exe -> [2006/02/15 19:34:00 | 00,143,426 | —- | M] (NVIDIA Corporation)
outpost.exe -> %ProgramFiles%\Agnitum\Outpost Firewall\outpost.exe -> [2007/04/05 17:56:54 | 00,094,720 | —- | M] (Agnitum Ltd.)
regsrvc.exe -> %ProgramFiles%\Intel\Wireless\Bin\RegSrvc.exe -> [2005/11/28 12:28:14 | 00,217,164 | —- | M] (Intel Corporation)
mcrdsvc.exe -> %SystemRoot%\ehome\mcrdsvc.exe -> [2005/08/05 17:27:08 | 00,099,328 | —- | M] (Microsoft Corporation)
calmain.exe -> %ProgramFiles%\Canon\CAL\CALMAIN.exe -> [2005/09/30 19:22:50 | 00,096,341 | —- | M] (Canon Inc.)
ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> [2007/12/04 08:59:53 | 00,247,160 | —- | M] (ALWIL Software)
wscntfy.exe -> %SystemRoot%\system32\wscntfy.exe -> [2004/08/10 08:00:00 | 00,013,824 | —- | M] (Microsoft Corporation)
dot1xcfg.exe -> %ProgramFiles%\Intel\Wireless\Bin\Dot1XCfg.exe -> [2005/11/28 12:37:52 | 00,397,381 | —- | M] (Intel Corporation)
ehmsas.exe -> %SystemRoot%\ehome\ehmsas.exe -> [2005/08/05 17:56:28 | 00,046,592 | —- | M] (Microsoft Corporation)
ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> [2007/12/04 08:59:01 | 00,345,464 | —- | M] (ALWIL Software)
wmiprvse.exe -> %SystemRoot%\system32\wbem\wmiprvse.exe -> [2004/08/10 08:00:00 | 00,218,112 | —- | M] (Microsoft Corporation)
wordpad.exe -> %ProgramFiles%\Windows NT\Accessories\wordpad.exe -> [2004/08/10 08:00:00 | 00,214,528 | —- | M] (Microsoft Corporation)
firefox.exe -> %ProgramFiles%\Mozilla Firefox\firefox.exe -> [2008/09/24 13:43:01 | 07,671,408 | —- | M] (Mozilla Corporation)
otscanit2.exe -> %UserProfile%\Desktop\OTScanIt2\OTScanIt2.exe -> [2008/10/16 22:36:52 | 00,416,256 | —- | M] (OldTimer Tools)
 
[Win32 Services - Safe List]
(a2free) a-squared Free Service [Win32_Own | Auto | Running] -> %ProgramFiles%\a-squared Free\a2service.exe -> [2008/08/17 02:29:48 | 00,380,536 | —- | M] (Emsi Software GmbH)
(Adobe LM Service) Adobe LM Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Adobe Systems Shared\Service\Adobelmsvc.exe -> [2008/01/10 16:33:37 | 00,072,704 | —- | M] (Adobe Systems)
(aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -> [2004/07/15 05:49:26 | 00,032,768 | —- | M] (Microsoft Corporation)
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> [2007/12/04 10:36:33 | 00,017,272 | —- | M] (ALWIL Software)
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> [2007/12/04 09:00:16 | 00,140,664 | —- | M] (ALWIL Software)
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> [2007/12/04 08:59:53 | 00,247,160 | —- | M] (ALWIL Software)
(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> [2007/12/04 08:59:01 | 00,345,464 | —- | M] (ALWIL Software)
(Bonjour Service) ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## [Win32_Own | Auto | Running] -> %ProgramFiles%\Bonjour\mDNSResponder.exe -> [2006/02/28 13:42:38 | 00,229,376 | —- | M] (Apple Computer, Inc.)
(CCALib8) Canon Camera Access Library 8 [Win32_Own | Auto | Running] -> %ProgramFiles%\Canon\CAL\CALMAIN.exe -> [2005/09/30 19:22:50 | 00,096,341 | —- | M] (Canon Inc.)
(CFSvcs) ConfigFree Service [Win32_Own | Auto | Running] -> %ProgramFiles%\TOSHIBA\ConfigFree\CFSvcs.exe -> [2005/01/17 13:38:00 | 00,040,960 | —- | M] (TOSHIBA CORPORATION)
(DVD-RAM_Service) DVD-RAM_Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\DVDRAMSV.exe -> [2004/08/27 21:33:00 | 00,110,592 | —- | M] (Matsushita Electric Industrial Co., Ltd.)
(ehRecvr) Media Center Receiver Service [Win32_Own | Auto | Running] -> %SystemRoot%\ehome\ehrecvr.exe -> [2005/10/11 12:40:32 | 00,237,568 | —- | M] (Microsoft Corporation)
(ehSched) Media Center Scheduler Service [Win32_Own | Auto | Running] -> %SystemRoot%\ehome\ehSched.exe -> [2005/08/05 17:56:32 | 00,102,912 | —- | M] (Microsoft Corporation)
(EvtEng) Intel(R) PROSet/Wireless Event Log [Win32_Own | Auto | Running] -> %ProgramFiles%\Intel\Wireless\Bin\EvtEng.exe -> [2005/11/28 12:29:00 | 00,114,753 | —- | M] (Intel Corporation)
(FLEXnet Licensing Service) FLEXnet Licensing Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -> [2008/01/09 16:49:44 | 00,654,848 | —- | M] (Macrovision Europe Ltd.)
(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IDriverT.exe -> [2005/04/04 04:41:10 | 00,069,632 | —- | M] (Macrovision Corporation)
(McrdSvc) Media Center Extender Service [Win32_Own | Auto | Running] -> %SystemRoot%\ehome\mcrdsvc.exe -> [2005/08/05 17:27:08 | 00,099,328 | —- | M] (Microsoft Corporation)
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\nvsvc32.exe -> [2006/02/15 19:34:00 | 00,143,426 | —- | M] (NVIDIA Corporation)
(ose) Office Source Engine [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Microsoft Shared\Source Engine\OSE.EXE -> [2003/07/28 13:28:22 | 00,089,136 | —- | M] (Microsoft Corporation)
(OutpostFirewall) Outpost Firewall Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\outpost.exe -> [2007/04/05 17:56:54 | 00,094,720 | —- | M] (Agnitum Ltd.)
(RegSrvc) Intel(R) PROSet/Wireless Registry Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Intel\Wireless\Bin\RegSrvc.exe -> [2005/11/28 12:28:14 | 00,217,164 | —- | M] (Intel Corporation)
(S24EventMonitor) Intel(R) PROSet/Wireless Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Intel\Wireless\Bin\S24EvMon.exe -> [2005/11/28 12:31:32 | 00,540,745 | —- | M] (Intel Corporation )
(UMWdf) Windows User Mode Driver Framework [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\system32\wdfmgr.exe -> [2004/08/11 05:45:04 | 00,038,912 | —- | M] (Microsoft Corporation)
 
[Driver Services - Safe List]
(Aavmker4) avast! Asynchronous Virus Monitor [Kernel | System | Running] -> %SystemRoot%\System32\drivers\aavmker4.sys -> [2007/12/04 10:49:02 | 00,026,624 | —- | M] (ALWIL Software)
(ADBLOCK.DLL) Outpost Firewall PlugIn (ADBLOCK.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\adblock.dll -> [2007/04/05 17:57:18 | 00,033,568 | —- | M] (Agnitum Ltd.)
(AegisP) AEGIS Protocol (IEEE 802.1x) v3.4.9.0 [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\AegisP.sys -> [2007/12/16 08:00:48 | 00,021,275 | —- | M] (Meetinghouse Data Communications)
(ARP.DLL) Outpost Firewall PlugIn (ARP.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\arp.dll -> [2007/04/05 17:57:48 | 00,017,632 | —- | M] (Agnitum Ltd.)
(aswMon2) avast! Standard Shield Support [File_System | Auto | Running] -> %SystemRoot%\System32\drivers\aswmon2.sys -> [2007/12/04 10:55:46 | 00,094,544 | —- | M] (ALWIL Software)
(aswRdr) aswRdr [Kernel | On_Demand | Running] -> %SystemRoot%\System32\drivers\aswRdr.sys -> [2007/12/04 10:53:39 | 00,023,152 | —- | M] (ALWIL Software)
(aswTdi) avast! Network Shield Support [Kernel | System | Running] -> %SystemRoot%\System32\drivers\aswTdi.sys -> [2007/12/04 10:51:52 | 00,042,912 | —- | M] (ALWIL Software)
(BoiHwsetup) Access 32bits INT15 routine [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\BoiHwSetup.sys -> [2005/06/10 02:42:00 | 00,005,504 | —- | M] (Quanta Computer Corp)
(CONTENT.DLL) Outpost Firewall PlugIn (CONTENT.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\content.dll -> [2007/04/05 17:57:28 | 00,004,896 | —- | M] (Agnitum Ltd.)
(DLABOIOM) DLABOIOM [File_System | Auto | Running] -> %SystemRoot%\system32\DLA\DLABOIOM.SYS -> [2005/10/06 09:20:00 | 00,025,628 | —- | M] (Sonic Solutions)
(DLACDBHM) DLACDBHM [File_System | System | Running] -> %SystemRoot%\system32\drivers\DLACDBHM.SYS -> [2005/08/25 16:16:52 | 00,005,628 | —- | M] (Sonic Solutions)
(DLADResN) DLADResN [File_System | Auto | Running] -> %SystemRoot%\system32\DLA\DLADResN.SYS -> [2005/10/06 09:20:00 | 00,002,496 | —- | M] (Sonic Solutions)
(DLAIFS_M) DLAIFS_M [File_System | Auto | Running] -> %SystemRoot%\system32\DLA\DLAIFS_M.SYS -> [2005/10/06 09:20:00 | 00,086,524 | —- | M] (Sonic Solutions)
(DLAOPIOM) DLAOPIOM [File_System | Auto | Running] -> %SystemRoot%\system32\DLA\DLAOPIOM.SYS -> [2005/10/06 09:20:00 | 00,014,684 | —- | M] (Sonic Solutions)
(DLAPoolM) DLAPoolM [File_System | Auto | Running] -> %SystemRoot%\system32\DLA\DLAPoolM.SYS -> [2005/10/06 09:20:00 | 00,006,364 | —- | M] (Sonic Solutions)
(DLARTL_N) DLARTL_N [File_System | System | Running] -> %SystemRoot%\system32\drivers\DLARTL_N.SYS -> [2005/08/25 16:16:16 | 00,022,684 | —- | M] (Sonic Solutions)
(DLAUDFAM) DLAUDFAM [File_System | Auto | Running] -> %SystemRoot%\system32\DLA\DLAUDFAM.SYS -> [2005/10/06 09:20:00 | 00,094,332 | —- | M] (Sonic Solutions)
(DLAUDF_M) DLAUDF_M [File_System | Auto | Running] -> %SystemRoot%\system32\DLA\DLAUDF_M.SYS -> [2005/10/06 09:20:00 | 00,087,036 | —- | M] (Sonic Solutions)
(DNSCACHE.DLL) Outpost Firewall PlugIn (DNSCACHE.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\dnscache.dll -> [2007/04/05 17:57:06 | 00,014,656 | —- | M] (Agnitum Ltd.)
(DRVMCDB) DRVMCDB [Kernel | Boot | Running] -> %SystemRoot%\system32\drivers\DRVMCDB.SYS -> [2005/09/12 07:30:00 | 00,089,264 | —- | M] (Sonic Solutions)
(DRVNDDM) DRVNDDM [File_System | Auto | Running] -> %SystemRoot%\system32\drivers\DRVNDDM.SYS -> [2005/08/12 09:20:00 | 00,040,544 | —- | M] (Sonic Solutions)
(e1express) Intel(R) PRO/1000 PCI Express Network Connection Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\e1e5132.sys -> [2005/09/13 23:24:08 | 00,179,200 | —- | M] (Intel Corporation)
(FTPFILT.DLL) Outpost Firewall PlugIn (FTPFILT.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\ftpfilt.dll -> [2007/04/05 17:57:40 | 00,009,248 | —- | M] (Agnitum Ltd.)
(HdAudAddService) Microsoft UAA Function Driver for High Definition Audio Service [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\CHDAud.sys -> [2005/12/28 19:20:38 | 00,561,664 | —- | M] (Conexant Systems Inc.)
(HDAudBus) Microsoft UAA Bus Driver for High Definition Audio [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\Hdaudbus.sys -> [2005/01/07 21:07:18 | 00,138,752 | —- | M] (Windows (R) Server 2003 DDK provider)
(HSFHWAZL) HSFHWAZL [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\HSFHWAZL.sys -> [2005/11/07 20:11:00 | 00,202,240 | —- | M] (Conexant Systems, Inc.)
(HSF_DPV) HSF_DPV [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\HSF_DPV.sys -> [2005/11/07 20:12:00 | 00,997,376 | —- | M] (Conexant Systems, Inc.)
(HTMLFILT.DLL) Outpost Firewall PlugIn (HTMLFILT.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\htmlfilt.dll -> [2007/04/05 17:57:14 | 00,011,552 | —- | M] (Agnitum Ltd.)
(HTTPFILT.DLL) Outpost Firewall PlugIn (HTTPFILT.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\httpfilt.dll -> [2007/04/05 17:57:12 | 00,013,216 | —- | M] (Agnitum Ltd.)
(IMAPFILT.DLL) Outpost Firewall PlugIn (IMAPFILT.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\imapfilt.dll -> [2007/04/05 17:57:36 | 00,007,168 | —- | M] (Agnitum Ltd.)
(Iviaspi) IVI ASPI Shell [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\iviaspi.sys -> [2003/09/11 03:36:54 | 00,021,060 | —- | M] (InterVideo, Inc.)
(MAILFILT.DLL) Outpost Firewall PlugIn (MAILFILT.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\mailfilt.dll -> [2007/04/05 17:57:26 | 00,014,880 | —- | M] (Agnitum Ltd.)
(mdmxsdk) mdmxsdk [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\mdmxsdk.sys -> [2005/10/04 20:57:00 | 00,012,544 | —- | M] (Conexant)
(meiudf) meiudf [File_System | System | Running] -> %SystemRoot%\system32\drivers\meiudf.sys -> [2005/06/02 00:33:00 | 00,102,384 | —- | M] (Matsushita Electric Industrial Co.,Ltd.)
(Netdevio) TOSHIBA Network Device Usermode I/O Protocol [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\Netdevio.sys -> [2003/01/29 11:35:00 | 00,012,032 | —- | M] (TOSHIBA Corporation.)
(NNTPFILT.DLL) Outpost Firewall PlugIn (NNTPFILT.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\nntpfilt.dll -> [2007/04/05 17:57:32 | 00,006,752 | —- | M] (Agnitum Ltd.)
(nv) nv [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\nv4_mini.sys -> [2006/02/15 19:34:00 | 03,642,944 | —- | M] (NVIDIA Corporation)
(Pfc) Padus ASPI Shell [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\pfc.sys -> [2003/09/19 05:47:00 | 00,010,368 | —- | M] (Padus, Inc.)
(POP3FILT.DLL) Outpost Firewall PlugIn (POP3FILT.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\pop3filt.dll -> [2007/04/05 17:57:22 | 00,010,048 | —- | M] (Agnitum Ltd.)
(PROTECT.DLL) Outpost Firewall PlugIn (PROTECT.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\protect.dll -> [2007/04/05 17:57:42 | 00,015,200 | —- | M] (Agnitum Ltd.)
(Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\ptilink.sys -> [2004/08/10 08:00:00 | 00,017,792 | —- | M] (Parallel Technologies, Inc.)
(PxHelp20) PxHelp20 [Kernel | Boot | Running] -> %SystemRoot%\system32\drivers\pxhelp20.sys -> [2005/04/25 05:03:00 | 00,020,640 | —- | M] (Sonic Solutions)
(qkbfiltr) Quanta HotKey Keyboard Filter Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\qkbfiltr.sys -> [2006/01/12 20:21:18 | 00,031,872 | —- | M] (Quanta Computer, Inc.)
(qmofiltr) Quanta HotKey Mouse Filter Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\qmofiltr.sys -> [2005/05/05 18:27:38 | 00,007,936 | —- | M] (Quanta Computer, Inc.)
(s24trans) WLAN Transport [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\s24trans.sys -> [2005/11/28 13:09:26 | 00,013,568 | —- | M] (Intel Corporation)
(SandBox) Outpost Firewall Sandbox Driver [Kernel | System | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\SandBox.sys -> [2007/06/18 14:07:48 | 00,406,344 | —- | M] (Agnitum Ltd.)
(sdbus) sdbus [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\sdbus.sys -> [2004/08/10 08:00:00 | 00,067,584 | —- | M] (Microsoft Corporation)
(Secdrv) Secdrv [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\secdrv.sys -> [2007/11/13 06:25:53 | 00,020,480 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
(SECRET.DLL) Outpost Firewall PlugIn (SECRET.DLL) [Kernel | On_Demand | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\secret.dll -> [2007/04/05 17:57:52 | 00,013,056 | —- | M] (Agnitum Ltd.)
(SynTP) Synaptics TouchPad Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\SynTP.sys -> [2006/03/02 03:46:54 | 00,191,968 | —- | M] (Synaptics, Inc.)
(TBiosDrv) TBiosDrv [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\Tbiosdrv.sys -> [2002/01/24 15:43:40 | 00,006,528 | —- | M] ()
(tifm21) tifm21 [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\tifm21.sys -> [2005/11/29 15:12:00 | 00,162,560 | —- | M] (Texas Instruments)
(VFILT) Outpost Firewall Kernel Driver [Kernel | System | Running] -> %ProgramFiles%\Agnitum\Outpost Firewall\Kernel\filtnt.sys -> [2007/04/05 17:56:16 | 00,163,840 | —- | M] (Agnitum Ltd.)
(w39n51) Intel(R) PRO/Wireless 3945ABG Adapter Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\w39n51.sys -> [2005/12/04 22:55:30 | 01,428,096 | —- | M] (Intel® Corporation)
(winachsf) winachsf [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\HSF_CNXT.sys -> [2005/11/07 20:11:00 | 00,723,712 | —- | M] (Conexant Systems, Inc.)
(WmiAcpi) Microsoft Windows Management Interface for ACPI [Kernel | System | Running] -> %SystemRoot%\system32\drivers\wmiacpi.sys -> [2004/08/03 19:07:42 | 00,008,832 | —- | M] (Microsoft Corporation)
 
[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=6&ar;=msnhome -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> C:\windows\system32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid;={SUB_CLSID}&pver;={SUB_PVER}&ar;=home -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_LOCAL_MACHINE\: Search\\"Default_Search_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch -> 
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> 
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> 
HKEY_CURRENT_USER\: Main\\"Default_Search_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch -> 
HKEY_CURRENT_USER\: Main\\"Local Page" -> C:\windows\system32\blank.htm -> 
HKEY_CURRENT_USER\: Main\\"Page_Transitions" ->  -> 
HKEY_CURRENT_USER\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch -> 
HKEY_CURRENT_USER\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=6&ar;=msnhome -> 
HKEY_CURRENT_USER\: SearchURL\\"" -> http://home.microsoft.com/access/autosearch.asp?p=%s -> 
HKEY_CURRENT_USER\: SearchURL\\"provider" ->  -> 
HKEY_CURRENT_USER\: "ProxyEnable" -> 0 -> 
HKEY_CURRENT_USER\: "ProxyOverride" -> *.local -> 
< HOSTS File > (1001 bytes and 24 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts -> 
127.0.0.1	   localhost
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"avast!" -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe [C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe] -> [2007/12/04 09:00:23 | 00,079,224 | —- | M] (ALWIL Software)
"brastk" -> %SystemRoot%\system32\brastk.exe [C:\WINDOWS\system32\brastk.exe] -> File not found
"DLA" -> %SystemRoot%\system32\DLA\DLACTRLW.EXE [C:\WINDOWS\System32\DLA\DLACTRLW.EXE] -> [2005/10/06 09:20:00 | 00,122,940 | —- | M] (Sonic Solutions)
"ehTray" -> %SystemRoot%\ehome\ehtray.exe [C:\WINDOWS\ehome\ehtray.exe] -> [2005/08/05 17:56:34 | 00,064,512 | —- | M] (Microsoft Corporation)
"High Definition Audio Property Page Shortcut" -> %SystemRoot%\system32\CHDAudPropShortcut.exe [CHDAudPropShortcut.exe] -> [2005/12/28 19:21:02 | 00,061,952 | —- | M] (Windows (R) Server 2003 DDK provider)
"IntelWireless" -> %ProgramFiles%\Intel\Wireless\Bin\iFrmewrk.exe ["C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless] -> [2005/11/28 12:41:50 | 00,602,182 | —- | M] (Intel Corporation)
"IntelZeroConfig" -> %ProgramFiles%\Intel\Wireless\Bin\ZCfgSvc.exe ["C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"] -> [2005/12/05 13:37:40 | 00,667,718 | —- | M] (Intel Corporation)
"LaunchApp" ->  [launchapp] -> File not found
"NDSTray.exe" ->  [NDSTray.exe] -> File not found
"NvCplDaemon" -> %SystemRoot%\system32\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> [2006/02/15 19:34:00 | 07,557,120 | —- | M] (NVIDIA Corporation)
"nwiz" -> %SystemRoot%\system32\nwiz.exe [nwiz.exe /installquiet] -> [2006/02/15 19:34:00 | 01,519,616 | —- | M] ()
"Outpost Firewall" -> %ProgramFiles%\Agnitum\Outpost Firewall\outpost.exe [C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice] -> [2007/04/05 17:56:54 | 00,094,720 | —- | M] (Agnitum Ltd.)
"OutpostFeedBack" -> %ProgramFiles%\Agnitum\Outpost Firewall\feedback.exe [C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup] -> [2007/06/09 14:35:54 | 00,335,872 | —- | M] (Agnitum Ltd.)
"QuickTime Task" -> %ProgramFiles%\QuickTime\QTTask.exe ["C:\Program Files\QuickTime\qttask.exe" -atboottime] -> [2008/03/28 23:37:20 | 00,413,696 | —- | M] (Apple Inc.)
"SmoothView" -> %ProgramFiles%\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe [C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe] -> [2005/04/26 20:13:20 | 00,122,880 | —- | M] (TOSHIBA Corporation)
"SunJavaUpdateSched" -> %ProgramFiles%\Java\jre1.6.0_03\bin\jusched.exe ["C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"] -> [2007/09/25 02:11:35 | 00,132,496 | —- | M] (Sun Microsystems, Inc.)
"SynTPEnh" -> %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] -> [2006/03/02 04:02:08 | 00,761,948 | —- | M] (Synaptics, Inc.)
"Toshiba Hotkey Utility" -> %ProgramFiles%\TOSHIBA\Windows Utilities\Hotkey.exe ["C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" /lang en] -> [2006/03/14 15:12:24 | 01,769,472 | —- | M] (TOSHIBA Inc.)
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"TOSCDSPD" -> %ProgramFiles%\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe] -> [2004/12/30 04:32:20 | 00,065,536 | —- | M] (TOSHIBA)
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 
%AllUsersProfile%\Start Menu\Programs\Startup\RAMASST.lnk -> %SystemRoot%\system32\RAMASST.exe -> [2004/08/27 21:37:00 | 00,155,648 | —- | M] (Matsushita Electric Industrial Co., Ltd.)
< Christine Startup Folder > -> C:\Documents and Settings\Christine\Start Menu\Programs\Startup -> 
%UserProfile%\Start Menu\Programs\Startup\Adobe Gamma.lnk -> %CommonProgramFiles%\Adobe\Calibration\Adobe Gamma Loader.exe -> [2005/03/16 20:16:50 | 00,113,664 | —- | M] (Adobe Systems, Inc.)
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"dontdisplaylastusername" ->  [0] -> File not found
\\"legalnoticecaption" ->  [] -> File not found
\\"legalnoticetext" ->  [] -> File not found
\\"shutdownwithoutlogon" ->  [1] -> File not found
\\"undockwithoutlogon" ->  [1] -> File not found
\\"InstallVisualStyle" -> %SystemRoot%\Resources\Themes\Royale\Royale.mss [C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles] -> File not found
\\"InstallTheme" -> %SystemRoot%\Resources\Themes\Royale.the [C:\WINDOWS\Resources\Themes\Royale.theme] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" ->  [145] -> File not found
< CurrentVersion Policy Settings - System [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} [HKLM] -> %ProgramFiles%\Java\jre1.6.0_03\bin\npjpi160_03.dll [Menu: Sun Java Console] -> [2007/09/25 02:11:34 | 00,132,496 | —- | M] (Sun Microsystems, Inc.)
{44627E97-789B-40d4-B5C2-58BD171129A1}:{A1A7E22D-1587-4230-8F16-081C68D21448} [HKLM] -> %ProgramFiles%\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll [Button: Outpost Firewall Pro Quick Tune] -> [2007/06/09 14:14:36 | 00,294,912 | —- | M] (Agnitum Ltd.)
{92780B25-18CC-41C8-B9BE-3C9C571A8263}:{FF059E31-CC5A-4E2E-BF3B-96E929D65503} [HKLM] -> %ProgramFiles%\Microsoft Office\OFFICE11\REFIEBAR.DLL [Button: Research] -> [2003/07/14 23:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Menu: Spybot - Search & Destroy Configuration] -> [2008/08/14 13:39:52 | 01,562,448 | —- | M] (Safer Networking Limited)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Button: Messenger] -> [2004/10/13 12:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2004/10/13 12:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> 
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> %ProgramFiles%\Java\jre1.6.0_03\bin\npjpi160_03.dll [Sun Java Console] -> [2007/09/25 02:11:34 | 00,132,496 | —- | M] (Sun Microsystems, Inc.)
CmdMapping\\"{44627E97-789B-40d4-B5C2-58BD171129A1}" [HKLM] -> %ProgramFiles%\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll [Outpost Firewall Pro Quick Tune] -> [2007/06/09 14:14:36 | 00,294,912 | —- | M] (Agnitum Ltd.)
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] -> %ProgramFiles%\Microsoft Office\OFFICE11\REFIEBAR.DLL [Research] -> [2003/07/14 23:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
CmdMapping\\"{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}" [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2008/08/14 13:39:52 | 01,562,448 | —- | M] (Safer Networking Limited)
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> [2004/10/13 12:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime;=%s -> 
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. -> 
1 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 3124 domain(s) found. -> 
26 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{6414512B-B978-451D-A0D8-FCFDF33E833C} [HKLM] -> http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197965572375[WUWebControl Class] -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab[Java Plug-in 1.6.0_03] -> 
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab[Java Plug-in 1.6.0_03] -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab[Java Plug-in 1.6.0_03] -> 
{D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab[Shockwave Flash Object] -> 
< DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{34382EBC-EE5E-4987-BA12-FE719C8027C2} ->	(Intel(R) PRO/Wireless 3945ABG Network Connection) -> 
{79447A55-956F-42C6-BB8C-7519B5E748F2} ->	(Intel(R) PRO/1000 PL Network Connection) -> 
{7E48954C-E0F8-445C-BC57-0D9B1FF3D8C5} ->	(1394 Net Adapter) -> 
{ED6E858F-A383-4E67-9141-04367743C59A} ->	(1394 Net Adapter) -> 
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List -> 
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2004/08/10 08:00:00 | 00,140,800 | —- | M] (Microsoft Corporation)
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2004/08/10 08:00:00 | 00,140,800 | —- | M] (Microsoft Corporation)
"C:\Program Files\Bonjour\mDNSResponder.exe" -> C:\Program Files\Bonjour\mDNSResponder.exe [C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour] -> [2006/02/28 13:42:38 | 00,229,376 | —- | M] (Apple Computer, Inc.)
"C:\Program Files\Messenger\msmsgs.exe" -> C:\Program Files\Messenger\msmsgs.exe [C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger] -> [2004/10/13 12:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
"AlternateShell" -> cmd.exe -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> %SystemRoot%\system32\drivers\cdrom.sys [system32\DRIVERS\cdrom.sys] -> [2004/08/10 08:00:00 | 00,049,536 | —- | M] (Microsoft Corporation)
< Drives with AutoRun files > ->  -> 
C:\AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ] -> [2006/01/01 05:51:59 | 00,000,000 | —- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 
 
[Registry - Additional Scans - Safe List]
< App Paths [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ -> 
AcroRd32.exe -> %ProgramFiles%\Adobe\Acrobat 7.0\Reader\AcroRd32.exe [C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe] -> [2005/09/24 02:02:20 | 00,065,536 | —- | M] (Adobe Systems Incorporated)
ahc.exe -> %ProgramFiles%\Adobe\Adobe Help Center\ahc.exe [C:\Program Files\Adobe\Adobe Help Center\ahc.exe] -> [2005/03/15 21:46:48 | 04,460,544 | R— | M] (Adobe Systems Incorporated)
ashAvast.exe -> %ProgramFiles%\Alwil Software\Avast4\ashAvast.exe [C:\Program Files\Alwil Software\Avast4\ashAvast.exe] -> [2007/12/04 08:52:15 | 00,271,736 | —- | M] (ALWIL Software)
aupdate.dll -> %CommonProgramFiles%\Agnitum Shared\aupdate\aupdate.dll [C:\Program Files\Common Files\Agnitum Shared\aupdate\aupdate.dll] -> [2007/06/09 14:43:28 | 01,585,152 | —- | M] (Agnitum Ltd.)
bckgzm.exe -> %ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe [C:\Program Files\MSN Gaming Zone\Windows\bckgzm.exe] -> [2004/08/10 08:00:00 | 00,042,577 | —- | M] (Microsoft Corporation)
bridge.exe -> %ProgramFiles%\Adobe\Adobe Bridge CS3\Bridge.exe [C:\Program Files\Adobe\Adobe Bridge CS3\bridge.exe] -> [2007/03/14 20:21:30 | 11,151,536 | —- | M] (Adobe Systems, Inc.)
CFSServ.exe -> %ProgramFiles%\TOSHIBA\ConfigFree\CFSServ.exe [C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe] -> [2005/11/17 12:44:00 | 00,798,720 | —- | M] (TOSHIBA CORPORATION)
chkrzm.exe -> %ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe [C:\Program Files\MSN Gaming Zone\Windows\chkrzm.exe] -> [2004/08/10 08:00:00 | 00,042,575 | —- | M] (Microsoft Corporation)
cmmgr32.exe -> %SystemRoot%\system32\cmmgr32.exe [C:\WINDOWS\system32\cmmgr32.exe] -> File not found
CONF.EXE -> %ProgramFiles%\NetMeeting\conf.exe [C:\Program Files\NetMeeting\conf.exe] -> [2004/08/10 08:00:00 | 01,032,192 | —- | M] (Microsoft Corporation)
dialer.exe -> %ProgramFiles%\Windows NT\dialer.exe [C:\Program Files\Windows NT\dialer.exe] -> [2004/08/10 08:00:00 | 00,539,136 | —- | M] (Microsoft Corporation)
DVDFORM.EXE -> %ProgramFiles%\DVD-RAM\WinXP\DVD-RAM Driver\DVDForm.exe [C:\Program Files\DVD-RAM\WinXP\DVD-RAM Driver\DVDFORM.EXE] -> [2004/11/09 22:18:00 | 00,348,160 | —- | M] (Matsushita Electric Industrial Co., Ltd.)
engine.dll -> %ProgramFiles%\Agnitum\Outpost Firewall\engine.dll [C:\Program Files\Agnitum\Outpost Firewall\engine.dll] -> [2007/06/09 14:15:46 | 01,695,744 | —- | M] (Agnitum Ltd.)
firefox.exe -> %ProgramFiles%\Mozilla Firefox\firefox.exe [C:\Program Files\Mozilla Firefox\firefox.exe] -> [2008/09/24 13:43:01 | 07,671,408 | —- | M] (Mozilla Corporation)
Fireworks.exe -> %ProgramFiles%\Adobe\Adobe Fireworks CS3\Fireworks.exe [C:\Program Files\Adobe\Adobe Fireworks CS3\Fireworks.exe] -> [2007/03/16 13:54:12 | 27,781,792 | —- | M] (Adobe Systems Incorporated)
HELPCTR.EXE -> %SystemRoot%\pchealth\helpctr\binaries\HelpCtr.exe [C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe] -> [2004/08/10 08:00:00 | 00,768,512 | —- | M] (Microsoft Corporation)
HijackThis.exe -> %ProgramFiles%\Trend Micro\HijackThis\HijackThis.exe [C:\Program Files\Trend Micro\HijackThis\hijackthis.exe] -> [2007/12/16 06:28:18 | 00,396,288 | —- | M] (Trend Micro Inc.)
hrtzzm.exe -> %ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe [C:\Program Files\MSN Gaming Zone\Windows\hrtzzm.exe] -> [2004/08/10 08:00:00 | 00,042,573 | —- | M] (Microsoft Corporation)
hypertrm.exe -> %ProgramFiles%\Windows NT\hypertrm.exe ["C:\Program Files\Windows NT\hypertrm.exe"] -> [2004/08/10 08:00:00 | 00,028,160 | —- | M] (Hilgraeve, Inc.)
ICWCONN1.EXE -> %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe ["C:\Program Files\Internet Explorer\Connection Wizard\ICWCONN1.EXE"] -> [2004/08/10 08:00:00 | 00,214,528 | —- | M] (Microsoft Corporation)
ICWCONN2.EXE -> %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe ["C:\Program Files\Internet Explorer\Connection Wizard\ICWCONN2.EXE"] -> [2004/08/10 08:00:00 | 00,086,016 | —- | M] (Microsoft Corporation)
IEXPLORE.EXE -> %ProgramFiles%\Internet Explorer\IEXPLORE.EXE [C:\Program Files\Internet Explorer\iexplore.exe] -> [2004/08/10 08:00:00 | 00,093,184 | —- | M] (Microsoft Corporation)
ImageReady.exe -> %ProgramFiles%\Adobe\Adobe Photoshop CS2\ImageReady.exe [C:\Program Files\Adobe\Adobe Photoshop CS2\ImageReady.exe] -> [2005/03/22 04:41:12 | 19,980,288 | —- | M] (Adobe Systems Incorporated)
INETWIZ.EXE -> %ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe ["C:\Program Files\Internet Explorer\Connection Wizard\INETWIZ.EXE"] -> [2004/08/10 08:00:00 | 00,020,480 | —- | M] (Microsoft Corporation)
install.exe -> Reg Error: Value  does not exist or could not be read. [Reg Error: Value  does not exist or could not be read.] -> File not found
ISIGNUP.EXE -> %ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe ["C:\Program Files\Internet Explorer\Connection Wizard\ISIGNUP.EXE"] -> [2004/08/10 08:00:00 | 00,016,384 | —- | M] (Microsoft Corporation)
javaws.exe -> %ProgramFiles%\Java\jre1.6.0_03\bin\javaws.exe [C:\Program Files\Java\jre1.6.0_03\bin\javaws.exe] -> [2007/09/25 00:31:42 | 00,139,264 | —- | M] (Sun Microsystems, Inc.)
migwiz.exe -> %SystemRoot%\system32\usmt\migwiz.exe [%SystemRoot%\system32\usmt\migwiz.exe] -> [2004/08/10 08:00:00 | 00,240,128 | —- | M] (Microsoft Corporation)
moviemk.exe -> %ProgramFiles%\Movie Maker\moviemk.exe [C:\Program Files\Movie Maker\moviemk.exe] -> [2004/08/10 08:00:00 | 03,555,328 | —- | M] (Microsoft Corporation)
mplayer2.exe -> %ProgramFiles%\Windows Media Player\mplayer2.exe ["C:\Program Files\Windows Media Player\mplayer2.exe"] -> File not found
MSCONFIG.EXE -> %SystemRoot%\pchealth\helpctr\binaries\msconfig.exe [C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe] -> [2004/08/10 08:00:00 | 00,158,208 | —- | M] (Microsoft Corporation)
msimn.exe -> %ProgramFiles%\Outlook Express\msimn.exe [%ProgramFiles%\Outlook Express\msimn.exe] -> [2004/08/10 08:00:00 | 00,060,416 | —- | M] (Microsoft Corporation)
msinfo32.exe -> %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe [C:\Program Files\Common Files\Microsoft Shared\MSInfo\MSInfo32.exe] -> [2004/08/10 08:00:00 | 00,039,936 | —- | M] (Microsoft Corporation)
MSMSGS.EXE -> %ProgramFiles%\Messenger\msmsgs.exe [C:\Program Files\Messenger\msmsgs.exe] -> [2004/10/13 12:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
MsoHtmEd.exe -> Reg Error: Value  does not exist or could not be read. [Reg Error: Value  does not exist or could not be read.] -> File not found
msoxmled.exe -> %CommonProgramFiles%\Microsoft Shared\OFFICE11\MSOXMLED.EXE [C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXE] -> [2003/07/14 23:45:12 | 00,055,360 | —- | M] (Microsoft Corporation)
NDSTray.exe -> %ProgramFiles%\TOSHIBA\ConfigFree\NDSTray.exe [C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe] -> [2005/11/02 13:41:00 | 00,978,944 | —- | M] (TOSHIBA CORPORATION)
OneNote.exe -> %ProgramFiles%\Microsoft Office\OFFICE11\ONENOTE.EXE [C:\PROGRA~1\MICROS~2\OFFICE11\ONENOTE.EXE] -> [2004/06/11 22:57:58 | 00,710,344 | —- | M] (Microsoft Corporation)
ORUN32.EXE -> %SystemRoot%\ORUN32.EXE [C:\WINDOWS\ORUN32.EXE] -> File not found
pbrush.exe -> %SystemRoot%\system32\mspaint.exe [%SystemRoot%\system32\mspaint.exe] -> [2004/08/10 08:00:00 | 00,343,040 | —- | M] (Microsoft Corporation)
PCDiag.exe -> %ProgramFiles%\TOSHIBA\PCDiag\PCDiag.exe [C:\Program Files\TOSHIBA\PCDiag\PCDiag.exe] -> [2006/03/09 23:29:58 | 00,430,080 | —- | M] (TOSHIBA)
Photoshop.exe -> %ProgramFiles%\Adobe\Adobe Photoshop CS2\Photoshop.exe [C:\Program Files\Adobe\Adobe Photoshop CS2\Photoshop.exe] -> [2005/03/22 05:29:36 | 19,533,824 | —- | M] (Adobe Systems, Incorporated)
PictureViewer.exe -> %ProgramFiles%\QuickTime\PictureViewer.exe [C:\Program Files\QuickTime\PictureViewer.exe] -> [2008/03/28 23:37:12 | 00,548,864 | —- | M] (Apple Inc.)
pinball.exe -> %ProgramFiles%\Windows NT\Pinball\PINBALL.EXE [C:\Program Files\Windows NT\Pinball\pinball.exe] -> [2004/08/10 08:00:00 | 00,281,088 | —- | M] (Cinematronics)
QuickTimePlayer.exe -> %ProgramFiles%\QuickTime\QuickTimePlayer.exe [C:\Program Files\QuickTime\QuickTimePlayer.exe] -> [2008/03/28 23:37:46 | 07,673,136 | —- | M] (Apple Inc.)
RecordNow.exe -> %ProgramFiles%\Sonic\RecordNow!\RecordNow.exe [C:\Program Files\Sonic\RecordNow!\RecordNow.exe] -> [2005/06/22 10:31:00 | 01,961,984 | —- | M] ()
rvsezm.exe -> %ProgramFiles%\MSN Gaming Zone\Windows\Rvsezm.exe [C:\Program Files\MSN Gaming Zone\Windows\rvsezm.exe] -> [2004/08/10 08:00:00 | 00,042,574 | —- | M] (Microsoft Corporation)
SC3.EXE -> %ProgramFiles%\Maxis\SimCity 3000\Game\SC3.EXE [C:\Program Files\Maxis\SimCity 3000\Game\SC3.EXE] -> [1998/12/30 07:16:24 | 01,142,272 | —- | M] (Maxis)
setup.exe -> Reg Error: Value  does not exist or could not be read. [Reg Error: Value  does not exist or could not be read.] -> File not found
shvlzm.exe -> %ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe [C:\Program Files\MSN Gaming Zone\Windows\shvlzm.exe] -> [2004/08/10 08:00:00 | 00,042,573 | —- | M] (Microsoft Corporation)
SmoothView.exe -> %ProgramFiles%\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe [C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe] -> [2005/04/26 20:13:20 | 00,122,880 | —- | M] (TOSHIBA Corporation)
table30.exe -> Reg Error: Value  does not exist or could not be read. [Reg Error: Value  does not exist or could not be read.] -> File not found
TInTouch.exe -> %ProgramFiles%\TOSHIBA\TOSHIBA Assist\TInTouch.exe [C:\Program Files\TOSHIBA\TOSHIBA Assist\TInTouch.exe] -> [2005/02/16 01:10:52 | 00,524,288 | —- | M] (TOSHIBA Corporation)
TOSCDSPD.exe -> %ProgramFiles%\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe] -> [2004/12/30 04:32:20 | 00,065,536 | —- | M] (TOSHIBA)
TOSSDFMT.EXE -> %ProgramFiles%\TOSHIBA\SD Format\TOSSDfmt.exe [C:\Program Files\TOSHIBA\SD Format\TOSSDFMT.EXE] -> [2005/07/15 23:23:34 | 00,225,280 | —- | M] (TOSHIBA Corporation)
TosSrWsN.exe -> %ProgramFiles%\TOSHIBA\Speech System NLS\TosSrWsN.exe [C:\Program Files\TOSHIBA\Speech System NLS\TosSrWsN.exe] -> [2005/01/11 05:00:00 | 00,045,056 | —- | M] (TOSHIBA Corporation.)
TosvceN.exe -> %ProgramFiles%\TOSHIBA\Speech System NLS\TosvceN.exe [C:\Program Files\TOSHIBA\Speech System NLS\TosvceN.exe] -> [2005/01/11 05:00:00 | 00,536,576 | —- | M] (TOSHIBA Corporation.)
ToswbrN.exe -> %ProgramFiles%\TOSHIBA\Speech System NLS\ToswbrN.exe [C:\Program Files\TOSHIBA\Speech System NLS\ToswbrN.exe] -> [2005/01/11 05:00:00 | 00,102,400 | —- | M] (TOSHIBA Corporation.)
wab.exe -> %ProgramFiles%\Outlook Express\wab.exe [%ProgramFiles%\Outlook Express\wab.exe] -> [2004/08/10 08:00:00 | 00,046,080 | —- | M] (Microsoft Corporation)
wabmig.exe -> %ProgramFiles%\Outlook Express\wabmig.exe [%ProgramFiles%\Outlook Express\wabmig.exe] -> [2004/08/10 08:00:00 | 00,030,208 | —- | M] (Microsoft Corporation)
WCreator.exe -> %ProgramFiles%\InterVideo\WCreator2\WCreator.exe [C:\Program Files\InterVideo\WCreator2\WCreator.exe] -> [2005/11/16 10:19:12 | 02,834,536 | —- | M] (InterVideo Inc.)
WinDVD.exe -> %ProgramFiles%\InterVideo\WinDVD\WinDVD.exe [C:\Program Files\InterVideo\WinDVD\WinDVD.exe] -> [2005/12/12 00:20:36 | 00,102,400 | —- | M] (InterVideo Inc.)
winnt32.exe -> Reg Error: Value  does not exist or could not be read. [Reg Error: Value  does not exist or could not be read.] -> File not found
WinRAR.exe -> %ProgramFiles%\WinRAR\WinRAR.exe [C:\Program Files\WinRAR\WinRAR.exe] -> [2007/05/29 15:48:22 | 00,932,352 | —- | M] ()
winzip.exe -> %ProgramFiles%\WinZip\WINZIP32.EXE [C:\PROGRA~1\WINZIP\winzip32.exe] -> [2006/04/07 11:00:00 | 03,579,904 | —- | M] (WinZip Computing LP)
winzip32.exe -> %ProgramFiles%\WinZip\WINZIP32.EXE [C:\PROGRA~1\WINZIP\winzip32.exe] -> [2006/04/07 11:00:00 | 03,579,904 | —- | M] (WinZip Computing LP)
wmplayer.exe -> %ProgramFiles%\Windows Media Player\wmplayer.exe [C:\Program Files\Windows Media Player\wmplayer.exe] -> [2004/08/10 08:00:00 | 00,073,728 | —- | M] (Microsoft Corporation)
WORDPAD.EXE -> %ProgramFiles%\Windows NT\Accessories\wordpad.exe ["%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE"] -> [2004/08/10 08:00:00 | 00,214,528 | —- | M] (Microsoft Corporation)
WRITE.EXE -> %ProgramFiles%\Windows NT\Accessories\wordpad.exe ["%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE"] -> [2004/08/10 08:00:00 | 00,214,528 | —- | M] (Microsoft Corporation)
< Disabled MSConfig Registry Items [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ -> 
MSMSGS hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> %ProgramFiles%\Messenger\msmsgs.exe -> [2004/10/13 12:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
< Disabled MSConfig State [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state -> 
"bootini" -> 0 -> 
"services" -> 0 -> 
"startup" -> 2 -> 
"system.ini" -> 0 -> 
"win.ini" -> 0 -> 
< File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\ -> 
.bat [@ = batfile] -> "%1" %* -> 
.chm [@ = chm.file] -> %SystemRoot%\hh.exe -> [2005/05/26 19:22:01 | 00,010,752 | —- | M] (Microsoft Corporation)
.cmd [@ = cmdfile] -> "%1" %* -> 
.com [@ = comfile] -> "%1" %* -> 
.exe [@ = exefile] -> "%1" %* -> 
.hlp [@ = hlpfile] -> %SystemRoot%\system32\winhlp32.exe -> [2004/08/10 08:00:00 | 00,008,192 | —- | M] (Microsoft Corporation)
.hta [@ = htafile] -> %SystemRoot%\system32\mshta.exe -> [2004/08/10 08:00:00 | 00,029,184 | —- | M] (Microsoft Corporation)
.html [@ = htmlfile] -> %ProgramFiles%\Internet Explorer\IEXPLORE.EXE -> [2004/08/10 08:00:00 | 00,093,184 | —- | M] (Microsoft Corporation)
.inf [@ = inffile] -> %SystemRoot%\system32\notepad.exe -> [2004/08/10 08:00:00 | 00,069,120 | —- | M] (Microsoft Corporation)
.ini [@ = inifile] -> %SystemRoot%\system32\notepad.exe -> [2004/08/10 08:00:00 | 00,069,120 | —- | M] (Microsoft Corporation)
.js [@ = JSFile] -> %SystemRoot%\system32\wscript.exe -> [2004/08/10 08:00:00 | 00,114,688 | —- | M] (Microsoft Corporation)
.jse [@ = JSEFile] -> %SystemRoot%\system32\wscript.exe -> [2004/08/10 08:00:00 | 00,114,688 | —- | M] (Microsoft Corporation)
.pif [@ = piffile] -> "%1" %* -> 
.reg [@ = regfile] -> %SystemRoot%\regedit.exe -> [2004/08/10 08:00:00 | 00,146,432 | —- | M] (Microsoft Corporation)
.scr [@ = scrfile] -> "%1" /S -> 
.txt [@ = txtfile] -> %SystemRoot%\system32\notepad.exe -> [2004/08/10 08:00:00 | 00,069,120 | —- | M] (Microsoft Corporation)
.vbe [@ = VBEFile] -> %SystemRoot%\system32\wscript.exe -> [2004/08/10 08:00:00 | 00,114,688 | —- | M] (Microsoft Corporation)
.vbs [@ = VBSFile] -> %SystemRoot%\system32\wscript.exe -> [2004/08/10 08:00:00 | 00,114,688 | —- | M] (Microsoft Corporation)
.wsf [@ = WSFFile] -> %SystemRoot%\system32\wscript.exe -> [2004/08/10 08:00:00 | 00,114,688 | —- | M] (Microsoft Corporation)
.wsh [@ = WSHFile] -> %SystemRoot%\system32\wscript.exe -> [2004/08/10 08:00:00 | 00,114,688 | —- | M] (Microsoft Corporation)
< EventViewer Logs - Last 10 Errors > -> Event Information -> Description
Antivirus [ Error ] 18/01/2008 12:04:47 PM Computer Name = SLOWPURR | Source = avast! | ID = 33554522 -> Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of Incoming email 'This is way too skinny! Rather have a few extra pounds than this.' From: "Debbie Martel-Miles (MRRCON)" <[removed]>, To: <[removed]>, failed, 0000000D.  
Antivirus [ Error ] 19/02/2008 1:44:00 PM Computer Name = SLOWPURR | Source = avast! | ID = 33554522 -> Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of Incoming email 'Door Frame!?#$%^' From: "Debbie Martel-Miles (MRRCON)" <[removed]>, To: "Sue_home" <[removed]>, failed, 0000000D.  
Application [ Error ] 04/04/2008 12:55:53 PM Computer Name = SLOWPURR | Source = Application Hang | ID = 1002 -> Description = Hanging application firefox.exe, version 1.8.20080.31114, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 04/04/2008 12:56:01 PM Computer Name = SLOWPURR | Source = Application Hang | ID = 1002 -> Description = Hanging application Photoshop.exe, version 9.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 06/04/2008 6:49:35 AM Computer Name = SLOWPURR | Source = Application Hang | ID = 1002 -> Description = Hanging application firefox.exe, version 1.8.20080.31114, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 07/04/2008 9:52:07 AM Computer Name = SLOWPURR | Source = Application Error | ID = 1000 -> Description = Faulting application firefox.exe, version 1.8.20080.31114, faulting module js3250.dll, version 4.0.0.0, fault address 0x0001ec8d.
Application [ Error ] 08/04/2008 11:15:34 AM Computer Name = SLOWPURR | Source = Application Hang | ID = 1002 -> Description = Hanging application firefox.exe, version 1.8.20080.31114, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 08/04/2008 11:16:27 AM Computer Name = SLOWPURR | Source = Application Hang | ID = 1002 -> Description = Hanging application firefox.exe, version 1.8.20080.31114, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 27/05/2008 3:36:48 PM Computer Name = SLOWPURR | Source = Application Hang | ID = 1002 -> Description = Hanging application Bridge.exe, version 1.0.0.545, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
System [ Error ] 16/09/2008 10:51:34 PM Computer Name = SLOWPURR | Source = Dhcp | ID = 1001 -> Description = Your computer was not assigned an address from the network (by the DHCP  Server) for the Network Card with network address 001302D271C5.  The following error  occurred:   %%1223.  Your computer will continue to try and obtain an address on its own from  the network address (DHCP) server.
System [ Error ] 17/09/2008 11:33:30 PM Computer Name = SLOWPURR | Source = Service Control Manager | ID = 7034 -> Description = The Outpost Firewall Service service terminated unexpectedly.  It has done this 1 time(s).
System [ Error ] 19/09/2008 9:31:52 PM Computer Name = SLOWPURR | Source = PlugPlayManager | ID = 12 -> Description = The device 'HL-DT-ST DVDRAM GMA-4082N' (IDE\CdRomHL-DT-ST_DVDRAM_GMA-4082N_______________HV02____\304d36303438344b323420372020202020202020) disappeared from the system without first being prepared for removal.
System [ Error ] 20/09/2008 1:11:17 AM Computer Name = SLOWPURR | Source = Service Control Manager | ID = 7034 -> Description = The Outpost Firewall Service service terminated unexpectedly.  It has done this 1 time(s).
System [ Error ] 20/09/2008 7:48:38 PM Computer Name = SLOWPURR | Source = MRxSmb | ID = 8003 -> Description = The master browser has received a server announcement from the computer LABTOP  that believes that it is the master browser for the domain on transport NetBT_Tcpip_{34382EBC-EE5E-4987-BA.  The master browser is stopping or an election is being forced.
System [ Error ] 26/09/2008 5:22:09 AM Computer Name = SLOWPURR | Source = Service Control Manager | ID = 7034 -> Description = The Outpost Firewall Service service terminated unexpectedly.  It has done this 1 time(s).
System [ Error ] 28/09/2008 5:59:19 AM Computer Name = SLOWPURR | Source = Service Control Manager | ID = 7034 -> Description = The Outpost Firewall Service service terminated unexpectedly.  It has done this 1 time(s).
System [ Error ] 04/10/2008 11:37:03 AM Computer Name = SLOWPURR | Source = Dhcp | ID = 1001 -> Description = Your computer was not assigned an address from the network (by the DHCP  Server) for the Network Card with network address 001302D271C5.  The following error  occurred:   %%1223.  Your computer will continue to try and obtain an address on its own from  the network address (DHCP) server.
System [ Error ] 14/10/2008 11:15:41 PM Computer Name = SLOWPURR | Source = Service Control Manager | ID = 7034 -> Description = The Outpost Firewall Service service terminated unexpectedly.  It has done this 1 time(s).
System [ Error ] 16/10/2008 2:04:59 AM Computer Name = SLOWPURR | Source = Service Control Manager | ID = 7011 -> Description = Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.
 
[Files/Folders - Created Within 90 Days]
OTScanIt2 -> %UserProfile%\Desktop\OTScanIt2 -> [2008/10/17 16:25:50 | 00,000,000 | —D | C]
OTScanIt2.exe -> %UserProfile%\Desktop\OTScanIt2.exe -> [2008/10/17 16:25:29 | 00,586,751 | —- | C] ()
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [2008/10/17 16:19:09 | 21,455,70816 | -HS- | C] ()
tmp.reg -> %SystemRoot%\System32\tmp.reg -> [2008/10/17 16:13:17 | 00,003,504 | —- | C] ()
SmitfraudFix -> %UserProfile%\Desktop\SmitfraudFix -> [2008/10/17 16:12:01 | 00,000,000 | —D | C]
SmitfraudFix.exe -> %UserProfile%\Desktop\SmitfraudFix.exe -> [2008/10/17 15:55:50 | 01,661,652 | —- | C] ()
Removal Instruction.rtf -> %UserProfile%\Desktop\Removal Instruction.rtf -> [2008/10/17 15:55:01 | 00,003,353 | —- | C] ()
Lady_GaGa_-_Beautiful_Dirty_Rich.mp3 -> %UserProfile%\Desktop\Lady_GaGa_-_Beautiful_Dirty_Rich.mp3 -> [2008/10/14 14:26:19 | 02,791,581 | —- | C] ()
nView_Profiles -> %AllUsersProfile%\Application Data\nView_Profiles -> [2008/10/14 12:41:54 | 00,000,000 | —D | C]
Flo_Rida_-_In_The_Ayer_(Dirty_RMX).mp3 -> %UserProfile%\Desktop\Flo_Rida_-_In_The_Ayer_(Dirty_RMX).mp3 -> [2008/10/10 10:51:15 | 03,531,369 | —- | C] ()
WallpaperClubSpecialPack_www.romaniainedit.us.rar -> %UserProfile%\Desktop\WallpaperClubSpecialPack_www.romaniainedit.us.rar -> [2008/10/07 11:36:04 | 46,104,935 | —- | C] ()
wordpress-2.6.2.zip -> %UserProfile%\Desktop\wordpress-2.6.2.zip -> [2008/10/02 08:55:40 | 01,514,600 | —- | C] ()
Support Ticket.rtf -> %UserProfile%\Desktop\Support Ticket.rtf -> [2008/09/21 23:54:11 | 00,007,347 | —- | C] ()
Sonic -> %AppData%\Sonic -> [2008/09/19 20:58:41 | 00,000,000 | —D | C]
HJTInstall.exe -> %UserProfile%\Desktop\HJTInstall.exe -> [2008/09/19 20:56:25 | 00,812,344 | —- | C] (Trend Micro Inc.)
watermark-image-text.zip -> %UserProfile%\Desktop\watermark-image-text.zip -> [2008/09/16 10:19:07 | 00,002,811 | —- | C] ()
tmp_4655.zip -> %UserProfile%\Desktop\tmp_4655.zip -> [2008/09/13 09:58:51 | 00,087,715 | —- | C] ()
nautica.zip -> %UserProfile%\Desktop\nautica.zip -> [2008/09/11 17:40:05 | 00,206,416 | —- | C] ()
cpscan.dll -> %SystemRoot%\System32\dllcache\cpscan.dll -> [2008/09/10 19:43:09 | 00,216,064 | —- | C] (COMPAQ Inc.)
cprofile.exe -> %SystemRoot%\System32\dllcache\cprofile.exe -> [2008/09/10 19:43:09 | 00,018,944 | —- | C] (Microsoft Corporation)
cpqtrnd5.sys -> %SystemRoot%\System32\dllcache\cpqtrnd5.sys -> [2008/09/10 19:43:08 | 00,060,970 | —- | C] (Compaq Computer Corp.)
cpqndis5.sys -> %SystemRoot%\System32\dllcache\cpqndis5.sys -> [2008/09/10 19:43:07 | 00,021,533 | —- | C] (Compaq Computer Corporation)
cplexe.exe -> %SystemRoot%\System32\dllcache\cplexe.exe -> [2008/09/10 19:43:06 | 00,057,399 | —- | C] (Microsoft Corporation)
counters.dll -> %SystemRoot%\System32\dllcache\counters.dll -> [2008/09/10 19:43:06 | 00,020,480 | —- | C] (Microsoft Corporation)
cpqarray.sys -> %SystemRoot%\System32\dllcache\cpqarray.sys -> [2008/09/10 19:43:06 | 00,014,976 | —- | C] (Microsoft Corporation)
convlog.exe -> %SystemRoot%\System32\dllcache\convlog.exe -> [2008/09/10 19:43:05 | 00,056,320 | —- | C] (Microsoft Corporation)
controt.dll -> %SystemRoot%\System32\dllcache\controt.dll -> [2008/09/10 19:43:05 | 00,033,792 | —- | C] (Microsoft Corporation)
compfilt.dll -> %SystemRoot%\System32\dllcache\compfilt.dll -> [2008/09/10 19:43:02 | 00,024,064 | —- | C] (Microsoft Corporation)
cnusd.dll -> %SystemRoot%\System32\dllcache\cnusd.dll -> [2008/09/10 19:42:59 | 00,044,032 | —- | C] (Microsoft Corporation)
cmbp0wdm.sys -> %SystemRoot%\System32\dllcache\cmbp0wdm.sys -> [2008/09/10 19:42:56 | 00,020,736 | —- | C] (OMNIKEY AG)
cl546xm.sys -> %SystemRoot%\System32\dllcache\cl546xm.sys -> [2008/09/10 19:42:54 | 00,248,064 | —- | C] (Microsoft Corporation)
cl546x.dll -> %SystemRoot%\System32\dllcache\cl546x.dll -> [2008/09/10 19:42:53 | 00,170,880 | —- | C] (Microsoft Corporation)
cl5465.dll -> %SystemRoot%\System32\dllcache\cl5465.dll -> [2008/09/10 19:42:52 | 00,111,232 | —- | C] (Microsoft Corporation)
cirrus.sys -> %SystemRoot%\System32\dllcache\cirrus.sys -> [2008/09/10 19:42:52 | 00,045,696 | —- | C] (Microsoft Corporation)
cirrus.dll -> %SystemRoot%\System32\dllcache\cirrus.dll -> [2008/09/10 19:42:51 | 00,091,264 | —- | C] (Microsoft Corporation)
cintsetp.exe -> %SystemRoot%\System32\dllcache\cintsetp.exe -> [2008/09/10 19:42:50 | 00,480,256 | —- | C] (Microsoft Corporation)
cintime.dll -> %SystemRoot%\System32\dllcache\cintime.dll -> [2008/09/10 19:42:50 | 00,198,656 | —- | C] (Microsoft Corporation)
cintlgnt.ime -> %SystemRoot%\System32\dllcache\cintlgnt.ime -> [2008/09/10 19:42:50 | 00,021,504 | —- | C] (Microsoft Corporation)
cinemclc.sys -> %SystemRoot%\System32\dllcache\cinemclc.sys -> [2008/09/10 19:42:49 | 00,272,640 | —- | C] (RAVISENT Technologies Inc.)
cicap.sys -> %SystemRoot%\System32\dllcache\cicap.sys -> [2008/09/10 19:42:48 | 00,980,034 | —- | C] (Xircom)
chtbrkr.dll -> %SystemRoot%\System32\dllcache\chtbrkr.dll -> [2008/09/10 19:42:47 | 00,838,144 | —- | C] (Microsoft Corporation)
chtskf.dll -> %SystemRoot%\System32\dllcache\chtskf.dll -> [2008/09/10 19:42:47 | 00,173,568 | —- | C] ()
chtmbx.dll -> %SystemRoot%\System32\dllcache\chtmbx.dll -> [2008/09/10 19:42:47 | 00,097,792 | —- | C] (Microsoft Corporation)
chtskdic.dll -> %SystemRoot%\System32\dllcache\chtskdic.dll -> [2008/09/10 19:42:47 | 00,056,320 | —- | C] (Microsoft Corporation)
chsbrkr.dll -> %SystemRoot%\System32\dllcache\chsbrkr.dll -> [2008/09/10 19:42:46 | 01,677,824 | —- | C] (Microsoft Corporation)
chgusr.exe -> %SystemRoot%\System32\dllcache\chgusr.exe -> [2008/09/10 19:42:46 | 00,014,336 | —- | C] (Microsoft Corporation)
chgport.exe -> %SystemRoot%\System32\dllcache\chgport.exe -> [2008/09/10 19:42:45 | 00,015,872 | —- | C] (Microsoft Corporation)
chglogon.exe -> %SystemRoot%\System32\dllcache\chglogon.exe -> [2008/09/10 19:42:45 | 00,013,312 | —- | C] (Microsoft Corporation)
chajei.ime -> %SystemRoot%\System32\dllcache\chajei.ime -> [2008/09/10 19:42:44 | 00,078,336 | —- | C] (Microsoft Corporation)
change.exe -> %SystemRoot%\System32\dllcache\change.exe -> [2008/09/10 19:42:44 | 00,009,728 | —- | C] (Microsoft Corporation)
changer.sys -> %SystemRoot%\System32\dllcache\changer.sys -> [2008/09/10 19:42:44 | 00,008,192 | —- | C] (Microsoft Corporation)
cem56n5.sys -> %SystemRoot%\System32\dllcache\cem56n5.sys -> [2008/09/10 19:42:42 | 00,049,182 | —- | C] (Xircom, Inc.)
cem33n5.sys -> %SystemRoot%\System32\dllcache\cem33n5.sys -> [2008/09/10 19:42:41 | 00,022,044 | —- | C] (Xircom, Inc.)
cem28n5.sys -> %SystemRoot%\System32\dllcache\cem28n5.sys -> [2008/09/10 19:42:41 | 00,022,044 | —- | C] (Xircom, Inc.)
ce3n5.sys -> %SystemRoot%\System32\dllcache\ce3n5.sys -> [2008/09/10 19:42:40 | 00,027,164 | —- | C] (Xircom, Inc.)
ce2n5.sys -> %SystemRoot%\System32\dllcache\ce2n5.sys -> [2008/09/10 19:42:39 | 00,021,530 | —- | C] (Xircom, Inc.)
cd20xrnt.sys -> %SystemRoot%\System32\dllcache\cd20xrnt.sys -> [2008/09/10 19:42:38 | 00,007,680 | —- | C] (Microsoft Corporation)
ccdecode.sys -> %SystemRoot%\System32\dllcache\ccdecode.sys -> [2008/09/10 19:42:37 | 00,017,024 | —- | C] (Microsoft Corporation)
cbmdmkxx.sys -> %SystemRoot%\System32\dllcache\cbmdmkxx.sys -> [2008/09/10 19:42:36 | 00,714,698 | —- | C] (Xircom, Inc.)
cben5.sys -> %SystemRoot%\System32\dllcache\cben5.sys -> [2008/09/10 19:42:35 | 00,046,108 | —- | C] (Xircom, Inc.)
cb325.sys -> %SystemRoot%\System32\dllcache\cb325.sys -> [2008/09/10 19:42:34 | 00,039,680 | —- | C] (Silicom Ltd.)
cb102.sys -> %SystemRoot%\System32\dllcache\cb102.sys -> [2008/09/10 19:42:34 | 00,037,916 | —- | C] (Fast Ethernet Controller Provider)
diapi2NT.dll -> %SystemRoot%\System32\dllcache\diapi2NT.dll -> [2008/09/10 19:42:32 | 00,032,256 | —- | C] (Eicon Technology Corporation)
diapi2.sys -> %SystemRoot%\System32\dllcache\diapi2.sys -> [2008/09/10 19:42:31 | 00,164,923 | —- | C] (Eicon Technology)
camext30.dll -> %SystemRoot%\System32\dllcache\camext30.dll -> [2008/09/10 19:42:30 | 00,119,296 | —- | C] (Microsoft Corporation)
cap7146.sys -> %SystemRoot%\System32\dllcache\cap7146.sys -> [2008/09/10 19:42:30 | 00,054,528 | —- | C] (Philips Semiconductors GmbH)
camext30.ax -> %SystemRoot%\System32\dllcache\camext30.ax -> [2008/09/10 19:42:29 | 00,116,736 | —- | C] (Microsoft Corporation)
camext20.ax -> %SystemRoot%\System32\dllcache\camext20.ax -> [2008/09/10 19:42:28 | 00,244,224 | —- | C] (Microsoft Corporation)
camext20.dll -> %SystemRoot%\System32\dllcache\camext20.dll -> [2008/09/10 19:42:28 | 00,236,032 | —- | C] (Microsoft Corporation)
camexo20.dll -> %SystemRoot%\System32\dllcache\camexo20.dll -> [2008/09/10 19:42:27 | 00,074,240 | —- | C] (Microsoft Corporation)
camdrv30.sys -> %SystemRoot%\System32\dllcache\camdrv30.sys -> [2008/09/10 19:42:26 | 00,171,264 | —- | C] (Microsoft Corporation)
camexo20.ax -> %SystemRoot%\System32\dllcache\camexo20.ax -> [2008/09/10 19:42:26 | 00,073,216 | —- | C] (Microsoft Corporation)
camdrv21.sys -> %SystemRoot%\System32\dllcache\camdrv21.sys -> [2008/09/10 19:42:25 | 00,223,232 | —- | C] (Microsoft Corporation)
camdro21.sys -> %SystemRoot%\System32\dllcache\camdro21.sys -> [2008/09/10 19:42:24 | 00,314,752 | —- | C] (Microsoft Corporation)
c_g18030.dll -> %SystemRoot%\System32\dllcache\c_g18030.dll -> [2008/09/10 19:42:23 | 00,218,112 | —- | C] (Microsoft Corporation)
c_iscii.dll -> %SystemRoot%\System32\dllcache\c_iscii.dll -> [2008/09/10 19:42:23 | 00,010,752 | —- | C] (Microsoft Corporation)
c_is2022.dll -> %SystemRoot%\System32\dllcache\c_is2022.dll -> [2008/09/10 19:42:23 | 00,006,656 | —- | C] (Microsoft Corporation)
bulltlp3.sys -> %SystemRoot%\System32\dllcache\bulltlp3.sys -> [2008/09/10 19:42:03 | 00,013,824 | —- | C] (Microsoft Corporation)
bthusb.sys -> %SystemRoot%\System32\dllcache\bthusb.sys -> [2008/09/10 19:42:02 | 00,018,944 | —- | C] (Microsoft Corporation)
bthport.sys -> %SystemRoot%\System32\dllcache\bthport.sys -> [2008/09/10 19:42:01 | 00,274,304 | —- | C] (Microsoft Corporation)
bthprint.sys -> %SystemRoot%\System32\dllcache\bthprint.sys -> [2008/09/10 19:42:01 | 00,035,456 | —- | C] (Microsoft Corporation)
bthpan.sys -> %SystemRoot%\System32\dllcache\bthpan.sys -> [2008/09/10 19:42:00 | 00,100,992 | —- | C] (Microsoft Corporation)
bthmodem.sys -> %SystemRoot%\System32\dllcache\bthmodem.sys -> [2008/09/10 19:41:59 | 00,038,016 | —- | C] (Microsoft Corporation)
bthenum.sys -> %SystemRoot%\System32\dllcache\bthenum.sys -> [2008/09/10 19:41:58 | 00,017,024 | —- | C] (Microsoft Corporation)
brzwlan.sys -> %SystemRoot%\System32\dllcache\brzwlan.sys -> [2008/09/10 19:41:57 | 00,031,529 | —- | C] (BreezeCOM)
brusbscn.sys -> %SystemRoot%\System32\dllcache\brusbscn.sys -> [2008/09/10 19:41:57 | 00,010,368 | —- | C] (Brother Industries Ltd.)
brserwdm.sys -> %SystemRoot%\System32\dllcache\brserwdm.sys -> [2008/09/10 19:41:56 | 00,060,416 | —- | C] (Brother Industries Ltd.)
brusbmdm.sys -> %SystemRoot%\System32\dllcache\brusbmdm.sys -> [2008/09/10 19:41:56 | 00,011,008 | —- | C] (Brother Industries Ltd.)
brserif.dll -> %SystemRoot%\System32\dllcache\brserif.dll -> [2008/09/10 19:41:55 | 00,009,728 | —- | C] (Brother Industries, Ltd.)
brparwdm.sys -> %SystemRoot%\System32\dllcache\brparwdm.sys -> [2008/09/10 19:41:54 | 00,039,552 | —- | C] (Brother Industries Ltd.)
brscnrsm.dll -> %SystemRoot%\System32\dllcache\brscnrsm.dll -> [2008/09/10 19:41:54 | 00,005,120 | —- | C] (Brother Industries,Ltd.)
brparimg.sys -> %SystemRoot%\System32\dllcache\brparimg.sys -> [2008/09/10 19:41:53 | 00,003,168 | —- | C] (Brother Industries Ltd.)
browscap.dll -> %SystemRoot%\System32\dllcache\browscap.dll -> [2008/09/10 19:41:52 | 00,045,568 | —- | C] (Microsoft Corporation)
brmfusb.dll -> %SystemRoot%\System32\dllcache\brmfusb.dll -> [2008/09/10 19:41:51 | 00,041,472 | —- | C] (Brother Industries, Ltd.)
brmfrsmg.exe -> %SystemRoot%\System32\dllcache\brmfrsmg.exe -> [2008/09/10 19:41:51 | 00,032,256 | —- | C] (Brother Industries, Ltd.)
brmflpt.dll -> %SystemRoot%\System32\dllcache\brmflpt.dll -> [2008/09/10 19:41:50 | 00,029,696 | —- | C] (Brother Industries, Ltd.)
brmfcwia.dll -> %SystemRoot%\System32\dllcache\brmfcwia.dll -> [2008/09/10 19:41:49 | 00,081,408 | —- | C] (Microsoft Corporation)
brmfbidi.dll -> %SystemRoot%\System32\dllcache\brmfbidi.dll -> [2008/09/10 19:41:49 | 00,015,360 | —- | C] (Brother Industries, Ltd.)
brfiltup.sys -> %SystemRoot%\System32\dllcache\brfiltup.sys -> [2008/09/10 19:41:48 | 00,003,968 | —- | C] (Brother Industries, Ltd.)
brfiltlo.sys -> %SystemRoot%\System32\dllcache\brfiltlo.sys -> [2008/09/10 19:41:47 | 00,012,160 | —- | C] (Brother Industries, Ltd.)
brfilt.sys -> %SystemRoot%\System32\dllcache\brfilt.sys -> [2008/09/10 19:41:47 | 00,002,944 | —- | C] (Brother Industries Ltd.)
brevif.dll -> %SystemRoot%\System32\dllcache\brevif.dll -> [2008/09/10 19:41:46 | 00,012,800 | —- | C] (Brother Industries, Ltd.)
brcoinst.dll -> %SystemRoot%\System32\dllcache\brcoinst.dll -> [2008/09/10 19:41:46 | 00,009,728 | —- | C] (Brother Industries Ltd.)
brbidiif.dll -> %SystemRoot%\System32\dllcache\brbidiif.dll -> [2008/09/10 19:41:45 | 00,019,456 | —- | C] (Brother Industries, Ltd.)
binlsvc.dll -> %SystemRoot%\System32\dllcache\binlsvc.dll -> [2008/09/10 19:41:43 | 00,102,400 | —- | C] (Microsoft Corporation)
bdaplgin.ax -> %SystemRoot%\System32\dllcache\bdaplgin.ax -> [2008/09/10 19:41:42 | 00,018,432 | —- | C] (Microsoft Corporation)
bdasup.sys -> %SystemRoot%\System32\dllcache\bdasup.sys -> [2008/09/10 19:41:42 | 00,011,776 | —- | C] (Microsoft Corporation)
bcmdm.sys -> %SystemRoot%\System32\dllcache\bcmdm.sys -> [2008/09/10 19:41:41 | 00,871,388 | —- | C] (BCM)
banshee.dll -> %SystemRoot%\System32\dllcache\banshee.dll -> [2008/09/10 19:41:38 | 00,342,336 | —- | C] (3Dfx Interactive, Inc.)
banshee.sys -> %SystemRoot%\System32\dllcache\banshee.sys -> [2008/09/10 19:41:38 | 00,036,128 | —- | C] (3Dfx Interactive, Inc.)
b1cbase.sys -> %SystemRoot%\System32\dllcache\b1cbase.sys -> [2008/09/10 19:41:37 | 00,089,952 | —- | C] (AVM GmbH)
aztw2320.sys -> %SystemRoot%\System32\dllcache\aztw2320.sys -> [2008/09/10 19:41:36 | 00,036,992 | —- | C] (Aztech Systems Ltd)
avmenum.dll -> %SystemRoot%\System32\dllcache\avmenum.dll -> [2008/09/10 19:41:35 | 00,144,384 | —- | C] (AVM GmbH)
avmwan.sys -> %SystemRoot%\System32\dllcache\avmwan.sys -> [2008/09/10 19:41:35 | 00,037,568 | —- | C] (AVM GmbH)
avmcoxp.dll -> %SystemRoot%\System32\dllcache\avmcoxp.dll -> [2008/09/10 19:41:34 | 00,087,552 | —- | C] (AVM GmbH)
avcstrm.sys -> %SystemRoot%\System32\dllcache\avcstrm.sys -> [2008/09/10 19:41:33 | 00,013,696 | —- | C] (Microsoft Corporation)
avcaudio.sys -> %SystemRoot%\System32\dllcache\avcaudio.sys -> [2008/09/10 19:41:32 | 00,036,096 | —- | C] (Microsoft Corporation)
avc.sys -> %SystemRoot%\System32\dllcache\avc.sys -> [2008/09/10 19:41:31 | 00,038,912 | —- | C] (Microsoft Corporation)
authfilt.dll -> %SystemRoot%\System32\dllcache\authfilt.dll -> [2008/09/10 19:41:30 | 00,009,216 | —- | C] (Microsoft Corporation)
atixbar.sys -> %SystemRoot%\System32\dllcache\atixbar.sys -> [2008/09/10 19:41:27 | 00,023,552 | —- | C] ()
ativxbar.sys -> %SystemRoot%\System32\dllcache\ativxbar.sys -> [2008/09/10 19:41:26 | 00,026,624 | —- | C] ()
ativttxx.sys -> %SystemRoot%\System32\dllcache\ativttxx.sys -> [2008/09/10 19:41:25 | 00,019,456 | —- | C] ()
atitvsnd.sys -> %SystemRoot%\System32\dllcache\atitvsnd.sys -> [2008/09/10 19:41:24 | 00,017,152 | —- | C] ()
ativmdcd.sys -> %SystemRoot%\System32\dllcache\ativmdcd.sys -> [2008/09/10 19:41:24 | 00,009,472 | —- | C] ()
atirtsnd.sys -> %SystemRoot%\System32\dllcache\atirtsnd.sys -> [2008/09/10 19:41:23 | 00,026,880 | —- | C] ()
atitunep.sys -> %SystemRoot%\System32\dllcache\atitunep.sys -> [2008/09/10 19:41:23 | 00,017,152 | —- | C] ()
atirtcap.sys -> %SystemRoot%\System32\dllcache\atirtcap.sys -> [2008/09/10 19:41:22 | 00,049,920 | —- | C] ()
atipcxxx.sys -> %SystemRoot%\System32\dllcache\atipcxxx.sys -> [2008/09/10 19:41:21 | 00,010,240 | —- | C] ()
atievxx.exe -> %SystemRoot%\System32\dllcache\atievxx.exe -> [2008/09/10 19:41:11 | 00,037,376 | —- | C] (Microsoft Corporation)
atibt829.sys -> %SystemRoot%\System32\dllcache\atibt829.sys -> [2008/09/10 19:41:09 | 00,046,464 | —- | C] ()
ati.dll -> %SystemRoot%\System32\dllcache\ati.dll -> [2008/09/10 19:40:57 | 00,096,128 | —- | C] (Microsoft Corporation)
ati.sys -> %SystemRoot%\System32\dllcache\ati.sys -> [2008/09/10 19:40:57 | 00,077,568 | —- | C] (ATI Technologies, Inc.)
asptxn.dll -> %SystemRoot%\System32\dllcache\asptxn.dll -> [2008/09/10 19:40:56 | 00,029,184 | —- | C] (Microsoft Corporation)
aspperf.dll -> %SystemRoot%\System32\dllcache\aspperf.dll -> [2008/09/10 19:40:56 | 00,010,240 | —- | C] (Microsoft Corporation)
asp51.dll -> %SystemRoot%\System32\dllcache\asp51.dll -> [2008/09/10 19:40:55 | 00,369,664 | —- | C] (Microsoft Corporation)
aspndis3.sys -> %SystemRoot%\System32\dllcache\aspndis3.sys -> [2008/09/10 19:40:55 | 00,097,354 | —- | C] (Bay Networks, Inc.)
asc3350p.sys -> %SystemRoot%\System32\dllcache\asc3350p.sys -> [2008/09/10 19:40:54 | 00,022,400 | —- | C] (Microsoft Corporation)
aqueue.dll -> %SystemRoot%\System32\dllcache\aqueue.dll -> [2008/09/10 19:40:53 | 00,331,264 | —- | C] (Microsoft Corporation)
EXCH_aqadmin.dll -> %SystemRoot%\System32\dllcache\EXCH_aqadmin.dll -> [2008/09/10 19:40:53 | 00,045,056 | —- | C] (Microsoft Corporation)
appconf.dll -> %SystemRoot%\System32\dllcache\appconf.dll -> [2008/09/10 19:40:52 | 00,108,544 | —- | C] (Microsoft Corporation)
apmbatt.sys -> %SystemRoot%\System32\dllcache\apmbatt.sys -> [2008/09/10 19:40:51 | 00,006,272 | —- | C] (Microsoft Corporation)
amsint.sys -> %SystemRoot%\System32\dllcache\amsint.sys -> [2008/09/10 19:40:50 | 00,012,032 | —- | C] (Microsoft Corporation)
amb8002.sys -> %SystemRoot%\System32\dllcache\amb8002.sys -> [2008/09/10 19:40:49 | 00,016,969 | —- | C] (AmbiCom, Inc.)
alim1541.sys -> %SystemRoot%\System32\dllcache\alim1541.sys -> [2008/09/10 19:40:48 | 00,042,752 | —- | C] (Microsoft Corporation)
aic78xx.sys -> %SystemRoot%\System32\dllcache\aic78xx.sys -> [2008/09/10 19:40:46 | 00,056,960 | —- | C] (Microsoft Corporation)
aic78u2.sys -> %SystemRoot%\System32\dllcache\aic78u2.sys -> [2008/09/10 19:40:45 | 00,055,168 | —- | C] (Microsoft Corporation)
agt0804.dll -> %SystemRoot%\System32\dllcache\agt0804.dll -> [2008/09/10 19:40:45 | 00,019,456 | —- | C] (Microsoft Corporation)
aha154x.sys -> %SystemRoot%\System32\dllcache\aha154x.sys -> [2008/09/10 19:40:45 | 00,012,800 | —- | C] (Microsoft Corporation)
agt0412.dll -> %SystemRoot%\System32\dllcache\agt0412.dll -> [2008/09/10 19:40:44 | 00,019,456 | —- | C] (Microsoft Corporation)
agt0411.dll -> %SystemRoot%\System32\dllcache\agt0411.dll -> [2008/09/10 19:40:44 | 00,019,456 | —- | C] (Microsoft Corporation)
agt040d.dll -> %SystemRoot%\System32\dllcache\agt040d.dll -> [2008/09/10 19:40:43 | 00,019,456 | —- | C] (Microsoft Corporation)
agt0404.dll -> %SystemRoot%\System32\dllcache\agt0404.dll -> [2008/09/10 19:40:42 | 00,019,456 | —- | C] (Microsoft Corporation)
agt0401.dll -> %SystemRoot%\System32\dllcache\agt0401.dll -> [2008/09/10 19:40:42 | 00,019,456 | —- | C] (Microsoft Corporation)
agpcpq.sys -> %SystemRoot%\System32\dllcache\agpcpq.sys -> [2008/09/10 19:40:41 | 00,044,928 | —- | C] (Microsoft Corporation)
agp440.sys -> %SystemRoot%\System32\dllcache\agp440.sys -> [2008/09/10 19:40:40 | 00,042,368 | —- | C] (Microsoft Corporation)
agcgauge.ax -> %SystemRoot%\System32\dllcache\agcgauge.ax -> [2008/09/10 19:40:39 | 00,024,576 | —- | C] (Microsoft Corporation)
EXCH_adsiisex.dll -> %SystemRoot%\System32\dllcache\EXCH_adsiisex.dll -> [2008/09/10 19:40:36 | 00,005,632 | —- | C] (Microsoft Corporation)
adpu160m.sys -> %SystemRoot%\System32\dllcache\adpu160m.sys -> [2008/09/10 19:40:35 | 00,101,888 | —- | C] (Microsoft Corporation)
adrot.dll -> %SystemRoot%\System32\dllcache\adrot.dll -> [2008/09/10 19:40:35 | 00,049,664 | —- | C] (Microsoft Corporation)
adptsf50.sys -> %SystemRoot%\System32\dllcache\adptsf50.sys -> [2008/09/10 19:40:34 | 00,046,112 | —- | C] (Adaptec, Inc )
admxprox.dll -> %SystemRoot%\System32\dllcache\admxprox.dll -> [2008/09/10 19:40:34 | 00,006,144 | —- | C] (Microsoft Corporation)
admexs.dll -> %SystemRoot%\System32\dllcache\admexs.dll -> [2008/09/10 19:40:33 | 00,029,696 | —- | C] (Microsoft Corporation)
admjoy.sys -> %SystemRoot%\System32\dllcache\admjoy.sys -> [2008/09/10 19:40:33 | 00,010,880 | —- | C] (Aureal, Inc.)
adm8830.sys -> %SystemRoot%\System32\dllcache\adm8830.sys -> [2008/09/10 19:40:32 | 00,747,392 | —- | C] (Aureal, Inc.)
adm8810.sys -> %SystemRoot%\System32\dllcache\adm8810.sys -> [2008/09/10 19:40:32 | 00,584,448 | —- | C] (Aureal, Inc.)
adm8820.sys -> %SystemRoot%\System32\dllcache\adm8820.sys -> [2008/09/10 19:40:32 | 00,553,984 | —- | C] (Aureal, Inc.)
adm8511.sys -> %SystemRoot%\System32\dllcache\adm8511.sys -> [2008/09/10 19:40:31 | 00,020,160 | —- | C] (ADMtek Incorporated)
adicvls.sys -> %SystemRoot%\System32\dllcache\adicvls.sys -> [2008/09/10 19:40:31 | 00,007,424 | —- | C] (Microsoft Corporation)
acerscad.dll -> %SystemRoot%\System32\dllcache\acerscad.dll -> [2008/09/10 19:40:29 | 00,061,440 | —- | C] (Color Flatbed Scanner)
ac97sis.sys -> %SystemRoot%\System32\dllcache\ac97sis.sys -> [2008/09/10 19:40:28 | 00,297,728 | —- | C] (Silicon Integrated Systems Corp.)
a3dapi.dll -> %SystemRoot%\System32\dllcache\a3dapi.dll -> [2008/09/10 19:40:26 | 00,462,848 | —- | C] (Aureal Inc.)
abp480n5.sys -> %SystemRoot%\System32\dllcache\abp480n5.sys -> [2008/09/10 19:40:26 | 00,023,552 | —- | C] (Microsoft Corporation)
a3d.dll -> %SystemRoot%\System32\dllcache\a3d.dll -> [2008/09/10 19:40:25 | 00,098,304 | —- | C] (Aureal Semiconductor)
8514a.dll -> %SystemRoot%\System32\dllcache\8514a.dll -> [2008/09/10 19:40:25 | 00,038,400 | —- | C] (Microsoft Corporation)
61883.sys -> %SystemRoot%\System32\dllcache\61883.sys -> [2008/09/10 19:40:24 | 00,048,128 | —- | C] (Microsoft Corporation)
3dfxvs.dll -> %SystemRoot%\System32\dllcache\3dfxvs.dll -> [2008/09/10 19:40:23 | 00,689,216 | —- | C] (3dfx Interactive, Inc.)
3dfxvsm.sys -> %SystemRoot%\System32\dllcache\3dfxvsm.sys -> [2008/09/10 19:40:23 | 00,148,352 | —- | C] (3dfx Interactive, Inc.)
4mmdat.sys -> %SystemRoot%\System32\dllcache\4mmdat.sys -> [2008/09/10 19:40:23 | 00,012,288 | —- | C] (Microsoft Corporation)
3cwmcru.sys -> %SystemRoot%\System32\dllcache\3cwmcru.sys -> [2008/09/10 19:40:22 | 00,762,780 | —- | C] (3Com, Inc.)
1394vdbg.sys -> %SystemRoot%\System32\dllcache\1394vdbg.sys -> [2008/09/10 19:40:22 | 00,011,264 | —- | C] (Microsoft Corporation)
npdsplay.dll -> %SystemRoot%\System32\dllcache\npdsplay.dll -> [2008/09/10 19:40:19 | 00,364,544 | —- | C] (Microsoft Corporation (written by Digital Renaissance Inc.))
npwmsdrm.dll -> %SystemRoot%\System32\dllcache\npwmsdrm.dll -> [2008/09/10 19:40:19 | 00,010,240 | —- | C] (Microsoft Corporation)
mplayer2.exe -> %SystemRoot%\System32\dllcache\mplayer2.exe -> [2008/09/10 19:40:11 | 00,004,639 | —- | C] ()
wamregps.dll -> %SystemRoot%\System32\dllcache\wamregps.dll -> [2008/09/10 19:40:09 | 00,007,168 | —- | C] (Microsoft Corporation)
tcptsat.dll -> %SystemRoot%\System32\dllcache\tcptsat.dll -> [2008/09/10 19:40:08 | 00,016,384 | —- | C] (Microsoft Corporation)
tcptest.exe -> %SystemRoot%\System32\dllcache\tcptest.exe -> [2008/09/10 19:40:07 | 00,032,827 | —- | C] (Microsoft Corporation)
staxmem.dll -> %SystemRoot%\System32\dllcache\staxmem.dll -> [2008/09/10 19:40:07 | 00,008,192 | —- | C] (Microsoft Corporation)
smtpsnap.dll -> %SystemRoot%\System32\dllcache\smtpsnap.dll -> [2008/09/10 19:40:06 | 02,134,528 | —- | C] (Microsoft Corporation)
smtpadm.dll -> %SystemRoot%\System32\dllcache\smtpadm.dll -> [2008/09/10 19:40:06 | 00,189,440 | —- | C] (Microsoft Corporation)
shtml.exe -> %SystemRoot%\System32\dllcache\shtml.exe -> [2008/09/10 19:40:06 | 00,016,437 | —- | C] (Microsoft Corporation)
shtml.dll -> %SystemRoot%\System32\dllcache\shtml.dll -> [2008/09/10 19:40:05 | 00,020,536 | —- | C] (Microsoft Corporation)
s3legacy.dll -> %SystemRoot%\System32\dllcache\s3legacy.dll -> [2008/09/10 19:40:00 | 00,066,048 | —- | C] (Microsoft Corporation)
logui.ocx -> %SystemRoot%\System32\dllcache\logui.ocx -> [2008/09/10 19:39:51 | 00,076,800 | —- | C] (Microsoft Corporation)
inetmgr.dll -> %SystemRoot%\System32\dllcache\inetmgr.dll -> [2008/09/10 19:39:49 | 00,829,440 | —- | C] (Microsoft Corporation)
isatq.dll -> %SystemRoot%\System32\dllcache\isatq.dll -> [2008/09/10 19:39:49 | 00,068,608 | —- | C] (Microsoft Corporation)
inetsloc.dll -> %SystemRoot%\System32\dllcache\inetsloc.dll -> [2008/09/10 19:39:49 | 00,019,968 | —- | C] (Microsoft Corporation)
infoadmn.dll -> %SystemRoot%\System32\dllcache\infoadmn.dll -> [2008/09/10 19:39:49 | 00,013,312 | —- | C] (Microsoft Corporation)
inetmgr.exe -> %SystemRoot%\System32\dllcache\inetmgr.exe -> [2008/09/10 19:39:49 | 00,007,680 | —- | C] (Microsoft Corporation)
iisui.dll -> %SystemRoot%\System32\dllcache\iisui.dll -> [2008/09/10 19:39:48 | 00,169,984 | —- | C] (Microsoft Corporation)
iisrtl.dll -> %SystemRoot%\System32\dllcache\iisrtl.dll -> [2008/09/10 19:39:48 | 00,133,632 | —- | C] (Microsoft Corporation)
iisrstas.exe -> %SystemRoot%\System32\dllcache\iisrstas.exe -> [2008/09/10 19:39:48 | 00,030,720 | —- | C] (Microsoft Corporation)
iisreset.exe -> %SystemRoot%\System32\dllcache\iisreset.exe -> [2008/09/10 19:39:48 | 00,014,336 | —- | C] (Microsoft Corporation)
iisrstap.dll -> %SystemRoot%\System32\dllcache\iisrstap.dll -> [2008/09/10 19:39:48 | 00,005,632 | —- | C] (Microsoft Corporation)
iisext51.dll -> %SystemRoot%\System32\dllcache\iisext51.dll -> [2008/09/10 19:39:47 | 00,068,608 | —- | C] (Microsoft Corporation)
iismap.dll -> %SystemRoot%\System32\dllcache\iismap.dll -> [2008/09/10 19:39:47 | 00,064,512 | —- | C] (Microsoft Corporation)
ftpsapi2.dll -> %SystemRoot%\System32\dllcache\ftpsapi2.dll -> [2008/09/10 19:39:47 | 00,006,144 | —- | C] (Microsoft Corporation)
fpmmc.dll -> %SystemRoot%\System32\dllcache\fpmmc.dll -> [2008/09/10 19:39:46 | 00,598,071 | —- | C] (Microsoft Corporation)
fpmmcsat.dll -> %SystemRoot%\System32\dllcache\fpmmcsat.dll -> [2008/09/10 19:39:46 | 00,208,896 | —- | C] (Microsoft Corporation)
fpexedll.dll -> %SystemRoot%\System32\dllcache\fpexedll.dll -> [2008/09/10 19:39:46 | 00,020,541 | —- | C] (Microsoft Corporation)
fpremadm.exe -> %SystemRoot%\System32\dllcache\fpremadm.exe -> [2008/09/10 19:39:46 | 00,020,538 | —- | C] (Microsoft Corporation)
fp4awel.dll -> %SystemRoot%\System32\dllcache\fp4awel.dll -> [2008/09/10 19:39:45 | 00,876,653 | —- | C] (Microsoft Corporation)
fpcount.exe -> %SystemRoot%\System32\dllcache\fpcount.exe -> [2008/09/10 19:39:45 | 00,188,494 | —- | C] (Microsoft Corporation)
fp98swin.exe -> %SystemRoot%\System32\dllcache\fp98swin.exe -> [2008/09/10 19:39:45 | 00,109,328 | —- | C] (Microsoft Corporation)
fp98sadm.exe -> %SystemRoot%\System32\dllcache\fp98sadm.exe -> [2008/09/10 19:39:45 | 00,014,608 | —- | C] (Microsoft Corporation)
fp4atxt.dll -> %SystemRoot%\System32\dllcache\fp4atxt.dll -> [2008/09/10 19:39:44 | 00,102,509 | —- | C] (Microsoft Corporation)
fp4awebs.dll -> %SystemRoot%\System32\dllcache\fp4awebs.dll -> [2008/09/10 19:39:44 | 00,049,212 | —- | C] (Microsoft Corporation)
fp4areg.dll -> %SystemRoot%\System32\dllcache\fp4areg.dll -> [2008/09/10 19:39:44 | 00,049,210 | —- | C] (Microsoft Corporation)
fp4avnb.dll -> %SystemRoot%\System32\dllcache\fp4avnb.dll -> [2008/09/10 19:39:44 | 00,041,020 | —- | C] (Microsoft Corporation)
fp4avss.dll -> %SystemRoot%\System32\dllcache\fp4avss.dll -> [2008/09/10 19:39:44 | 00,032,826 | —- | C] (Microsoft Corporation)
fp4amsft.dll -> %SystemRoot%\System32\dllcache\fp4amsft.dll -> [2008/09/10 19:39:43 | 00,184,435 | —- | C] (Microsoft Corporation)
fp4apws.dll -> %SystemRoot%\System32\dllcache\fp4apws.dll -> [2008/09/10 19:39:43 | 00,147,513 | —- | C] (Microsoft Corporation)
fp4anscp.dll -> %SystemRoot%\System32\dllcache\fp4anscp.dll -> [2008/09/10 19:39:43 | 00,082,035 | —- | C] (Microsoft Corporation)
cfgwiz.exe -> %SystemRoot%\System32\dllcache\cfgwiz.exe -> [2008/09/10 19:39:40 | 00,188,480 | —- | C] (Microsoft Corporation)
cnfgprts.ocx -> %SystemRoot%\System32\dllcache\cnfgprts.ocx -> [2008/09/10 19:39:40 | 00,076,288 | —- | C] (Microsoft Corporation)
coadmin.dll -> %SystemRoot%\System32\dllcache\coadmin.dll -> [2008/09/10 19:39:40 | 00,046,592 | —- | C] (Microsoft Corporation)
certwiz.ocx -> %SystemRoot%\System32\dllcache\certwiz.ocx -> [2008/09/10 19:39:39 | 00,275,968 | —- | C] (Microsoft Corporation)
certmap.ocx -> %SystemRoot%\System32\dllcache\certmap.ocx -> [2008/09/10 19:39:39 | 00,094,720 | —- | C] (Microsoft Corporation)
author.dll -> %SystemRoot%\System32\dllcache\author.dll -> [2008/09/10 19:39:38 | 00,020,540 | —- | C] (Microsoft Corporation)
author.exe -> %SystemRoot%\System32\dllcache\author.exe -> [2008/09/10 19:39:38 | 00,016,439 | —- | C] (Microsoft Corporation)
adsiis51.dll -> %SystemRoot%\System32\dllcache\adsiis51.dll -> [2008/09/10 19:39:37 | 00,290,816 | —- | C] (Microsoft Corporation)
admwprox.dll -> %SystemRoot%\System32\dllcache\admwprox.dll -> [2008/09/10 19:39:37 | 00,043,520 | —- | C] (Microsoft Corporation)
admin.dll -> %SystemRoot%\System32\dllcache\admin.dll -> [2008/09/10 19:39:36 | 00,020,540 | —- | C] (Microsoft Corporation)
admin.exe -> %SystemRoot%\System32\dllcache\admin.exe -> [2008/09/10 19:39:36 | 00,016,439 | —- | C] (Microsoft Corporation)
wussa.zip -> %UserProfile%\Desktop\wussa.zip -> [2008/09/10 08:12:18 | 00,139,200 | —- | C] ()
database backup.rtf -> %UserProfile%\Desktop\database backup.rtf -> [2008/09/08 04:12:42 | 00,605,539 | —- | C] ()
test.sql.gz -> %UserProfile%\Desktop\test.sql.gz -> [2008/09/08 04:05:22 | 00,000,020 | —- | C] ()
data.sql.gz -> %UserProfile%\Desktop\data.sql.gz -> [2008/09/08 04:05:04 | 00,000,020 | —- | C] ()
databases.zip -> %UserProfile%\Desktop\databases.zip -> [2008/09/08 03:46:38 | 03,579,010 | —- | C] ()
directory-ver2.6-nulled.zip -> %UserProfile%\Desktop\directory-ver2.6-nulled.zip -> [2008/09/08 03:32:54 | 06,033,160 | —- | C] ()
directory-ver2.6-nulled.rar -> %UserProfile%\Desktop\directory-ver2.6-nulled.rar -> [2008/09/07 02:05:31 | 05,898,759 | —- | C] ()
article_cms.zip -> %UserProfile%\Desktop\article_cms.zip -> [2008/09/06 21:04:36 | 01,288,204 | —- | C] ()
AmsCrystalx.zip -> %UserProfile%\Desktop\AmsCrystalx.zip -> [2008/09/05 10:21:50 | 00,076,724 | —- | C] ()
skaff.zip -> %UserProfile%\Desktop\skaff.zip -> [2008/09/05 04:57:29 | 00,084,638 | —- | C] ()
Videocore_2.5.zip -> %UserProfile%\Desktop\Videocore_2.5.zip -> [2008/08/28 01:00:14 | 00,249,532 | —- | C] ()
SpyHunter.lnk -> %AllUsersProfile%\Desktop\SpyHunter.lnk -> [2008/08/27 22:58:59 | 00,000,910 | —- | C] ()
Enigma Software Group -> %ProgramFiles%\Enigma Software Group -> [2008/08/27 22:58:53 | 00,000,000 | —D | C]
backup-ebookdawg.com-8-25-2008.tar.gz -> %UserProfile%\Desktop\backup-ebookdawg.com-8-25-2008.tar.gz -> [2008/08/25 16:17:16 | 54,773,760 | —- | C] ()
Opera -> %AppData%\Opera -> [2008/08/19 20:28:51 | 00,000,000 | —D | C]
directory-ver2.6(2).zip -> %UserProfile%\Desktop\directory-ver2.6(2).zip -> [2008/08/18 15:20:56 | 02,859,367 | —- | C] ()
 
[Files/Folders - Modified Within 90 Days]
1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs -> [2008/10/17 16:20:00 | 00,000,000 | —D | M]
eHomeLog-0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\eHomeLog-0.dat -> [2006/01/01 05:57:07 | 00,000,268 | -H– | M] ()
eHomeLog-1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\eHomeLog-1.dat -> [2006/01/01 05:59:29 | 00,000,268 | -H– | M] ()
eHomeLog-2.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\eHomeLog-2.dat -> [2006/01/01 05:59:52 | 00,000,268 | -H– | M] ()
eHomeLog-3.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\eHomeLog-3.dat -> [2006/01/01 06:01:33 | 00,000,268 | -H– | M] ()
eHomeLog-4.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\eHomeLog-4.dat -> [2006/01/01 06:07:36 | 00,000,268 | -H– | M] ()
eHomeLog-5.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\eHomeLog-5.dat -> [2006/01/01 06:20:54 | 00,000,268 | -H– | M] ()
eHomeLog-6.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\eHomeLog-6.dat -> [2006/01/01 06:23:19 | 00,000,268 | -H– | M] ()
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader -> [2007/12/18 04:18:11 | 00,000,000 | —D | M]
qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [2007/12/18 04:48:04 | 00,004,617 | —- | M] ()
qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [2007/12/18 04:48:04 | 00,004,232 | —- | M] ()
C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp -> [2008/10/17 16:20:20 | 00,000,000 | —D | M]
Perflib_Perfdata_274.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_274.dat -> [2008/10/17 16:19:48 | 00,016,384 | —- | M] ()
5 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> 
OTScanIt2.exe -> %UserProfile%\Desktop\OTScanIt2.exe -> [2008/10/17 16:25:17 | 00,586,751 | —- | M] ()
ODBC.INI -> %SystemRoot%\ODBC.INI -> [2008/10/17 16:20:20 | 00,000,498 | —- | M] ()
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [2008/10/17 16:19:48 | 00,000,006 | -H– | M] ()
nvapps.xml -> %SystemRoot%\System32\nvapps.xml -> [2008/10/17 16:19:44 | 00,045,378 | —- | M] ()
bootstat.dat -> %SystemRoot%\bootstat.dat -> [2008/10/17 16:19:16 | 00,002,048 | –S- | M] ()
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [2008/10/17 16:19:09 | 21,455,70816 | -HS- | M] ()
IconCache.db -> %UserProfile%\Local Settings\Application Data\IconCache.db -> [2008/10/17 16:18:24 | 03,712,656 | -H– | M] ()
tmp.reg -> %SystemRoot%\System32\tmp.reg -> [2008/10/17 16:13:17 | 00,003,504 | —- | M] ()
HOSTS -> %SystemRoot%\System32\drivers\etc\HOSTS -> [2008/10/17 16:13:14 | 00,001,001 | —- | M] ()
SmitfraudFix.exe -> %UserProfile%\Desktop\SmitfraudFix.exe -> [2008/10/17 15:57:17 | 01,661,652 | —- | M] ()
Removal Instruction.rtf -> %UserProfile%\Desktop\Removal Instruction.rtf -> [2008/10/17 15:55:01 | 00,003,353 | —- | M] ()
Lady_GaGa_-_Beautiful_Dirty_Rich.mp3 -> %UserProfile%\Desktop\Lady_GaGa_-_Beautiful_Dirty_Rich.mp3 -> [2008/10/14 14:28:08 | 02,791,581 | —- | M] ()
Flo_Rida_-_In_The_Ayer_(Dirty_RMX).mp3 -> %UserProfile%\Desktop\Flo_Rida_-_In_The_Ayer_(Dirty_RMX).mp3 -> [2008/10/10 10:54:05 | 03,531,369 | —- | M] ()
WallpaperClubSpecialPack_www.romaniainedit.us.rar -> %UserProfile%\Desktop\WallpaperClubSpecialPack_www.romaniainedit.us.rar -> [2008/10/07 11:43:22 | 46,104,935 | —- | M] ()
wordpress-2.6.2.zip -> %UserProfile%\Desktop\wordpress-2.6.2.zip -> [2008/10/02 08:55:47 | 01,514,600 | —- | M] ()
wpa.dbl -> %SystemRoot%\System32\wpa.dbl -> [2008/09/30 03:07:01 | 00,001,158 | —- | M] ()
Support Ticket.rtf -> %UserProfile%\Desktop\Support Ticket.rtf -> [2008/09/21 23:54:11 | 00,007,347 | —- | M] ()
HJTInstall.exe -> %UserProfile%\Desktop\HJTInstall.exe -> [2008/09/19 20:56:22 | 00,812,344 | —- | M] (Trend Micro Inc.)
watermark-image-text.zip -> %UserProfile%\Desktop\watermark-image-text.zip -> [2008/09/16 10:19:07 | 00,002,811 | —- | M] ()
tmp_4655.zip -> %UserProfile%\Desktop\tmp_4655.zip -> [2008/09/13 09:58:52 | 00,087,715 | —- | M] ()
nautica.zip -> %UserProfile%\Desktop\nautica.zip -> [2008/09/11 17:40:06 | 00,206,416 | —- | M] ()
win.ini -> %SystemRoot%\win.ini -> [2008/09/10 13:32:31 | 00,000,477 | —- | M] ()
wussa.zip -> %UserProfile%\Desktop\wussa.zip -> [2008/09/10 08:12:20 | 00,139,200 | —- | M] ()
database backup.rtf -> %UserProfile%\Desktop\database backup.rtf -> [2008/09/08 04:12:42 | 00,605,539 | —- | M] ()
test.sql.gz -> %UserProfile%\Desktop\test.sql.gz -> [2008/09/08 04:05:21 | 00,000,020 | —- | M] ()
data.sql.gz -> %UserProfile%\Desktop\data.sql.gz -> [2008/09/08 04:05:01 | 00,000,020 | —- | M] ()
databases.zip -> %UserProfile%\Desktop\databases.zip -> [2008/09/08 03:47:01 | 03,579,010 | —- | M] ()
directory-ver2.6-nulled.zip -> %UserProfile%\Desktop\directory-ver2.6-nulled.zip -> [2008/09/08 03:33:24 | 06,033,160 | —- | M] ()
directory-ver2.6-nulled.rar -> %UserProfile%\Desktop\directory-ver2.6-nulled.rar -> [2008/09/07 02:06:37 | 05,898,759 | —- | M] ()
article_cms.zip -> %UserProfile%\Desktop\article_cms.zip -> [2008/09/06 21:04:42 | 01,288,204 | —- | M] ()
AmsCrystalx.zip -> %UserProfile%\Desktop\AmsCrystalx.zip -> [2008/09/05 10:21:50 | 00,076,724 | —- | M] ()
Spybot - Search & Destroy.lnk -> %UserProfile%\Desktop\Spybot - Search & Destroy.lnk -> [2008/09/05 08:53:23 | 00,000,944 | —- | M] ()
skaff.zip -> %UserProfile%\Desktop\skaff.zip -> [2008/09/05 04:57:29 | 00,084,638 | —- | M] ()
Videocore_2.5.zip -> %UserProfile%\Desktop\Videocore_2.5.zip -> [2008/08/28 01:00:16 | 00,249,532 | —- | M] ()
SpyHunter.lnk -> %AllUsersProfile%\Desktop\SpyHunter.lnk -> [2008/08/27 22:58:59 | 00,000,910 | —- | M] ()
backup-ebookdawg.com-8-25-2008.tar.gz -> %UserProfile%\Desktop\backup-ebookdawg.com-8-25-2008.tar.gz -> [2008/08/25 16:23:12 | 54,773,760 | —- | M] ()
directory-ver2.6(2).zip -> %UserProfile%\Desktop\directory-ver2.6(2).zip -> [2008/08/18 15:21:13 | 02,859,367 | —- | M] ()
WORDPAD.INI -> %SystemRoot%\WORDPAD.INI -> [2008/07/27 07:55:41 | 00,000,754 | —- | M] ()
[File - Lop Check]
Application Data -> C:\Documents and Settings\All Users\Application Data -> [2008/10/14 12:41:54 | 00,000,000 | RH-D | M]
Adobe -> C:\Documents and Settings\All Users\Application Data\Adobe -> [2008/01/10 15:47:26 | 00,000,000 | —D | M]
Adobe Systems -> C:\Documents and Settings\All Users\Application Data\Adobe Systems -> [2008/01/10 16:36:30 | 00,000,000 | —D | M]
Apple -> C:\Documents and Settings\All Users\Application Data\Apple -> [2008/05/02 10:06:30 | 00,000,000 | —D | M]
Apple Computer -> C:\Documents and Settings\All Users\Application Data\Apple Computer -> [2008/05/02 10:06:54 | 00,000,000 | —D | M]
FLEXnet -> C:\Documents and Settings\All Users\Application Data\FLEXnet -> [2008/01/09 16:57:38 | 00,000,000 | —D | M]
Intel -> C:\Documents and Settings\All Users\Application Data\Intel -> [2007/12/16 08:00:38 | 00,000,000 | —D | M]
Microsoft -> C:\Documents and Settings\All Users\Application Data\Microsoft -> [2007/12/20 12:23:01 | 00,000,000 | –SD | M]
nView_Profiles -> C:\Documents and Settings\All Users\Application Data\nView_Profiles -> [2008/10/14 12:41:54 | 00,000,000 | —D | M]
SBSI -> C:\Documents and Settings\All Users\Application Data\SBSI -> [2006/01/01 20:05:23 | 00,000,000 | —D | M]
Spybot - Search & Destroy -> C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy -> [2007/12/18 15:14:27 | 00,000,000 | —D | M]
Windows Genuine Advantage -> C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage -> [2007/12/18 04:19:24 | 00,000,000 | —D | M]
Application Data -> C:\Documents and Settings\Christine\Application Data -> [2008/10/17 16:13:17 | 00,000,000 | RH-D | M]
Adobe -> C:\Documents and Settings\Christine\Application Data\Adobe -> [2008/08/22 09:59:22 | 00,000,000 | —D | M]
AdobeUM -> C:\Documents and Settings\Christine\Application Data\AdobeUM -> [2008/01/05 15:23:57 | 00,000,000 | —D | M]
Apple Computer -> C:\Documents and Settings\Christine\Application Data\Apple Computer -> [2008/05/24 18:16:26 | 00,000,000 | —D | M]
FlashFXP -> C:\Documents and Settings\Christine\Application Data\FlashFXP -> [2007/12/20 10:18:16 | 00,000,000 | —D | M]
fretsonfire -> C:\Documents and Settings\Christine\Application Data\fretsonfire -> [2008/03/25 20:38:19 | 00,000,000 | —D | M]
Identities -> C:\Documents and Settings\Christine\Application Data\Identities -> [2006/01/01 05:59:20 | 00,000,000 | —D | M]
Intel -> C:\Documents and Settings\Christine\Application Data\Intel -> [2007/12/16 08:00:29 | 00,000,000 | —D | M]
Lavasoft -> C:\Documents and Settings\Christine\Application Data\Lavasoft -> [2007/12/20 12:23:09 | 00,000,000 | —D | M]
Macromedia -> C:\Documents and Settings\Christine\Application Data\Macromedia -> [2007/12/18 06:10:28 | 00,000,000 | —D | M]
MailWasher -> C:\Documents and Settings\Christine\Application Data\MailWasher -> [2008/10/17 13:10:21 | 00,000,000 | —D | M]
Microsoft -> C:\Documents and Settings\Christine\Application Data\Microsoft -> [2008/07/23 23:25:02 | 00,000,000 | –SD | M]
Mozilla -> C:\Documents and Settings\Christine\Application Data\Mozilla -> [2007/12/16 06:21:18 | 00,000,000 | —D | M]
Opera -> C:\Documents and Settings\Christine\Application Data\Opera -> [2008/08/19 20:28:51 | 00,000,000 | —D | M]
Sonic -> C:\Documents and Settings\Christine\Application Data\Sonic -> [2008/09/19 20:58:41 | 00,000,000 | —D | M]
Sun -> C:\Documents and Settings\Christine\Application Data\Sun -> [2007/12/18 03:05:07 | 00,000,000 | —D | M]
SystemRequirementsLab -> C:\Documents and Settings\Christine\Application Data\SystemRequirementsLab -> [2008/03/25 20:07:38 | 00,000,000 | —D | M]
toshiba -> C:\Documents and Settings\Christine\Application Data\toshiba -> [2006/01/01 06:26:11 | 00,000,000 | —D | M]
WinRAR -> C:\Documents and Settings\Christine\Application Data\WinRAR -> [2008/01/09 11:15:32 | 00,000,000 | —D | M]
C:\WINDOWS\Tasks\ -> C:\WINDOWS\Tasks -> [2008/09/09 05:35:22 | 00,000,000 | –SD | M]
desktop.ini -> C:\WINDOWS\Tasks\desktop.ini -> [2004/08/10 08:00:00 | 00,000,065 | RH– | M] ()
Registration reminder 1.job -> C:\WINDOWS\Tasks\Registration reminder 1.job -> [2007/12/16 07:58:49 | 00,000,258 | —- | M] ()
SA.DAT -> C:\WINDOWS\Tasks\SA.DAT -> [2008/10/17 16:19:48 | 00,000,006 | -H– | M] ()
[File - Purity Scan]
 
[CatchMe Rootkit Scan by GMER]
< Windows folder & sub-folders >
scanning hidden processes …
IPC error: 2 The system cannot find the file specified.
scanning hidden services & system hive …
scanning hidden registry entries …
scanning hidden files …
C:\WINDOWS\Web\Wallpaper\Thumbs.db:encryptable 0 bytes
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1
< Document and Settings folder & sub folders >
scanning hidden files …
IPC error: 2 The system cannot find the file specified.
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Downloaded Programs\Adobe Photoshop CS3\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\2007_12_24\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\2007_12_25\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\2007_12_26\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\2007_12_31\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\2008_01_01\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\2008_02_09\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\2008_03_08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\2008_03_17\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\2008_03_18\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\My Pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\1.0 - 1\1.0 - 1.1\Upload\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\avatars\avatars\GIF Versions(65x65)\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\avatars\avatars\PNG Versions(128x128)\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\maxajaxrating-1\style\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\myspacesecrets\myspacesecrets\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\photography_2\photography_2\images\series_one\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\photography_2\photography_2\style\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\dreamjokes\admin\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\dw_random\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\dw_rotator\dw_rotator\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\font1blue\font1blue\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\FunnyImages\FunnyImages\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\Gamescriptfree\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\IconsLandVistaElementsIcons-1\IconsLandVistaElementsIconsDemo\PNG\128x128\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\IconsLandVistaElementsIcons-1\IconsLandVistaElementsIconsDemo\PNG\256x256\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\IconsLandVistaElementsIcons-1\IconsLandVistaElementsIconsDemo\PNG\48x48\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\IconsLandVistaElementsIcons-1\IconsLandVistaElementsIconsDemo\PNG\64x64\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\jokes_website\jokes_website\jokewebsite\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\kearone__s_helloween_icons\png\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\kearone__s_helloween_icons\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\krato\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\linkd\linkd_pack\linkd\layout\buttons\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\linkd\linkd_pack\linkd\layout\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\macromedia-icons-crystalxp.net-251013189\ICO\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\macromedia-icons-crystalxp.net-251013189\PNG\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\macromedia-icons-crystalxp.net-251013189\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\refresh-cl\PNG\Windows\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\tinycms\tinycms\templates\whale\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\tmp_4655\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\Videocore_2.5\Videocore_2.5\upload\admin\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\Videocore_2.5\Videocore_2.5\upload\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\wallpaper_site\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\wordpress_theme\wordpress\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\public_html\public_html\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\big_fat_rate_my_photo_website\big_fat_rate_my_photo_website\bigfatratemyphoto\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\biohazard\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\cheatsite\Game.Cheats.Red\images\5\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\choose-your-sport\ico\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\choose-your-sport\png\256\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\choose-your-sport\png\512 bonus format\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\choose-your-sport\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\comicgallery\images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\comicgallery\kubrick\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\comicpress-2.5\comicpress-gn\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\comicpress-2.5\comicpress-v\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Christine\My Documents\Unzipped\dlstore1blue\dlstore1blue\images\Thumbs.db:encryptable 0 bytes
scan completed successfully
hidden files: 111
 
< End of report >

Rorschach112

Post #4October 17, 2008, 9:05 PM UTC

Can you attach the OTScanIt2 log

-Maverick-

Post #5October 17, 2008, 9:12 PM UTC

I've attached the OTScanIt2 log that I posted. Is my laptop safe to do some work now? Just wondering…

Attachments:

📎OTScanIt.Txt

Rorschach112

Post #6October 17, 2008, 9:33 PM UTC

Yes it is safe

Start OTScanIt2. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

[Kill Explorer]
[Unregister Dlls]
[Processes - Safe List]
YN -> a2service.exe -> %ProgramFiles%\a-squared Free\a2service.exe
[Registry - Safe List]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "brastk" -> %SystemRoot%\system32\brastk.exe [C:\WINDOWS\system32\brastk.exe]
YN -> "LaunchApp" -> [launchapp]
YN -> "NDSTray.exe" -> [NDSTray.exe]
[Files/Folders - Modified Within 90 Days]
NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
[Empty Temp Folders]
[Start Explorer]
[Reboot]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here

I will review the information when it comes back in.

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

-Maverick-

Post #7October 18, 2008, 12:04 AM UTC

I've applied the OTScanIt2 fix. Here's the log taken after the fix: Explorer killed successfully [Processes - Safe List] Unable to kill process a2service.exe . [Registry - Safe List] Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\brastk deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\LaunchApp deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\NDSTray.exe deleted successfully. [Files/Folders - Modified Within 90 Days] [Empty Temp Folders] File delete failed. C:\Documents and Settings\Christine\Local Settings\Temp\~DFD6B6.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\JET4CB3.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_274.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. RecycleBin -> emptied. Explorer started successfully < End of fix log > OTScanIt2 by OldTimer - Version 1.0.0.15b fix logfile created on 10172008_174130 Files moved on Reboot… C:\Documents and Settings\Christine\Local Settings\Temp\~DFD6B6.tmp moved successfully. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully. File C:\WINDOWS\temp\_avast4_\Webshlock.txt not found! File C:\WINDOWS\temp\JET4CB3.tmp not found! File C:\WINDOWS\temp\Perflib_Perfdata_274.dat not found! C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Christine\Local Settings\Application Data\Mozilla\Firefox\Profiles\3vv15odh.default\XUL.mfl moved successfully. Here's the Malwarebytes' Anti-Malware log file results: Malwarebytes' Anti-Malware 1.29 Database version: 1279 Windows 5.1.2600 Service Pack 2 17/10/2008 5:53:03 PM mbam-log-2008-10-17 (17-53-03).txt Scan type: Quick Scan Objects scanned: 50535 Time elapsed: 2 minute(s), 32 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) And last but not least, here's the Kaspersky Online Scan results: ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Friday, October 17, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Friday, October 17, 2008 20:09:21 Records in database: 1319598 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 71335 Threat name: 1 Infected objects: 2 Suspicious objects: 0 Duration of the scan: 01:33:03 File name / Threat name / Threats count C:\Documents and Settings\Christine\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 C:\Documents and Settings\Christine\Desktop\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 The selected area was scanned.

Rorschach112

Post #8October 18, 2008, 11:26 PM UTC

Nearly done

Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<

-Maverick-

Post #9October 19, 2008, 12:03 AM UTC

Here's the results from the RSIT program:

First info.txt:

info.txt logfile of random's system information tool 1.04 2008-10-18 19:58:16

======Uninstall list======

–>C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
–>C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
–>C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware SE Personal–>C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Anchor Service CS3–>MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3–>MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}Adobe Bridge 1.0–>MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Bridge CS3–>MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting–>MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0–>MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps–>MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Common File Installer–>MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Default Language CS3–>MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe ExtendScript Toolkit 2–>MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Extension Manager CS3–>MsiExec.exe /I{D7A53E41-3F32-4A44-989C-53DDEBB2130C}
Adobe Fireworks CS3–>C:\Program Files\Common Files\Adobe\Installers\bbef028176efa5abf0233d3e1747be8\Setup.exe
Adobe Fireworks CS3–>MsiExec.exe /I{E16110F7-1C85-4675-99F4-7938F832C825}
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Help Center 1.0–>MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Help Viewer CS3–>MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe PDF Library Files–>MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS2–>msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Reader 7.0.5–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70500000002}
Adobe Setup–>MsiExec.exe /I{15C768E2-AB61-4DE3-952F-6B237A834951}
Adobe Stock Photos 1.0–>MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
Adobe Type Support–>MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3–>MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client–>MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe XMP Panels CS3–>MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Agnitum Outpost Firewall Pro–>C:\Program Files\Agnitum\Outpost Firewall\uninst.exe
Apple Software Update–>MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
a-squared Free 3.1–>"C:\Program Files\a-squared Free\unins000.exe"
avast! Antivirus–>rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
Canon Camera Access Library–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CAL\Uninst.ini"
Canon Camera Support Core Library–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CSCLIB\Uninst.ini"
Canon Camera Window DC_DV 5 for ZoomBrowser EX–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC\Uninst.ini"
Canon Camera Window DC_DV 6 for ZoomBrowser EX–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini"
Canon Camera Window MC 6 for ZoomBrowser EX–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowMC\Uninst.ini"
Canon G.726 WMP-Decoder–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\G726Decoder\G726DecUnInstall.ini"
Canon MovieEdit Task for ZoomBrowser EX–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\MVWUninst.ini"
Canon RAW Image Task for ZoomBrowser EX–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\RAW Image Task\Uninst.ini"
Canon RemoteCapture Task for ZoomBrowser EX–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini"
Canon Utilities EOS Utility–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\EOS Utility\Uninst.ini"
Canon Utilities PhotoStitch–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini"
Canon Utilities ZoomBrowser EX–>"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\Uninst.ini"
CD/DVD Drive Acoustic Silencer–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\setup.exe" -l0x9
Conexant HD Audio–>C:\Program Files\CONEXANT\CNXT_HDAUDIO\HXFSETUP.EXE -U -IBD1HDAa.inf
DivX Content Uploader–>C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player–>C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD-RAM Driver–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}\setup.exe" -l0x9 DVD-RAM Driver
FlashFXP v3–>"C:\Program Files\FlashFXP\Uninstall.exe" "C:\Program Files\FlashFXP\install.log" -u
Frets On Fire–>"C:\Program Files\Frets on Fire\Uninstall.exe"
HDAUDIO Soft Data Fax Modem with SmartCP–>C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV;_5047&SUBSYS;_1179FF31\HXFSETUP.EXE -U -IBD1HDAm.inf
High Definition Audio Driver Package - KB888111–>"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2–>"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Player 10 (KB903157)–>"C:\WINDOWS\$NtUninstallKB903157$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB888795)–>"C:\WINDOWS\$NtUninstallKB888795$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB891593)–>"C:\WINDOWS\$NtUninstallKB891593$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB895961)–>"C:\WINDOWS\$NtUninstallKB895961$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB899337)–>"C:\WINDOWS\$NtUninstallKB899337$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB899510)–>"C:\WINDOWS\$NtUninstallKB899510$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB902841)–>"C:\WINDOWS\$NtUninstallKB902841$\spuninst\spuninst.exe"
Intel® PRO Network Connections Drivers–>Prounstl.exe
Intel® PROSet/Wireless Software–>C:\WINDOWS\Installer\iProInst.exe
InterVideo WinDVD Creator 2–>"C:\Program Files\InstallShield Installation Information\{2FCE4FC5-6930-40E7-A4F1-F862207424EF}\setup.exe" REMOVEALL
InterVideo WinDVD for TOSHIBA–>"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
MailWasher–>"C:\Program Files\MailWasher\unins000.exe"
Malwarebytes' Anti-Malware–>"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
mCore–>MsiExec.exe /I{E81667C6-2856-46D6-ABEA-6A2F42166779}
mDrWiFi–>MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49}
mHelp–>MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
Microsoft .NET Framework 1.0 Hotfix (KB930494)–>"C:\WINDOWS\$NtUninstallKB930494$\spuninst\spuninst.exe"
Microsoft .NET Framework 1.1 Hotfix (KB886903)–>"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M886903\M886903Uninstall.msp"
Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office OneNote 2003–>MsiExec.exe /I{91A10409-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
mIWA–>MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F}
mLogView–>MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}
mMHouse–>MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
Mozilla Firefox (2.0.0.17)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
mPfMgr–>MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mPfWiz–>MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9}
mProSafe–>MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
Multiple File Search and Replace–>C:\Program Files\Multiple File Search and Replace\uninstall.exe
mWlsSafe–>MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}
mXML–>MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401}
mZConfig–>MsiExec.exe /I{94658027-9F16-4509-BBD7-A59FE57C3023}
NVIDIA Drivers–>C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Otto–>"C:\Program Files\EnglishOtto\uninstallotto.exe"
QuickTime–>MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
SD Secure Module–>MsiExec.exe /X{C45F4811-31D5-4786-801D-F79CD06EDD85}
Security Update for Step By Step Interactive Training (KB923723)–>"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)–>"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)–>"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)–>"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)–>"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)–>"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)–>"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908519)–>"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911562)–>"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)–>"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)–>"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914388)–>"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)–>"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917953)–>"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)–>"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918439)–>"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Security Update for Windows XP (KB919007)–>"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920670)–>"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920683)–>"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920685)–>"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921503)–>"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)–>"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)–>"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923414)–>"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)–>"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923980)–>"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)–>"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924496)–>"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)–>"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)–>"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)–>"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)–>"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)–>"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)–>"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)–>"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)–>"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)–>"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)–>"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)–>"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931784)–>"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)–>"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933729)–>"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935839)–>"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935840)–>"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Security Update for Windows XP (KB936021)–>"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937894)–>"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938127)–>"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938829)–>"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941202)–>"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941568)–>"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB942615)–>"C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)–>"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)–>"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
SimCity 3000–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Maxis\SimCity 3000\Uninst.isu"
Sonic DLA–>MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
Sonic Encoders–>MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
Sonic RecordNow!–>MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
Spybot - Search & Destroy 1.5.2.20–>"C:\WINDOWS\unins000.exe"
Spybot - Search & Destroy–>"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SpyHunter–>"C:\Program Files\Enigma Software Group\SpyHunter\Uninstall.exe" "C:\Program Files\Enigma Software Group\SpyHunter\install.log" -u
SpywareBlaster v3.5.1–>"C:\Program Files\SpywareBlaster\unins000.exe"
Synaptics Pointing Device Driver–>rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
System Requirements Lab–>C:\Program Files\SystemRequirementsLab\Uninstall.exe
Texas Instruments PCIxx21/x515/xx12 drivers.–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{4497AFF6-98C4-4F49-B073-F48F42BCBF9E} /l1033
TOSHIBA Assist–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\setup.exe" -l0x9
TOSHIBA ConfigFree–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}\setup.exe" -l0x9 UNINSTALL
Toshiba Controls Utility–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{ACA1086B-9B62-4F80-B4B9-5659395E4F25} /l1033
TOSHIBA PC Diagnostic Tool–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\TOSHIBA\PCDiag\Uninst.isu"
TOSHIBA SD Memory Card Format–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{48CF9A66-5F03-4025-ABD0-B3A3FA095A59}\setup.exe"
TOSHIBA Speech System Applications–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EE033C1F-443E-41EC-A0E2-559B539A4E4D}\Setup.exe" -l0x9
TOSHIBA Speech System SR Engine(U.S.) Version1.0–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{008D69EB-70FF-46AB-9C75-924620DF191A}\Setup.exe" -l0x9 UNINSTALL
TOSHIBA Speech System TTS Engine(U.S.) Version1.0–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3FBF6F99-8EC6-41B4-8527-0A32241B5496}\Setup.exe" -l0x9
Toshiba Tbiosdrv Driver–>C:\PROGRA~1\TOSHIBA\TOSHIB~3\UNWISE.EXE C:\PROGRA~1\TOSHIBA\TOSHIB~3\INSTALL.LOG
Toshiba Touchpad Utility–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{F77890F3-774A-4CBE-A2E3-7BB0DC71D1FA} /l1033
Toshiba Utility–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{099D12EC-0321-4CAC-A0CC-33D020156FCD} /l1033
TOSHIBA Zooming Utility–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64212898-097F-4F3F-AECA-6D34A7EF82DF}\setup.exe"
Update for Windows XP (KB898461)–>"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB900485)–>"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update for Windows XP (KB908531)–>"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)–>"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB911280)–>"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Update for Windows XP (KB916595)–>"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update for Windows XP (KB920872)–>"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update for Windows XP (KB922582)–>"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)–>"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)–>"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)–>"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)–>"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)–>"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB942840)–>"C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe"
Update Rollup 2 for Windows XP Media Center Edition 2005–>C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
WD Diagnostics–>MsiExec.exe /X{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}
Winamp (remove only)–>"C:\Program Files\Winamp\UninstWA.exe"
Windows Media Format Runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
WinMX v3.53 Patch level: 3.0 mod 2a–>C:\Program Files\Winmx\UninstallMX.exe
WinRAR archiver–>C:\Program Files\WinRAR\uninstall.exe
WinZip–>"C:\Program Files\WinZip\WINZIP32.EXE" /uninstall

======Hosts File======

======Security center information======

AV: avast! antivirus 4.7.1098 [VPS 080511-0] (outdated)
FW: Outpost Firewall Pro

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Adobe\AGL;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip

—————–EOF—————–

Second log.txt:

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-10-18 19:58:04
Microsoft Windows XP Professional Service Pack 2
System drive C: has 90 GB (86%) free of 104 GB
Total RAM: 2046 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:58:10 PM, on 18/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Christine\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Christine.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shoptoshiba.ca/welcome
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Toshiba Hotkey Utility] "C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" /lang en
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'SYSTEM')
O4 - .DEFAULT Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
O4 - .DEFAULT User Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1197965572375
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

–
End of file - 7875 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Registration reminder 1.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\CHDAudPropShortcut.exe [2005-12-28 61952]
"DLA"=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2005-10-06 122940]
"SmoothView"=C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe [2005-04-26 122880]
"Toshiba Hotkey Utility"=C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe [2006-03-14 1769472]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-03-02 761948]
"nwiz"=nwiz.exe /installquiet []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-02-15 7557120]
"IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2005-12-05 667718]
"IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2005-11-28 602182]
"Outpost Firewall"=C:\Program Files\Agnitum\Outpost Firewall\outpost.exe [2007-04-05 94720]
"OutpostFeedBack"=C:\Program Files\Agnitum\Outpost Firewall\feedback.exe [2007-06-09 335872]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [2007-09-25 132496]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2007-12-04 79224]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-03-28 413696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [2004-12-30 65536]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe

C:\Documents and Settings\Christine\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2008-10-18 19:58:04 —-D—- C:\rsit
2008-10-17 17:47:46 —-D—- C:\Documents and Settings\Christine\Application Data\Malwarebytes
2008-10-17 17:47:28 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-17 17:47:28 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-17 17:41:30 —-D—- C:\_OTScanIt
2008-10-17 16:13:17 —-A—- C:\WINDOWS\system32\tmp.txt
2008-10-17 16:13:11 —-A—- C:\rapport.txt
2008-10-17 16:03:03 —-A—- C:\WINDOWS\ntbtlog.txt
2008-10-14 12:41:54 —-D—- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-19 20:58:41 —-D—- C:\Documents and Settings\Christine\Application Data\Sonic

======List of files/folders modified in the last 1 months======

2008-10-18 19:58:08 —-D—- C:\WINDOWS\Prefetch
2008-10-18 15:22:36 —-D—- C:\Program Files\Mozilla Firefox
2008-10-18 13:42:13 —-A—- C:\WINDOWS\ODBC.INI
2008-10-18 13:41:47 —-D—- C:\WINDOWS\Temp
2008-10-18 13:41:46 —-D—- C:\WINDOWS\Registration
2008-10-18 13:41:16 —-AD—- C:\WINDOWS
2008-10-18 13:40:29 —-D—- C:\WINDOWS\system32\DLA
2008-10-18 03:00:04 —-A—- C:\WINDOWS\SchedLgU.Txt
2008-10-17 20:59:52 —-D—- C:\Documents and Settings\Christine\Application Data\MailWasher
2008-10-17 17:47:31 —-AD—- C:\WINDOWS\system32\drivers
2008-10-17 17:47:28 —-RD—- C:\Program Files
2008-10-17 17:41:30 —-AD—- C:\WINDOWS\system32
2008-10-17 13:25:27 —-RSHDC—- C:\WINDOWS\system32\dllcache
2008-10-08 09:28:41 —-D—- C:\Program Files\FlashFXP
2008-09-25 14:23:42 —-D—- C:\WINDOWS\system32\CatRoot2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2007-12-04 26624]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2007-12-04 42912]
R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-08-25 5628]
R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-08-25 22684]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-10 36096]
R1 meiudf;meiudf; C:\WINDOWS\System32\Drivers\meiudf.sys [2005-06-02 102384]
R1 SandBox;Outpost Firewall Sandbox Driver; \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS []
R1 VFILT;Outpost Firewall Kernel Driver; \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.9.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-12-16 21275]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2007-12-04 94544]
R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2005-10-06 25628]
R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2005-10-06 2496]
R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2005-10-06 86524]
R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2005-10-06 14684]
R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2005-10-06 6364]
R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2005-10-06 87036]
R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2005-10-06 94332]
R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-08-12 40544]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-10-04 12544]
R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2005-11-28 13568]
R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL []
R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL []
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-10 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2007-12-04 23152]
R3 BoiHwsetup;Access 32bits INT15 routine; C:\WINDOWS\system32\drivers\BoiHwSetup.sys [2005-06-10 5504]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-03 14080]
R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL []
R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL []
R3 e1express;Intel® PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2005-09-13 179200]
R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL []
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDAud.sys [2005-12-28 561664]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-11-07 997376]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2005-11-07 202240]
R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL []
R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL []
R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL []
R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-11 21060]
R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL []
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-10 61824]
R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-02-15 3642944]
R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 10368]
R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL []
R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL []
R3 qkbfiltr;Quanta HotKey Keyboard Filter Driver; C:\WINDOWS\system32\drivers\qkbfiltr.sys [2006-01-12 31872]
R3 qmofiltr;Quanta HotKey Mouse Filter Driver; C:\WINDOWS\system32\drivers\qmofiltr.sys [2005-05-05 7936]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-10 67584]
R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL); \??\C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL []
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-02 191968]
R3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2005-11-29 162560]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 w39n51;Intel® PRO/Wireless 3945ABG Adapter Driver; C:\WINDOWS\system32\DRIVERS\w39n51.sys [2005-12-04 1428096]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-11-07 723712]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 TBiosDrv;TBiosDrv; \??\C:\WINDOWS\system32\Drivers\Tbiosdrv.sys []
S3 UIUSys;Conexant Setup API; C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS []
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; C:\Program Files\a-squared Free\a2service.exe [2008-08-17 380536]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2007-12-04 17272]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2007-12-04 140664]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2005-09-30 96341]
R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2005-01-17 40960]
R2 DVD-RAM_Service;DVD-RAM_Service; C:\WINDOWS\system32\DVDRAMSV.exe [2004-08-27 110592]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2005-10-11 237568]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
R2 EvtEng;Intel® PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2005-11-28 114753]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-02-15 143426]
R2 OutpostFirewall;Outpost Firewall Service; C:\Program Files\Agnitum\Outpost Firewall\outpost.exe [2007-04-05 94720]
R2 RegSrvc;Intel® PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2005-11-28 217164]
R2 S24EventMonitor;Intel® PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2005-11-28 540745]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2007-12-04 247160]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2007-12-04 345464]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-01-10 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-01-09 654848]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2004-08-10 14336]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]

—————–EOF—————–

Rorschach112

Post #10October 19, 2008, 12:21 AM UTC

Your logs are clean

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com/products/acrobat/readstep2.html

Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.

Make sure you have an Internet Connection.
Download OTCleanIt to your desktop and run it
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
Click Yes to beging the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

*ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

*NoScript - Addon for Firefox that stops all scripts from running on websites. Stops malicious software from invading via flash, java, javascript, and many other entry points.

*Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

-Maverick-

Post #11October 19, 2008, 12:31 AM UTC

Thanks for all your help Rorschach112. It was greatly appreciated.

I will follow the instructions on your last post and hopefully I'll be a little more secure while browsing online.

Rorschach112

Post #12October 19, 2008, 11:49 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Infected with Win32:Agent-QNI[Trj]

✨ Ask AI

Ask AI