I really don't know what this is but would love if someone could help me out. I'm usually quite good at getting rid of this stuff myself but this one has stumped me, I'm starting to think it might be some messed up system services or drivers but I'm a bit out of my depth here.
Explorer is always running at around 50-60% CPU usage and 100-200mb of RAM which I know isn't right. At the moment to stop my laptop getting too hot I've just been killing explroer and running everything else normally, that works great.
Have fully scanned with MalwareBytes and AVG, run ATF Cleaner and restarted. Same problem.
Operating system: Windows Vista
Rootkit
Microsoft Windows Vista Home Edition (6.0.6001) Service Pack 1
C:\ [Fixed] - NTFS - (Total:168650 Mo/Free:165 Mo)
E:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
25/05/2009|11:43
----------------------\\ Processes..
--Locked-- [System Process]
--Locked-- System
---------- \SystemRoot\System32\smss.exe
---------- C:\Windows\system32\csrss.exe
---------- C:\Windows\system32\wininit.exe
---------- C:\Windows\system32\services.exe
---------- C:\Windows\system32\lsass.exe
---------- C:\Windows\system32\lsm.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Windows\system32\svchost.exe
--Locked-- audiodg.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\system32\SLsvc.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\System32\spoolsv.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\system32\WLANExt.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\System32\StkCSrv.exe
---------- c:\wamp\apache2\bin\httpd.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\wamp\apache2\bin\httpd.exe
---------- C:\Windows\System32\alg.exe
---------- C:\Windows\ehome\ehsched.exe
---------- C:\Windows\ehome\ehRecvr.exe
---------- C:\Program Files\Windows Media Player\wmpnetwk.exe
---------- C:\Windows\system32\csrss.exe
---------- C:\Windows\system32\winlogon.exe
---------- C:\Windows\system32\Dwm.exe
---------- C:\Windows\Explorer.EXE
---------- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
---------- C:\Program Files\ASUS\ATK Media\DMedia.exe
---------- C:\Windows\System32\rundll32.exe
---------- C:\Program Files\Java\jre6\bin\jusched.exe
---------- C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
---------- C:\Users\Andrew\AppData\Local\Google\Update\GoogleUpdate.exe
---------- C:\Windows\system32\mmc.exe
---------- C:\Program Files\Mozilla Firefox\firefox.exe
---------- C:\Program Files\Last.fm\LastFM.exe
---------- C:\Users\Andrew\Desktop\Rooter.exe
---------- C:\Windows\system32\cmd.exe
---------- C:\Rooter$\RK.exe
----------------------\\ Search..
----------------------\\ ROOTKIT !!
----------------------\\ Cracks & Keygens..
C:\Users\Andrew\AppData\Roaming\uTorrent\mIRC 6.31 with keygen and authpatch.rar.torrent
C:\Users\Andrew\AppData\Roaming\uTorrent\Nokia 6600 WayFinder_v3.02+keygen.rar.torrent
C:\Users\Andrew\AppData\Roaming\uTorrent\RAR Password cracker V4.12.00.torrent
C:\Users\Andrew\AppData\Roaming\uTorrent\Spore Crack by RELOADED.rar.torrent
C:\Users\Andrew\Documents\keygen.exe
C:\Users\Andrew\Documents\VMware Workstation v6 0 0 45731 with Keygen\Torrent downloaded from Demonoid.com.txt
1 - "C:\Rooter$\Rooter_1.txt" - 25/05/2009| 0:44
2 - "C:\Rooter$\Rooter_2.txt" - 25/05/2009|11:43
----------------------\\ Scan completed at 11:43
OTListIt logfile created on: 25/05/2009 11:44:50 - Run 2
OTListIt2 by OldTimer - Version 2.0.15.8 Folder = C:\Users\Andrew\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
2.00 Gb Total Physical Memory | 0.96 Gb Available Physical Memory | 47.94% Memory free
4.00 Gb Paging File | 3.18 Gb Available in Paging File | 79.62% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 164.70 Gb Total Space | 12.16 Gb Free Space | 7.38% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: ANDREW-PC
Current User Name: Andrew
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On
========== Processes (SafeList) ==========
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Windows\System32\StkCSrv.exe (Syntek America Inc.)
PRC - c:\wamp\apache2\bin\httpd.exe (Apache Software Foundation)
PRC - C:\wamp\apache2\bin\httpd.exe (Apache Software Foundation)
PRC - C:\Windows\ehome\ehsched.exe (Microsoft Corporation)
PRC - C:\Windows\ehome\ehRecvr.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUSTeK Computer INC.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe (Jay Elaraj)
PRC - C:\Users\Andrew\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
PRC - C:\Windows\system32\mmc.exe (Microsoft Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Last.fm\LastFM.exe (Last.fm)
PRC - C:\Windows\system32\cmd.exe (Microsoft Corporation)
PRC - C:\Users\Andrew\Desktop\OTListIt2.exe (OldTimer Tools)
PRC - C:\Program Files\IDM Computer Solutions\UltraEdit-32\uedit32.exe (IDM Computer Solutions, Inc.)
========== Win32 Services (SafeList) ==========
SRV - (AdeonaClientService [Disabled | Stopped]) -- C:\Program Files\Adeona\cygrunsrv.exe ()
SRV - (ASLDRService [Disabled | Stopped]) -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()
SRV - (ATKGFNEXSrv [Disabled | Stopped]) -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CLTNetCnService [On_Demand | Stopped]) -- File not found
SRV - (ehRecvr [On_Demand | Running]) -- C:\Windows\ehome\ehRecvr.exe (Microsoft Corporation)
SRV - (ehSched [On_Demand | Running]) -- C:\Windows\ehome\ehsched.exe (Microsoft Corporation)
SRV - (ehstart [Auto | Stopped]) -- C:\Windows\ehome\ehstart.dll (Microsoft Corporation)
SRV - (EvtEng [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (gupdate1c9879e90864170 [Disabled | Stopped]) -- C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (IAANTMON [Disabled | Stopped]) -- C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (Intel Corporation)
SRV - (IDriverT [Disabled | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (LightScribeService [Disabled | Stopped]) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (Microsoft Office Groove Audit Service [On_Demand | Stopped]) -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 3 [Disabled | Stopped]) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG)
SRV - (Net Driver HPZ12 [Auto | Running]) -- C:\Windows\system32\HPZinw12.dll (Hewlett-Packard)
SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (NJPZG [On_Demand | Stopped]) -- File not found
SRV - (nTuneService [Auto | Running]) -- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA)
SRV - (odserv [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [Disabled | Stopped]) -- C:\Windows\system32\HPZipm12.dll (Hewlett-Packard)
SRV - (RegSrvc [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (spmgr [Disabled | Stopped]) -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe ()
SRV - (StkSSrv [Auto | Running]) -- C:\Windows\System32\StkCSrv.exe (Syntek America Inc.)
SRV - (ufad-ws60 [Disabled | Stopped]) -- C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe (VMware, Inc.)
SRV - (VMAuthdService [Disabled | Stopped]) -- C:\Program Files\VMware\VMware Workstation\vmware-authd.exe (VMware, Inc.)
SRV - (VMnetDHCP [Disabled | Stopped]) -- C:\Windows\system32\vmnetdhcp.exe (VMware, Inc.)
SRV - (VMware NAT Service [Disabled | Stopped]) -- C:\Windows\system32\vmnat.exe (VMware, Inc.)
SRV - (wampapache [Auto | Running]) -- c:\wamp\apache2\bin\httpd.exe (Apache Software Foundation)
SRV - (wampmysqld [Disabled | Stopped]) -- c:\wamp\mysql\bin\mysqld-nt.exe ()
SRV - (WinDefend [Auto | Running]) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc [Auto | Running]) -- C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (a347bus [Boot | Stopped]) -- C:\Windows\System32\drivers\a347bus.DEAD ( )
DRV - (adp94xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (adpahci [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (adpu160m [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (adpu320 [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (aic78xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (aliide [Disabled | Stopped]) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (arc [Disabled | Stopped]) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (arcsas [Disabled | Stopped]) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (ASMMAP [Auto | Running]) -- C:\Program Files\ATKGFNEX\ASMMAP.sys ()
DRV - (AtcL001 [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\atl01v32.sys (Attansic Technology corporation.)
DRV - (BrFiltLo [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (Brserid [Disabled | Stopped]) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrSerWdm [Disabled | Stopped]) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm [Disabled | Stopped]) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (CM1063264 [On_Demand | Stopped]) -- C:\Windows\system32\drivers\CM106.sys (C-Media Inc)
DRV - (cmdide [Disabled | Stopped]) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (E1G60 [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\E1G60I32.sys (Intel Corporation)
DRV - (elxstor [Disabled | Stopped]) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (ghaio [Auto | Stopped]) -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys ()
DRV - (giveio [Boot | Running]) -- C:\Windows\system32\giveio.sys ()
DRV - (grmnusb [On_Demand | Stopped]) -- C:\Windows\system32\drivers\grmnusb.sys (GARMIN Corp.)
DRV - (hcmon [Auto | Running]) -- C:\Windows\system32\drivers\hcmon.sys (VMware, Inc.)
DRV - (HpCISSs [Disabled | Stopped]) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (iaStor [Boot | Running]) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (iaStorV [Disabled | Stopped]) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (iirsp [Disabled | Stopped]) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (IntcAzAudAddService [On_Demand | Running]) -- C:\Windows\system32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (iteatapi [Disabled | Stopped]) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (itecir [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\itecir.sys (Windows ® Codename Longhorn DDK provider)
DRV - (iteraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (JGOGO [Boot | Running]) -- C:\Windows\system32\DRIVERS\JGOGO.sys (JMicron )
DRV - (JRAID [Boot | Running]) -- C:\Windows\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV - (kbfiltr [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\kbfiltr.sys ( )
DRV - (LSI_FC [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (LSI_SAS [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (LSI_SCSI [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (Ltn_hyd7700pc [On_Demand | Running]) -- C:\Windows\System32\Drivers\Ltn_hyd7700pc.sys (Liteon)
DRV - (megasas [Disabled | Stopped]) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (MODEMCSA [On_Demand | Running]) -- C:\Windows\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (motmodem [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\motmodem.sys (Motorola)
DRV - (Mraid35x [Disabled | Stopped]) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (MTsensor [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\ATKACPI.sys (ATK0100)
DRV - (NETw3v32 [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\NETw3v32.sys (Intel® Corporation)
DRV - (NETw4v32 [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\NETw4v32.sys (Intel Corporation)
DRV - (nfrd960 [Disabled | Stopped]) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (NSNDIS5 [On_Demand | Stopped]) -- C:\Windows\system32\NSNDIS5.SYS (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (ntrigdigi [Disabled | Stopped]) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (nvlddmkm [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVR0Dev [On_Demand | Running]) -- C:\Windows\nvoclock.sys (NVidia Corp.)
DRV - (nvraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor [Disabled | Stopped]) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (ql2300 [Disabled | Stopped]) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (ql40xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (rimmptsk [Auto | Running]) -- C:\Windows\system32\DRIVERS\rimmptsk.sys (REDC)
DRV - (rimsptsk [Auto | Running]) -- C:\Windows\system32\DRIVERS\rimsptsk.sys (REDC)
DRV - (rismxdp [Auto | Running]) -- C:\Windows\system32\DRIVERS\rixdptsk.sys (REDC)
DRV - (RTL8169 [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\Rtlh86.sys (Realtek Corporation)
DRV - (secdrv [Auto | Running]) -- C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SiSRaid2 [Disabled | Stopped]) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (SiSRaid4 [Disabled | Stopped]) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (smserial [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\smserial.sys (Motorola Inc.)
DRV - (speedfan [Boot | Running]) -- C:\Windows\system32\speedfan.sys (Windows ® 2000 DDK provider)
DRV - (sptd [Boot | Running]) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (StkCMini [On_Demand | Running]) -- C:\Windows\System32\Drivers\StkCMini.sys (Syntek)
DRV - (Symc8xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_hi [Disabled | Stopped]) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Sym_u3 [Disabled | Stopped]) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (SynTP [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\SynTP.sys (Synaptics, Inc.)
DRV - (TPM [On_Demand | Stopped]) -- C:\Windows\system32\drivers\tpm.sys (Microsoft Corporation)
DRV - (uliahci [Disabled | Stopped]) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (UlSata [Disabled | Stopped]) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (ulsata2 [Disabled | Stopped]) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (usbaudio [On_Demand | Stopped]) -- C:\Windows\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (USB_RNDIS [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\usb8023.sys (Microsoft Corporation)
DRV - (viaide [Disabled | Stopped]) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (vmci [Auto | Running]) -- C:\Windows\system32\Drivers\vmci.sys (VMware, Inc.)
DRV - (vmkbd [On_Demand | Running]) -- C:\Windows\system32\drivers\VMkbd.sys (VMware, Inc.)
DRV - (VMnetAdapter [On_Demand | Stopped]) -- C:\Windows\system32\DRIVERS\vmnetadapter.sys (VMware, Inc.)
DRV - (VMnetBridge [Auto | Running]) -- C:\Windows\system32\DRIVERS\vmnetbridge.sys (VMware, Inc.)
DRV - (VMnetuserif [Auto | Running]) -- C:\Windows\system32\drivers\vmnetuserif.sys (VMware, Inc.)
DRV - (vmx86 [Auto | Running]) -- C:\Windows\system32\Drivers\vmx86.sys (VMware, Inc.)
DRV - (vnccom [Auto | Running]) -- C:\Windows\System32\Drivers\vnccom.SYS (RDV Soft)
DRV - (vncdrv [On_Demand | Running]) -- C:\Windows\system32\DRIVERS\vncdrv.sys (RDV Soft)
DRV - (vsmraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vstor2-ws60 [Auto | Running]) -- C:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys (VMware, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default = AF 7C 14 17 F2 8B 73 4D A0 48 A7 73 F1 E8 C1 C4 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://127.0.0.1/Cou...ownToExams.php"
FF - prefs.js..extensions.enabledItems: {44d0a1b4-9c90-4f86-ac92-8680b5d6549e}:0.6.3.11
FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:5.0.20090324W
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}:6.0.02
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}:6.0.04
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}:6.0.05
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: {53A03D43-5363-4669-8190-99061B2DEBA5}:1.3.3.9
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/05/04 12:14:27 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/28 21:49:08 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.12\extensions\\Components: C:\PROGRAM FILES\MOZILLA THUNDERBIRD\COMPONENTS [2008/03/22 23:52:38 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\MOZILLA THUNDERBIRD
[2009/04/12 21:26:59 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Extensions
[2009/04/12 21:26:59 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Extensions\{ea278cf8-93cd-484f-b951-57360482d33a}
[2008/06/08 12:33:08 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/05/24 21:45:51 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions
[2009/05/15 16:34:08 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/03/29 22:41:57 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions\{44d0a1b4-9c90-4f86-ac92-8680b5d6549e}
[2009/04/29 22:29:19 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions\{53A03D43-5363-4669-8190-99061B2DEBA5}
[2008/05/14 10:27:41 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2009/03/30 14:40:54 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions\{A64F9D1E-FA5E-11DA-A187-6B94C2ED2B83}
[2008/12/20 03:07:08 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2008/08/31 16:25:44 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions\{dc0fa13e-3db0-73ec-e852-912722c85409}
[2008/04/10 00:26:13 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
[2008/12/13 22:40:44 | 00,000,000 | ---D | M] -- C:\Users\Andrew\AppData\Roaming\mozilla\Firefox\Profiles\3kcftl18.default\extensions\[email protected]
[2008/06/20 03:30:54 | 00,001,108 | ---- | M] () -- C:\Users\Andrew\AppData\Roaming\Mozilla\FireFox\Profiles\3kcftl18.default\searchplugins\wikipedia-en.xml
[2009/05/24 21:45:51 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/04/28 21:49:08 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2007/09/10 23:25:33 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
[2007/10/10 12:59:08 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
[2008/04/23 11:22:36 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
[2008/03/05 11:25:12 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
[2008/08/19 12:24:23 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2008/12/05 14:29:33 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009/03/28 12:42:46 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/04/28 21:49:06 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/28 21:49:06 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2004/07/02 15:51:00 | 00,327,904 | ---- | M] (Macromedia, Inc.) -- C:\Program Files\mozilla firefox\components\np32asw.dll
[2009/02/07 18:27:04 | 00,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2009/02/07 18:27:04 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/02/07 18:27:04 | 00,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2009/02/07 18:27:04 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/02/07 18:27:04 | 00,000,759 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2009/02/07 18:27:04 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/02/07 18:27:04 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/02/07 18:27:04 | 00,000,831 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml
O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE (ASUSTeK Computer INC.)
O4 - HKLM..\Run: [CM106Sound] RunDll32 CM106.cpl,CMICtrlWnd File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKCU..\Run: [Google Update] "C:\Users\Andrew\AppData\Local\Google\Update\GoogleUpdate.exe" /c (Google Inc.)
O4 - HKCU..\Run: [Taskbar Shuffle] C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe (Jay Elaraj)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - Reg Error: Key error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [@%SystemRoot%\system32\nlasvc.dll,-1000] - C:\Windows\system32\NLAapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [@%SystemRoot%\system32\napinsp.dll,-1000] - C:\Windows\system32\napinsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [@%SystemRoot%\system32\pnrpnsp.dll,-1000] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [@%SystemRoot%\system32\pnrpnsp.dll,-1001] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [Bluetooth Namespace] - C:\Windows\system32\wshbth.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} http://cdn.scan.onec...b/wlscctrl2.cab (Windows Live OneCare safety scanner control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Interfaces\{B01A60E2-A5A6-4E51-A0A3-952D2E6A7A75}\\NameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (C:\Windows\system32\ddcDWpol) - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2009/05/06 20:16:48 | 00,000,000 | ---D | M] - C:\automata -- [ NTFS ]
O33 - MountPoints2\{03c36676-44b3-11dc-8db9-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{03c36676-44b3-11dc-8db9-806e6f6e6963}\Shell\AutoRun\command - "" = E:\setup.exe -- File not found
O33 - MountPoints2\{104122d4-d9c4-11dd-b256-f22659b88dca}\Shell\Auto\command - "" = fun.xls.exe
O33 - MountPoints2\{104122d4-d9c4-11dd-b256-f22659b88dca}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\
O33 - MountPoints2\{26ac140f-b7bd-11dd-8d16-001bfca87a7c}\Shell\AutoRun\command - "" = G:\umenu.exe -- File not found
O33 - MountPoints2\{50b58db5-cdc7-11dd-9963-001bfca87a7c}\Shell - "" = AutoRun
O33 - MountPoints2\{50b58db5-cdc7-11dd-9963-001bfca87a7c}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\{95bf108c-1a03-11de-8656-0013e883a987}\Shell\AutoRun\command - "" = D:\hbcd\wintools\autorun.exe -- File not found
O33 - MountPoints2\{95bf108c-1a03-11de-8656-0013e883a987}\Shell\Option1\Command - "" = D:\hbcd\wintools\autorun.exe -- File not found
O33 - MountPoints2\{ddc33f66-6c88-11dc-b992-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{ddc33f66-6c88-11dc-b992-005056c00008}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\{e41e716c-5bb5-11dc-9da4-001d600fd517}\Shell - "" = AutoRun
O33 - MountPoints2\{e41e716c-5bb5-11dc-9da4-001d600fd517}\Shell\AutoRun\command - "" = F:\setup\rsrc\Autorun.exe -- File not found
O33 - MountPoints2\{e41e716c-5bb5-11dc-9da4-001d600fd517}\Shell\dinstall\command - "" = F:\Directx\dxsetup.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009/05/25 11:28:46 | 00,000,000 | R--D | M]
========== Files/Folders - Created Within 30 Days ==========
[1 C:\Users\Andrew\Documents\*.tmp files]
[2009/05/25 00:44:15 | 00,000,000 | ---D | C] -- C:\Rooter$
[2009/05/25 00:43:55 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTListIt2.exe
[2009/05/25 00:43:41 | 00,267,612 | ---- | C] () -- C:\Users\Andrew\Desktop\Rooter.exe
[2009/05/25 00:42:30 | 23,975,176 | ---- | C] (PC Tools ) -- C:\Users\Andrew\Desktop\sdsetup.exe
[2009/05/24 19:51:23 | 00,000,718 | ---- | C] () -- C:\index.html
[2009/05/23 23:14:28 | 84,128,114 | ---- | C] () -- C:\Users\Andrew\Desktop\Adam and Joe_090523 Edited.m4a
[2009/05/20 18:20:21 | 73,290,9568 | ---- | C] () -- C:\Users\Andrew\Desktop\ubuntu-9.04-desktop-i386.iso
[2009/05/19 16:20:05 | 12,008,595 | ---- | C] () -- C:\Users\Andrew\Desktop\RB2-AusCERT-DDoS.mp3
[2009/05/19 13:38:24 | 79,095,512 | ---- | C] () -- C:\Users\Andrew\Desktop\william stalling - Computer Organization and Architecture.6th.Ed.pdf
[2009/05/19 13:09:10 | 74,986,855 | ---- | C] () -- C:\Users\Andrew\Desktop\william_stalling_-_Computer_Organization_and_Architecture.6th.Ed(2).rar
[2009/05/19 11:44:23 | 00,828,488 | ---- | C] (Piriform Ltd) -- C:\Users\Andrew\Desktop\dfsetup110.exe
[2009/05/17 17:56:26 | 08,325,632 | ---- | C] (Cavedog Entertainment) -- C:\Users\Andrew\Desktop\ta1x-31c.exe
[2009/05/17 17:39:24 | 87,843,760 | ---- | C] () -- C:\Users\Andrew\Desktop\Adam and Joe_090516 Edited.m4a
[2009/05/16 13:10:45 | 00,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Roaming\Toribash
[2009/05/16 13:10:39 | 00,000,728 | ---- | C] () -- C:\Users\Andrew\Desktop\Toribash.lnk
[2009/05/16 13:10:25 | 00,000,000 | ---D | C] -- C:\Games
[2009/05/16 13:06:55 | 08,239,674 | ---- | C] (Nabi Studios Pte Ltd ) -- C:\Users\Andrew\Desktop\Toribash-3.72-Setup.exe
[2009/05/15 20:46:32 | 00,001,345 | ---- | C] () -- C:\Users\Public\Desktop\Cygwin.lnk
[2009/05/15 20:32:49 | 00,000,015 | ---- | C] () -- C:\Users\Andrew\Desktop\25toBhlbApIC.pdf
[2009/05/15 20:30:39 | 00,000,000 | ---D | C] -- C:\Users\Andrew\Desktop\a
[2009/05/15 20:23:42 | 00,585,728 | ---- | C] () -- C:\Users\Andrew\Desktop\setup.exe
[2009/05/15 17:30:17 | 64,866,928 | ---- | C] (AVG Technologies) -- C:\Users\Andrew\Desktop\avg_free_stf_en_85_336a1515.exe
[2009/05/15 17:27:37 | 00,000,000 | ---D | C] -- C:\ProgramData\ESET
[2009/05/15 17:24:12 | 00,000,000 | ---D | C] -- C:\Users\Andrew\Desktop\GBD-0.1.0.alpha8
[2009/05/15 17:23:09 | 00,705,754 | ---- | C] () -- C:\Users\Andrew\Desktop\Topic12.pdf
[2009/05/15 17:10:30 | 00,334,720 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Users\Andrew\Desktop\RootkitRevealer.exe
[2009/05/15 17:06:04 | 00,001,894 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2009/05/15 15:25:12 | 01,464,768 | ---- | C] (Stephan Schreiber) -- C:\Users\Andrew\Desktop\Ext2IFS_1_11a.exe
[2009/05/11 11:59:20 | 00,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Roaming\Malwarebytes
[2009/05/11 11:59:18 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2009/05/11 11:59:18 | 00,000,825 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/05/11 11:59:16 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2009/05/11 11:59:15 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2009/05/11 11:59:15 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/05/11 11:58:52 | 02,967,800 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Andrew\Desktop\mbam-setup.exe
[2009/05/11 11:51:02 | 00,360,021 | ---- | C] () -- C:\Users\Andrew\Desktop\dds.scr
[2009/05/11 00:22:34 | 00,000,000 | ---D | C] -- C:\Program Files\Hedgewars 0.9.10
[2009/05/11 00:19:07 | 59,603,214 | ---- | C] () -- C:\Users\Andrew\Desktop\hedgewars-0.9.10.exe
[2009/05/10 21:35:01 | 00,000,000 | ---D | C] -- C:\CAVEDOG
[2009/05/10 21:32:56 | 01,352,435 | ---- | C] () -- C:\Users\Andrew\Desktop\setup_magicdisc.exe
[2009/05/10 21:28:56 | 00,000,000 | ---D | C] -- C:\Program Files\Virtual CD v9
[2009/05/10 21:22:51 | 00,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Pro
[2009/05/10 21:19:48 | 11,472,328 | ---- | C] (DT Soft Ltd.) -- C:\Users\Andrew\Desktop\DTPro4300305.exe
[2009/05/10 17:12:04 | 00,000,038 | ---- | C] () -- C:\@id=.1
[2009/05/10 17:11:55 | 00,000,038 | ---- | C] () -- C:\@id=
[2009/05/10 16:57:44 | 00,013,069 | ---- | C] () -- C:\Users\Andrew\Desktop\5.png
[2009/05/10 16:15:24 | 83,260,630 | ---- | C] () -- C:\Users\Andrew\Desktop\Adam and Joe_090509 Edited.mp3
[2009/05/08 14:40:00 | 74,986,855 | ---- | C] () -- C:\Users\Andrew\Desktop\william_stalling_-_Computer_Organization_and_Architecture.6th.Ed.rar
[2009/05/08 12:43:38 | 00,000,000 | ---D | C] -- C:\Users\Andrew\Desktop\Stallings_Solutions
[2009/05/08 12:43:00 | 01,268,789 | ---- | C] () -- C:\Users\Andrew\Desktop\Stallings_Solutions.rar
[2009/05/08 12:23:34 | 02,362,859 | ---- | C] () -- C:\Users\Andrew\Desktop\1584883871.rar
[2009/05/08 12:23:29 | 00,000,000 | ---- | C] () -- C:\Users\Andrew\Desktop\knowledge_representation_and_reasoning_44.rar
[2009/05/08 12:23:26 | 01,212,744 | ---- | C] () -- C:\Users\Andrew\Desktop\knowledge_representation_and_reasoning_44.rar.part
[2009/05/08 12:16:28 | 00,000,000 | ---D | C] -- C:\Users\Andrew\Desktop\Books
[2009/05/06 19:16:31 | 00,323,403 | ---- | C] (Holger Stenger) -- C:\Users\Andrew\Desktop\foo_comserver2-0.7-setup.exe
[2009/05/06 19:14:05 | 00,000,000 | ---D | C] -- C:\Program Files\AlbumArtDownloader
[2009/05/06 19:13:52 | 01,019,277 | ---- | C] () -- C:\Users\Andrew\Desktop\AlbumArtDownloaderXUI-0.25.exe
[2009/05/06 10:42:48 | 00,000,000 | ---D | C] -- C:\Program Files\Unlocker
[2009/05/06 10:42:29 | 00,261,295 | ---- | C] () -- C:\Users\Andrew\Desktop\unlocker1.8.7.exe
[2009/05/05 13:46:56 | 00,000,835 | ---- | C] () -- C:\Users\Public\Desktop\foobar2000.lnk
[2009/05/05 13:46:07 | 03,077,558 | ---- | C] (foobar2000.org) -- C:\Users\Andrew\Desktop\foobar2000_0.9.6.5.exe
[2009/05/04 14:59:36 | 06,862,036 | ---- | C] () -- C:\Users\Andrew\Desktop\picard-setup-0.11.exe
[2009/05/04 14:55:39 | 00,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Roaming\Mp3tag
[2009/05/04 14:55:36 | 00,000,783 | ---- | C] () -- C:\Users\Public\Desktop\Mp3tag.lnk
[2009/05/04 14:55:36 | 00,000,000 | ---D | C] -- C:\Program Files\Mp3tag
[2009/05/04 14:55:27 | 01,864,680 | ---- | C] () -- C:\Users\Andrew\Desktop\mp3tagv243setup.exe
[2009/05/03 21:17:04 | 04,935,749 | ---- | C] (Mathias Kunter ) -- C:\Users\Andrew\Desktop\magic_tagger.exe
[2009/05/03 20:23:36 | 00,000,762 | ---- | C] () -- C:\Users\Andrew\Desktop\TagScanner.lnk
[2009/05/03 20:22:33 | 01,712,029 | ---- | C] (Sergey Serkov ) -- C:\Users\Andrew\Desktop\tagscan531setup.exe
[2009/05/03 19:40:38 | 00,948,392 | ---- | C] ( ) -- C:\Users\Andrew\Desktop\hddh.exe
[2009/05/03 19:00:30 | 00,338,580 | ---- | C] () -- C:\Users\Andrew\Desktop\what.png
[2009/05/03 14:37:55 | 00,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Roaming\DAEMON Tools Pro
[2009/05/03 14:37:16 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Pro
[2009/05/02 16:44:16 | 84,842,326 | ---- | C] () -- C:\Users\Andrew\Desktop\Adam and Joe_090502 Edited.mp3
[2009/05/01 17:56:53 | 00,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2009/05/01 17:56:53 | 00,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardie.dll
[2009/05/01 17:56:52 | 00,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2009/05/01 17:56:52 | 00,156,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2009/05/01 17:56:52 | 00,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2009/05/01 17:56:52 | 00,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2009/05/01 17:56:52 | 00,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2009/05/01 17:56:51 | 00,125,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2009/05/01 17:56:51 | 00,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tdc.ocx
[2009/05/01 17:56:51 | 00,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2009/05/01 17:56:51 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\corpol.dll
[2009/05/01 17:56:50 | 01,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2009/05/01 17:56:50 | 00,348,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2009/05/01 17:56:50 | 00,236,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webcheck.dll
[2009/05/01 17:56:50 | 00,229,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2009/05/01 17:56:50 | 00,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2009/05/01 17:56:50 | 00,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2009/05/01 17:56:50 | 00,183,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2009/05/01 17:56:50 | 00,109,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\occache.dll
[2009/05/01 17:56:50 | 00,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2009/05/01 17:56:50 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2009/05/01 17:56:50 | 00,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2009/05/01 17:56:50 | 00,034,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2009/05/01 17:56:49 | 00,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2009/05/01 17:56:49 | 00,594,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2009/05/01 17:56:49 | 00,445,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2009/05/01 17:56:49 | 00,208,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WinFXDocObj.exe
[2009/05/01 17:56:49 | 00,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2009/05/01 17:56:49 | 00,128,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\advpack.dll
[2009/05/01 17:56:49 | 00,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2009/05/01 17:56:49 | 00,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2009/05/01 17:56:49 | 00,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2009/05/01 17:56:49 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2009/05/01 17:56:48 | 00,726,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2009/05/01 17:56:48 | 00,420,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2009/05/01 17:56:48 | 00,391,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2009/05/01 17:56:48 | 00,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2009/05/01 17:56:48 | 00,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2009/05/01 17:56:47 | 00,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2009/05/01 17:56:47 | 00,169,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2009/05/01 17:56:47 | 00,045,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshta.exe
[2009/05/01 17:56:46 | 03,698,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2009/05/01 17:56:46 | 01,985,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iertutil.dll
[2009/05/01 17:56:46 | 00,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2009/05/01 17:56:46 | 00,132,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2009/05/01 17:56:46 | 00,109,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PDMSetup.exe
[2009/05/01 17:56:46 | 00,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2009/05/01 17:56:46 | 00,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2009/05/01 17:56:46 | 00,107,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2009/05/01 17:56:46 | 00,103,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetDepNx.exe
[2009/05/01 17:56:45 | 01,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2009/05/01 17:56:45 | 01,206,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\urlmon.dll
[2009/05/01 17:56:45 | 00,914,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wininet.dll
[2009/05/01 17:56:44 | 11,063,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieframe.dll
[2009/05/01 17:56:44 | 05,937,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.dll
[2009/05/01 17:54:46 | 00,000,000 | ---- | C] () -- C:\Windows\System32\w32apiw.dll
[2009/05/01 17:54:44 | 00,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Roaming\nCleaner
[2009/05/01 17:54:36 | 00,000,945 | ---- | C] () -- C:\Users\Andrew\Desktop\nCleaner.lnk
[2009/05/01 17:54:32 | 00,000,000 | ---D | C] -- C:\Program Files\NKProds
[2009/05/01 17:53:24 | 00,892,614 | ---- | C] (NKProds) -- C:\Users\Andrew\Desktop\ncleaner_setup.exe
[2009/05/01 17:40:14 | 00,001,709 | ---- | C] () -- C:\Users\Andrew\Desktop\Defraggler.lnk
[2009/05/01 17:40:14 | 00,000,000 | ---D | C] -- C:\Program Files\Defraggler
[2009/05/01 17:39:34 | 00,162,898 | ---- | C] () -- C:\Users\Andrew\Documents\cc_20090501_173932.reg
[2009/05/01 17:39:24 | 00,805,120 | ---- | C] (Piriform Ltd) -- C:\Users\Andrew\Desktop\dfsetup109.exe
[2009/05/01 17:37:14 | 00,001,677 | ---- | C] () -- C:\Users\Andrew\Desktop\CCleaner.lnk
[2009/05/01 17:37:13 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2009/05/01 17:35:03 | 03,227,536 | ---- | C] (Piriform Ltd) -- C:\Users\Andrew\Desktop\ccsetup219.exe
[2009/04/29 13:24:32 | 00,000,012 | ---- | C] () -- C:\Users\Andrew\Desktop\test
[2009/04/29 13:16:40 | 00,002,330 | ---- | C] () -- C:\Users\Andrew\Documents\shoutthree.php
[2009/04/29 13:15:44 | 00,000,948 | ---- | C] () -- C:\Users\Andrew\Documents\config.php
[2009/04/28 16:16:45 | 00,000,811 | ---- | C] () -- C:\Users\Andrew\Desktop\QuickPar.lnk
[2009/04/28 16:16:45 | 00,000,000 | ---D | C] -- C:\Program Files\QuickPar
[2009/04/28 16:16:37 | 00,501,363 | ---- | C] (Peter B Clements) -- C:\Users\Andrew\Desktop\QuickPar-0.9.1.0.exe
[2009/04/28 16:10:41 | 00,000,000 | ---D | C] -- C:\Users\Andrew\Documents\GrabIt Downloads
[2009/04/28 16:06:59 | 00,000,000 | ---D | C] -- C:\Users\Andrew\AppData\Roaming\GrabIt
[2009/04/28 16:06:11 | 00,000,735 | ---- | C] () -- C:\Users\Andrew\Desktop\GrabIt.lnk
[2009/04/28 16:06:10 | 00,000,000 | ---D | C] -- C:\Program Files\GrabIt
[2009/04/28 16:05:59 | 02,188,566 | ---- | C] (Ilan Shemes ) -- C:\Users\Andrew\Desktop\GrabIt172b3.exe
[2009/04/26 16:34:26 | 00,000,000 | ---D | C] -- C:\Users\Andrew\Desktop\3333 - Big Bang Mini (U)
[2009/04/26 16:34:17 | 00,000,166 | ---- | C] () -- C:\Users\Andrew\Desktop\nDASH.eu.url
[2009/04/26 16:34:17 | 00,000,000 | ---D | C] -- C:\Users\Andrew\Desktop\Assassins_Creed_Altairs_Chronicles_USA_NDS-Micronauts
[2009/04/26 14:24:36 | 05,262,340 | ---- | C] () -- C:\Users\Andrew\Desktop\MaNNiNG-JeSS.iN.aCTioN-2003.pdf
[2009/04/26 14:23:48 | 04,338,722 | ---- | C] () -- C:\Users\Andrew\Desktop\MaNNiNG-JeSS.iN.aCTioN-2003.rar
[2009/04/26 14:07:56 | 00,000,000 | ---D | C] -- C:\Users\Andrew\Desktop\Jess
[2009/04/26 13:24:36 | 09,760,304 | ---- | C] () -- C:\Users\Andrew\Desktop\3333 - Big Bang Mini (U).zip
[2009/04/26 13:16:04 | 38,239,248 | ---- | C] () -- C:\Users\Andrew\Desktop\1992_Assassins_Creed_Altairs_Chronicles_USA_NDS-Micronauts.zip
[2009/04/26 13:03:52 | 00,000,000 | ---D | C] -- C:\ProgramData\Last.fm
[2009/04/26 13:03:25 | 00,000,740 | ---- | C] () -- C:\Users\Public\Desktop\Last.fm.lnk
[2009/04/26 13:03:23 | 00,000,000 | ---D | C] -- C:\Program Files\Last.fm
[2009/04/26 13:03:02 | 05,287,682 | ---- | C] (Last.fm ) -- C:\Users\Andrew\Desktop\Last.fm-1.5.4.24567.exe
[2009/04/25 15:51:35 | 78,892,246 | ---- | C] () -- C:\Users\Andrew\Desktop\Adam and Joe_090425 Edited.mp3
[2009/04/22 00:19:06 | 00,172,173 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2009/04/15 13:43:18 | 00,000,000 | ---- | C] () -- C:\Windows\PhoneBkExe.INI
[2009/04/15 13:41:53 | 00,000,000 | ---- | C] () -- C:\Windows\PanelExe.INI
[2009/03/29 18:45:35 | 00,000,272 | ---- | C] () -- C:\Windows\{93564F30-2010-43DB-B7AF-D1EFD102887D}_WiseFW.ini
[2008/12/11 15:43:57 | 00,000,319 | ---- | C] () -- C:\Windows\game.ini
[2008/11/24 11:41:08 | 00,013,576 | ---- | C] () -- C:\Windows\System32\wnaspi32.dll
[2008/11/23 22:52:17 | 00,055,856 | ---- | C] () -- C:\Windows\System32\vnetinst.dll
[2008/10/24 12:34:29 | 00,000,755 | ---- | C] () -- C:\Windows\cmudax3.ini
[2008/07/23 20:50:15 | 00,034,308 | ---- | C] () -- C:\Windows\System32\BASSMOD.dll
[2008/07/17 13:29:24 | 00,000,131 | ---- | C] () -- C:\Windows\WFTPSRV.INI
[2008/07/07 18:14:27 | 00,000,621 | ---- | C] () -- C:\Windows\tlknw14.ini
[2008/05/31 19:54:24 | 00,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
[2008/04/28 00:14:48 | 00,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
[2008/03/30 20:54:16 | 00,000,125 | ---- | C] () -- C:\Windows\fd3.INI
[2007/12/29 15:56:44 | 00,000,077 | ---- | C] () -- C:\Windows\ts_settings.ini
[2007/12/14 03:31:44 | 00,676,224 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2007/12/12 01:35:33 | 00,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007/12/03 16:55:12 | 00,161,280 | ---- | C] () -- C:\Windows\tbhookin.dll
[2007/10/31 16:08:52 | 00,045,056 | R--- | C] () -- C:\Windows\System32\CM106rm.dll
[2007/10/31 16:08:44 | 00,000,293 | ---- | C] () -- C:\Windows\Cm106.ini.cfl
[2007/10/31 16:08:43 | 00,065,536 | R--- | C] () -- C:\Windows\System32\CmiInstallResAll.dll
[2007/10/31 16:08:43 | 00,002,113 | R--- | C] () -- C:\Windows\Cm106.ini.cfg
[2007/10/31 16:08:43 | 00,000,782 | ---- | C] () -- C:\Windows\Cm106.ini.imi
[2007/10/31 16:08:39 | 00,102,400 | R--- | C] () -- C:\Windows\VMix.dll
[2007/10/31 16:08:39 | 00,000,768 | R--- | C] () -- C:\Windows\cm106.ini
[2007/09/04 21:53:03 | 00,721,904 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2007/08/07 09:36:39 | 00,012,288 | ---- | C] () -- C:\Windows\impborl.dll
[2007/08/07 09:14:37 | 00,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2007/07/25 14:24:28 | 01,559,040 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2007/04/18 10:06:01 | 00,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2007/03/12 13:01:30 | 00,217,088 | ---- | C] () -- C:\Windows\NVGfxOgl.dll
[2007/03/10 12:51:48 | 00,282,624 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2007/02/21 19:26:58 | 00,995,328 | ---- | C] () -- C:\Windows\System32\WLIHVUI.dll
[2007/01/24 11:08:39 | 00,005,632 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
[2006/11/02 13:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\win.ini
[2006/11/02 11:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\system.ini
[2006/11/02 08:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/03/09 03:57:59 | 01,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2002/10/15 23:54:04 | 00,153,088 | ---- | C] () -- C:\Windows\System32\unrar.dll
[1996/04/03 20:33:26 | 00,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
========== Files - Modified Within 30 Days ==========
[1 C:\Users\Andrew\Documents\*.tmp files]
[2009/05/25 11:20:12 | 00,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/05/25 11:20:12 | 00,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/05/25 11:19:52 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2009/05/25 01:24:37 | 00,000,836 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2009/05/25 00:43:56 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Users\Andrew\Desktop\OTListIt2.exe
[2009/05/25 00:43:48 | 23,975,176 | ---- | M] (PC Tools ) -- C:\Users\Andrew\Desktop\sdsetup.exe
[2009/05/25 00:43:42 | 00,267,612 | ---- | M] () -- C:\Users\Andrew\Desktop\Rooter.exe
[2009/05/24 22:10:58 | 00,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2009/05/24 19:51:23 | 00,000,718 | ---- | M] () -- C:\index.html
[2009/05/23 23:24:23 | 84,128,114 | ---- | M] () -- C:\Users\Andrew\Desktop\Adam and Joe_090523 Edited.m4a
[2009/05/23 22:20:22 | 00,054,156 | -H-- | M] () -- C:\Windows\QTFont.qfn
[2009/05/20 18:32:52 | 73,290,9568 | ---- | M] () -- C:\Users\Andrew\Desktop\ubuntu-9.04-desktop-i386.iso
[2009/05/19 16:21:29 | 12,008,595 | ---- | M] () -- C:\Users\Andrew\Desktop\RB2-AusCERT-DDoS.mp3
[2009/05/19 13:14:36 | 74,986,855 | ---- | M] () -- C:\Users\Andrew\Desktop\william_stalling_-_Computer_Organization_and_Architecture.6th.Ed(2).rar
[2009/05/19 11:44:47 | 00,001,709 | ---- | M] () -- C:\Users\Andrew\Desktop\Defraggler.lnk
[2009/05/19 11:44:35 | 00,828,488 | ---- | M] (Piriform Ltd) -- C:\Users\Andrew\Desktop\dfsetup110.exe
[2009/05/17 17:57:19 | 08,325,632 | ---- | M] (Cavedog Entertainment) -- C:\Users\Andrew\Desktop\ta1x-31c.exe
[2009/05/17 17:51:12 | 87,843,760 | ---- | M] () -- C:\Users\Andrew\Desktop\Adam and Joe_090516 Edited.m4a
[2009/05/17 17:35:22 | 00,699,112 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2009/05/17 17:35:22 | 00,605,966 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2009/05/17 17:35:22 | 00,107,906 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2009/05/16 13:10:39 | 00,000,728 | ---- | M] () -- C:\Users\Andrew\Desktop\Toribash.lnk
[2009/05/16 13:10:13 | 08,239,674 | ---- | M] (Nabi Studios Pte Ltd ) -- C:\Users\Andrew\Desktop\Toribash-3.72-Setup.exe
[2009/05/15 20:46:32 | 00,001,345 | ---- | M] () -- C:\Users\Public\Desktop\Cygwin.lnk
[2009/05/15 20:32:56 | 00,000,015 | ---- | M] () -- C:\Users\Andrew\Desktop\25toBhlbApIC.pdf
[2009/05/15 20:24:10 | 00,585,728 | ---- | M] () -- C:\Users\Andrew\Desktop\setup.exe
[2009/05/15 19:27:50 | 00,000,858 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3530518803-3422028961-3636715163-1000.job
[2009/05/15 17:33:08 | 64,866,928 | ---- | M] (AVG Technologies) -- C:\Users\Andrew\Desktop\avg_free_stf_en_85_336a1515.exe
[2009/05/15 17:23:10 | 00,705,754 | ---- | M] () -- C:\Users\Andrew\Desktop\Topic12.pdf
[2009/05/15 17:06:04 | 00,001,894 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2009/05/15 15:25:14 | 01,464,768 | ---- | M] (Stephan Schreiber) -- C:\Users\Andrew\Desktop\Ext2IFS_1_11a.exe
[2009/05/11 11:59:18 | 00,000,825 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/05/11 11:58:58 | 02,967,800 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Andrew\Desktop\mbam-setup.exe
[2009/05/11 11:51:02 | 00,360,021 | ---- | M] () -- C:\Users\Andrew\Desktop\dds.scr
[2009/05/11 00:58:22 | 00,013,072 | ---- | M] () -- C:\Users\Andrew\AppData\Roaming\nvModes.001
[2009/05/11 00:22:23 | 59,603,214 | ---- | M] () -- C:\Users\Andrew\Desktop\hedgewars-0.9.10.exe
[2009/05/10 21:33:01 | 01,352,435 | ---- | M] () -- C:\Users\Andrew\Desktop\setup_magicdisc.exe
[2009/05/10 21:20:35 | 00,721,904 | ---- | M] () -- C:\Windows\System32\drivers\sptd.sys
[2009/05/10 21:20:04 | 11,472,328 | ---- | M] (DT Soft Ltd.) -- C:\Users\Andrew\Desktop\DTPro4300305.exe
[2009/05/10 21:16:44 | 00,409,304 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/05/10 17:12:04 | 00,000,038 | ---- | M] () -- C:\@id=.1
[2009/05/10 17:11:55 | 00,000,038 | ---- | M] () -- C:\@id=
[2009/05/10 16:57:44 | 00,013,069 | ---- | M] () -- C:\Users\Andrew\Desktop\5.png
[2009/05/10 16:19:35 | 83,260,630 | ---- | M] () -- C:\Users\Andrew\Desktop\Adam and Joe_090509 Edited.mp3
[2009/05/08 14:45:17 | 74,986,855 | ---- | M] () -- C:\Users\Andrew\Desktop\william_stalling_-_Computer_Organization_and_Architecture.6th.Ed.rar
[2009/05/08 12:43:00 | 01,268,789 | ---- | M] () -- C:\Users\Andrew\Desktop\Stallings_Solutions.rar
[2009/05/08 12:26:04 | 01,212,744 | ---- | M] () -- C:\Users\Andrew\Desktop\knowledge_representation_and_reasoning_44.rar.part
[2009/05/08 12:23:36 | 02,362,859 | ---- | M] () -- C:\Users\Andrew\Desktop\1584883871.rar
[2009/05/08 12:23:29 | 00,000,000 | ---- | M] () -- C:\Users\Andrew\Desktop\knowledge_representation_and_reasoning_44.rar
[2009/05/07 08:16:29 | 24,699,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mrt.exe
[2009/05/06 19:16:34 | 00,323,403 | ---- | M] (Holger Stenger) -- C:\Users\Andrew\Desktop\foo_comserver2-0.7-setup.exe
[2009/05/06 19:13:54 | 01,019,277 | ---- | M] () -- C:\Users\Andrew\Desktop\AlbumArtDownloaderXUI-0.25.exe
[2009/05/06 10:42:33 | 00,261,295 | ---- | M] () -- C:\Users\Andrew\Desktop\unlocker1.8.7.exe
[2009/05/05 13:46:56 | 00,000,835 | ---- | M] () -- C:\Users\Public\Desktop\foobar2000.lnk
[2009/05/05 13:46:08 | 03,077,558 | ---- | M] (foobar2000.org) -- C:\Users\Andrew\Desktop\foobar2000_0.9.6.5.exe
[2009/05/04 16:56:43 | 00,000,000 | ---- | M] () -- C:\lol
[2009/05/04 15:00:10 | 06,862,036 | ---- | M] () -- C:\Users\Andrew\Desktop\picard-setup-0.11.exe
[2009/05/04 14:55:36 | 00,000,783 | ---- | M] () -- C:\Users\Public\Desktop\Mp3tag.lnk
[2009/05/04 14:55:29 | 01,864,680 | ---- | M] () -- C:\Users\Andrew\Desktop\mp3tagv243setup.exe
[2009/05/03 21:17:09 | 04,935,749 | ---- | M] (Mathias Kunter ) -- C:\Users\Andrew\Desktop\magic_tagger.exe
[2009/05/03 20:23:36 | 00,000,762 | ---- | M] () -- C:\Users\Andrew\Desktop\TagScanner.lnk
[2009/05/03 20:22:36 | 01,712,029 | ---- | M] (Sergey Serkov ) -- C:\Users\Andrew\Desktop\tagscan531setup.exe
[2009/05/03 19:40:41 | 00,948,392 | ---- | M] ( ) -- C:\Users\Andrew\Desktop\hddh.exe
[2009/05/03 19:00:31 | 00,338,580 | ---- | M] () -- C:\Users\Andrew\Desktop\what.png
[2009/05/02 16:48:37 | 84,842,326 | ---- | M] () -- C:\Users\Andrew\Desktop\Adam and Joe_090502 Edited.mp3
[2009/05/02 03:06:13 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2009/05/01 23:45:32 | 00,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachine.job
[2009/05/01 18:06:58 | 00,000,219 | ---- | M] () -- C:\Windows\win.ini
[2009/05/01 18:01:29 | 00,000,000 | ---- | M] () -- C:\Windows\System32\w32apiw.dll
[2009/05/01 17:54:36 | 00,000,945 | ---- | M] () -- C:\Users\Andrew\Desktop\nCleaner.lnk
[2009/05/01 17:53:45 | 00,892,614 | ---- | M] (NKProds) -- C:\Users\Andrew\Desktop\ncleaner_setup.exe
[2009/05/01 17:39:41 | 00,805,120 | ---- | M] (Piriform Ltd) -- C:\Users\Andrew\Desktop\dfsetup109.exe
[2009/05/01 17:39:38 | 00,162,898 | ---- | M] () -- C:\Users\Andrew\Documents\cc_20090501_173932.reg
[2009/05/01 17:37:14 | 00,001,677 | ---- | M] () -- C:\Users\Andrew\Desktop\CCleaner.lnk
[2009/05/01 17:36:19 | 03,227,536 | ---- | M] (Piriform Ltd) -- C:\Users\Andrew\Desktop\ccsetup219.exe
[2009/04/30 15:44:52 | 00,002,330 | ---- | M] () -- C:\Users\Andrew\Documents\shoutthree.php
[2009/04/30 15:44:51 | 00,002,298 | ---- | M] () -- C:\Users\Andrew\Documents\shoutthree.php.bak
[2009/04/30 15:23:23 | 00,000,948 | ---- | M] () -- C:\Users\Andrew\Documents\config.php
[2009/04/30 15:21:46 | 00,000,944 | ---- | M] () -- C:\Users\Andrew\Documents\config.php.bak
[2009/04/29 13:24:32 | 00,000,012 | ---- | M] () -- C:\Users\Andrew\Desktop\test
[2009/04/28 16:16:45 | 00,000,811 | ---- | M] () -- C:\Users\Andrew\Desktop\QuickPar.lnk
[2009/04/28 16:16:38 | 00,501,363 | ---- | M] (Peter B Clements) -- C:\Users\Andrew\Desktop\QuickPar-0.9.1.0.exe
[2009/04/28 16:06:11 | 00,000,735 | ---- | M] () -- C:\Users\Andrew\Desktop\GrabIt.lnk
[2009/04/28 16:06:00 | 02,188,566 | ---- | M] (Ilan Shemes ) -- C:\Users\Andrew\Desktop\GrabIt172b3.exe
[2009/04/26 20:19:52 | 00,000,759 | ---- | M] () -- C:\Users\Andrew\Desktop\µTorrent.lnk
[2009/04/26 14:24:05 | 04,338,722 | ---- | M] () -- C:\Users\Andrew\Desktop\MaNNiNG-JeSS.iN.aCTioN-2003.rar
[2009/04/26 13:26:33 | 09,760,304 | ---- | M] () -- C:\Users\Andrew\Desktop\3333 - Big Bang Mini (U).zip
[2009/04/26 13:18:47 | 38,239,248 | ---- | M] () -- C:\Users\Andrew\Desktop\1992_Assassins_Creed_Altairs_Chronicles_USA_NDS-Micronauts.zip
[2009/04/26 13:03:25 | 00,000,740 | ---- | M] () -- C:\Users\Public\Desktop\Last.fm.lnk
[2009/04/26 13:03:14 | 05,287,682 | ---- | M] (Last.fm ) -- C:\Users\Andrew\Desktop\Last.fm-1.5.4.24567.exe
[2009/04/25 16:08:29 | 78,892,246 | ---- | M] () -- C:\Users\Andrew\Desktop\Adam and Joe_090425 Edited.mp3
========== Alternate Data Streams ==========
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:C8B8CEBD
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:3D7E84FA
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:98781370
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:466F9D5D
< End of report >
Any help would be greatly appreciated, thankyou!
Sign In
Create Account
