Please help - infected with tough malware [Solved]

Geeks to Go Forums > Security > Virus, Spyware, Malware Removal

Today's New Content

Please help - infected with tough malware [Solved] This is one of the toughest ones I've encountered

#1 rpjaway

Group: Member
Posts: 5
Joined: 04-April 10

Posted 04 April 2010 - 08:53 PM

Would greatly appreciate any help. This one has been immune to all the scan and fix tooling I've thrown at it. There's some suspicious looking rootkit activity going on with this one, particularly this one: C:\WINDOWS\system32\drivers\flkboivc.sys

Logs attached (as per the FAQ)

Thanks for any assistance!
-Ray

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-04 21:13:01
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Sheila\LOCALS~1\Temp\pxtdypow.sys

---- System - GMER 1.0.15 ----

SSDT 89832AF0 ZwAlertResumeThread
SSDT 89C02F00 ZwAlertThread
SSDT 89813918 ZwAllocateVirtualMemory
SSDT 897FFF90 ZwAssignProcessToJobObject
SSDT 88A99CB8 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xB0E42210] <-- ROOTKIT !!!
SSDT 8980EDE8 ZwCreateMutant
SSDT 897FFDF0 ZwCreateSymbolicLinkObject
SSDT 89BD0500 ZwCreateThread
SSDT 8980E9A0 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xB0E42490] <-- ROOTKIT !!!
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xB0E429F0] <-- ROOTKIT !!!
SSDT 89832BB0 ZwDuplicateObject
SSDT 89C06908 ZwFreeVirtualMemory
SSDT 8964CBE0 ZwImpersonateAnonymousToken
SSDT 898138E0 ZwImpersonateThread
SSDT 8980EB20 ZwLoadDriver
SSDT 89BC0C90 ZwMapViewOfSection
SSDT 8981B9F8 ZwOpenEvent
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwOpenKey [0xB0E427A0] <-- ROOTKIT !!!
SSDT 89807BB8 ZwOpenProcess
SSDT 89808A98 ZwOpenProcessToken
SSDT 8980EBE0 ZwOpenSection
SSDT 89C02FC0 ZwOpenThread
SSDT 897FFEC0 ZwProtectVirtualMemory
SSDT 89C02B60 ZwResumeThread
SSDT 897F6C18 ZwSetContextThread
SSDT 8981BD20 ZwSetInformationProcess
SSDT 8980EA60 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xB0E42C40] <-- ROOTKIT !!!
SSDT 8980ECA0 ZwSuspendProcess
SSDT 89DB0218 ZwSuspendThread
SSDT 89838BA0 ZwTerminateProcess
SSDT 89BBB3A0 ZwTerminateThread
SSDT 89809D40 ZwUnmapViewOfSection
SSDT 8964CC18 ZwWriteVirtualMemory

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 89DD55E8

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \FileSystem\Fastfat \Fat ACDEDC8A
Device \FileSystem\Fastfat \Fat ACE054F4

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Services - GMER 1.0.15 ----

Service (*** hidden *** ) [BOOT] flkboivc <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\flkboivc@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\flkboivc@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\flkboivc@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\flkboivc@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet003\Services\flkboivc@Type 1
Reg HKLM\SYSTEM\ControlSet003\Services\flkboivc@Start 0
Reg HKLM\SYSTEM\ControlSet003\Services\flkboivc@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet003\Services\flkboivc@Group Boot Bus Extender

---- EOF - GMER 1.0.15 ----
--------------------------------------------------------------
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3954

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

04/04/2010 9:24:55 PM
mbam-log-2010-04-04 (21-24-55).txt

Scan type: Quick scan
Objects scanned: 121713
Time elapsed: 7 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\drivers\flkboivc.sys (Rootkit.Agent) -> No action taken.

--------------------------------------------------------------

OTL logfile created on: 04/04/2010 9:39:23 PM - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Documents and Settings\Sheila\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 33.32 Gb Total Space | 18.55 Gb Free Space | 55.65% Space Free | Partition Type: NTFS
Drive D: | 209.58 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JD
Current User Name: Sheila
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/04/04 20:39:31 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\OTL.exe
PRC - [2010/03/01 14:18:44 | 000,181,608 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
PRC - [2010/03/01 14:18:42 | 000,431,464 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
PRC - [2010/03/01 14:18:40 | 000,243,048 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
PRC - [2010/03/01 14:18:38 | 000,103,784 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
PRC - [2010/03/01 13:17:34 | 000,172,032 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
PRC - [2010/01/06 02:13:00 | 000,132,456 | ---- | M] (Lenovo.) -- C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
PRC - [2010/01/06 02:13:00 | 000,053,248 | ---- | M] () -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe
PRC - [2009/12/11 13:19:02 | 000,337,256 | ---- | M] (Lenovo.) -- C:\WINDOWS\system32\TpShocks.exe
PRC - [2009/12/09 05:05:51 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccsvchst.exe
PRC - [2009/11/18 15:04:18 | 000,038,248 | ---- | M] (Lenovo.) -- C:\WINDOWS\system32\ibmpmsvc.exe
PRC - [2009/09/28 17:27:18 | 000,144,752 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\ZOOM\TpScrex.exe
PRC - [2009/09/24 16:03:58 | 000,475,220 | ---- | M] (Atheros) -- C:\WINDOWS\system32\acs.exe
PRC - [2009/09/21 15:55:12 | 000,858,384 | ---- | M] (Intel® Corporation) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe
PRC - [2009/09/21 15:44:48 | 000,954,368 | ---- | M] (Intel® Corporation) -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
PRC - [2009/09/21 15:31:36 | 000,473,360 | ---- | M] (Intel® Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
PRC - [2009/08/20 10:38:30 | 000,062,752 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe
PRC - [2009/07/15 11:18:00 | 000,062,320 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
PRC - [2009/03/13 18:32:46 | 000,068,976 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2009/02/02 19:04:08 | 000,067,432 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2004/08/04 01:56:50 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003/10/29 04:06:00 | 000,024,576 | ---- | M] (BVRP Software) -- C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2003/06/24 14:34:38 | 000,126,976 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

========== Modules (SafeList) ==========

MOD - [2010/04/04 20:39:31 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\OTL.exe
MOD - [2009/12/17 02:08:57 | 000,407,408 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\17.5.0.127\asoehook.dll
MOD - [2009/07/12 03:02:02 | 000,653,120 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton Internet Security\Engine\17.5.0.127\microsoft.vc90.crt\msvcr90.dll
MOD - [2009/07/12 03:02:00 | 000,569,664 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton Internet Security\Engine\17.5.0.127\microsoft.vc90.crt\msvcp90.dll
MOD - [2008/03/13 19:46:22 | 000,079,224 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\HKVOLKEY.dll
MOD - [2004/08/04 01:57:02 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
MOD - [2003/06/24 14:33:54 | 000,065,536 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/03/01 14:18:40 | 000,243,048 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe -- (AcSvc)
SRV - [2010/03/01 14:18:38 | 000,103,784 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)
SRV - [2010/01/06 02:13:00 | 000,132,456 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE -- (DozeSvc)
SRV - [2010/01/06 02:13:00 | 000,053,248 | ---- | M] () [Auto | Running] -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
SRV - [2009/12/09 05:05:51 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe -- (NIS)
SRV - [2009/11/18 15:04:18 | 000,038,248 | ---- | M] (Lenovo.) [Auto | Running] -- C:\WINDOWS\system32\ibmpmsvc.exe -- (IBMPMSVC)
SRV - [2009/10/09 13:12:30 | 000,039,976 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\WINDOWS\system32\TPHDEXLG.exe -- (TPHDEXLGSVC)
SRV - [2009/09/24 16:03:58 | 000,475,220 | ---- | M] (Atheros) [Auto | Running] -- C:\WINDOWS\system32\acs.exe -- (acs)
SRV - [2009/09/21 15:55:12 | 000,858,384 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel®
SRV - [2009/09/21 15:44:48 | 000,954,368 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe -- (S24EventMonitor) Intel®
SRV - [2009/09/21 15:31:36 | 000,473,360 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel®
SRV - [2009/07/15 11:18:00 | 000,062,320 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV - [2009/07/03 19:47:08 | 000,045,424 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\ [2010/04/04 11:16:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\ [2010/04/04 20:44:12 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2001/08/22 22:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ipsbho.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo )
O4 - HKLM..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo )
O4 - HKLM..\Run: [LENOVO.TPFNF6R] C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (Lenovo.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1269139162539 (WUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s...el_4.1.66.0.cab (SysInfo Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\WINDOWS\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\ACNotify: DllName - ACNotify.dll - C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll (Lenovo )
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\psfus: DllName - C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll - C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)
O20 - Winlogon\Notify\tpfnf2: DllName - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Sheila\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Sheila\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/20 21:36:55 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2010/03/20 16:56:18 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
Unable to start service SrService!

========== Files/Folders - Created Within 14 Days ==========

[2010/04/04 20:39:28 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\OTL.exe
[2010/04/04 20:36:47 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Sheila\Desktop\erunt_setup.exe
[2010/04/04 20:36:26 | 000,444,416 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\TFC.exe
[2010/04/04 20:26:26 | 000,340,016 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symtdiv.sys
[2010/04/04 20:26:25 | 000,362,032 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symtdi.sys
[2010/04/04 20:26:25 | 000,328,752 | R--- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symds.sys
[2010/04/04 20:26:25 | 000,172,592 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symefa.sys
[2010/04/04 20:26:24 | 000,501,888 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\cchpx86.sys
[2010/04/04 20:26:24 | 000,325,168 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtsp.sys
[2010/04/04 20:26:24 | 000,116,272 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\ironx86.sys
[2010/04/04 20:26:24 | 000,043,696 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtspx.sys
[2010/04/04 20:25:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NIS\1105000.07F
[2010/04/04 11:15:58 | 000,124,976 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/04/04 11:15:58 | 000,060,808 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/04/04 11:15:58 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2010/04/04 11:15:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NIS
[2010/04/04 11:15:11 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Internet Security
[2010/04/04 11:14:04 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/04/04 07:32:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Desktop\Norton Internet Security 2010 v17.0.0.136 + NTR 2010 v1.4 [RH]
[2010/04/03 19:01:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\Identities
[2010/04/03 01:14:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\Yahoo!
[2010/04/02 08:21:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/04/02 08:19:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2010/04/02 08:18:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Adobe Reader 9 Installer
[2010/04/02 08:18:50 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2010/04/02 08:18:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Adobe
[2010/04/02 08:18:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010/04/02 08:17:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\Adobe
[2010/04/02 08:17:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\NOS
[2010/04/01 20:30:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Desktop\Crosswords DS [USA - English - NDS][www.TMasGames.com]
[2010/04/01 20:28:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Desktop\Brain Voyage [USA - English - NDS][www.TMasGames.com]
[2010/04/01 20:22:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\.BitTornado
[2010/04/01 20:22:20 | 000,000,000 | ---D | C] -- C:\Program Files\BitTornado
[2010/03/28 22:09:31 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2010/03/28 08:37:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Desktop\gmer
[2010/03/27 12:23:38 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/03/27 08:11:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/03/27 08:11:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/03/26 20:28:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\Malwarebytes
[2010/03/26 20:28:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/26 20:28:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
[2010/03/26 20:28:41 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/26 20:28:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/03/25 22:00:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\FastStone
[2010/03/25 21:59:46 | 000,000,000 | ---D | C] -- C:\Program Files\FastStone Image Viewer
[2010/03/25 20:29:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010/03/25 20:19:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2010/03/25 20:19:10 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Sidebar
[2010/03/25 20:19:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton
[2010/03/25 20:18:51 | 000,000,000 | ---D | C] -- C:\Program Files\WinDefender32
[2010/03/25 20:18:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\NortonInstaller
[2010/03/25 20:17:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\My Documents\Norton AntiVirus 2010 17.0.0.136 Final
[2010/03/25 19:43:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\WinRAR
[2010/03/25 19:42:50 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2010/03/23 22:49:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\My Documents\Attachments
[2010/03/23 22:16:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\Forte
[2010/03/23 22:16:21 | 000,000,000 | ---D | C] -- C:\Program Files\Agent
[2010/03/22 23:50:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\KB905474
[2010/03/22 22:55:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot_bak
[2010/03/22 00:13:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall
[2010/03/21 23:52:13 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Sheila\PrivacIE
[2010/03/21 23:47:50 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Sheila\IETldCache
[2010/03/21 23:41:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/03/21 23:41:32 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
[2010/03/21 23:41:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
[2010/03/21 23:39:44 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/03/21 23:29:17 | 000,000,000 | ---D | C] -- C:\Program Files\Digital Line Detect
[2010/03/21 23:29:03 | 000,000,000 | ---D | C] -- C:\Program Files\NetWaiting
[2010/03/21 23:29:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\BVRP Software
[2010/03/21 23:28:46 | 000,000,000 | ---D | C] -- C:\Program Files\CONEXANT
[2010/03/21 23:08:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SPBA
[2010/03/21 23:08:08 | 000,000,000 | ---D | C] -- C:\Program Files\ThinkVantage Fingerprint Software
[2010/03/21 23:07:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\UIB
[2010/03/21 22:58:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\My Documents\Access Connections
[2010/03/21 22:33:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\ATI
[2010/03/21 22:33:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\ATI
[2010/03/21 22:33:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\ATI
[2010/03/21 22:01:44 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2010/03/21 21:52:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\Intel
[2010/03/21 21:52:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2010/03/21 21:51:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2010/03/21 21:51:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Intel
[2010/03/20 22:16:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/03/20 22:11:06 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/03/20 22:11:06 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/04/04 21:43:08 | 000,823,808 | ---- | M] () -- C:\WINDOWS\System32\drivers\flkboivc.sys
[2010/04/04 21:36:00 | 000,000,302 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job
[2010/04/04 21:35:24 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2010/04/04 21:34:08 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/04 21:33:56 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/04 21:32:37 | 001,835,008 | -H-- | M] () -- C:\Documents and Settings\Sheila\NTUSER.DAT
[2010/04/04 21:32:37 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Sheila\ntuser.ini
[2010/04/04 21:26:25 | 003,223,504 | -H-- | M] () -- C:\Documents and Settings\Sheila\Local Settings\Application Data\IconCache.db
[2010/04/04 21:13:37 | 000,436,896 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\Malware and Spyware Cleaning Guide.mht
[2010/04/04 20:43:01 | 000,001,984 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Norton Internet Security.LNK
[2010/04/04 20:42:17 | 001,143,216 | ---- | M] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\Cat.DB
[2010/04/04 20:39:31 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\OTL.exe
[2010/04/04 20:36:50 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Sheila\Desktop\erunt_setup.exe
[2010/04/04 20:36:29 | 000,444,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\TFC.exe
[2010/04/04 20:28:05 | 000,465,298 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\RootRepeal.rar
[2010/04/04 15:36:36 | 000,018,944 | ---- | M] () -- C:\Documents and Settings\Sheila\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/04 11:20:36 | 080,938,247 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\Norton AntiVirus 2010 17.0.0.136 Final.zip
[2010/04/04 11:15:58 | 000,124,976 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/04/04 11:15:58 | 000,060,808 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/04/04 11:15:58 | 000,007,443 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/04/04 11:15:58 | 000,000,805 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/04/03 14:55:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/04/03 01:09:53 | 000,106,618 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\25913_414864686048_561816048_5318925_1750788_n[1].jpg
[2010/04/02 08:22:20 | 000,000,732 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Acrobat_com.lnk
[2010/04/02 08:20:11 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Adobe Reader 9.lnk
[2010/04/02 08:16:00 | 000,311,620 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\CocoRice_LunchSpecial.pdf
[2010/04/01 21:51:02 | 002,125,517 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Super_Fun_Sudoku[EUR][ESPALNDS.com].zip
[2010/04/01 20:55:56 | 053,010,083 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]The Legend Of Zelda Phantom Hourglass [EUR][NeoGamersX.CoM].zip
[2010/04/01 20:46:52 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]SimCity_Creator[EUR][ESPALNDS.com].zip
[2010/04/01 20:39:42 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Prism_Light_the_Way[USA][ESPALNDS.com].zip
[2010/04/01 20:38:27 | 031,633,119 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]TouchMaster_2[USA][ESPALNDS.com].zip
[2010/04/01 20:29:20 | 065,787,272 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Professor_Layton_And_The_Curious_Village[EUR][REPACK][ESPALNDS.com].zip
[2010/03/31 17:38:02 | 000,001,148 | -H-- | M] () -- C:\Documents and Settings\Sheila\My Documents\Default.rdp
[2010/03/31 10:30:18 | 000,000,598 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Shortcut to Quest Connect Canada.lnk
[2010/03/30 22:05:16 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\dds.scr
[2010/03/30 00:46:30 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/30 00:45:52 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/28 08:37:07 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\gmer.zip
[2010/03/26 20:28:52 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/25 21:59:48 | 000,000,780 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\FastStone Image Viewer.lnk
[2010/03/25 21:57:28 | 000,308,453 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\5x7_DSC3075.JPG
[2010/03/25 21:55:45 | 008,702,828 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\5x7_DSC3075.tif
[2010/03/24 05:28:38 | 000,508,956 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/24 05:28:38 | 000,433,566 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/24 05:28:38 | 000,068,164 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/24 05:13:46 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/03/23 22:16:34 | 000,000,570 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/03/22 23:55:41 | 000,095,072 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/03/21 23:29:20 | 000,000,493 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Digital Line Detect.lnk
[2010/03/21 23:25:29 | 000,000,303 | -HS- | M] () -- C:\boot.ini
[2010/03/21 22:57:36 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\AccConnAdvanced.html
[2010/03/21 22:34:23 | 000,013,104 | ---- | M] () -- C:\Documents and Settings\Sheila\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/03/21 22:33:19 | 000,000,000 | ---- | M] () -- C:\WINDOWS\ativpsrm.bin

========== Files Created - No Company Name ==========

[2010/04/04 21:13:29 | 000,436,896 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\Malware and Spyware Cleaning Guide.mht
[2010/04/04 20:41:56 | 001,143,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\Cat.DB
[2010/04/04 20:28:02 | 000,465,298 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\RootRepeal.rar
[2010/04/04 20:26:25 | 000,007,787 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symnetv.cat
[2010/04/04 20:26:25 | 000,007,444 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symefa.cat
[2010/04/04 20:26:25 | 000,007,425 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symds.cat
[2010/04/04 20:26:25 | 000,007,368 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symnet.cat
[2010/04/04 20:26:25 | 000,003,374 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symefa.inf
[2010/04/04 20:26:25 | 000,002,793 | R--- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symds.inf
[2010/04/04 20:26:25 | 000,001,473 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symnetv.inf
[2010/04/04 20:26:25 | 000,001,445 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symnet.inf
[2010/04/04 20:26:24 | 000,007,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtspx.cat
[2010/04/04 20:26:24 | 000,007,438 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtsp.cat
[2010/04/04 20:26:24 | 000,007,438 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\iron.cat
[2010/04/04 20:26:24 | 000,007,396 | R--- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\cchpx86.cat
[2010/04/04 20:26:24 | 000,001,756 | R--- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\cchpx86.inf
[2010/04/04 20:26:24 | 000,001,388 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtspx.inf
[2010/04/04 20:26:24 | 000,001,382 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtsp.inf
[2010/04/04 20:26:24 | 000,000,742 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\iron.inf
[2010/04/04 20:25:50 | 000,000,172 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\isolate.ini
[2010/04/04 11:20:21 | 080,938,247 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\Norton AntiVirus 2010 17.0.0.136 Final.zip
[2010/04/04 11:15:58 | 000,007,443 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/04/04 11:15:58 | 000,000,805 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/04/04 11:15:47 | 000,001,984 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Norton Internet Security.LNK
[2010/04/03 01:11:55 | 000,106,618 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\25913_414864686048_561816048_5318925_1750788_n[1].jpg
[2010/04/02 08:20:09 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Adobe Reader 9.lnk
[2010/04/02 08:18:52 | 000,000,732 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Acrobat_com.lnk
[2010/04/02 08:15:58 | 000,311,620 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\CocoRice_LunchSpecial.pdf
[2010/04/01 21:18:11 | 002,125,517 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Super_Fun_Sudoku[EUR][ESPALNDS.com].zip
[2010/04/01 20:50:02 | 053,010,083 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]The Legend Of Zelda Phantom Hourglass [EUR][NeoGamersX.CoM].zip
[2010/04/01 20:46:52 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]SimCity_Creator[EUR][ESPALNDS.com].zip
[2010/04/01 20:39:42 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Prism_Light_the_Way[USA][ESPALNDS.com].zip
[2010/04/01 20:31:45 | 031,633,119 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]TouchMaster_2[USA][ESPALNDS.com].zip
[2010/04/01 20:23:14 | 065,787,272 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Professor_Layton_And_The_Curious_Village[EUR][REPACK][ESPALNDS.com].zip
[2010/03/31 10:32:22 | 000,001,148 | -H-- | C] () -- C:\Documents and Settings\Sheila\My Documents\Default.rdp
[2010/03/31 10:30:18 | 000,000,598 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Shortcut to Quest Connect Canada.lnk
[2010/03/30 22:05:15 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\dds.scr
[2010/03/28 08:37:02 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\gmer.zip
[2010/03/26 20:28:51 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/25 22:24:56 | 000,018,944 | ---- | C] () -- C:\Documents and Settings\Sheila\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/25 21:59:48 | 000,000,780 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\FastStone Image Viewer.lnk
[2010/03/25 21:57:23 | 000,308,453 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\5x7_DSC3075.JPG
[2010/03/25 21:54:07 | 008,702,828 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\5x7_DSC3075.tif
[2010/03/25 20:25:28 | 000,823,808 | ---- | C] () -- C:\WINDOWS\System32\drivers\flkboivc.sys
[2010/03/22 23:54:23 | 000,158,888 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/03/22 23:50:24 | 000,000,260 | ---- | C] () -- C:\WINDOWS\tasks\WGASetup.job
[2010/03/21 23:29:20 | 000,000,493 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Digital Line Detect.lnk
[2010/03/21 23:28:40 | 000,141,392 | ---- | C] () -- C:\WINDOWS\System32\drivers\HSFProf.cty
[2010/03/21 22:57:48 | 000,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.sys
[2010/03/21 22:57:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\AccConnAdvanced.html
[2010/03/21 22:43:42 | 000,000,302 | ---- | C] () -- C:\WINDOWS\tasks\PMTask.job
[2010/03/21 22:43:25 | 000,196,608 | ---- | C] () -- C:\WINDOWS\PWMBTHLP.EXE
[2010/03/21 22:43:24 | 000,004,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2010/03/21 22:33:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010/03/20 23:17:00 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2010/03/20 23:17:00 | 000,262,216 | ---- | C] () -- C:\WINDOWS\System32\IPTests.dll
[2010/03/20 23:17:00 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2010/03/20 22:25:42 | 000,020,480 | -H-- | C] () -- C:\Documents and Settings\Sheila\ntuser.dat.LOG
[2010/03/20 22:25:42 | 000,000,178 | -HS- | C] () -- C:\Documents and Settings\Sheila\ntuser.ini
[2010/03/20 22:25:41 | 001,835,008 | -H-- | C] () -- C:\Documents and Settings\Sheila\NTUSER.DAT
[2010/03/20 21:36:14 | 000,021,952 | -H-- | C] () -- C:\Program Files\folder.htt
[2003/06/24 14:43:48 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2002/03/25 13:02:14 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

========== LOP Check ==========

[2010/03/21 23:07:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\UIB
[2010/04/01 20:22:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sheila\Application Data\.BitTornado
[2010/04/02 08:21:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sheila\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/03/23 22:16:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sheila\Application Data\Forte
[2010/04/04 21:36:00 | 000,000,302 | ---- | M] () -- C:\WINDOWS\Tasks\PMTask.job
[2010/04/04 21:35:24 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\agp440.sys
[2004/08/04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2004/08/04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2002/08/28 20:50:10 | 010,158,890 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/04 02:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2002/08/29 02:27:50 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2002/08/28 18:27:50 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
[1999/12/07 08:00:00 | 000,084,976 | ---- | M] (Microsoft Corporation) MD5=F4D5D4CC7B704608FC686D248981F461 -- C:\WINNT\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\eventlog.dll
[2004/08/04 01:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2004/08/04 01:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\eventlog.dll
[2002/08/28 20:40:52 | 000,049,152 | ---- | M] (Microsoft Corporation) MD5=BF3C8CF53C77B48206B39910B6D6CBCC -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[1999/12/07 08:00:00 | 000,044,816 | ---- | M] (Microsoft Corporation) MD5=E3B0DABC518C3744DF00B12899D60805 -- C:\WINNT\system32\dllcache\eventlog.dll
[1999/12/07 08:00:00 | 000,044,816 | ---- | M] (Microsoft Corporation) MD5=E3B0DABC518C3744DF00B12899D60805 -- C:\WINNT\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\netlogon.dll
[1999/12/07 08:00:00 | 000,356,112 | ---- | M] (Microsoft Corporation) MD5=2C2BEF8554A1F3C950E063ABFE286192 -- C:\WINNT\system32\dllcache\netlogon.dll
[1999/12/07 08:00:00 | 000,356,112 | ---- | M] (Microsoft Corporation) MD5=2C2BEF8554A1F3C950E063ABFE286192 -- C:\WINNT\system32\netlogon.dll
[2002/08/28 20:41:08 | 000,399,360 | ---- | M] (Microsoft Corporation) MD5=3ADD563ED7A1C66E6F5E0F7A661AA96D -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2004/08/04 01:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2004/08/04 01:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 01:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2004/08/04 01:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\scecli.dll
[1999/12/07 08:00:00 | 000,107,792 | ---- | M] (Microsoft Corporation) MD5=5D4EFA4B12CBF2F00A06F0C9A720BDAF -- C:\WINNT\system32\dllcache\scecli.dll
[1999/12/07 08:00:00 | 000,107,792 | ---- | M] (Microsoft Corporation) MD5=5D4EFA4B12CBF2F00A06F0C9A720BDAF -- C:\WINNT\system32\scecli.dll
[2002/08/28 20:41:12 | 000,174,592 | ---- | M] (Microsoft Corporation) MD5=97418A5C642A5C748A28BD7CF6860B57 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/09/29 16:21:56 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010/04/04 21:45:21 | 000,823,808 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\flkboivc.sys

< %systemroot%\System32\config\*.sav >
[2010/03/20 16:59:13 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010/03/20 16:59:13 | 000,626,688 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010/03/20 16:59:13 | 000,425,984 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
< End of report >

-----------------------------

#2 hammerman

Group: Member
Posts: 4,183
Joined: 28-November 08

Posted 05 April 2010 - 05:48 AM

Hello rpjaway and welcome to GeeksToGo

I'm hammerman and I'm going to help you fix your problem.

Before we begin, here are some guidelines which will help us both in fixing your problem.

Malware removal is not instantaneous and will take a number of steps to complete. Please continue to carry out the steps requested until I let you know that your computer appears clean.
Please do no attach logs or post them in Quote/Code boxes unless requested.
I suggest you print or save any instructions I give you for easy reference. We may be using Safe mode and you will not always be able to access this thread. You can copy and paste these instructions into Notepad and then save the text file to your Desktop. If you need any help with this or further clarification, please let me know.
When posting logs, please ensure Word Wrap is turned off in Notepad. Open Notepad, select Format on the menu bar and make sure that Word Wrap is unchecked.
Please follow the steps exactly in the same order posted. If you can't perform a certain step, or you're unsure on what to do, please stop and let me know.
If in doubt about anything, please ask.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".
During the download, rename Combofix to Combo-Fix as follows:
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
-----------------------------------------------------------
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  -----------------------------------------------------------
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
-----------------------------------------------------------
Double click on Combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

#3 rpjaway

Group: Member
Posts: 5
Joined: 04-April 10

Posted 05 April 2010 - 06:32 PM

Hi hammerman. Thanks so much for offering to assist.

All done with instructions. Here's the requested log:

ComboFix 10-04-04.01 - Sheila 05/04/2010 17:37:15.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.2.1033.18.2046.1456 [GMT -4:00]
Running from: c:\documents and settings\Sheila\Desktop\Combo-Fix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\flkboivc.sys
c:\windows\system32\Kernel32x.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_flkboivc
-------\Service_flkboivc

((((((((((((((((((((((((( Files Created from 2010-03-05 to 2010-04-05 )))))))))))))))))))))))))))))))
.

2010-04-05 00:26 . 2010-04-04 16:35 84912 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.020\NAVENG.SYS
2010-04-05 00:26 . 2010-04-04 16:35 1324720 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.020\NAVEX15.SYS
2010-04-05 00:26 . 2009-08-29 09:00 177520 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.020\NAVENG32.DLL
2010-04-05 00:26 . 2009-08-29 09:00 1647984 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.020\NAVEX32A.DLL
2010-04-05 00:26 . 2009-08-29 09:00 102448 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.020\ERASER.SYS
2010-04-05 00:26 . 2010-04-04 16:35 2747440 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.020\CCERASER.DLL
2010-04-05 00:26 . 2010-04-04 16:35 259440 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.020\ECMSVR32.DLL
2010-04-05 00:26 . 2009-08-29 09:00 371248 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.020\EECTRL.SYS
2010-04-04 15:16 . 2009-12-10 03:16 784752 ----a-r- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll
2010-04-04 15:16 . 2009-08-30 00:16 164216 ----a-r- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll
2010-04-04 15:15 . 2010-04-04 15:15 -------- d-----w- c:\program files\Symantec
2010-04-04 15:15 . 2010-04-04 15:15 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-04-04 15:15 . 2010-04-04 15:15 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-04-04 15:15 . 2009-08-26 22:13 900464 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\OCS\hsplayer.dll
2010-04-04 15:15 . 2009-09-01 08:48 893296 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\CLT\cltLMSx.dll
2010-04-04 15:15 . 2010-04-05 00:43 -------- d-----w- c:\windows\system32\drivers\NIS
2010-04-04 15:15 . 2010-04-04 15:15 -------- d-----w- c:\program files\Norton Internet Security
2010-04-04 15:14 . 2010-04-04 15:14 -------- d-----w- c:\program files\NortonInstaller
2010-04-03 23:06 . 2010-04-03 23:06 5918776 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-03 23:01 . 2010-04-03 23:01 -------- d-----w- c:\documents and settings\Sheila\Local Settings\Application Data\Identities
2010-04-03 05:14 . 2010-04-03 05:14 -------- d-----w- c:\documents and settings\Sheila\Local Settings\Application Data\Yahoo!
2010-04-02 12:21 . 2010-04-02 12:21 -------- d-----w- c:\documents and settings\Sheila\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-04-02 12:20 . 2010-04-02 12:20 -------- d-----w- c:\documents and settings\Default User.WINDOWS\Local Settings\Application Data\Adobe
2010-04-02 12:19 . 2010-04-02 12:20 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-02 12:18 . 2010-04-02 12:18 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-04-02 12:17 . 2010-04-02 12:22 -------- d-----w- c:\documents and settings\Sheila\Local Settings\Application Data\Adobe
2010-04-02 12:17 . 2010-04-02 12:17 86016 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS\Adobe_Downloads\arh.exe
2010-04-02 12:17 . 2010-04-03 18:57 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2010-04-02 00:22 . 2010-04-02 00:22 -------- d-----w- c:\documents and settings\Sheila\Application Data\.BitTornado
2010-04-02 00:22 . 2010-04-02 00:22 -------- d-----w- c:\program files\BitTornado
2010-03-29 02:09 . 2010-03-29 02:09 -------- d-----w- c:\program files\Synaptics
2010-03-28 17:09 . 2001-08-18 02:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2010-03-28 17:09 . 2004-08-04 04:56 159232 ----a-w- c:\windows\system32\ptpusd.dll
2010-03-28 17:09 . 2004-08-04 02:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-03-28 17:09 . 2004-08-04 02:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-03-27 16:23 . 2010-03-27 16:23 -------- d-----w- c:\program files\ESET
2010-03-27 12:11 . 2010-03-27 12:11 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-03-27 00:28 . 2010-03-27 00:28 -------- d-----w- c:\documents and settings\Sheila\Application Data\Malwarebytes
2010-03-27 00:28 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 00:28 . 2010-03-27 00:28 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-03-27 00:28 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 00:28 . 2010-04-03 23:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-26 02:00 . 2010-03-26 02:00 -------- d-----w- c:\documents and settings\Sheila\Application Data\FastStone
2010-03-26 01:59 . 2010-03-26 01:59 -------- d-----w- c:\program files\FastStone Image Viewer
2010-03-26 01:49 . 2004-08-04 03:08 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2010-03-26 00:34 . 2010-03-26 00:34 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-03-26 00:24 . 2010-03-26 00:24 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-03-26 00:19 . 2010-04-04 15:15 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-03-26 00:19 . 2010-03-26 00:19 -------- d-----w- c:\program files\Windows Sidebar
2010-03-26 00:19 . 2010-04-04 15:15 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton
2010-03-26 00:18 . 2010-03-27 00:23 -------- d-----w- c:\program files\WinDefender32
2010-03-26 00:18 . 2010-04-04 15:14 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NortonInstaller
2010-03-25 00:40 . 2010-03-25 00:40 678960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100324.001\BHDrvx64.sys
2010-03-25 00:40 . 2010-03-25 00:40 611216 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100324.001\bbRGen.dll
2010-03-25 00:40 . 2010-03-25 00:40 536112 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100324.001\BHDrvx86.sys
2010-03-25 00:40 . 2010-03-25 00:40 201616 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100324.001\BHRules.dll
2010-03-25 00:40 . 2010-03-25 00:40 1407888 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100324.001\BHEngine.dll
2010-03-24 02:16 . 2010-03-24 02:16 -------- d-----w- c:\documents and settings\Sheila\Application Data\Forte
2010-03-24 02:16 . 2010-03-24 02:16 -------- d-----w- c:\program files\Agent
2010-03-23 03:54 . 2010-04-05 21:42 158888 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-03-23 03:50 . 2010-03-23 03:50 -------- d-----w- c:\windows\system32\KB905474
2010-03-23 03:50 . 2009-03-11 02:26 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2010-03-23 03:50 . 2009-03-11 02:18 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2010-03-23 02:55 . 2010-03-23 03:11 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-03-23 02:53 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-03-23 01:52 . 2009-10-23 14:27 3555328 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-23 01:52 . 2009-12-04 14:41 453760 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-03-23 01:52 . 2008-04-11 18:50 683520 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-03-23 01:52 . 2008-05-01 14:30 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-03-23 01:52 . 2009-07-31 04:57 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-03-23 01:52 . 2009-06-21 22:04 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-03-23 01:51 . 2009-11-21 16:36 470528 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-03-23 01:50 . 2009-07-10 13:42 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-03-23 01:49 . 2009-06-05 07:42 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2010-03-23 01:49 . 2008-04-21 10:02 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-03-23 01:47 . 2008-10-15 16:57 332800 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-03-23 01:46 . 2009-12-31 16:14 352640 -c----w- c:\windows\system32\dllcache\srv.sys
2010-03-22 03:52 . 2010-03-22 03:52 -------- d-sh--w- c:\documents and settings\Sheila\PrivacIE
2010-03-22 03:47 . 2010-03-22 03:47 -------- d-sh--w- c:\documents and settings\Sheila\IETldCache
2010-03-22 03:41 . 2010-03-31 09:57 -------- d-----w- c:\windows\ie8updates
2010-03-22 03:41 . 2010-03-31 09:56 -------- d--h--w- c:\windows\$hf_mig$
2010-03-22 03:39 . 2010-03-22 03:40 -------- dc-h--w- c:\windows\ie8
2010-03-22 03:36 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-03-22 03:36 . 2010-02-25 06:24 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-03-22 03:36 . 2010-02-25 06:24 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-03-22 03:36 . 2010-02-25 06:24 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-03-22 03:36 . 2010-02-25 06:24 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-03-22 03:36 . 2010-02-25 06:24 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-03-22 03:36 . 2010-02-25 15:54 11070976 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-03-22 03:29 . 2010-03-22 03:29 -------- d-----w- c:\program files\Digital Line Detect
2010-03-22 03:29 . 2010-03-22 03:29 -------- d-----w- c:\program files\NetWaiting
2010-03-22 03:29 . 2010-03-22 03:29 -------- d-----w- c:\documents and settings\Sheila\Local Settings\Application Data\BVRP Software
2010-03-22 03:28 . 2010-03-22 03:28 -------- d-----w- c:\program files\CONEXANT
2010-03-22 03:28 . 2005-10-18 21:53 998656 ----a-w- c:\windows\system32\drivers\HSF_DPV.sys
2010-03-22 03:28 . 2005-10-18 21:52 242304 ----a-w- c:\windows\system32\drivers\HSFHWICH.sys
2010-03-22 03:28 . 2005-10-18 21:52 721280 ----a-w- c:\windows\system32\drivers\HSF_CNXT.sys
2010-03-22 03:28 . 2005-09-16 19:14 110592 ----a-w- c:\windows\system32\Uci32101.dll
2010-03-22 03:08 . 2010-03-22 03:08 -------- d-----w- c:\program files\Common Files\SPBA
2010-03-22 03:08 . 2010-03-22 03:12 -------- d-----w- c:\program files\ThinkVantage Fingerprint Software
2010-03-22 03:07 . 2010-03-22 03:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\UIB
2010-03-22 03:04 . 2009-10-12 13:54 69632 -c----w- c:\windows\system32\dllcache\raschap.dll
2010-03-22 03:04 . 2009-10-12 13:54 112128 -c----w- c:\windows\system32\dllcache\rastls.dll
2010-03-22 02:58 . 2008-11-13 23:02 1056768 ----a-w- c:\windows\system32\MFC71.dll
2010-03-22 02:58 . 2008-11-13 23:02 1049600 ----a-w- c:\windows\system32\MFC71u.dll
2010-03-22 02:58 . 2003-03-19 18:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-03-22 02:58 . 2003-02-22 02:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-03-22 02:57 . 2009-02-27 00:02 582968 ----a-w- c:\windows\system32\tvt_gina.dll
2010-03-22 02:57 . 2008-05-15 20:46 292152 ----a-w- c:\windows\system32\tvt_gina_api.dll
2010-03-22 02:57 . 2008-05-13 01:22 4224 ----a-w- c:\windows\system32\drivers\IBMBLDID.sys
2010-03-22 02:57 . 2005-09-28 22:07 11520 ----a-w- c:\windows\system32\drivers\ANC.sys
2010-03-22 02:43 . 2010-01-06 06:13 196608 ------w- c:\windows\PWMBTHLP.EXE
2010-03-22 02:43 . 2010-01-06 06:13 4442 ------w- c:\windows\system32\drivers\TPPWRIF.SYS
2010-03-22 02:43 . 2010-01-06 06:13 24304 ------w- c:\windows\system32\drivers\DOZEHDD.SYS
2010-03-22 02:33 . 2010-03-22 02:33 -------- d-----w- c:\documents and settings\Sheila\Local Settings\Application Data\ATI
2010-03-22 02:33 . 2010-03-22 02:33 -------- d-----w- c:\documents and settings\Sheila\Application Data\ATI
2010-03-22 02:33 . 2010-03-22 02:33 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\ATI
2010-03-22 02:33 . 2010-03-22 02:33 0 ----a-w- c:\windows\ativpsrm.bin
2010-03-22 02:01 . 2010-03-22 02:03 -------- d-----w- c:\program files\ATI Technologies
2010-03-22 01:52 . 2010-03-22 01:52 -------- d-----w- c:\documents and settings\Sheila\Application Data\Intel
2010-03-22 01:52 . 2010-03-22 01:52 -------- dc----w- c:\windows\system32\DRVSTORE
2010-03-22 01:51 . 2010-03-22 01:51 -------- d-----w- c:\program files\Common Files\Intel
2010-03-22 01:51 . 2010-03-22 01:51 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Intel
2010-03-22 00:15 . 2010-03-22 00:15 -------- d-----w- c:\windows\system32\XPSViewer
2010-03-22 00:12 . 2010-03-22 00:12 -------- d-----w- c:\program files\MSXML 6.0
2010-03-22 00:04 . 2010-03-22 02:34 13104 ----a-w- c:\documents and settings\Sheila\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-04 16:35 . 2010-04-04 16:35 84912 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.004\NAVENG.SYS
2010-04-04 16:35 . 2010-04-04 16:35 1324720 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.004\NAVEX15.SYS
2010-04-04 16:35 . 2010-04-04 16:35 2747440 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.004\CCERASER.DLL
2010-04-04 16:35 . 2010-04-04 16:35 259440 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100404.004\ECMSVR32.DLL
2010-04-04 15:15 . 2010-04-04 15:15 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-04-04 15:15 . 2010-04-04 15:15 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-03-22 03:29 . 2010-03-21 02:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-22 03:28 . 2010-03-21 02:55 -------- d-----w- c:\program files\ThinkPad
2010-03-22 02:02 . 2010-03-21 02:52 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-22 00:14 . 2010-03-22 00:14 -------- d-----w- c:\program files\MSBuild
2010-03-22 00:14 . 2010-03-22 00:14 -------- d-----w- c:\program files\Reference Assemblies
2010-03-21 23:42 . 2010-03-21 02:10 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-03-21 03:16 . 2010-03-21 02:56 -------- d-----w- c:\program files\Lenovo
2010-03-21 02:11 . 2010-03-21 02:11 558142 ----a-w- c:\windows\java\Packages\TVHRVZVP.ZIP
2010-03-21 02:11 . 2010-03-21 02:11 2678 ----a-w- c:\windows\java\Packages\Data\GZRJNDNX.DAT
2010-03-21 02:11 . 2010-03-21 02:11 2678 ----a-w- c:\windows\java\Packages\Data\8ZLFXR9Z.DAT
2010-03-21 02:11 . 2010-03-21 02:11 155995 ----a-w- c:\windows\java\Packages\TBFN7BTV.ZIP
2010-03-21 02:11 . 2010-03-21 02:11 2678 ----a-w- c:\windows\java\Packages\Data\QFNN71Z1.DAT
2010-03-21 02:11 . 2010-03-21 02:11 2678 ----a-w- c:\windows\java\Packages\Data\B7V9Z5JJ.DAT
2010-03-21 02:11 . 2010-03-21 02:11 2678 ----a-w- c:\windows\java\Packages\Data\9ZR37931.DAT
2010-03-21 02:08 . 2010-03-21 02:08 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-03-21 01:37 . 2010-03-21 01:37 -------- d-----w- c:\program files\microsoft frontpage
2010-03-21 01:36 . 2010-03-21 01:36 21952 ---ha-w- c:\program files\folder.htt
2010-03-20 20:34 . 2010-03-20 20:34 -------- d-----w- c:\program files\Accessories
2010-02-25 06:24 . 2002-08-29 00:41 916480 ----a-w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"="TpShocks.exe" [2009-12-11 337256]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-03-13 68976]
"LENOVO.TPFNF6R"="c:\program files\Lenovo\HOTKEY\TPFNF6R.exe" [2009-08-20 62752]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2010-01-06 513384]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2010-03-01 431464]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2010-03-01 181608]
"PSQLLauncher"="c:\program files\ThinkVantage Fingerprint Software\launcher.exe" [2009-12-01 55048]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 561152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2010-3-21 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2009-12-01 18:41 100104 ----a-w- c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-06 21:37 34344 ----a-w- c:\program files\Lenovo\HOTKEY\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTornado\\btdownloadgui.exe"=

R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [21/03/2010 10:43 PM 24304]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1105000.07F\symds.sys [04/04/2010 8:26 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1105000.07F\symefa.sys [04/04/2010 8:26 PM 172592]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [09/10/2009 1:10 PM 20520]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100324.001\BHDrvx86.sys [24/03/2010 8:40 PM 536112]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1105000.07F\cchpx86.sys [04/04/2010 8:26 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1105000.07F\ironx86.sys [04/04/2010 8:26 PM 116272]
R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [21/03/2010 10:43 PM 132456]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.5.0.127\ccsvchst.exe [04/04/2010 8:26 PM 126392]
R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.exe [21/03/2010 10:43 PM 53248]
R2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [13/03/2009 2:47 PM 12560]
R2 TPHKSVC;On Screen Display;c:\program files\Lenovo\HOTKEY\TPHKSVC.exe [20/03/2010 10:56 PM 62320]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [25/03/2010 8:23 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100326.001\IDSXpx86.sys [04/04/2010 12:35 PM 329592]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\Lenovo\HOTKEY\micmute.exe [20/03/2010 10:56 PM 45424]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [18/12/2009 11:58 AM 11336]
S3 EraserUtilDrv10920;EraserUtilDrv10920;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10920.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10920.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-04-05 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2010-03-22 06:13]

2010-04-05 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-03-23 02:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
.
- - - - ORPHANS REMOVED - - - -

Notify-ACNotify - ACNotify.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-05 19:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.5.0.127\diMaster.dll\" /prefetch:1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1104)
c:\windows\system32\vrlogon.dll
c:\windows\system32\tvt_gina.dll
c:\program files\ThinkPad\ConnectUtilities\ACGina.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACON.dll
c:\windows\system32\WININET.dll
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgr.dll
c:\program files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll
c:\program files\ThinkPad\ConnectUtilities\ACTurinSupport.dll
c:\program files\ThinkPad\ConnectUtilities\AcSmBiosHelper.dll
c:\program files\ThinkPad\ConnectUtilities\ACNewBiosHelper.dll
c:\program files\ThinkPad\ConnectUtilities\AcAdaptersInfo.dll
c:\program files\ThinkPad\ConnectUtilities\Res\US\ACGinaRes.dll
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
c:\program files\ThinkVantage Fingerprint Software\homefus2.dll
c:\program files\ThinkVantage Fingerprint Software\infql2.dll
c:\program files\ThinkVantage Fingerprint Software\homepass.dll
c:\program files\ThinkVantage Fingerprint Software\bio.dll
c:\program files\ThinkVantage Fingerprint Software\qlbase.dll
c:\program files\ThinkVantage Fingerprint Software\ps2css.dll
c:\program files\ThinkVantage Fingerprint Software\sysset.dll

- - - - - - - > 'explorer.exe'(2840)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\windows\System32\acs.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\windows\system32\TpShocks.exe
c:\windows\system32\rundll32.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\Zoom\TpScrex.exe
.
**************************************************************************
.
Completion time: 2010-04-05 19:26:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-05 23:26

Pre-Run: 19,816,841,216 bytes free
Post-Run: 19,745,923,072 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Professional" /fastdetect

- - End Of File - - 91C736408933AF6517DCF8F15FC475FD

#4 hammerman

Group: Member
Posts: 4,183
Joined: 28-November 08

Posted 05 April 2010 - 08:08 PM

Hi,

Please follow these steps and let me know how your computer's running.

-- Step 1 --

Download TFC to your desktop

Open the file and close any other windows.
It will close all programs itself when run, make sure to let it run uninterrupted.
Click the Start button to begin the process. The program should not take long to finish its job
Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

-- Step 2 --

Run Malwarebytes' Anti-Malware.

Select the Update tab and then click Check for Updates. If an update is found, it will download and install the latest version.
Select the Scanner tab, select "Perform Quick Scan", then click Scan
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

-- Step 3 --

Run OTL and select Minimal Output.
Select Use SafeList under Extra Registry
Use the Run Scan button to start a scan.
Please post the OTL.txt and Extras.txt in your reply.

#5 rpjaway

Group: Member
Posts: 5
Joined: 04-April 10

Posted 05 April 2010 - 09:32 PM

Things are looking considerably better after running Combo-Fix.

In anticipation of getting a "clean bill of health", do you have a preferred means of taking tips (e.g. paypal)?

---------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3958

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

05/04/2010 10:05:22 PM
mbam-log-2010-04-05 (22-05-22).txt

Scan type: Quick scan
Objects scanned: 121154
Time elapsed: 7 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

---------------------------------------------------------------------------------

OTL logfile created on: 05/04/2010 10:14:12 PM - Run 2
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Documents and Settings\Sheila\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 67.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 33.32 Gb Total Space | 18.41 Gb Free Space | 55.24% Space Free | Partition Type: NTFS
Drive D: | 209.58 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JD
Current User Name: Sheila
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Sheila\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo )
PRC - C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo )
PRC - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo )
PRC - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo )
PRC - C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe (Lenovo )
PRC - C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE (Lenovo.)
PRC - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe ()
PRC - C:\WINDOWS\system32\TpShocks.exe (Lenovo.)
PRC - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files\ThinkVantage Fingerprint Software\ctlcntrx.exe (UPEK Inc.)
PRC - C:\Program Files\ThinkVantage Fingerprint Software\ctlcntr.exe (UPEK Inc.)
PRC - C:\WINDOWS\system32\ibmpmsvc.exe (Lenovo.)
PRC - C:\Program Files\Lenovo\ZOOM\TpScrex.exe (Lenovo Group Limited)
PRC - C:\WINDOWS\system32\acs.exe (Atheros)
PRC - C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe (Lenovo Group Limited)
PRC - C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe (Lenovo Group Limited)
PRC - C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
PRC - C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe (Lenovo Group Limited)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Sheila\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\asoehook.dll (Symantec Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\microsoft.vc90.crt\msvcr90.dll (Microsoft Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\microsoft.vc90.crt\msvcp90.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.)

========== Win32 Services (SafeList) ==========

SRV - (AcSvc) -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo )
SRV - (AcPrfMgrSvc) -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo )
SRV - (DozeSvc) -- C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE (Lenovo.)
SRV - (Power Manager DBC Service) -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe ()
SRV - (NIS) -- C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe (Symantec Corporation)
SRV - (IBMPMSVC) -- C:\WINDOWS\system32\ibmpmsvc.exe (Lenovo.)
SRV - (TPHDEXLGSVC) -- C:\WINDOWS\system32\TPHDEXLG.exe (Lenovo.)
SRV - (acs) -- C:\WINDOWS\system32\acs.exe (Atheros)
SRV - (EvtEng) Intel® -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (S24EventMonitor) Intel® -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) Intel® -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (TPHKSVC) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe (Lenovo Group Limited)
SRV - (LENOVO.MICMUTE) -- C:\Program Files\Lenovo\HOTKEY\micmute.exe (Lenovo Group Limited)

========== Driver Services (SafeList) ==========

DRV - (NAVEX15) -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100405.023\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100405.023\NAVENG.SYS (Symantec Corporation)
DRV - (SymEvent) -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (BHDrvx86) -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100324.001\BHDrvx86.sys (Symantec Corporation)
DRV - (DozeHDD) -- C:\WINDOWS\System32\DRIVERS\DozeHDD.sys (Lenovo.)
DRV - (TPPWRIF) -- C:\WINDOWS\system32\drivers\TPPWRIF.SYS ()
DRV - (cpudrv) -- C:\Program Files\SystemRequirementsLab\cpudrv.sys ()
DRV - (ccHP) -- C:\WINDOWS\system32\drivers\NIS\1105000.07F\ccHPx86.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\WINDOWS\System32\Drivers\NIS\1105000.07F\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\WINDOWS\system32\drivers\NIS\1105000.07F\SRTSPX.SYS (Symantec Corporation)
DRV - (SymEFA) -- C:\WINDOWS\system32\drivers\NIS\1105000.07F\SYMEFA.SYS (Symantec Corporation)
DRV - (SymIRON) -- C:\WINDOWS\system32\drivers\NIS\1105000.07F\Ironx86.SYS (Symantec Corporation)
DRV - (SYMTDI) -- C:\WINDOWS\System32\Drivers\NIS\1105000.07F\SYMTDI.SYS (Symantec Corporation)
DRV - (IBMPMDRV) -- C:\WINDOWS\system32\drivers\ibmpmdrv.sys (Lenovo.)
DRV - (IDSxpx86) -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100402.001\IDSXpx86.sys (Symantec Corporation)
DRV - (Shockprf) -- C:\WINDOWS\System32\DRIVERS\Apsx86.sys (Lenovo.)
DRV - (TPDIGIMN) -- C:\WINDOWS\System32\DRIVERS\ApsHM86.sys (Lenovo.)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (SymDS) -- C:\WINDOWS\system32\drivers\NIS\1105000.07F\SYMDS.SYS (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (smihlp) SMI Helper Driver (smihlp) -- C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys (UPEK Inc.)
DRV - (TcUsb) -- C:\WINDOWS\system32\drivers\tcusb.sys (UPEK Inc.)
DRV - (TPHKDRV) -- C:\WINDOWS\system32\drivers\TPHKDRV.sys (Lenovo Group Limited)
DRV - (IBMTPCHK) -- C:\WINDOWS\system32\drivers\IBMBLDID.sys ()
DRV - (WSIMD) -- C:\WINDOWS\system32\drivers\wsimd.sys (Atheros Communications, Inc.)
DRV - (w29n51) Intel® -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (ANC) -- C:\WINDOWS\system32\drivers\ANC.sys (IBM Corp.)
DRV - (portio) -- C:\WINDOWS\system32\drivers\NscTpmDD.sys (National Semiconductor Corp.)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\ [2010/04/04 11:16:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\ [2010/04/04 20:44:12 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2010/04/05 19:19:10 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ipsbho.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo )
O4 - HKLM..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo )
O4 - HKLM..\Run: [LENOVO.TPFNF6R] C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (Lenovo.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1269139162539 (WUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s...el_4.1.66.0.cab (SysInfo Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.71.255.198
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\WINDOWS\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\psfus: DllName - C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll - C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)
O20 - Winlogon\Notify\tpfnf2: DllName - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Sheila\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Sheila\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/20 21:36:55 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/04/05 21:53:38 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/04/05 17:35:52 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/04/05 17:31:57 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/04/05 07:38:43 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/04/05 07:38:43 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/04/05 07:38:43 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/04/05 07:38:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/04/05 07:37:57 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/04/04 20:39:28 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\OTL.exe
[2010/04/04 20:36:47 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Sheila\Desktop\erunt_setup.exe
[2010/04/04 20:36:26 | 000,444,416 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\TFC.exe
[2010/04/04 20:26:26 | 000,340,016 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symtdiv.sys
[2010/04/04 20:26:25 | 000,362,032 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symtdi.sys
[2010/04/04 20:26:25 | 000,328,752 | R--- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symds.sys
[2010/04/04 20:26:25 | 000,172,592 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symefa.sys
[2010/04/04 20:26:24 | 000,501,888 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\cchpx86.sys
[2010/04/04 20:26:24 | 000,325,168 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtsp.sys
[2010/04/04 20:26:24 | 000,116,272 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\ironx86.sys
[2010/04/04 20:26:24 | 000,043,696 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtspx.sys
[2010/04/04 20:25:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NIS\1105000.07F
[2010/04/04 11:15:58 | 000,124,976 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/04/04 11:15:58 | 000,060,808 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/04/04 11:15:58 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2010/04/04 11:15:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NIS
[2010/04/04 11:15:11 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Internet Security
[2010/04/04 11:14:04 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/04/04 07:32:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Desktop\Norton Internet Security 2010 v17.0.0.136 + NTR 2010 v1.4 [RH]
[2010/04/03 19:01:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\Identities
[2010/04/03 01:14:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\Yahoo!
[2010/04/02 08:21:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/04/02 08:19:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2010/04/02 08:18:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Adobe Reader 9 Installer
[2010/04/02 08:18:50 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2010/04/02 08:18:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Adobe
[2010/04/02 08:18:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010/04/02 08:17:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\Adobe
[2010/04/02 08:17:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\NOS
[2010/04/01 20:30:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Desktop\Crosswords DS [USA - English - NDS][www.TMasGames.com]
[2010/04/01 20:28:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Desktop\Brain Voyage [USA - English - NDS][www.TMasGames.com]
[2010/04/01 20:22:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\.BitTornado
[2010/04/01 20:22:20 | 000,000,000 | ---D | C] -- C:\Program Files\BitTornado
[2010/03/28 22:09:31 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2010/03/28 13:09:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll
[2010/03/28 13:09:15 | 000,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll
[2010/03/28 13:09:14 | 000,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbscan.sys
[2010/03/28 08:37:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Desktop\gmer
[2010/03/27 12:23:38 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/03/27 08:11:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/03/27 08:11:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/03/26 20:28:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\Malwarebytes
[2010/03/26 20:28:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/26 20:28:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
[2010/03/26 20:28:41 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/26 20:28:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/03/25 22:00:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\FastStone
[2010/03/25 21:59:46 | 000,000,000 | ---D | C] -- C:\Program Files\FastStone Image Viewer
[2010/03/25 21:49:22 | 000,026,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbstor.sys
[2010/03/25 20:29:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010/03/25 20:19:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2010/03/25 20:19:10 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Sidebar
[2010/03/25 20:19:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Norton
[2010/03/25 20:18:51 | 000,000,000 | ---D | C] -- C:\Program Files\WinDefender32
[2010/03/25 20:18:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\NortonInstaller
[2010/03/25 20:17:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\My Documents\Norton AntiVirus 2010 17.0.0.136 Final
[2010/03/25 19:43:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\WinRAR
[2010/03/25 19:42:50 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2010/03/23 22:49:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\My Documents\Attachments
[2010/03/23 22:16:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\Forte
[2010/03/23 22:16:21 | 000,000,000 | ---D | C] -- C:\Program Files\Agent
[2010/03/22 23:50:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\KB905474
[2010/03/22 22:55:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot_bak
[2010/03/22 22:53:01 | 000,272,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys
[2010/03/22 21:52:45 | 003,555,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/03/22 21:52:39 | 000,453,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2010/03/22 21:52:37 | 000,683,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcomm.dll
[2010/03/22 21:52:31 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadce.dll
[2010/03/22 21:52:29 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml3.dll
[2010/03/22 21:51:29 | 000,470,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll
[2010/03/22 21:49:38 | 000,655,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstscax.dll
[2010/03/22 21:49:05 | 000,351,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsp3res.dll
[2010/03/22 21:47:20 | 000,332,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\netapi32.dll
[2010/03/22 21:46:35 | 000,352,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srv.sys
[2010/03/22 00:13:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall
[2010/03/21 23:52:13 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Sheila\PrivacIE
[2010/03/21 23:47:50 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Sheila\IETldCache
[2010/03/21 23:41:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/03/21 23:41:32 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
[2010/03/21 23:41:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
[2010/03/21 23:39:44 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/03/21 23:36:53 | 000,594,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010/03/21 23:36:53 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010/03/21 23:36:52 | 001,985,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll
[2010/03/21 23:36:50 | 011,070,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/03/21 23:29:17 | 000,000,000 | ---D | C] -- C:\Program Files\Digital Line Detect
[2010/03/21 23:29:03 | 000,000,000 | ---D | C] -- C:\Program Files\NetWaiting
[2010/03/21 23:29:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\BVRP Software
[2010/03/21 23:28:46 | 000,000,000 | ---D | C] -- C:\Program Files\CONEXANT
[2010/03/21 23:28:40 | 000,998,656 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\drivers\HSF_DPV.sys
[2010/03/21 23:28:40 | 000,721,280 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\drivers\HSF_CNXT.sys
[2010/03/21 23:28:40 | 000,242,304 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\drivers\HSFHWICH.sys
[2010/03/21 23:28:40 | 000,110,592 | ---- | C] (Conexant Systems, Inc) -- C:\WINDOWS\System32\Uci32101.dll
[2010/03/21 23:22:53 | 000,006,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\splitter.sys
[2010/03/21 23:22:51 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wdmaud.sys
[2010/03/21 23:22:48 | 000,052,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmusic.sys
[2010/03/21 23:22:47 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\swmidi.sys
[2010/03/21 23:22:45 | 000,142,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aec.sys
[2010/03/21 23:22:43 | 000,171,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kmixer.sys
[2010/03/21 23:22:41 | 000,002,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\drmkaud.sys
[2010/03/21 23:22:39 | 000,060,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sysaudio.sys
[2010/03/21 23:22:37 | 000,007,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mskssrv.sys
[2010/03/21 23:22:35 | 000,004,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mspqm.sys
[2010/03/21 23:22:32 | 000,005,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mspclock.sys
[2010/03/21 23:22:27 | 000,145,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\portcls.sys
[2010/03/21 23:22:27 | 000,145,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\portcls.sys
[2010/03/21 23:22:27 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ksuser.dll
[2010/03/21 23:22:27 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ksuser.dll
[2010/03/21 23:22:26 | 000,130,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ksproxy.ax
[2010/03/21 23:22:26 | 000,130,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ksproxy.ax
[2010/03/21 23:22:26 | 000,060,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\drmk.sys
[2010/03/21 23:22:26 | 000,060,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\drmk.sys
[2010/03/21 23:08:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SPBA
[2010/03/21 23:08:08 | 000,000,000 | ---D | C] -- C:\Program Files\ThinkVantage Fingerprint Software
[2010/03/21 23:07:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\UIB
[2010/03/21 23:04:36 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\raschap.dll
[2010/03/21 23:04:35 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rastls.dll
[2010/03/21 22:58:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\My Documents\Access Connections
[2010/03/21 22:58:00 | 001,056,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC71.dll
[2010/03/21 22:58:00 | 001,049,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC71u.dll
[2010/03/21 22:58:00 | 000,499,712 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp71.dll
[2010/03/21 22:58:00 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr71.dll
[2010/03/21 22:57:56 | 000,582,968 | ---- | C] (Lenovo) -- C:\WINDOWS\System32\tvt_gina.dll
[2010/03/21 22:57:56 | 000,292,152 | ---- | C] (Lenovo) -- C:\WINDOWS\System32\tvt_gina_api.dll
[2010/03/21 22:57:48 | 000,011,520 | ---- | C] (IBM Corp.) -- C:\WINDOWS\System32\drivers\ANC.sys
[2010/03/21 22:43:24 | 000,251,240 | ---- | C] (Lenovo Group Limited) -- C:\WINDOWS\System32\PWMCPl.cpl
[2010/03/21 22:43:24 | 000,024,304 | ---- | C] (Lenovo.) -- C:\WINDOWS\System32\drivers\DOZEHDD.SYS
[2010/03/21 22:33:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\ATI
[2010/03/21 22:33:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\ATI
[2010/03/21 22:33:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\ATI
[2010/03/21 22:01:44 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2010/03/21 21:52:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\Intel
[2010/03/21 21:52:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2010/03/21 21:51:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2010/03/21 21:51:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Intel
[2010/03/21 21:48:03 | 000,724,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lsasrv.dll
[2010/03/21 21:48:03 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\colbact.dll
[2010/03/21 21:48:02 | 002,180,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2010/03/21 21:48:02 | 002,136,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2010/03/21 21:48:01 | 002,015,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2010/03/21 21:48:00 | 002,057,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlpa.exe
[2010/03/21 20:15:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\XPSViewer
[2010/03/21 20:14:58 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild
[2010/03/21 20:14:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US
[2010/03/21 20:14:47 | 000,000,000 | ---D | C] -- C:\Program Files\Reference Assemblies
[2010/03/21 20:14:08 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpssvcs.dll
[2010/03/21 20:14:08 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2010/03/21 20:14:08 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2010/03/21 20:14:08 | 000,575,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2010/03/21 20:14:08 | 000,117,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\prntvpt.dll
[2010/03/21 20:14:08 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2010/03/21 20:14:08 | 000,000,000 | ---D | C] -- C:\6fb87d9b259b89b41a66be6f21ffa1fb
[2010/03/21 20:13:11 | 000,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2010/03/21 20:12:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2010/03/21 20:12:03 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 6.0
[2010/03/21 20:03:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2010/03/21 19:37:43 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpcdll.dll
[2010/03/21 19:37:37 | 000,040,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\irbus.sys
[2010/03/21 19:37:37 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comsdupd.exe
[2010/03/21 19:37:33 | 003,565,056 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtag.sys
[2010/03/21 19:37:33 | 003,565,056 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\ati2mtag.sys
[2010/03/21 19:37:33 | 000,327,040 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtaa.sys
[2010/03/21 19:37:33 | 000,104,960 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinrvxx.sys
[2010/03/21 19:37:33 | 000,073,216 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atintuxx.sys
[2010/03/21 19:37:33 | 000,063,663 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2010/03/21 19:37:33 | 000,063,488 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxsxx.sys
[2010/03/21 19:37:33 | 000,057,856 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinbtxx.sys
[2010/03/21 19:37:33 | 000,056,623 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1btxx.sys
[2010/03/21 19:37:33 | 000,052,224 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinraxx.sys
[2010/03/21 19:37:33 | 000,043,008 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\drivers\amdagp.sys
[2010/03/21 19:37:33 | 000,036,463 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2010/03/21 19:37:33 | 000,035,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthprint.sys
[2010/03/21 19:37:33 | 000,034,735 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2010/03/21 19:37:33 | 000,031,744 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxbxx.sys
[2010/03/21 19:37:33 | 000,030,671 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1raxx.sys
[2010/03/21 19:37:33 | 000,029,455 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2010/03/21 19:37:33 | 000,028,672 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinsnxx.sys
[2010/03/21 19:37:33 | 000,026,367 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1snxx.sys
[2010/03/21 19:37:33 | 000,025,471 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\atv04nt5.dll
[2010/03/21 19:37:33 | 000,021,343 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2010/03/21 19:37:33 | 000,021,183 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\atv01nt5.dll
[2010/03/21 19:37:33 | 000,017,279 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\atv10nt5.dll
[2010/03/21 19:37:33 | 000,015,423 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\ch7xxnt5.dll
[2010/03/21 19:37:33 | 000,014,336 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinpdxx.sys
[2010/03/21 19:37:33 | 000,014,143 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\atv06nt5.dll
[2010/03/21 19:37:33 | 000,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinttxx.sys
[2010/03/21 19:37:33 | 000,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinmdxx.sys
[2010/03/21 19:37:33 | 000,012,047 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2010/03/21 19:37:33 | 000,011,615 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2010/03/21 19:37:33 | 000,011,359 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\atv02nt5.dll
[2010/03/21 19:37:33 | 000,004,255 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\adv01nt5.dll
[2010/03/21 19:37:33 | 000,003,967 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\adv02nt5.dll
[2010/03/21 19:37:33 | 000,003,775 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\adv11nt5.dll
[2010/03/21 19:37:33 | 000,003,711 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\adv09nt5.dll
[2010/03/21 19:37:33 | 000,003,647 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\adv07nt5.dll
[2010/03/21 19:37:33 | 000,003,615 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\adv05nt5.dll
[2010/03/21 19:37:33 | 000,003,135 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\adv08nt5.dll
[2010/03/21 19:37:32 | 001,897,408 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\drivers\nv4_mini.sys
[2010/03/21 19:37:32 | 001,309,184 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlstrm.sys
[2010/03/21 19:37:32 | 000,452,736 | ---- | C] (Matrox Graphics Inc.) -- C:\WINDOWS\System32\drivers\mtxparhm.sys
[2010/03/21 19:37:32 | 000,404,990 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slntamr.sys
[2010/03/21 19:37:32 | 000,180,360 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\ntmtlfax.sys
[2010/03/21 19:37:32 | 000,166,912 | ---- | C] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\drivers\s3gnbm.sys
[2010/03/21 19:37:32 | 000,129,535 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnt7554.sys
[2010/03/21 19:37:32 | 000,126,686 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlmnt5.sys
[2010/03/21 19:37:32 | 000,095,424 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnthal.sys
[2010/03/21 19:37:32 | 000,041,088 | ---- | C] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\System32\drivers\sisagp.sys
[2010/03/21 19:37:32 | 000,030,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rndismpx.sys
[2010/03/21 19:37:32 | 000,013,776 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\recagent.sys
[2010/03/21 19:37:32 | 000,013,240 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slwdmsup.sys
[2010/03/21 19:37:32 | 000,012,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\mutohpen.sys
[2010/03/21 19:37:32 | 000,011,325 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\vchnt5.dll
[2010/03/21 19:37:32 | 000,006,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\smbali.sys
[2010/03/21 19:37:32 | 000,003,901 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\siint5.dll
[2010/03/21 19:37:31 | 003,818,272 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\dllcache\ati3duag.dll
[2010/03/21 19:37:31 | 003,818,272 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\ati3duag.dll
[2010/03/21 19:37:31 | 000,870,784 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\ati3d1ag.dll
[2010/03/21 19:37:31 | 000,626,688 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\ati2cqag.dll
[2010/03/21 19:37:31 | 000,626,688 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2cqag.dll
[2010/03/21 19:37:31 | 000,377,984 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2dvaa.dll
[2010/03/21 19:37:31 | 000,325,120 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\ati2dvag.dll
[2010/03/21 19:37:31 | 000,325,120 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2dvag.dll
[2010/03/21 19:37:31 | 000,032,768 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativtmxx.dll
[2010/03/21 19:37:31 | 000,025,471 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\watv10nt.sys
[2010/03/21 19:37:31 | 000,023,040 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativmvxx.ax
[2010/03/21 19:37:31 | 000,022,271 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\watv06nt.sys
[2010/03/21 19:37:31 | 000,011,935 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\wadv11nt.sys
[2010/03/21 19:37:31 | 000,011,871 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\wadv09nt.sys
[2010/03/21 19:37:31 | 000,011,807 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\wadv07nt.sys
[2010/03/21 19:37:31 | 000,011,295 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\wadv08nt.sys
[2010/03/21 19:37:31 | 000,009,728 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativdaxx.ax
[2010/03/21 19:37:30 | 002,670,592 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\dllcache\ativvaxx.dll
[2010/03/21 19:37:30 | 002,670,592 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\ativvaxx.dll
[2010/03/21 19:37:30 | 001,689,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3d9.dll
[2010/03/21 19:37:30 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bthprops.cpl
[2010/03/21 19:37:30 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\blastcln.exe
[2010/03/21 19:37:30 | 000,050,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\btpanui.dll
[2010/03/21 19:37:30 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bthci.dll
[2010/03/21 19:37:30 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\auditusr.exe
[2010/03/21 19:37:30 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\cmsetacl.dll
[2010/03/21 19:37:30 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bitsprx2.dll
[2010/03/21 19:37:30 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bitsprx3.dll
[2010/03/21 19:37:29 | 002,113,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dxdiagn.dll
[2010/03/21 19:37:29 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\html.iec
[2010/03/21 19:37:29 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\fsquirt.exe
[2010/03/21 19:37:29 | 000,080,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\firewall.cpl
[2010/03/21 19:37:29 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\fwcfg.dll
[2010/03/21 19:37:29 | 000,032,285 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\hsfcisp2.dll
[2010/03/21 19:37:29 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\httpapi.dll
[2010/03/21 19:37:29 | 000,022,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\fltmc.exe
[2010/03/21 19:37:28 | 000,848,384 | ---- | C] (Intel Corporation) -- C:\WINDOWS\System32\ir41_32.ax
[2010/03/21 19:37:28 | 000,755,200 | ---- | C] (Intel Corporation) -- C:\WINDOWS\System32\ir50_32.dll
[2010/03/21 19:37:28 | 000,384,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mp4sdmod.dll
[2010/03/21 19:37:28 | 000,380,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\irprops.cpl
[2010/03/21 19:37:28 | 000,338,432 | ---- | C] (Intel Corporation.) -- C:\WINDOWS\System32\ir41_qcx.dll
[2010/03/21 19:37:28 | 000,310,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mp43dmod.dll
[2010/03/21 19:37:28 | 000,200,192 | ---- | C] (Intel Corporation.) -- C:\WINDOWS\System32\ir50_qc.dll
[2010/03/21 19:37:28 | 000,199,680 | ---- | C] (Intel Corporation) -- C:\WINDOWS\System32\iac25_32.ax
[2010/03/21 19:37:28 | 000,183,808 | ---- | C] (Intel Corporation.) -- C:\WINDOWS\System32\ir50_qcx.dll
[2010/03/21 19:37:28 | 000,154,624 | ---- | C] (Intel Corporation) -- C:\WINDOWS\System32\ivfsrc.ax
[2010/03/21 19:37:28 | 000,120,320 | ---- | C] (Intel Corporation.) -- C:\WINDOWS\System32\ir41_qc.dll
[2010/03/21 19:37:28 | 000,086,016 | ---- | C] (Conexant) -- C:\WINDOWS\System32\mdmxsdk.dll
[2010/03/21 19:37:28 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdsmsno.dll
[2010/03/21 19:37:28 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdsmsfi.dll
[2010/03/21 19:37:28 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdukx.dll
[2010/03/21 19:37:28 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdno1.dll
[2010/03/21 19:37:28 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdfi1.dll
[2010/03/21 19:37:28 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdinmal.dll
[2010/03/21 19:37:28 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdinben.dll
[2010/03/21 19:37:28 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdmlt48.dll
[2010/03/21 19:37:28 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdmlt47.dll
[2010/03/21 19:37:28 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdinbe1.dll
[2010/03/21 19:37:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdmaori.dll
[2010/03/21 19:37:27 | 004,274,816 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nv4_disp.dll
[2010/03/21 19:37:27 | 001,737,856 | ---- | C] (Matrox Graphics Inc.) -- C:\WINDOWS\System32\mtxparhd.dll
[2010/03/21 19:37:27 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdadiag.dll
[2010/03/21 19:37:27 | 000,116,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\p2p.dll
[2010/03/21 19:37:27 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\p2pgasvc.dll
[2010/03/21 19:37:27 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\netsetup.cpl
[2010/03/21 19:37:26 | 000,397,056 | ---- | C] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\s3gnb.dll
[2010/03/21 19:37:26 | 000,312,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\p2pgraph.dll
[2010/03/21 19:37:26 | 000,286,792 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slextspk.dll
[2010/03/21 19:37:26 | 000,188,508 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slgen.dll
[2010/03/21 19:37:26 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\p2pnetsh.dll
[2010/03/21 19:37:26 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\strmfilt.dll
[2010/03/21 19:37:26 | 000,073,832 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slcoinst.dll
[2010/03/21 19:37:26 | 000,073,796 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slserv.exe
[2010/03/21 19:37:26 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\powercfg.exe
[2010/03/21 19:37:26 | 000,032,866 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slrundll.exe
[2010/03/21 19:37:26 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\sdhcinst.dll
[2010/03/21 19:37:26 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\vidcap.ax
[2010/03/21 19:37:26 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\smbinst.exe
[2010/03/21 19:37:25 | 001,119,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmsdmoe2.dll
[2010/03/21 19:37:25 | 001,001,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmvdmoe2.dll
[2010/03/21 19:37:25 | 000,896,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmspdmoe.dll
[2010/03/21 19:37:25 | 000,485,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmspdmod.dll
[2010/03/21 19:37:25 | 000,168,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmerror.dll
[2010/03/21 19:37:25 | 000,151,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmidx.dll
[2010/03/21 19:37:25 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmpasf.dll
[2010/03/21 19:37:25 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\winshfhc.dll
[2010/03/21 19:37:24 | 000,438,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpob2res.dll
[2010/03/21 19:37:24 | 000,183,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaueng1.dll
[2010/03/21 19:37:24 | 000,165,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuauclt1.exe
[2010/03/21 19:37:24 | 000,148,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wscui.cpl
[2010/03/21 19:37:24 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xmlprovi.dll
[2010/03/21 19:37:24 | 000,032,866 | ---- | C] (Smart Link) -- C:\WINDOWS\slrundll.exe
[2010/03/21 19:37:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\peernet
[2010/03/21 19:37:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\provisioning
[2010/03/21 19:35:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
[2010/03/21 19:34:07 | 002,897,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsp2res.dll
[2010/03/21 19:32:21 | 000,026,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spupdsvc.exe
[2010/03/21 19:30:18 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$
[2010/03/21 19:30:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\EHome
[2010/03/21 13:18:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\Macromedia
[2010/03/21 12:16:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\Adobe
[2010/03/20 23:34:23 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2010/03/20 23:32:07 | 000,000,000 | ---D | C] -- C:\Program Files\Lavalys
[2010/03/20 23:17:00 | 000,475,220 | ---- | C] (Atheros) -- C:\WINDOWS\System32\acs.exe
[2010/03/20 23:17:00 | 000,426,052 | ---- | C] (Atheros) -- C:\WINDOWS\System32\wcapi.dll
[2010/03/20 23:17:00 | 000,401,498 | ---- | C] (Atheros) -- C:\WINDOWS\System32\wgapi.dll
[2010/03/20 23:17:00 | 000,372,736 | ---- | C] (Atheros) -- C:\WINDOWS\System32\athcfg11.dll
[2010/03/20 23:17:00 | 000,352,347 | ---- | C] (Atheros) -- C:\WINDOWS\System32\wcapiU.dll
[2010/03/20 23:17:00 | 000,307,294 | ---- | C] (Atheros) -- C:\WINDOWS\System32\athcfg20U.dll
[2010/03/20 23:17:00 | 000,299,079 | ---- | C] (Atheros) -- C:\WINDOWS\System32\athcfg20.dll
[2010/03/20 23:17:00 | 000,127,079 | ---- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\athcfg20resU.dll
[2010/03/20 23:17:00 | 000,127,053 | ---- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\athcfg20res.dll
[2010/03/20 23:17:00 | 000,077,824 | ---- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\athcfg11res.dll
[2010/03/20 23:16:46 | 000,057,408 | ---- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\drivers\wsimd.sys
[2010/03/20 23:16:30 | 001,269,854 | R--- | C] (Devicescape) -- C:\WINDOWS\System32\dsa.dll
[2010/03/20 23:16:30 | 000,254,022 | ---- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\wsfwDS.dll
[2010/03/20 23:16:30 | 000,249,924 | ---- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\wsimd.dll
[2010/03/20 23:16:30 | 000,082,017 | R--- | C] (Devicescape, Inc.) -- C:\WINDOWS\System32\dsaNac.dll
[2010/03/20 23:16:21 | 000,057,408 | ---- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\wsimd.sys
[2010/03/20 23:16:20 | 001,347,168 | ---- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\athw.sys
[2010/03/20 23:16:20 | 000,118,784 | ---- | C] (Atheros) -- C:\WINDOWS\System32\ATHCFG10.DLL
[2010/03/20 23:05:23 | 000,000,000 | --SD | C] -- C:\WINDOWS\System32\Microsoft
[2010/03/20 23:04:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Atheros
[2010/03/20 23:02:15 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2010/03/20 23:02:05 | 000,142,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbport.sys
[2010/03/20 23:02:05 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\usbui.dll
[2010/03/20 23:02:04 | 000,000,000 | ---D | C] -- C:\SWTOOLS
[2010/03/20 23:01:50 | 000,095,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atapi.sys
[2010/03/20 23:01:50 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\pciidex.sys
[2010/03/20 23:01:50 | 000,003,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pciide.sys
[2010/03/20 23:01:47 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isapnp.sys
[2010/03/20 23:01:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[2010/03/20 22:56:25 | 000,000,000 | ---D | C] -- C:\Program Files\Lenovo
[2010/03/20 22:56:13 | 000,017,844 | ---- | C] (Lenovo Group Limited) -- C:\WINDOWS\System32\drivers\TPHKDRV.sys
[2010/03/20 22:55:27 | 000,000,000 | ---D | C] -- C:\Program Files\ThinkPad
[2010/03/20 22:54:55 | 000,016,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2010/03/20 22:54:45 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
[2010/03/20 22:54:00 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2010/03/20 22:53:47 | 000,038,248 | ---- | C] (Lenovo.) -- C:\WINDOWS\System32\ibmpmsvc.exe
[2010/03/20 22:53:47 | 000,035,176 | ---- | C] (Lenovo.) -- C:\WINDOWS\System32\tpinspm.dll
[2010/03/20 22:53:47 | 000,026,608 | ---- | C] (Lenovo.) -- C:\WINDOWS\System32\drivers\ibmpmdrv.sys
[2010/03/20 22:52:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2010/03/20 22:51:49 | 000,155,648 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Oemdspif.dll
[2010/03/20 22:51:48 | 000,290,816 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atiok3x2.dll
[2010/03/20 22:51:48 | 000,204,800 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\atipdlxx.dll
[2010/03/20 22:51:48 | 000,017,408 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atitvo32.dll
[2010/03/20 22:51:46 | 011,845,632 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atioglxx.dll
[2010/03/20 22:51:45 | 000,475,136 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atikvmag.dll
[2010/03/20 22:51:45 | 000,442,368 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\ATIDEMGX.dll
[2010/03/20 22:51:45 | 000,307,200 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atiiiexx.dll
[2010/03/20 22:51:45 | 000,126,976 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atiadlxx.dll
[2010/03/20 22:51:45 | 000,118,784 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atibrtmon.exe
[2010/03/20 22:51:45 | 000,053,248 | ---- | C] ( ATI Technologies Inc.) -- C:\WINDOWS\System32\ATIDDC.DLL
[2010/03/20 22:51:43 | 000,155,648 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2evxx.dll
[2010/03/20 22:51:43 | 000,053,248 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2erec.dll
[2010/03/20 22:51:43 | 000,049,664 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\amdpcom32.dll
[2010/03/20 22:51:43 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ati2edxx.dll
[2010/03/20 22:51:43 | 000,026,112 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Ati2mdxx.exe
[2010/03/20 22:50:35 | 000,000,000 | ---D | C] -- C:\DRIVERS
[2010/03/20 22:39:57 | 000,327,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll
[2010/03/20 22:39:57 | 000,044,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wups2.dll
[2010/03/20 22:39:57 | 000,035,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wups.dll
[2010/03/20 22:39:57 | 000,021,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll.mui
[2010/03/20 22:39:57 | 000,017,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaueng.dll.mui
[2010/03/20 22:39:56 | 000,575,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll
[2010/03/20 22:39:56 | 000,015,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaucpl.cpl.mui
[2010/03/20 22:39:56 | 000,015,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll.mui
[2010/03/20 22:39:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
[2010/03/20 22:39:21 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Sheila\UserData
[2010/03/20 22:36:46 | 000,000,000 | ---D | C] -- C:\WUTemp
[2010/03/20 22:36:44 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\iuengine.dll
[2010/03/20 22:26:02 | 000,000,000 | -HSD | C] -- C:\WINDOWS\Installer
[2010/03/20 22:25:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Application Data\Identities
[2010/03/20 22:25:46 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
[2010/03/20 22:25:45 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Sheila\My Documents\My Pictures
[2010/03/20 22:25:45 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Sheila\My Documents\My Music
[2010/03/20 22:25:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Local Settings\Application Data\Microsoft
[2010/03/20 22:25:41 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Sheila\Application Data\Microsoft
[2010/03/20 22:25:41 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Sheila\SendTo
[2010/03/20 22:25:41 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Sheila\Recent
[2010/03/20 22:25:41 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Sheila\Application Data
[2010/03/20 22:25:41 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Sheila\Start Menu
[2010/03/20 22:25:41 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Sheila\My Documents
[2010/03/20 22:25:41 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Sheila\Favorites
[2010/03/20 22:25:41 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Sheila\Cookies
[2010/03/20 22:25:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Sheila\Templates
[2010/03/20 22:25:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Sheila\PrintHood
[2010/03/20 22:25:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Sheila\NetHood
[2010/03/20 22:25:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Sheila\Local Settings
[2010/03/20 22:25:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sheila\Desktop
[2010/03/20 22:16:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/03/20 22:14:05 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winzm.ime
[2010/03/20 22:14:04 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winsp.ime
[2010/03/20 22:14:04 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winpy.ime
[2010/03/20 22:14:04 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wingb.ime
[2010/03/20 22:14:04 | 000,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winime.ime
[2010/03/20 22:14:03 | 000,079,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winar30.ime
[2010/03/20 22:14:02 | 000,041,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\weitekp9.dll
[2010/03/20 22:14:02 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\weitekp9.sys
[2010/03/20 22:14:02 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wamps51.dll
[2010/03/20 22:14:01 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\w3ext.dll
[2010/03/20 22:14:01 | 000,048,256 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\w32.dll
[2010/03/20 22:14:01 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\w3svapi.dll
[2010/03/20 22:14:01 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\w3ctrs51.dll
[2010/03/20 22:14:00 | 000,426,041 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\voicepad.dll
[2010/03/20 22:14:00 | 000,086,073 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\voicesub.dll
[2010/03/20 22:13:59 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\uniime.dll
[2010/03/20 22:13:59 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\unicdime.ime
[2010/03/20 22:13:58 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tsprof.exe
[2010/03/20 22:13:57 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tools.dll
[2010/03/20 22:13:57 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tmigrate.dll
[2010/03/20 22:13:56 | 000,571,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tintlgnt.ime
[2010/03/20 22:13:56 | 000,455,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tintsetp.exe
[2010/03/20 22:13:56 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\thawbrkr.dll
[2010/03/20 22:13:56 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tintlphr.exe
[2010/03/20 22:13:55 | 000,021,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tdipx.sys
[2010/03/20 22:13:55 | 000,019,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tdspx.sys
[2010/03/20 22:13:55 | 000,013,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tdasync.sys
[2010/03/20 22:13:53 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\status.dll
[2010/03/20 22:13:52 | 000,143,422 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\softkey.dll
[2010/03/20 22:13:52 | 000,101,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srusbusd.dll
[2010/03/20 22:13:51 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\snmpstup.dll
[2010/03/20 22:13:51 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_snprfdll.dll
[2010/03/20 22:13:50 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm9aw.dll
[2010/03/20 22:13:50 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smb6w.dll
[2010/03/20 22:13:50 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sma3w.dll
[2010/03/20 22:13:50 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm93w.dll
[2010/03/20 22:13:50 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smierrsm.dll
[2010/03/20 22:13:50 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_smtpctrs.dll
[2010/03/20 22:13:50 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_smtpapi.dll
[2010/03/20 22:13:50 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smimsgif.dll
[2010/03/20 22:13:50 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smierrsy.dll
[2010/03/20 22:13:49 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm87w.dll
[2010/03/20 22:13:49 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm81w.dll
[2010/03/20 22:13:49 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm8cw.dll
[2010/03/20 22:13:49 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm92w.dll
[2010/03/20 22:13:49 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm90w.dll
[2010/03/20 22:13:49 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm8dw.dll
[2010/03/20 22:13:49 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm8aw.dll
[2010/03/20 22:13:49 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm89w.dll
[2010/03/20 22:13:49 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm59w.dll
[2010/03/20 22:13:49 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\simptcp.dll
[2010/03/20 22:13:46 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_seos.dll
[2010/03/20 22:13:45 | 000,205,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_seo.dll
[2010/03/20 22:13:45 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2010/03/20 22:13:45 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2010/03/20 22:13:45 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_scripto.dll
[2010/03/20 22:13:45 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_rwnh.dll
[2010/03/20 22:13:44 | 000,026,624 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2010/03/20 22:13:44 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rw001ext.dll
[2010/03/20 22:13:43 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\romanime.ime
[2010/03/20 22:13:43 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_regtrace.exe
[2010/03/20 22:13:43 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\register.exe
[2010/03/20 22:13:42 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\quser.exe
[2010/03/20 22:13:41 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\quick.ime
[2010/03/20 22:13:41 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\query.exe
[2010/03/20 22:13:40 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pmxviceo.dll
[2010/03/20 22:13:40 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pmxmcro.dll
[2010/03/20 22:13:40 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pmxgl.dll
[2010/03/20 22:13:39 | 000,482,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pintlgnt.ime
[2010/03/20 22:13:39 | 000,070,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pintlphr.exe
[2010/03/20 22:13:39 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pmigrate.dll
[2010/03/20 22:13:39 | 000,053,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pintlcsd.dll
[2010/03/20 22:13:38 | 000,079,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\phon.ime
[2010/03/20 22:13:38 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\permchk.dll
[2010/03/20 22:13:37 | 000,036,927 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\padrs411.dll
[2010/03/20 22:13:37 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pagecnt.dll
[2010/03/20 22:13:37 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\padrs404.dll
[2010/03/20 22:13:37 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\padrs804.dll
[2010/03/20 22:13:37 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\padrs412.dll
[2010/03/20 22:13:35 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_ntfsdrv.dll
[2010/03/20 22:13:34 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nextlink.dll
[2010/03/20 22:13:32 | 000,229,439 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\multibox.dll
[2010/03/20 22:13:32 | 000,111,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtstocom.exe
[2010/03/20 22:13:28 | 001,875,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msir3jp.lex
[2010/03/20 22:13:28 | 000,098,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msir3jp.dll
[2010/03/20 22:13:22 | 000,092,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mga.sys
[2010/03/20 22:13:22 | 000,092,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mga.dll
[2010/03/20 22:13:22 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mdsync.dll
[2010/03/20 22:13:20 | 000,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_mailmsg.dll
[2010/03/20 22:13:19 | 000,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\logscrpt.dll
[2010/03/20 22:13:18 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\korwbrkr.dll
[2010/03/20 22:13:17 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdth3.dll
[2010/03/20 22:13:17 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdth2.dll
[2010/03/20 22:13:17 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdvntc.dll
[2010/03/20 22:13:17 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdusa.dll
[2010/03/20 22:13:17 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdurdu.dll
[2010/03/20 22:13:17 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdth1.dll
[2010/03/20 22:13:17 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdth0.dll
[2010/03/20 22:13:16 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdnecat.dll
[2010/03/20 22:13:16 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdnecnt.dll
[2010/03/20 22:13:16 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdnec95.dll
[2010/03/20 22:13:16 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdlk41a.dll
[2010/03/20 22:13:16 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdlk41j.dll
[2010/03/20 22:13:16 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinpun.dll
[2010/03/20 22:13:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdsyr2.dll
[2010/03/20 22:13:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdsyr1.dll
[2010/03/20 22:13:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdintel.dll
[2010/03/20 22:13:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdintam.dll
[2010/03/20 22:13:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinmar.dll
[2010/03/20 22:13:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinkan.dll
[2010/03/20 22:13:15 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdibm02.dll
[2010/03/20 22:13:15 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinhin.dll
[2010/03/20 22:13:15 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinguj.dll
[2010/03/20 22:13:15 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdindev.dll
[2010/03/20 22:13:15 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdheb.dll
[2010/03/20 22:13:15 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdfa.dll
[2010/03/20 22:13:15 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbddiv2.dll
[2010/03/20 22:13:15 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbddiv1.dll
[2010/03/20 22:13:15 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdgeo.dll
[2010/03/20 22:13:14 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdax2.dll
[2010/03/20 22:13:14 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbd106n.dll
[2010/03/20 22:13:14 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbd101a.dll
[2010/03/20 22:13:14 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbd101.dll
[2010/03/20 22:13:14 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbda3.dll
[2010/03/20 22:13:14 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbda2.dll
[2010/03/20 22:13:14 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbda1.dll
[2010/03/20 22:13:14 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdarmw.dll
[2010/03/20 22:13:14 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdarme.dll
[2010/03/20 22:13:13 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jupiw.dll
[2010/03/20 22:13:13 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iwrps.dll
[2010/03/20 22:13:13 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isapips.dll
[2010/03/20 22:13:12 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\infoctrs.dll
[2010/03/20 22:13:11 | 000,471,102 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imskdic.dll
[2010/03/20 22:13:11 | 000,315,452 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imskf.dll
[2010/03/20 22:13:11 | 000,274,489 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjputyc.dll
[2010/03/20 22:13:11 | 000,102,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imlang.dll
[2010/03/20 22:13:11 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imkrinst.exe
[2010/03/20 22:13:10 | 000,307,257 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpdct.exe
[2010/03/20 22:13:10 | 000,262,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjputy.exe
[2010/03/20 22:13:10 | 000,233,527 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjprw.exe
[2010/03/20 22:13:10 | 000,208,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpmig.exe
[2010/03/20 22:13:10 | 000,155,705 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpdsvr.exe
[2010/03/20 22:13:10 | 000,081,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpdct.dll
[2010/03/20 22:13:10 | 000,045,109 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpuex.exe
[2010/03/20 22:13:09 | 000,811,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjp81k.dll
[2010/03/20 22:13:09 | 000,716,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpcus.dll
[2010/03/20 22:13:09 | 000,368,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpcic.dll
[2010/03/20 22:13:09 | 000,340,023 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjp81.ime
[2010/03/20 22:13:09 | 000,057,398 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpdadm.exe
[2010/03/20 22:13:08 | 000,311,359 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imepadsv.exe
[2010/03/20 22:13:08 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imekrcic.dll
[2010/03/20 22:13:08 | 000,102,463 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imepadsm.dll
[2010/03/20 22:13:08 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imekr61.ime
[2010/03/20 22:13:08 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imekrmbx.dll
[2010/03/20 22:13:08 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imekrmig.exe
[2010/03/20 22:13:08 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iissync.exe
[2010/03/20 22:13:08 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iismui.dll
[2010/03/20 22:13:07 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iisclex4.dll
[2010/03/20 22:13:07 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iiscrmap.dll
[2010/03/20 22:13:02 | 010,129,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hwxkor.dll
[2010/03/20 22:12:52 | 010,096,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hwxcht.dll
[2010/03/20 22:12:50 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hanjadic.dll
[2010/03/20 22:12:48 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsroute.dll
[2010/03/20 22:12:48 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxssend.exe
[2010/03/20 22:12:47 | 000,132,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsclntr.dll
[2010/03/20 22:12:47 | 000,111,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxscfgwz.dll
[2010/03/20 22:12:47 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ftpctrs2.dll
[2010/03/20 22:12:47 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ftlx041e.dll
[2010/03/20 22:12:45 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_fcachdll.dll
[2010/03/20 22:12:45 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\flattemp.exe
[2010/03/20 22:12:45 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\f3ahvoas.dll
[2010/03/20 22:12:44 | 000,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esuimgd.dll
[2010/03/20 22:12:44 | 000,045,056 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esunid.dll
[2010/03/20 22:12:44 | 000,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esucmd.dll
[2010/03/20 22:12:44 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\et4000.sys
[2010/03/20 22:12:43 | 000,514,587 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\edb500.dll
[2010/03/20 22:12:39 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dayi.ime
[2010/03/20 22:12:37 | 000,057,399 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cplexe.exe
[2010/03/20 22:12:37 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cprofile.exe
[2010/03/20 22:12:36 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\convlog.exe
[2010/03/20 22:12:36 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\controt.dll
[2010/03/20 22:12:36 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\counters.dll
[2010/03/20 22:12:34 | 000,480,256 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cintsetp.exe
[2010/03/20 22:12:34 | 000,198,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cintime.dll
[2010/03/20 22:12:34 | 000,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cintlgnt.ime
[2010/03/20 22:12:33 | 000,838,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chtbrkr.dll
[2010/03/20 22:12:33 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chtmbx.dll
[2010/03/20 22:12:33 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chtskdic.dll
[2010/03/20 22:12:32 | 001,677,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chsbrkr.dll
[2010/03/20 22:12:32 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chgport.exe
[2010/03/20 22:12:32 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chgusr.exe
[2010/03/20 22:12:32 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chglogon.exe
[2010/03/20 22:12:32 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\change.exe
[2010/03/20 22:12:31 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chajei.ime
[2010/03/20 22:12:30 | 000,218,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\c_g18030.dll
[2010/03/20 22:12:30 | 000,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2010/03/20 22:12:30 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\browscap.dll
[2010/03/20 22:12:30 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\c_iscii.dll
[2010/03/20 22:12:30 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\c_is2022.dll
[2010/03/20 22:12:28 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\asptxn.dll
[2010/03/20 22:12:28 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aspperf.dll
[2010/03/20 22:12:28 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\authfilt.dll
[2010/03/20 22:12:27 | 000,312,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_aqueue.dll
[2010/03/20 22:12:27 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_aqadmin.dll
[2010/03/20 22:12:27 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0804.dll
[2010/03/20 22:12:27 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0412.dll
[2010/03/20 22:12:27 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0411.dll
[2010/03/20 22:12:27 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt040d.dll
[2010/03/20 22:12:27 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0404.dll
[2010/03/20 22:12:26 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\adrot.dll
[2010/03/20 22:12:26 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0401.dll
[2010/03/20 22:12:26 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\admxprox.dll
[2010/03/20 22:12:26 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_adsiisex.dll
[2010/03/20 22:12:22 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wamregps.dll
[2010/03/20 22:12:20 | 002,134,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_smtpsnap.dll
[2010/03/20 22:12:20 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_smtpadm.dll
[2010/03/20 22:12:10 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iisui.dll
[2010/03/20 22:12:10 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetsloc.dll
[2010/03/20 22:12:10 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iisreset.exe
[2010/03/20 22:12:10 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetmgr.exe
[2010/03/20 22:12:10 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iisrstap.dll
[2010/03/20 22:12:09 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ftpsapi2.dll
[2010/03/20 22:12:06 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\certmap.ocx
[2010/03/20 22:11:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom
[2010/03/20 22:11:55 | 000,000,000 | ---D | C] -- C:\Program Files\xerox
[2010/03/20 22:11:18 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mapi32.dll
[2010/03/20 22:11:06 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/03/20 22:11:06 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/03/20 22:10:33 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\All Users.WINDOWS\DRM
[2010/03/20 22:10:24 | 000,000,000 | --SD | C] -- C:\WINDOWS\Downloaded Program Files
[2010/03/20 22:10:24 | 000,000,000 | R--D | C] -- C:\WINDOWS\Offline Web Pages
[2010/03/20 22:09:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DirectX
[2010/03/20 22:09:24 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoobe.exe
[2010/03/20 22:09:22 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\safrslv.dll
[2010/03/20 22:09:22 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\safrcdlg.dll
[2010/03/20 22:09:22 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\racpldlg.dll
[2010/03/20 22:09:22 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\safrdm.dll
[2010/03/20 22:09:21 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helphost.exe
[2010/03/20 22:09:21 | 000,035,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\notiflag.exe
[2010/03/20 22:09:21 | 000,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\brpinfo.dll
[2010/03/20 22:09:21 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atrace.dll
[2010/03/20 22:09:21 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\atrace.dll
[2010/03/20 22:09:21 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hcappres.dll
[2010/03/20 22:09:12 | 000,047,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srdiag.exe
[2010/03/20 22:09:10 | 000,032,768 | ---- | C] (Intel Corporation) -- C:\WINDOWS\System32\isrdbg32.dll
[2010/03/20 22:09:10 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wb32.exe
[2010/03/20 22:09:10 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\nmevtmsg.dll
[2010/03/20 22:09:10 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmevtmsg.dll
[2010/03/20 22:09:10 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cb32.exe
[2010/03/20 22:09:09 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\acctres.dll
[2010/03/20 22:09:09 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\acctres.dll
[2010/03/20 22:09:09 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msinfo32.exe
[2010/03/20 22:09:08 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\inetres.dll
[2010/03/20 22:09:05 | 000,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\icwphbk.dll
[2010/03/20 22:09:05 | 000,000,000 | --SD | C] -- C:\WINDOWS\Tasks
[2010/03/20 22:09:04 | 000,274,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcfg.dll
[2010/03/20 22:09:04 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\isign32.dll
[2010/03/20 22:09:04 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\icwdial.dll
[2010/03/20 22:09:04 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\icfgnt5.dll
[2010/03/20 22:09:04 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icfgnt5.dll
[2010/03/20 22:09:03 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwtutor.exe
[2010/03/20 22:09:03 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwres.dll
[2010/03/20 22:09:03 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\trialoc.dll
[2010/03/20 22:09:03 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isignup.exe
[2010/03/20 22:09:02 | 000,235,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mssoap1.dll
[2010/03/20 22:09:02 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wisc10.dll
[2010/03/20 22:09:02 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mssoapr.dll
[2010/03/20 22:09:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MSSoap
[2010/03/20 22:09:00 | 000,093,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieinfo5.ocx
[2010/03/20 22:08:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\srchasst
[2010/03/20 22:08:56 | 000,520,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmpvis.dll
[2010/03/20 22:08:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Macromed
[2010/03/20 22:08:55 | 000,319,542 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmmres.dll
[2010/03/20 22:08:55 | 000,163,897 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmmutil.dll
[2010/03/20 22:08:55 | 000,110,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmmfilt.dll
[2010/03/20 22:08:55 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qmgrprxy.dll
[2010/03/20 22:08:54 | 000,000,000 | ---D | C] -- C:\Program Files\Movie Maker
[2010/03/20 22:08:49 | 000,239,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\srrstr.dll
[2010/03/20 22:08:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Restore
[2010/03/20 22:08:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\PCHealth
[2010/03/20 22:08:48 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ils.dll
[2010/03/20 22:08:48 | 000,034,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mnmdd.dll
[2010/03/20 22:08:47 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msconf.dll
[2010/03/20 22:08:47 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\nmmkcert.dll
[2010/03/20 22:08:45 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msoeacct.dll
[2010/03/20 22:08:45 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msoert2.dll
[2010/03/20 22:08:43 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mstinit.exe
[2010/03/20 22:08:23 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users.WINDOWS\Documents\My Pictures
[2010/03/20 22:08:23 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users.WINDOWS\Documents\My Music
[2010/03/20 22:07:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Registration
[2010/03/20 22:07:32 | 000,000,000 | -H-D | C] -- C:\Program Files\WindowsUpdate
[2010/03/20 22:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\Online Services
[2010/03/20 22:07:22 | 000,000,000 | ---D | C] -- C:\Program Files\Messenger
[2010/03/20 22:07:20 | 001,817,687 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bckgres.dll
[2010/03/20 22:07:20 | 000,082,501 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bckg.dll
[2010/03/20 22:07:20 | 000,042,577 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bckgzm.exe
[2010/03/20 22:07:19 | 002,178,131 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shvlres.dll
[2010/03/20 22:07:19 | 000,780,885 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chkrres.dll
[2010/03/20 22:07:19 | 000,753,236 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rvseres.dll
[2010/03/20 22:07:19 | 000,066,113 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shvl.dll
[2010/03/20 22:07:19 | 000,048,706 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rvse.dll
[2010/03/20 22:07:19 | 000,042,575 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chkrzm.exe
[2010/03/20 22:07:19 | 000,042,574 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rvsezm.exe
[2010/03/20 22:07:19 | 000,042,573 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shvlzm.exe
[2010/03/20 22:07:19 | 000,040,515 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chkr.dll
[2010/03/20 22:07:18 | 001,175,635 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hrtzres.dll
[2010/03/20 22:07:18 | 000,057,409 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hrtz.dll
[2010/03/20 22:07:18 | 000,042,573 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hrtzzm.exe
[2010/03/20 22:07:18 | 000,041,029 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zcorem.dll
[2010/03/20 22:07:18 | 000,032,339 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\uniansi.dll
[2010/03/20 22:07:18 | 000,013,894 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zonelibm.dll
[2010/03/20 22:07:18 | 000,004,677 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zeeverm.dll
[2010/03/20 22:07:17 | 001,039,955 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cmnresm.dll
[2010/03/20 22:07:17 | 000,217,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cmnclim.dll
[2010/03/20 22:07:17 | 000,113,222 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zoneclim.dll
[2010/03/20 22:07:16 | 000,036,937 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zclientm.exe
[2010/03/20 22:07:16 | 000,029,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\znetm.dll
[2010/03/20 22:07:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\write.exe
[2010/03/20 22:07:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\write.exe
[2010/03/20 22:07:16 | 000,000,000 | ---D | C] -- C:\Program Files\MSN Gaming Zone
[2010/03/20 22:07:10 | 000,183,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\accwiz.exe
[2010/03/20 22:07:10 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\access.cpl
[2010/03/20 22:07:09 | 000,345,088 | ---- | C] (Hilgraeve, Inc.) -- C:\WINDOWS\System32\hypertrm.dll
[2010/03/20 22:07:09 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\sndvol32.exe
[2010/03/20 22:07:09 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sndvol32.exe
[2010/03/20 22:07:09 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\sndrec32.exe
[2010/03/20 22:07:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avwav.dll
[2010/03/20 22:07:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\avwav.dll
[2010/03/20 22:07:09 | 000,044,544 | ---- | C] (Hilgraeve, Inc.) -- C:\WINDOWS\System32\hticons.dll
[2010/03/20 22:07:09 | 000,013,312 | ---- | C] (Hilgraeve, Inc.) -- C:\WINDOWS\System32\dllcache\htrn_jis.dll
[2010/03/20 22:07:08 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avtapi.dll
[2010/03/20 22:07:08 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\avtapi.dll
[2010/03/20 22:07:08 | 000,035,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\winchat.exe
[2010/03/20 22:07:08 | 000,035,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winchat.exe
[2010/03/20 22:07:08 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avmeter.dll
[2010/03/20 22:07:08 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\avmeter.dll
[2010/03/20 22:07:01 | 000,605,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\getuname.dll
[2010/03/20 22:07:01 | 000,605,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\getuname.dll
[2010/03/20 22:07:01 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\calc.exe
[2010/03/20 22:07:01 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\calc.exe
[2010/03/20 22:07:01 | 000,080,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\charmap.exe
[2010/03/20 22:07:01 | 000,080,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\charmap.exe
[2010/03/20 22:07:00 | 000,126,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mshearts.exe
[2010/03/20 22:07:00 | 000,126,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshearts.exe
[2010/03/20 22:07:00 | 000,119,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\winmine.exe
[2010/03/20 22:07:00 | 000,119,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winmine.exe
[2010/03/20 22:07:00 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\sol.exe
[2010/03/20 22:07:00 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sol.exe
[2010/03/20 22:06:59 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdshost.exe
[2010/03/20 22:06:59 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\freecell.exe
[2010/03/20 22:06:59 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\freecell.exe
[2010/03/20 22:06:59 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tsshutdn.exe
[2010/03/20 22:06:59 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tsshutdn.exe
[2010/03/20 22:06:59 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tskill.exe
[2010/03/20 22:06:59 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tskill.exe
[2010/03/20 22:06:59 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rwinsta.exe
[2010/03/20 22:06:59 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rwinsta.exe
[2010/03/20 22:06:59 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tsdiscon.exe
[2010/03/20 22:06:59 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tsdiscon.exe
[2010/03/20 22:06:59 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tscon.exe
[2010/03/20 22:06:59 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tscon.exe
[2010/03/20 22:06:59 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\shadow.exe
[2010/03/20 22:06:59 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shadow.exe
[2010/03/20 22:06:59 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\reset.exe
[2010/03/20 22:06:59 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\reset.exe
[2010/03/20 22:06:58 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdtcuiu.dll
[2010/03/20 22:06:58 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\regini.exe
[2010/03/20 22:06:58 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\regini.exe
[2010/03/20 22:06:58 | 000,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qwinsta.exe
[2010/03/20 22:06:58 | 000,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qwinsta.exe
[2010/03/20 22:06:58 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msg.exe
[2010/03/20 22:06:58 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msg.exe
[2010/03/20 22:06:58 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qprocess.exe
[2010/03/20 22:06:58 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qappsrv.exe
[2010/03/20 22:06:58 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qappsrv.exe
[2010/03/20 22:06:58 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cdmodem.dll
[2010/03/20 22:06:58 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\cdmodem.dll
[2010/03/20 22:06:58 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\logoff.exe
[2010/03/20 22:06:58 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\logoff.exe
[2010/03/20 22:06:58 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdpcfgex.dll
[2010/03/20 22:06:58 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpcfgex.dll
[2010/03/20 22:06:57 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdtctm.dll
[2010/03/20 22:06:57 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mtxoci.dll
[2010/03/20 22:06:57 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdtclog.dll
[2010/03/20 22:06:57 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xolehlp.dll
[2010/03/20 22:06:56 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtsadmin.tlb
[2010/03/20 22:06:56 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comrereg.exe
[2010/03/20 22:06:55 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comrepl.dll
[2010/03/20 22:06:55 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comrepl.dll
[2010/03/20 22:06:55 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\colbact.dll
[2010/03/20 22:06:55 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\stclient.dll
[2010/03/20 22:06:55 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\stclient.dll
[2010/03/20 22:06:55 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comaddin.dll
[2010/03/20 22:06:55 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comaddin.dll
[2010/03/20 22:06:55 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mtxlegih.dll
[2010/03/20 22:06:55 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtxlegih.dll
[2010/03/20 22:06:55 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mtxdm.dll
[2010/03/20 22:06:55 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtxdm.dll
[2010/03/20 22:06:55 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dcomcnfg.exe
[2010/03/20 22:06:55 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dcomcnfg.exe
[2010/03/20 22:06:55 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mtxex.dll
[2010/03/20 22:06:55 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtxex.dll
[2010/03/20 22:06:54 | 000,540,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comuid.dll
[2010/03/20 22:06:54 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\catsrv.dll
[2010/03/20 22:06:54 | 000,147,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comsnap.dll
[2010/03/20 22:06:54 | 000,147,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comsnap.dll
[2010/03/20 22:06:54 | 000,110,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\clbcatex.dll
[2010/03/20 22:06:54 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\catsrvps.dll
[2010/03/20 22:06:53 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmi2xml.dll
[2010/03/20 22:06:49 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmipicmp.dll
[2010/03/20 22:06:49 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmimsg.dll
[2010/03/20 22:06:49 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmitimep.dll
[2010/03/20 22:06:48 | 000,116,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\updprov.dll
[2010/03/20 22:06:48 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tmplprov.dll
[2010/03/20 22:06:48 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemdisp.tlb
[2010/03/20 22:06:48 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\trnsprov.dll
[2010/03/20 22:06:48 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemads.tlb
[2010/03/20 22:06:48 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\unsecapp.exe
[2010/03/20 22:06:48 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winmgmtr.dll
[2010/03/20 22:06:48 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winmgmt.exe
[2010/03/20 22:06:48 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemads.dll
[2010/03/20 22:06:47 | 000,273,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msiprov.dll
[2010/03/20 22:06:47 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smtpcons.dll
[2010/03/20 22:06:46 | 000,120,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsprov.dll
[2010/03/20 22:06:46 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fwdprov.dll
[2010/03/20 22:06:45 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\cmprops.dll
[2010/03/20 22:06:45 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\servdeps.dll
[2010/03/20 22:06:45 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mmfutil.dll
[2010/03/20 22:06:39 | 000,000,000 | ---D | C] -- C:\Program Files\MSN
[2010/03/20 22:06:38 | 000,538,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spider.exe
[2010/03/20 22:06:38 | 000,343,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mspaint.exe
[2010/03/20 22:06:38 | 000,123,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mplay32.exe
[2010/03/20 22:06:38 | 000,102,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\clipbrd.exe
[2010/03/20 22:06:37 | 001,929,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaueng.dll
[2010/03/20 22:06:37 | 000,093,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tscfgwmi.dll
[2010/03/20 22:06:37 | 000,053,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuauclt.exe
[2010/03/20 22:06:36 | 000,147,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdchost.dll
[2010/03/20 22:06:36 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tscupgrd.exe
[2010/03/20 22:06:36 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdsaddin.exe
[2010/03/20 22:06:35 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdtcprx.dll
[2010/03/20 22:06:35 | 000,087,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdpwsx.dll
[2010/03/20 22:06:35 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdpclip.exe
[2010/03/20 22:06:35 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\cfgbkend.dll
[2010/03/20 22:06:35 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdpsnd.dll
[2010/03/20 22:06:35 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\icaapi.dll
[2010/03/20 22:06:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MsDtc
[2010/03/20 22:06:34 | 001,251,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comsvcs.dll
[2010/03/20 22:06:34 | 000,628,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\catsrvut.dll
[2010/03/20 22:06:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Com
[2010/03/20 22:06:28 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\licwmi.dll
[2010/03/20 22:06:20 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users.WINDOWS\Documents\My Videos
[2010/03/20 21:41:30 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2010/03/20 21:37:26 | 000,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2010/03/20 21:36:03 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Player
[2010/03/20 21:35:58 | 000,000,000 | ---D | C] -- C:\Program Files\NetMeeting
[2010/03/20 21:35:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Services
[2010/03/20 21:35:51 | 000,000,000 | ---D | C] -- C:\Program Files\Outlook Express
[2010/03/20 21:35:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\System
[2010/03/20 21:35:32 | 000,000,000 | ---D | C] -- C:\Program Files\Internet Explorer
[2010/03/20 21:35:24 | 000,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications
[2010/03/20 17:03:59 | 000,014,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\battc.sys
[2010/03/20 17:01:36 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\spcommon.dll
[2010/03/20 17:01:36 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\spcplui.dll
[2010/03/20 17:01:35 | 000,774,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\spttseng.dll
[2010/03/20 17:01:34 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sapisvr.exe
[2010/03/20 17:01:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SpeechEngines
[2010/03/20 17:01:31 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt041f.dll
[2010/03/20 17:01:30 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0419.dll
[2010/03/20 17:01:30 | 000,006,144 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdtuq.dll
[2010/03/20 17:01:30 | 000,006,144 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdtuf.dll
[2010/03/20 17:01:30 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdtuq.dll
[2010/03/20 17:01:30 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdtuf.dll
[2010/03/20 17:01:30 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdazel.dll
[2010/03/20 17:01:30 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdazel.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdycc.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbduzb.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdur.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdtat.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdru1.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdru.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdmon.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdkyr.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdkaz.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdbu.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdblr.dll
[2010/03/20 17:01:28 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdaze.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdycc.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbduzb.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdur.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdtat.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdru1.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdru.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdmon.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdkyr.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdkaz.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdbu.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdblr.dll
[2010/03/20 17:01:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdaze.dll
[2010/03/20 17:01:27 | 000,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0408.dll
[2010/03/20 17:01:26 | 000,008,192 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdhept.dll
[2010/03/20 17:01:26 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhept.dll
[2010/03/20 17:01:26 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdhela3.dll
[2010/03/20 17:01:26 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhela3.dll
[2010/03/20 17:01:26 | 000,006,144 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdhela2.dll
[2010/03/20 17:01:26 | 000,006,144 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdgkl.dll
[2010/03/20 17:01:26 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhela2.dll
[2010/03/20 17:01:26 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdgkl.dll
[2010/03/20 17:01:26 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdhe319.dll
[2010/03/20 17:01:26 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdhe220.dll
[2010/03/20 17:01:26 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdhe.dll
[2010/03/20 17:01:26 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhe319.dll
[2010/03/20 17:01:26 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhe220.dll
[2010/03/20 17:01:26 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhe.dll
[2010/03/20 17:01:24 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt040e.dll
[2010/03/20 17:01:24 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0415.dll
[2010/03/20 17:01:24 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0405.dll
[2010/03/20 17:01:24 | 000,006,144 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdlv1.dll
[2010/03/20 17:01:24 | 000,006,144 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdlv.dll
[2010/03/20 17:01:24 | 000,006,144 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdest.dll
[2010/03/20 17:01:24 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdlv1.dll
[2010/03/20 17:01:24 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdlv.dll
[2010/03/20 17:01:24 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdest.dll
[2010/03/20 17:01:24 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdlt1.dll
[2010/03/20 17:01:24 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdlt.dll
[2010/03/20 17:01:24 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdlt1.dll
[2010/03/20 17:01:24 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdlt.dll
[2010/03/20 17:01:22 | 000,007,168 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdcz.dll
[2010/03/20 17:01:22 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdcz.dll
[2010/03/20 17:01:22 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdycl.dll
[2010/03/20 17:01:22 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdsl1.dll
[2010/03/20 17:01:22 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdsl.dll
[2010/03/20 17:01:22 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdpl.dll
[2010/03/20 17:01:22 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdhu.dll
[2010/03/20 17:01:22 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdcz2.dll
[2010/03/20 17:01:22 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdcz1.dll
[2010/03/20 17:01:22 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdcr.dll
[2010/03/20 17:01:22 | 000,006,656 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\KBDAL.DLL
[2010/03/20 17:01:22 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdycl.dll
[2010/03/20 17:01:22 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdsl1.dll
[2010/03/20 17:01:22 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdsl.dll
[2010/03/20 17:01:22 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdpl.dll
[2010/03/20 17:01:22 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhu.dll
[2010/03/20 17:01:22 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdcz2.dll
[2010/03/20 17:01:22 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdcz1.dll
[2010/03/20 17:01:22 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdcr.dll
[2010/03/20 17:01:22 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdal.dll
[2010/03/20 17:01:22 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdro.dll
[2010/03/20 17:01:22 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdpl1.dll
[2010/03/20 17:01:22 | 000,005,632 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdhu1.dll
[2010/03/20 17:01:22 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdro.dll
[2010/03/20 17:01:22 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdpl1.dll
[2010/03/20 17:01:22 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhu1.dll
[2010/03/20 17:01:20 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\irclass.dll
[2010/03/20 17:01:20 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\irclass.dll
[2010/03/20 17:01:19 | 000,176,157 | ---- | C] (Digi International, Inc.) -- C:\WINDOWS\System32\dllcache\dgrpsetu.dll
[2010/03/20 17:01:19 | 000,176,157 | ---- | C] (Digi International, Inc.) -- C:\WINDOWS\System32\dgrpsetu.dll
[2010/03/20 17:01:19 | 000,103,424 | ---- | C] (Equinox Systems Inc.) -- C:\WINDOWS\System32\EqnClass.Dll
[2010/03/20 17:01:19 | 000,103,424 | ---- | C] (Equinox Systems Inc.) -- C:\WINDOWS\System32\dllcache\eqnclass.dll
[2010/03/20 17:01:19 | 000,085,020 | ---- | C] (Digi International) -- C:\WINDOWS\System32\dllcache\dgsetup.dll
[2010/03/20 17:01:19 | 000,085,020 | ---- | C] (Digi International) -- C:\WINDOWS\System32\dgsetup.dll
[2010/03/20 17:01:19 | 000,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\WINDOWS\System32\spxcoins.dll
[2010/03/20 17:01:19 | 000,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\WINDOWS\System32\dllcache\spxcoins.dll
[2010/03/20 17:01:19 | 000,013,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wfwnet.drv
[2010/03/20 17:01:19 | 000,013,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\WFWNET.DRV
[2010/03/20 17:01:19 | 000,009,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ver.dll
[2010/03/20 17:01:19 | 000,009,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\VER.DLL
[2010/03/20 17:01:19 | 000,004,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\timer.drv
[2010/03/20 17:01:19 | 000,004,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\TIMER.DRV
[2010/03/20 17:01:19 | 000,002,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vga.drv
[2010/03/20 17:01:19 | 000,002,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\VGA.DRV
[2010/03/20 17:01:18 | 000,126,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msvideo.dll
[2010/03/20 17:01:18 | 000,126,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\MSVIDEO.DLL
[2010/03/20 17:01:18 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\olecli.dll
[2010/03/20 17:01:18 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\OLECLI.DLL
[2010/03/20 17:01:18 | 000,068,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\mmsystem.dll
[2010/03/20 17:01:18 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\olesvr.dll
[2010/03/20 17:01:18 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\OLESVR.DLL
[2010/03/20 17:01:18 | 000,019,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tapi.dll
[2010/03/20 17:01:18 | 000,019,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\TAPI.DLL
[2010/03/20 17:01:18 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell.dll
[2010/03/20 17:01:18 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\SHELL.DLL
[2010/03/20 17:01:18 | 000,003,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\system.drv
[2010/03/20 17:01:18 | 000,003,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\SYSTEM.DRV
[2010/03/20 17:01:18 | 000,002,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mouse.drv
[2010/03/20 17:01:18 | 000,002,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\MOUSE.DRV
[2010/03/20 17:01:18 | 000,001,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sound.drv
[2010/03/20 17:01:18 | 000,001,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\SOUND.DRV
[2010/03/20 17:01:18 | 000,001,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mmtask.tsk
[2010/03/20 17:01:18 | 000,001,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\MMTASK.TSK
[2010/03/20 17:01:17 | 000,109,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avifile.dll
[2010/03/20 17:01:17 | 000,109,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\AVIFILE.DLL
[2010/03/20 17:01:17 | 000,073,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mciavi.drv
[2010/03/20 17:01:17 | 000,073,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\MCIAVI.DRV
[2010/03/20 17:01:17 | 000,069,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avicap.dll
[2010/03/20 17:01:17 | 000,069,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\AVICAP.DLL
[2010/03/20 17:01:17 | 000,032,816 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\commdlg.dll
[2010/03/20 17:01:17 | 000,032,816 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\COMMDLG.DLL
[2010/03/20 17:01:17 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mciwave.drv
[2010/03/20 17:01:17 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\MCIWAVE.DRV
[2010/03/20 17:01:17 | 000,025,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mciseq.drv
[2010/03/20 17:01:17 | 000,025,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\MCISEQ.DRV
[2010/03/20 17:01:17 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\TASKMAN.EXE
[2010/03/20 17:01:17 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\taskman.exe
[2010/03/20 17:01:17 | 000,009,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lzexpand.dll
[2010/03/20 17:01:17 | 000,009,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\LZEXPAND.DLL
[2010/03/20 17:01:17 | 000,002,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\keyboard.drv
[2010/03/20 17:01:17 | 000,002,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\KEYBOARD.DRV
[2010/03/20 17:01:16 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\winspool.drv
[2010/03/20 17:01:16 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\storprop.dll
[2010/03/20 17:01:16 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\batt.dll
[2010/03/20 17:01:06 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu
[2010/03/20 17:01:06 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users.WINDOWS\Documents
[2010/03/20 17:01:06 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users.WINDOWS\Templates
[2010/03/20 17:01:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Favorites
[2010/03/20 17:01:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Desktop
[2010/03/20 17:00:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot2
[2010/03/20 17:00:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot
[2010/03/20 17:00:43 | 000,000,000 | --SD | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft
[2010/03/20 17:00:43 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data
[2010/03/20 16:54:42 | 000,000,000 | R-SD | C] -- C:\WINDOWS\Fonts
[2010/03/20 16:54:42 | 000,000,000 | RHSD | C] -- C:\WINDOWS\System32\dllcache
[2010/03/20 16:54:42 | 000,000,000 | R--D | C] -- C:\WINDOWS\Web
[2010/03/20 16:54:42 | 000,000,000 | -H-D | C] -- C:\WINDOWS\inf
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\WinSxS
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wins
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wbem
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\usmt
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\twain_32
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Temp
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\system32
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\system
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\spool
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ShellExt
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Setup
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\security
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Resources
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\repair
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ras
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\oobe
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\npp
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\mui
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\mui
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\msapps
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\msagent
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Media
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\java
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\inetsrv
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\IME
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\ime
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\icsxml
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ias
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Help
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\export
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\etc
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Driver Cache
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\disdn
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\dhcp
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Debug
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Cursors
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Connection Wizard
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\config
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\Config
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\AppPatch
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\addins
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3com_dmi
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3076
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\2052
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1054
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1042
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1041
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1037
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1033
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1031
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1028
[2010/03/20 16:54:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1025
[2010/03/20 16:34:09 | 000,000,000 | ---D | C] -- C:\Program Files\Accessories
[2010/03/20 16:34:07 | 000,000,000 | ---D | C] -- C:\Program Files\Windows NT
[2010/03/20 16:17:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
[2010/03/20 16:17:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Microsoft Shared
[2010/03/20 16:17:08 | 000,000,000 | R--D | C] -- C:\Program Files
[2010/03/20 16:17:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files
[2010/03/20 16:16:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings
[2010/03/20 16:13:19 | 000,000,000 | ---D | C] -- C:\WINNT

========== Files - Modified Within 30 Days ==========

[2010/04/05 21:56:50 | 000,000,302 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job
[2010/04/05 21:56:44 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2010/04/05 21:56:14 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/05 21:56:06 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/05 21:53:57 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Sheila\ntuser.ini
[2010/04/05 21:53:56 | 001,835,008 | -H-- | M] () -- C:\Documents and Settings\Sheila\NTUSER.DAT
[2010/04/05 21:47:11 | 000,055,580 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\DealExtreme Shopping Cart - great design, price and selection on cool gadgets_.htm
[2010/04/05 21:46:58 | 000,530,719 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\My Cart - DinoDirect_com.mht
[2010/04/05 19:20:15 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/04/05 19:19:10 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/04/05 17:35:59 | 000,000,374 | RHS- | M] () -- C:\boot.ini
[2010/04/05 09:14:30 | 003,752,746 | -H-- | M] () -- C:\Documents and Settings\Sheila\Local Settings\Application Data\IconCache.db
[2010/04/05 07:15:30 | 003,907,460 | R--- | M] () -- C:\Documents and Settings\Sheila\Desktop\Combo-Fix.exe
[2010/04/04 21:13:37 | 000,436,896 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\Malware and Spyware Cleaning Guide.mht
[2010/04/04 20:43:01 | 000,001,984 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Norton Internet Security.LNK
[2010/04/04 20:42:17 | 001,143,216 | ---- | M] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\Cat.DB
[2010/04/04 20:39:31 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\OTL.exe
[2010/04/04 20:36:50 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Sheila\Desktop\erunt_setup.exe
[2010/04/04 20:36:29 | 000,444,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sheila\Desktop\TFC.exe
[2010/04/04 20:28:05 | 000,465,298 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\RootRepeal.rar
[2010/04/04 15:36:36 | 000,018,944 | ---- | M] () -- C:\Documents and Settings\Sheila\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/04 11:20:36 | 080,938,247 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\Norton AntiVirus 2010 17.0.0.136 Final.zip
[2010/04/04 11:15:58 | 000,124,976 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/04/04 11:15:58 | 000,060,808 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/04/04 11:15:58 | 000,007,443 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/04/04 11:15:58 | 000,000,805 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/04/03 14:55:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/04/03 01:09:53 | 000,106,618 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\25913_414864686048_561816048_5318925_1750788_n[1].jpg
[2010/04/02 08:22:20 | 000,000,732 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Acrobat_com.lnk
[2010/04/02 08:20:11 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Adobe Reader 9.lnk
[2010/04/02 08:16:00 | 000,311,620 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\CocoRice_LunchSpecial.pdf
[2010/04/01 21:51:02 | 002,125,517 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Super_Fun_Sudoku[EUR][ESPALNDS.com].zip
[2010/04/01 20:55:56 | 053,010,083 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]The Legend Of Zelda Phantom Hourglass [EUR][NeoGamersX.CoM].zip
[2010/04/01 20:46:52 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]SimCity_Creator[EUR][ESPALNDS.com].zip
[2010/04/01 20:39:42 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Prism_Light_the_Way[USA][ESPALNDS.com].zip
[2010/04/01 20:38:27 | 031,633,119 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]TouchMaster_2[USA][ESPALNDS.com].zip
[2010/04/01 20:29:20 | 065,787,272 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Professor_Layton_And_The_Curious_Village[EUR][REPACK][ESPALNDS.com].zip
[2010/03/31 17:38:02 | 000,001,148 | -H-- | M] () -- C:\Documents and Settings\Sheila\My Documents\Default.rdp
[2010/03/31 10:30:18 | 000,000,598 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Shortcut to Quest Connect Canada.lnk
[2010/03/30 22:05:16 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\dds.scr
[2010/03/30 00:46:30 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/30 00:45:52 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/28 08:37:07 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\Sheila\Desktop\gmer.zip
[2010/03/26 20:28:52 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/25 21:59:48 | 000,000,780 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\FastStone Image Viewer.lnk
[2010/03/25 21:57:28 | 000,308,453 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\5x7_DSC3075.JPG
[2010/03/25 21:55:45 | 008,702,828 | ---- | M] () -- C:\Documents and Settings\Sheila\My Documents\5x7_DSC3075.tif
[2010/03/24 05:28:38 | 000,508,956 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/24 05:28:38 | 000,433,566 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/24 05:28:38 | 000,068,164 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/24 05:13:46 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/03/23 22:16:34 | 000,000,570 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/03/22 23:55:41 | 000,095,072 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/03/21 23:29:20 | 000,000,493 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Digital Line Detect.lnk
[2010/03/21 23:25:29 | 000,000,303 | ---- | M] () -- C:\Boot.bak
[2010/03/21 22:57:36 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\AccConnAdvanced.html
[2010/03/21 22:34:23 | 000,013,104 | ---- | M] () -- C:\Documents and Settings\Sheila\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/03/21 22:33:19 | 000,000,000 | ---- | M] () -- C:\WINDOWS\ativpsrm.bin
[2010/03/21 20:05:09 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010/03/21 19:33:55 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2010/03/21 19:33:55 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2010/03/20 23:34:28 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/03/20 22:26:00 | 000,025,065 | ---- | M] () -- C:\WINDOWS\System32\wmpscheme.xml
[2010/03/20 22:15:42 | 000,008,192 | ---- | M] () -- C:\WINDOWS\REGLOCS.OLD
[2010/03/20 22:14:17 | 000,000,558 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2010/03/20 22:11:33 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/03/20 22:11:33 | 000,000,000 | ---- | M] () -- C:\WINDOWS\control.ini
[2010/03/20 22:11:31 | 000,299,552 | ---- | M] () -- C:\WINDOWS\WMSysPrx.prx
[2010/03/20 22:11:31 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2010/03/20 22:11:31 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2010/03/20 22:11:18 | 000,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2010/03/20 22:10:23 | 000,000,488 | RH-- | M] () -- C:\WINDOWS\System32\WindowsLogon.manifest
[2010/03/20 22:10:23 | 000,000,488 | RH-- | M] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\WindowsShell.Manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2010/03/20 22:08:02 | 000,021,640 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/03/20 22:07:47 | 000,000,037 | ---- | M] () -- C:\WINDOWS\vbaddin.ini
[2010/03/20 22:07:47 | 000,000,036 | ---- | M] () -- C:\WINDOWS\vb.ini
[2010/03/20 21:36:55 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/03/20 21:36:55 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/03/20 21:36:55 | 000,000,000 | -H-- | M] () -- C:\CONFIG.SYS
[2010/03/20 21:36:55 | 000,000,000 | -H-- | M] () -- C:\AUTOEXEC.BAT
[2010/03/20 21:36:14 | 000,021,952 | -H-- | M] () -- C:\Program Files\folder.htt
[2010/03/12 18:02:38 | 000,261,632 | ---- | M] () -- C:\WINDOWS\PEV.exe

========== Files Created - No Company Name ==========

[2010/04/05 21:47:11 | 000,055,580 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\DealExtreme Shopping Cart - great design, price and selection on cool gadgets_.htm
[2010/04/05 21:46:54 | 000,530,719 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\My Cart - DinoDirect_com.mht
[2010/04/05 17:35:59 | 000,000,303 | ---- | C] () -- C:\Boot.bak
[2010/04/05 17:35:55 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/04/05 07:38:43 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/04/05 07:38:43 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/04/05 07:38:43 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/04/05 07:38:43 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/04/05 07:38:43 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/04/05 07:15:16 | 003,907,460 | R--- | C] () -- C:\Documents and Settings\Sheila\Desktop\Combo-Fix.exe
[2010/04/04 21:13:29 | 000,436,896 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\Malware and Spyware Cleaning Guide.mht
[2010/04/04 20:41:56 | 001,143,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\Cat.DB
[2010/04/04 20:28:02 | 000,465,298 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\RootRepeal.rar
[2010/04/04 20:26:25 | 000,007,787 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symnetv.cat
[2010/04/04 20:26:25 | 000,007,444 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symefa.cat
[2010/04/04 20:26:25 | 000,007,425 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symds.cat
[2010/04/04 20:26:25 | 000,007,368 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symnet.cat
[2010/04/04 20:26:25 | 000,003,374 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symefa.inf
[2010/04/04 20:26:25 | 000,002,793 | R--- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symds.inf
[2010/04/04 20:26:25 | 000,001,473 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symnetv.inf
[2010/04/04 20:26:25 | 000,001,445 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\symnet.inf
[2010/04/04 20:26:24 | 000,007,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtspx.cat
[2010/04/04 20:26:24 | 000,007,438 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtsp.cat
[2010/04/04 20:26:24 | 000,007,438 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\iron.cat
[2010/04/04 20:26:24 | 000,007,396 | R--- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\cchpx86.cat
[2010/04/04 20:26:24 | 000,001,756 | R--- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\cchpx86.inf
[2010/04/04 20:26:24 | 000,001,388 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtspx.inf
[2010/04/04 20:26:24 | 000,001,382 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\srtsp.inf
[2010/04/04 20:26:24 | 000,000,742 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\iron.inf
[2010/04/04 20:25:50 | 000,000,172 | ---- | C] () -- C:\WINDOWS\System32\drivers\NIS\1105000.07F\isolate.ini
[2010/04/04 11:20:21 | 080,938,247 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\Norton AntiVirus 2010 17.0.0.136 Final.zip
[2010/04/04 11:15:58 | 000,007,443 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/04/04 11:15:58 | 000,000,805 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/04/04 11:15:47 | 000,001,984 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Norton Internet Security.LNK
[2010/04/03 01:11:55 | 000,106,618 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\25913_414864686048_561816048_5318925_1750788_n[1].jpg
[2010/04/02 08:20:09 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Adobe Reader 9.lnk
[2010/04/02 08:18:52 | 000,000,732 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Acrobat_com.lnk
[2010/04/02 08:15:58 | 000,311,620 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\CocoRice_LunchSpecial.pdf
[2010/04/01 21:18:11 | 002,125,517 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Super_Fun_Sudoku[EUR][ESPALNDS.com].zip
[2010/04/01 20:50:02 | 053,010,083 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]The Legend Of Zelda Phantom Hourglass [EUR][NeoGamersX.CoM].zip
[2010/04/01 20:46:52 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]SimCity_Creator[EUR][ESPALNDS.com].zip
[2010/04/01 20:39:42 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Prism_Light_the_Way[USA][ESPALNDS.com].zip
[2010/04/01 20:31:45 | 031,633,119 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]TouchMaster_2[USA][ESPALNDS.com].zip
[2010/04/01 20:23:14 | 065,787,272 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\[NDS]Professor_Layton_And_The_Curious_Village[EUR][REPACK][ESPALNDS.com].zip
[2010/03/31 10:32:22 | 000,001,148 | -H-- | C] () -- C:\Documents and Settings\Sheila\My Documents\Default.rdp
[2010/03/31 10:30:18 | 000,000,598 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Shortcut to Quest Connect Canada.lnk
[2010/03/30 22:05:15 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\dds.scr
[2010/03/28 08:37:02 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\Sheila\Desktop\gmer.zip
[2010/03/26 20:28:51 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/25 22:24:56 | 000,018,944 | ---- | C] () -- C:\Documents and Settings\Sheila\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/25 21:59:48 | 000,000,780 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\FastStone Image Viewer.lnk
[2010/03/25 21:57:23 | 000,308,453 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\5x7_DSC3075.JPG
[2010/03/25 21:54:07 | 008,702,828 | ---- | C] () -- C:\Documents and Settings\Sheila\My Documents\5x7_DSC3075.tif
[2010/03/22 23:54:23 | 000,158,888 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/03/22 23:50:24 | 000,000,260 | ---- | C] () -- C:\WINDOWS\tasks\WGASetup.job
[2010/03/21 23:29:20 | 000,000,493 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Digital Line Detect.lnk
[2010/03/21 23:28:40 | 000,141,392 | ---- | C] () -- C:\WINDOWS\System32\drivers\HSFProf.cty
[2010/03/21 22:57:48 | 000,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.sys
[2010/03/21 22:57:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\AccConnAdvanced.html
[2010/03/21 22:43:42 | 000,000,302 | ---- | C] () -- C:\WINDOWS\tasks\PMTask.job
[2010/03/21 22:43:25 | 000,196,608 | ---- | C] () -- C:\WINDOWS\PWMBTHLP.EXE
[2010/03/21 22:43:24 | 000,004,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2010/03/21 22:33:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010/03/21 19:38:17 | 000,316,640 | ---- | C] () -- C:\WINDOWS\WMSysPr9.prx
[2010/03/21 19:37:37 | 000,239,616 | ---- | C] () -- C:\WINDOWS\System32\wstrenderer.ax
[2010/03/21 19:37:37 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\wstpager.ax
[2010/03/21 19:37:37 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\vbicodec.ax
[2010/03/21 19:37:33 | 000,129,045 | ---- | C] () -- C:\WINDOWS\System32\drivers\cxthsfs2.cty
[2010/03/21 19:37:33 | 000,064,352 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativmc20.cod
[2010/03/21 19:37:32 | 000,067,866 | ---- | C] () -- C:\WINDOWS\System32\drivers\netwlan5.img
[2010/03/21 19:37:27 | 000,118,272 | ---- | C] () -- C:\WINDOWS\System32\mpeg2data.ax
[2010/03/20 23:34:28 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/03/20 23:17:04 | 000,010,134 | ---- | C] () -- C:\WINDOWS\SetupIcon.ico
[2010/03/20 23:17:00 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2010/03/20 23:17:00 | 000,262,216 | ---- | C] () -- C:\WINDOWS\System32\IPTests.dll
[2010/03/20 23:17:00 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2010/03/20 23:16:21 | 000,029,976 | ---- | C] () -- C:\WINDOWS\System32\wsimdp.cat
[2010/03/20 23:16:21 | 000,029,974 | ---- | C] () -- C:\WINDOWS\System32\wsimd.cat
[2010/03/20 23:16:21 | 000,005,363 | ---- | C] () -- C:\WINDOWS\System32\wsimdp.inf
[2010/03/20 23:16:21 | 000,002,179 | ---- | C] () -- C:\WINDOWS\System32\wsimd.inf
[2010/03/20 23:16:20 | 000,159,793 | ---- | C] () -- C:\WINDOWS\System32\netathw.inf
[2010/03/20 23:16:20 | 000,039,177 | ---- | C] () -- C:\WINDOWS\System32\netathw.cat
[2010/03/20 22:51:48 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010/03/20 22:51:48 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010/03/20 22:51:48 | 000,152,496 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.cap
[2010/03/20 22:51:46 | 000,015,577 | ---- | C] () -- C:\WINDOWS\atiogl.xml
[2010/03/20 22:51:45 | 000,189,051 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010/03/20 22:51:45 | 000,007,167 | ---- | C] () -- C:\WINDOWS\System32\atifglpf.xml
[2010/03/20 22:25:42 | 000,001,024 | -H-- | C] () -- C:\Documents and Settings\Sheila\ntuser.dat.LOG
[2010/03/20 22:25:42 | 000,000,178 | -HS- | C] () -- C:\Documents and Settings\Sheila\ntuser.ini
[2010/03/20 22:25:41 | 001,835,008 | -H-- | C] () -- C:\Documents and Settings\Sheila\NTUSER.DAT
[2010/03/20 22:15:42 | 000,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD
[2010/03/20 22:14:13 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/03/20 22:13:38 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2010/03/20 22:13:18 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2010/03/20 22:13:11 | 000,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2010/03/20 22:13:10 | 000,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2010/03/20 22:13:08 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2010/03/20 22:12:56 | 013,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2010/03/20 22:12:50 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2010/03/20 22:12:33 | 000,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2010/03/20 22:11:33 | 000,002,577 | ---- | C] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/03/20 22:11:32 | 000,025,065 | ---- | C] () -- C:\WINDOWS\System32\wmpscheme.xml
[2010/03/20 22:11:31 | 000,299,552 | ---- | C] () -- C:\WINDOWS\WMSysPrx.prx
[2010/03/20 22:11:31 | 000,023,392 | ---- | C] () -- C:\WINDOWS\System32\nscompat.tlb
[2010/03/20 22:11:31 | 000,016,832 | ---- | C] () -- C:\WINDOWS\System32\amcompat.tlb
[2010/03/20 22:10:23 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\WindowsLogon.manifest
[2010/03/20 22:10:23 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\WindowsShell.Manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2010/03/20 22:10:18 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2010/03/20 22:09:59 | 004,399,505 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nls302en.lex
[2010/03/20 22:09:18 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt256.bmp
[2010/03/20 22:09:18 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt.bmp
[2010/03/20 22:09:11 | 000,000,984 | ---- | C] () -- C:\WINDOWS\System32\dllcache\srframe.mmf
[2010/03/20 22:08:02 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/03/20 22:07:03 | 000,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp
[2010/03/20 22:07:03 | 000,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp
[2010/03/20 22:07:03 | 000,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp
[2010/03/20 22:07:03 | 000,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp
[2010/03/20 22:07:03 | 000,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp
[2010/03/20 22:07:03 | 000,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp
[2010/03/20 22:07:02 | 000,093,702 | ---- | C] () -- C:\WINDOWS\System32\subrange.uce
[2010/03/20 22:07:02 | 000,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp
[2010/03/20 22:07:02 | 000,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp
[2010/03/20 22:07:02 | 000,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp
[2010/03/20 22:07:02 | 000,016,740 | ---- | C] () -- C:\WINDOWS\System32\shiftjis.uce
[2010/03/20 22:07:02 | 000,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp
[2010/03/20 22:07:02 | 000,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp
[2010/03/20 22:07:01 | 000,060,458 | ---- | C] () -- C:\WINDOWS\System32\ideograf.uce
[2010/03/20 22:07:01 | 000,024,006 | ---- | C] () -- C:\WINDOWS\System32\gb2312.uce
[2010/03/20 22:07:01 | 000,022,984 | ---- | C] () -- C:\WINDOWS\System32\bopomofo.uce
[2010/03/20 22:07:01 | 000,012,876 | ---- | C] () -- C:\WINDOWS\System32\korean.uce
[2010/03/20 22:07:01 | 000,008,484 | ---- | C] () -- C:\WINDOWS\System32\kanji_2.uce
[2010/03/20 22:07:01 | 000,006,948 | ---- | C] () -- C:\WINDOWS\System32\kanji_1.uce
[2010/03/20 22:06:59 | 000,003,286 | ---- | C] () -- C:\WINDOWS\System32\tslabels.h
[2010/03/20 22:06:59 | 000,001,161 | ---- | C] () -- C:\WINDOWS\System32\usrlogon.cmd
[2010/03/20 22:06:57 | 000,000,768 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.h
[2010/03/20 22:06:46 | 000,063,488 | ---- | C] () -- C:\WINDOWS\System32\wmimgmt.msc
[2010/03/20 21:36:55 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2010/03/20 21:36:55 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2010/03/20 21:36:55 | 000,000,000 | -H-- | C] () -- C:\CONFIG.SYS
[2010/03/20 21:36:55 | 000,000,000 | -H-- | C] () -- C:\AUTOEXEC.BAT
[2010/03/20 21:36:14 | 000,021,952 | -H-- | C] () -- C:\Program Files\folder.htt
[2010/03/20 17:01:44 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/03/20 17:01:35 | 001,685,606 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.spd
[2010/03/20 17:01:35 | 000,000,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.sdf
[2010/03/20 17:01:34 | 000,643,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ltts1033.lxa
[2010/03/20 17:01:34 | 000,605,050 | ---- | C] () -- C:\WINDOWS\System32\dllcache\r1033tts.lxa
[2010/03/20 17:01:32 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28603.nls
[2010/03/20 17:01:30 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_857.nls
[2010/03/20 17:01:30 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28599.nls
[2010/03/20 17:01:30 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10081.nls
[2010/03/20 17:01:28 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28595.NLS
[2010/03/20 17:01:28 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10017.nls
[2010/03/20 17:01:28 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10007.nls
[2010/03/20 17:01:26 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_869.nls
[2010/03/20 17:01:26 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_737.nls
[2010/03/20 17:01:26 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_875.nls
[2010/03/20 17:01:26 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28597.NLS
[2010/03/20 17:01:26 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10006.nls
[2010/03/20 17:01:24 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_866.nls
[2010/03/20 17:01:24 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_855.nls
[2010/03/20 17:01:24 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28594.NLS
[2010/03/20 17:01:22 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_852.nls
[2010/03/20 17:01:22 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10082.nls
[2010/03/20 17:01:22 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10029.nls
[2010/03/20 17:01:22 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10010.nls
[2010/03/20 17:01:21 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_20127.nls
[2010/03/20 17:01:16 | 000,001,688 | ---- | C] () -- C:\WINDOWS\System32\AUTOEXEC.NT
[2010/03/20 17:01:06 | 000,390,168 | ---- | C] () -- C:\WINDOWS\System32\dllcache\WFC.CAT
[2010/03/20 17:01:06 | 000,056,081 | ---- | C] () -- C:\WINDOWS\System32\dllcache\DAJAVAC.CAT
[2010/03/20 17:01:06 | 000,052,311 | ---- | C] () -- C:\WINDOWS\System32\dllcache\DX3.CAT
[2010/03/20 17:01:06 | 000,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2010/03/20 17:01:06 | 000,022,151 | ---- | C] () -- C:\WINDOWS\System32\dllcache\TCLASSES.CAT
[2010/03/20 17:01:06 | 000,021,281 | ---- | C] () -- C:\WINDOWS\System32\dllcache\XMLDSOC.CAT
[2010/03/20 17:01:06 | 000,014,031 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSJDBC.CAT
[2010/03/20 17:01:06 | 000,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2010/03/20 17:01:06 | 000,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2010/03/20 17:01:06 | 000,007,382 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2010/03/20 17:01:05 | 000,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2010/03/20 17:01:05 | 000,657,548 | ---- | C] () -- C:\WINDOWS\System32\dllcache\CLASSES.CAT
[2010/03/20 17:01:05 | 000,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2010/03/20 16:59:50 | 000,095,072 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/03/20 16:59:10 | 000,000,558 | ---- | C] () -- C:\WINDOWS\System32\$winnt$.inf
[2010/03/20 16:15:27 | 000,000,374 | RHS- | C] () -- C:\boot.ini
[2003/06/24 14:43:48 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2002/03/25 13:02:14 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
< End of report >

--------------------------

OTL Extras logfile created on: 05/04/2010 10:14:12 PM - Run 2
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Documents and Settings\Sheila\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 67.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 33.32 Gb Total Space | 18.41 Gb Free Space | 55.24% Space Free | Partition Type: NTFS
Drive D: | 209.58 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JD
Current User Name: Sheila
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with FastStone] -- "C:\Program Files\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTornado\btdownloadgui.exe" = C:\Program Files\BitTornado\btdownloadgui.exe:*:Enabled:btdownloadgui -- ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{024D73F0-1C49-2340-8AC3-5234AAA560C0}" = ccc-core-static
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{17CBC505-D1AE-459D-B445-3D2000A85842}" = ThinkPad UltraNav Utility
"{24F9E04D-4CD5-3979-76F9-C1C6E78471AB}" = CCC Help Italian
"{3305E24F-1192-0424-8A25-39713FD92728}" = Skins
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3DA7A736-0B03-565C-1139-83FE890F0AF3}" = CCC Help French
"{43507E5B-94A0-4E56-9C7B-FAAAFBDB5904}" = Intel® PROSet/Wireless WiFi Software
"{43A1FE83-D39F-3779-8D48-D6D19EE7AC48}" = CCC Help Chinese Traditional
"{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage Active Protection System
"{57FA0525-01F9-4051-8DE9-CBF43CAC68D9}" = Catalyst Control Center - Branding
"{66CA5E58-0D03-A75D-16EF-68258DE0DFC3}" = CCC Help English
"{6BC292E6-5C85-4620-C1D0-A2FEAFD5D135}" = CCC Help Japanese
"{6CE851D7-DD98-489A-9227-5BBE08E7064B}" = ThinkVantage Fingerprint Software
"{7579A17B-0E6C-9EF3-D022-30729A24B399}" = CCC Help Chinese Standard
"{7BAA2000-5B8D-66DD-DBE7-089671AC118B}" = ccc-utility
"{7C2BD022-2B09-1F6D-D6C1-AD2A591E7537}" = Catalyst Control Center Core Implementation
"{7EB114D8-207F-45AE-BABD-1669715F2630}" = ThinkVantage Access Connections
"{806DB796-7082-C63F-284E-62245284A417}" = CCC Help Dutch
"{9FAC9E5C-0D20-4DBF-AFE5-2E09C52A95A2}" = ThinkPad 11a/b/g/n Wireless LAN Mini-PCI Express Adapter
"{A0E64EBA-8BF0-49FB-90C0-BB3D781A2016}" = ThinkPad Power Manager
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3E23D97-145F-29BF-81DE-DAEC1E5AB237}" = Catalyst Control Center Graphics Full New
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A8FA2AC0-3875-B59F-917F-719982FB1BE8}" = CCC Help Portuguese
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{AE1A0B0E-2EC7-656A-711A-0E7E8D4AB5CF}" = CCC Help Spanish
"{B016DE7B-CA2D-5EFD-9591-A109E67119BD}" = CCC Help Swedish
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4A92EF9-D14C-937F-742E-D272938DC590}" = CCC Help Korean
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D702172D-8D17-D9EC-B661-42FA268575AF}" = Catalyst Control Center Localization All
"{DAA3F236-CEEC-C6CC-12C2-AB1B75C8BC09}" = CCC Help German
"{E09CEE8B-1DCD-C628-A8EA-2B56D61DDEFA}" = ccc-core-preinstall
"{F3439243-1BAC-7250-D346-2642655F95ED}" = Catalyst Control Center Graphics Full Existing
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"{FF2AFF73-099E-0BB5-AE87-B044D3D7DE78}" = Catalyst Control Center Graphics Light
"{FFE62AAA-60EC-71CF-0505-740B8E797647}" = Acrobat.com
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"BitTornado" = BitTornado 0.3.17
"CNXT_MODEM_PCI_VEN_8086&DEV_24C6&SUBSYS_05591014" = ThinkPad Integrated 56K Modem
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ESET Online Scanner" = ESET Online Scanner v3
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FastStone Image Viewer" = FastStone Image Viewer 4.0
"Forte Agent" = Forté Agent
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NIS" = Norton Internet Security
"OnScreenDisplay" = On Screen Display
"Power Management Driver" = ThinkPad Power Management Driver
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = IBM ThinkPad UltraNav Driver
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"WIC" = Windows Imaging Component
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.6.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 20/03/2010 11:13:53 PM | Computer Name = JD | Source = MsiInstaller | ID = 10005
Description = Product: Intel® PROSet/Wireless WiFi Software -- 1: 0 2:

Error - 20/03/2010 11:00:39 PM | Computer Name = JD | Source = MsiInstaller | ID = 10005
Description = Product: Intel® PROSet/Wireless WiFi Software -- 1: 0 2:

Error - 20/03/2010 11:00:48 PM | Computer Name = JD | Source = MsiInstaller | ID = 10005
Description = Product: Intel® PROSet/Wireless WiFi Software -- 1: 0 2:

Error - 20/03/2010 11:01:11 PM | Computer Name = JD | Source = MsiInstaller | ID = 10005
Description = Product: Intel® PROSet/Wireless WiFi Software -- 1: 0 2:

Error - 20/03/2010 11:36:26 PM | Computer Name = JD | Source = MsiInstaller | ID = 11316
Description = Product: System Requirements Lab for Intel -- Error 1316. A network
error occurred while attempting to read from the file: C:\Documents and Settings\Sheila\Local
Settings\Temporary Internet Files\Content.IE5\91YMTNEY\srldetect.msi

Error - 20/03/2010 11:36:33 PM | Computer Name = JD | Source = MsiInstaller | ID = 11316
Description = Product: System Requirements Lab for Intel -- Error 1316. A network
error occurred while attempting to read from the file: C:\Documents and Settings\Sheila\Local
Settings\Temporary Internet Files\Content.IE5\91YMTNEY\srldetect.msi

Error - 25/03/2010 8:31:33 PM | Computer Name = JD | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module unknown, version 0.0.0.0, fault address 0x24087c1e.

Error - 25/03/2010 8:31:33 PM | Computer Name = JD | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module unknown, version 0.0.0.0, fault address 0x24017c1e.

Error - 02/04/2010 6:08:36 AM | Computer Name = JD | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 03/04/2010 7:12:54 PM | Computer Name = JD | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 03/04/2010 7:12:58 PM | Computer Name = JD | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 03/04/2010 7:13:12 PM | Computer Name = JD | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 03/04/2010 7:13:54 PM | Computer Name = JD | Source = Service Control Manager | ID = 7001
Description = The DHCP Client service depends on the NetBios over Tcpip service
which failed to start because of the following error: %%31

Error - 03/04/2010 7:13:54 PM | Computer Name = JD | Source = Service Control Manager | ID = 7001
Description = The DNS Client service depends on the TCP/IP Protocol Driver service
which failed to start because of the following error: %%31

Error - 03/04/2010 7:13:54 PM | Computer Name = JD | Source = Service Control Manager | ID = 7001
Description = The TCP/IP NetBIOS Helper service depends on the AFD Networking Support
Environment service which failed to start because of the following error: %%31

Error - 03/04/2010 7:13:54 PM | Computer Name = JD | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 03/04/2010 7:13:54 PM | Computer Name = JD | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD ANC BHDrvx86 ccHP eeCtrl Fips IBMTPCHK intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SRTSP
SRTSPX
SymIRON
SYMTDI
Tcpip
TPHKDRV
TPPWRIF

Error - 03/04/2010 8:29:29 PM | Computer Name = JD | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 03/04/2010 10:04:22 PM | Computer Name = JD | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

< End of report >

#6 hammerman

Group: Member
Posts: 4,183
Joined: 28-November 08

Posted 06 April 2010 - 11:07 AM

Hi,

There is some information here if you would like to donate to GeeksToGo.

Let's scan for remnants.

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

Tick the box next to YES, I accept the Terms of Use
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan (This scan can take several hours, so please be patient)
Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

#7 rpjaway

Group: Member
Posts: 5
Joined: 04-April 10

Posted 07 April 2010 - 05:36 PM

There was a virus found when I ran this yesterday, but ESET crashed before it completed. Second time I ran ESET, the results came up clean. Here's the log from the 2nd run.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=67ab9e31a0ead7478b9d5ad82d4d5ac6
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-03-27 07:10:30
# local_time=2010-03-27 03:10:30 (-0500, Eastern Daylight Time)
# country="Canada"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=3587 16777174 85 81 0 87775106 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=72872
# found=14
# cleaned=14
# scan_time=9710
C:\Documents and Settings\Sheila\My Documents\Norton AntiVirus 2010 17.0.0.136 Final\Norton AntiVirus 2010 17.0.0.136 Final\Norton2009.Trial.Reset.2.9A\Norton 2009 TrialReset v2.9A.exe probably a variant of Win32/StartPage trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xh0.exe a variant of Win32/Kryptik.DIC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xh1.exe a variant of Win32/Kryptik.DIF trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xh2.exe a variant of Win32/Kryptik.DIF trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xh3.exe a variant of Win32/Kryptik.DIF trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xh4.exe a variant of Win32/Kryptik.DIF trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xh5.exe a variant of Win32/Kryptik.DIF trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xh6.exe a variant of Win32/Kryptik.DIF trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xhw.exe a variant of Win32/Kryptik.DIC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xhx.exe a variant of Win32/Kryptik.DIC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xhy.exe a variant of Win32/Kryptik.DIC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\Xhz.exe a variant of Win32/Kryptik.DIC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\autorun.inf INF/Autorun.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\movies1\Remember the Titans\d4d map\binsearch_net.htm Win32/Iframer.NAF virus (deleted - quarantined) 00000000000000000000000000000000 C
# version=7
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=67ab9e31a0ead7478b9d5ad82d4d5ac6
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-04-07 12:15:40
# local_time=2010-04-07 08:15:40 (-0500, Eastern Daylight Time)
# country="Canada"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=3588 16777174 85 88 0 12136376 0 0
# compatibility_mode=8192 67108863 100 0 9632 9632 0 0
# scanned=38942
# found=0
# cleaned=0
# scan_time=4293

#8 hammerman

Group: Member
Posts: 4,183
Joined: 28-November 08

Posted 08 April 2010 - 12:51 PM

Hi,

Congratulations, your computer appears clean

Let's remove the tools we've been using.

Please follow these steps.

-- Step 1 --

Follow these steps to uninstall Combofix and tools used in the removal of malware

Click START then RUN
Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

-- Step 2 --

Download OTC to your desktop and run it
Click Yes to beginning the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Here are some measures you can take to ensure that your computer remains clean.

1. Updates

Windows Updates

It is essential that you regularly check and install the latest Windows Updates. Vulnerabilities within Windows can leave your computer open to infection. Regular updates are released to fix these security vulnerabilities. It is recommended that you set Windows to check, download and install your updates automatically.

Click Start
Select Control Panel
Click on Automatic (recommended)
Set the day and time for the update check. Set this to a time when your computer will normally be on and connected to the internet.
Click Apply then OK.

Java Updates

As with Windows, Java also needs to be regularly updated to fix security vulnerabilites. You can download the latest version of the Java Runtime Environment (JRE) from here. Download, install and reboot your computer. You also need to uininstall older versions of Java.

Click Start
Select Control Panel
Select Add or Remove Programs
Remove all Java updates except the latest one you have just installed.

Adobe Updates

You should ensure you use the latest Adobe Acrobat Reader and install any security updates that are released. You can download the latest reader and updates from here.

Other Updates

Regularly check for updates for all your security programs including firewall, antivirus, antispyware etc

2. Security Programs

Here is a list of security programs that I would recommend.

Firewall

A firewall is essential to stop hackers infiltrating your computer. The following firewalls are free for personal use. Do not install more than one firewall.

Zone Alarm is an excellent free basic firewall which is very easy to use.
Online-Armor Free is a more advanced firewall which includes a Host Intrusion Protection System (HIPS). This ensures that unrecognised programs will not run unless you give permission.

Antivirus

An antivirus program is essential. The following antivirus programs are free for personal use. Do not use more than one antivirus and always update virus definitions regularly.

AVG
Avira Free
Avast

Anti-Malware

Malwarebytes Anti-Malware MBAM is an excellent anti-malware tool that should be updated and a Quick Scan performed regularly. A Full Scan does not have to be carried out on such a regular basis as the developers aim to detect the vast majority of malware with the Quick Scan. The scanner is free for on-demand scans only.

Ad-Aware, Spybot, SuperAntispyware and A-Squared Free are also very good anti-malware programs that are free for on-demand scans. Spybot has a real-time protection feature called TeaTimer.

Prevention

SpywareBlaster is an excellent free tool for preventing the installation of spyware.
SpywareGuard offers real-time protection so that spyware is detected and blocked before it can do any harm.

Cleaner

ATF Cleaner removes temporary Internet Explorer, Firefox and Windows files.

Browser

Firefox is an alternative browser to Internet Explorer and is more secure.
NoScript is an add-on for Firefox and prevents execution of malicious scripts.
MVPS is a HOSTS file to replace your existing file. This prevents you connecting to a list of well-known ad sites.

#9 rpjaway

Group: Member
Posts: 5
Joined: 04-April 10

Posted 08 April 2010 - 01:26 PM

Many thanks, Hammerman! You were great help.

#10 hammerman

Group: Member
Posts: 4,183
Joined: 28-November 08

Posted 08 April 2010 - 04:04 PM

Glad to help. Stay safe

#11 hammerman

Group: Member
Posts: 4,183
Joined: 28-November 08

Posted 08 April 2010 - 04:04 PM

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Back to Virus, Spyware, Malware Removal

Share this topic:

Page 1 of 1

Please log in to reply

Please help - infected with tough malware [Solved] - Geeks to Go Forums