Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Constant attempts to access malware IPs

Started by therealex , May 18 2010 09:15 PM

  • This topic is locked This topic is locked

#121
therealex
Posted 30 July 2010 - 11:08 AM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
Hi,
About to do the final scan. After OTL rebooted, I had an NDIS error (BSOD), which resolved itself upon a cold reboot. Here's the two logs:

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #3
==============================================
>Drivers
==============================================
0xA86FC000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 5197824 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)
0xB5369000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 4399104 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver)
0xA8C3D000 C:\WINDOWS\system32\drivers\RtKHDMI.sys 3723264 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)
0xBF1EC000 C:\WINDOWS\System32\ati3duag.dll 2990080 bytes (ATI Technologies Inc. , ati3duag.dll)
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2150400 bytes
0x804D7000 RAW 2150400 bytes
0x804D7000 WMIxWDM 2150400 bytes
0xBF4C6000 C:\WINDOWS\System32\ativvaxx.dll 2125824 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver)
0xBF800000 Win32k 1851392 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1851392 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xB51D4000 C:\WINDOWS\system32\DRIVERS\vsc.sys 925696 bytes (Roland, Virtual Sound Canvas 3.2 Driver)
0xB9C32000 tdrpm258.sys 905216 bytes (Acronis, Acronis Try&Decide Volume Filter Driver)
0xBF068000 C:\WINDOWS\System32\ati2cqag.dll 651264 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module)
0xB9DDD000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xB9D0F000 timntr.sys 577536 bytes (Acronis, Acronis Backup Archive Explorer)
0xBF107000 C:\WINDOWS\System32\atikvmag.dll 544768 bytes (ATI Technologies Inc., Virtual Command And Memory Manager)
0xA8321000 C:\WINDOWS\System32\Drivers\L6TPortB.sys 536576 bytes (Line 6, GuitarPort WDM Audio Device Driver)
0xA8417000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xBF18C000 C:\WINDOWS\System32\atiok3x2.dll 393216 bytes (ATI Technologies Inc., Ring 0 x2 component)
0xB5112000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xA854A000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA4AAF000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)
0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 352256 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver)
0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA4CB5000 C:\WINDOWS\system32\DRIVERS\atksgt.sys 274432 bytes
0xA4B56000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xA3CBE000 C:\WINDOWS\system32\DRIVERS\rt2500usb.sys 245760 bytes (Ralink Technology Inc., Sample Driver for Ralink 802.11g Wireless USB Adapters)
0xA85FE000 C:\WINDOWS\System32\DRIVERS\cmdguard.sys 221184 bytes (COMODO, COMODO Internet Security Sandbox Driver)
0xB518D000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xB9F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA4D20000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xB9D9C000 C:\WINDOWS\System32\DRIVERS\NDIS.SYS 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xA354F000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xA8487000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB532D000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xA84FC000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xA47B7000 C:\Program Files\Roland\Virtual Sound Canvas DXi\RVIEg01.sys 163840 bytes (Roland, Roland VSC Synthesizer Engine)
0xA478F000 C:\Program Files\Roland\Virtual Sound Canvas VST\RVIEg01VST.sys 163840 bytes (Roland, Roland VSC Synthesizer Engine)
0xA83F0000 C:\WINDOWS\System32\Drivers\aswSP.SYS 159744 bytes (ALWIL Software, avast! self protection module)
0xB9F23000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xA8524000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xB9C0D000 snapman.sys 151552 bytes (Acronis, Acronis Snapshot API)
0xA83A4000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xA8C19000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB52ED000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB52CA000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xA84DA000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x806E4000 ACPI_HAL 134400 bytes
0x806E4000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xB9EBB000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xB9F49000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xB5170000 C:\WINDOWS\system32\DRIVERS\mcdbus.sys 118784 bytes (MagicISO, Inc., MagicISO SCSI Host Controller)
0xB5311000 C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 114688 bytes (Realtek Semiconductor Corporation , Realtek 10/100/1000 NDIS 5.1 Driver )
0xB9BF3000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xB9F0B000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xA81B5000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xB9EDB000 C:\WINDOWS\system32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
0xB9EF3000 SI3112r.sys 98304 bytes (Silicon Image, Inc., Serial ATA RAID miniport driver)
0xA4FF5000 C:\WINDOWS\System32\Drivers\aswMon2.SYS 94208 bytes (ALWIL Software, avast! File System Filter Driver for Windows XP)
0xB9E7D000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB51BD000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xB9E94000 drvmcdb.sys 86016 bytes (Sonic Solutions, Device Driver)
0xA4524000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xB9DC9000 inspect.sys 81920 bytes (COMODO, COMODO Internet Security Firewall Driver)
0xB52B6000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xB5355000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xA85A3000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xB9E6A000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xB9EA9000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xB9F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xBA268000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xBA318000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xB581B000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager)
0xBA0B8000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0xB580B000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xBA1F8000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client)
0xA4E05000 C:\WINDOWS\System32\Drivers\DgiVecp.sys 61440 bytes (DeviceGuys, Inc., Windows NT 4.0 IEEE-1284 parallel class driver for ECP, Byte, and Nibble modes)
0xBA198000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xA4A6F000 C:\WINDOWS\system32\drivers\npf.sys 61440 bytes (CACE Technologies, Inc., npf.sys (NT5/6 x86) Kernel Driver)
0xBA168000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xA4F3D000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xBA1A8000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xBA0C8000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0xBA2F8000 C:\WINDOWS\system32\DRIVERS\AmdPPM.sys 53248 bytes (Advanced Micro Devices, AMD Processor Driver)
0xBA108000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xB57FB000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xB57EB000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xBA0E8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xB57CB000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xBA258000 C:\WINDOWS\System32\Drivers\STREAM.SYS 49152 bytes (Microsoft Corporation, WDM CODEC Class Device Driver 2.0)
0xBA238000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xBA308000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xBA0D8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xB57DB000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xBA138000 sbp2port.sys 45056 bytes (Microsoft Corporation, SBP-2 Protocol Driver)
0xBA1E8000 C:\WINDOWS\System32\Drivers\aswTdi.SYS 40960 bytes (ALWIL Software, avast! TDI Filter Driver)
0xB582B000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 40960 bytes (GEAR Software Inc., CD DVD Filter)
0xBA0A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xA5124000 C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 40960 bytes (LogMeIn, Inc., LogMeIn Rfs Drivemap Driver)
0xB579B000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xB57BB000 C:\WINDOWS\System32\Drivers\Pcouffin.sys 40960 bytes (VSO Software, Patin-Couffin low level access layer for CD devices)
0xA4857000 C:\WINDOWS\system32\DRIVERS\secdrv.sys 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0xBA128000 sisagp.sys 40960 bytes (Silicon Integrated Systems Corporation, SiS NT AGP Filter)
0xB57AB000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xBA0F8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xA3973000 C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 36864 bytes (Microsoft Corporation, IP FILTER DRIVER)
0xBA1C8000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xBA208000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA5134000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xBA118000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xBA1D8000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xBA420000 C:\WINDOWS\System32\Drivers\l6dp.sys 32768 bytes (Line 6, Line 6 Device Proxy)
0xBA468000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xBA478000 C:\WINDOWS\System32\Drivers\SCDEmu.SYS 32768 bytes (PowerISO Computing, Inc., PowerISO Virtual Drive)
0xBA3F0000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xBA408000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xBA400000 C:\WINDOWS\System32\Drivers\incdrm.SYS 28672 bytes (Ahead Software AG, Ahead MRW Filter Driver)
0xBA328000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xBA4A8000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
0xBA4B0000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xBA498000 C:\WINDOWS\System32\Drivers\Aavmker4.SYS 24576 bytes (ALWIL Software, avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP)
0xBA418000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xBA410000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xBA458000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xBA448000 C:\WINDOWS\system32\DRIVERS\AegisP.sys 20480 bytes (Meetinghouse Data Communications, IEEE 802.1X Protocol Driver)
0xBA3F8000 C:\WINDOWS\System32\Drivers\AnyDVD.sys 20480 bytes (SlySoft, Inc., AnyDVD Filter Driver)
0xBA490000 C:\WINDOWS\System32\drivers\aspi32.sys 20480 bytes (Adaptec, ASPI for WIN32 Kernel Driver)
0xA82D1000 C:\WINDOWS\System32\Drivers\aswRdr.SYS 20480 bytes (ALWIL Software, avast! TDI RDR Driver)
0xBA470000 C:\WINDOWS\System32\DRIVERS\cmdhlp.sys 20480 bytes (COMODO, COMODO Internet Security Helper Driver)
0xBA440000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xBA390000 C:\WINDOWS\system32\DRIVERS\lirsgt.sys 20480 bytes
0xBA460000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xBA340000 nv_agp.sys 20480 bytes (NVIDIA Corporation, NVIDIA nForce AGP Filter)
0xBA330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xBA428000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xBA430000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xBA338000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xBA3E8000 C:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
0xBA388000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xA8BF5000 C:\WINDOWS\system32\ckldrv.sys 16384 bytes
0xA3D9E000 C:\WINDOWS\system32\GTNDIS5.SYS 16384 bytes (Printing Communications Assoc., Inc. (PCAUSA), PCAUSA NDIS 5.0 Protocol Driver)
0xA52E8000 C:\WINDOWS\system32\drivers\mbam.sys 16384 bytes (Malwarebytes Corporation, Malwarebytes' Anti-Malware)
0xB5A27000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xA5180000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xB5A43000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xA86D4000 C:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver)
0xA52E4000 C:\WINDOWS\System32\Drivers\aswFsBlk.SYS 12288 bytes (ALWIL Software, avast! File System Access Blocking Driver)
0xBA4B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xA4E15000 C:\WINDOWS\system32\drivers\CDAC15BA.SYS 12288 bytes
0xA824D000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xA4D61000 C:\WINDOWS\System32\Drivers\ElbyCDIO.sys 12288 bytes (Elaborate Bytes AG, ElbyCD Windows NT/2000/XP I/O driver)
0xA4514000 C:\WINDOWS\gdrv.sys 12288 bytes (Windows ® 2000 DDK provider, GIGABYTE Tools)
0xB5A3F000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xB510A000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xBA4BC000 SiWinAcc.sys 12288 bytes (Silicon Image, Inc., Windows Accelerator Driver)
0xA466F000 C:\WINDOWS\system32\Drivers\uphcleanhlp.sys 12288 bytes
0xB5A57000 C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 12288 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0xBA5D2000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xBA5AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xBA5DC000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xBA5D0000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xBA5A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xBA5E6000 C:\WINDOWS\System32\Drivers\MCSTRM.SYS 8192 bytes (RealNetworks, Inc., RealNetworks Virtual Path Manager®)
0xBA5D4000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xBA658000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xBA5C0000 C:\Program Files\LogMeIn\x86\RaInfo.sys 8192 bytes (LogMeIn, Inc., RemotelyAnywhere Kernel Information Provider)
0xBA5D6000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xBA5C8000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xBA5CC000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xBA5AA000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xBA6AD000 C:\WINDOWS\system32\drivers\aslm75.sys 4096 bytes
0xBA73B000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xBA73E000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xBA739000 C:\WINDOWS\system32\DRIVERS\LMImirr.sys 4096 bytes (LogMeIn, Inc., LogMeIn Mirror Miniport Driver)
0xBA7F4000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xBA670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BA5878 ] TID: 532
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B7F310 ] TID: 536
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89833DA8 ] TID: 624
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x897E1560 ] TID: 628, 4194368 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8B6EC030 ] TID: 644
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89BA5DA8 ] TID: 728
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89B89868 ] TID: 744
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89CDB710 ] TID: 756
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8B6E9B20 ] TID: 760
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89835DA8 ] TID: 764
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89779DA8 ] TID: 768
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x8982F5B8 ] TID: 772, 8781826 bytes
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89795AD0 ] TID: 776
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89CF8C18 ] TID: 784, 8781826 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B85030 ] TID: 788
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x877901D8 ] TID: 796, 8781829 bytes
0x8055C700 Faked ServiceTable-->ati2evxx.exe [ ETHREAD 0x89CF7AC8 ] TID: 836
0x8055C700 Faked ServiceTable-->ati2evxx.exe [ ETHREAD 0x89D0C460 ] TID: 852
0x8055C700 Faked ServiceTable-->ati2evxx.exe [ ETHREAD 0x89BAEDA8 ] TID: 856
0x8055C700 Faked ServiceTable-->rapimgr.exe [ ETHREAD 0x89422AD0 ] TID: 860, 8781836 bytes
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89EF9A78 ] TID: 868
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89D09468 ] TID: 872, 8781849 bytes
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89D14C18 ] TID: 876
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89D03C18 ] TID: 936
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89CDF6F8 ] TID: 940
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89D066F8 ] TID: 944
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x8B38DB18 ] TID: 948
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89B37DA8 ] TID: 952
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89CF6B20 ] TID: 956
0x8055C700 Faked ServiceTable-->smss.exe [ ETHREAD 0x8AB38630 ] TID: 968
0x8055C700 Faked ServiceTable-->smss.exe [ ETHREAD 0x8AB34030 ] TID: 972
0x8055C700 Faked ServiceTable-->smss.exe [ ETHREAD 0x8AB344B0 ] TID: 976
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89B8B870 ] TID: 980
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89B79C10 ] TID: 984
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89B76880 ] TID: 1156
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89D22DA8 ] TID: 1160
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89DD7A80 ] TID: 1164
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89B57AD0 ] TID: 1168
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89D02960 ] TID: 1172
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89766030 ] TID: 1180
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x8B6C08A0 ] TID: 1184
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89840818 ] TID: 1192
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x892E25E8 ] TID: 1196
0x8055C700 Faked ServiceTable-->MailWasher.exe [ ETHREAD 0x89738548 ] TID: 1240
0x8055C700 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x890C2990 ] TID: 1252
0x8055C700 Faked ServiceTable-->csrss.exe [ ETHREAD 0x8B319460 ] TID: 1284
0x8055C700 Faked ServiceTable-->csrss.exe [ ETHREAD 0x89CECDA8 ] TID: 1304
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89C8FAF0 ] TID: 1332, 8781878 bytes
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89D77998 ] TID: 1340
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89D6BDA8 ] TID: 1348
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89C5BB48 ] TID: 1376
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89C4B398 ] TID: 1380
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89C28AF0 ] TID: 1384, 3539020 bytes
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C1B5E0 ] TID: 1392
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C1B358 ] TID: 1396, 5111881 bytes
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C4E8A8 ] TID: 1400, 816576 bytes
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C2BB10 ] TID: 1404, 1051000 bytes
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C4EB40 ] TID: 1408
0x8055C700 Faked ServiceTable-->MailWasher.exe [ ETHREAD 0x896655C0 ] TID: 1412
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x897E68A0 ] TID: 1416
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C2BDA8 ] TID: 1420
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C5C360 ] TID: 1440
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C33DA8 ] TID: 1448
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C15838 ] TID: 1460
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89688030 ] TID: 1464
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89CDB460 ] TID: 1480
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89CFE2F0 ] TID: 1488
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89D7BDA8 ] TID: 1504
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89BFD348 ] TID: 1508
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89D84858 ] TID: 1512
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89D80770 ] TID: 1516
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8745CB58 ] TID: 1520
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89BF22F0 ] TID: 1528
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89BDC2F0 ] TID: 1532
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x8B6CADA8 ] TID: 1536
0x8055C700 Faked ServiceTable-->rapimgr.exe [ ETHREAD 0x8936FDA8 ] TID: 1540
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89C4B890 ] TID: 1544
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B32DA8 ] TID: 1556
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x87D86230 ] TID: 1560
0x8055C700 Faked ServiceTable-->alg.exe [ ETHREAD 0x8985BDA8 ] TID: 1568
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x8B31C830 ] TID: 1584
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89CDE468 ] TID: 1588
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BE7838 ] TID: 1592, 7077998 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BE75B0 ] TID: 1596
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BD9DA8 ] TID: 1600
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x88C75888 ] TID: 1604
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89BD52D0 ] TID: 1612, 34209800 bytes
0x8055C700 Faked ServiceTable-->ati2evxx.exe [ ETHREAD 0x89BF6618 ] TID: 1620
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89D1E878 ] TID: 1636
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89C0A648 ] TID: 1640, 589827 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89C0ADA8 ] TID: 1644, 6553700 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89C08A20 ] TID: 1648
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89C14740 ] TID: 1652, 196627 bytes
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x89E3B030 ] TID: 1656
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BCDDA8 ] TID: 1660, 3145776 bytes
0x8055C700 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x879A58E8 ] TID: 1700
0x8055C700 Faked ServiceTable-->mbamservice.exe [ ETHREAD 0x88A196A8 ] TID: 1716
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89B3CDA8 ] TID: 1724
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89D0E460 ] TID: 1728
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89D03460 ] TID: 1736
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89BB9DA8 ] TID: 1760, 3801155 bytes
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x89BB1580 ] TID: 1768
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BB8700 ] TID: 1780
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BE0030 ] TID: 1784
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BB1838 ] TID: 1792
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B79988 ] TID: 1796
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89D2DDA8 ] TID: 1800
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89C8B2F0 ] TID: 1808
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89BBF030 ] TID: 1836
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89BF1030 ] TID: 1840
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B2EDA8 ] TID: 1844
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89D04C28 ] TID: 1856
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89BACDA8 ] TID: 1864
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B2D558 ] TID: 1868, 7536686 bytes
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89BB48A0 ] TID: 1872
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89CF6DA8 ] TID: 1876
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89D20888 ] TID: 1880
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89D25B10 ] TID: 1888
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89D22888 ] TID: 1892
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B70AC8 ] TID: 1904
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B9C8A0 ] TID: 1908
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89CE3988 ] TID: 1912, 32 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89D10468 ] TID: 1916
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BD13A8 ] TID: 1920
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BE8850 ] TID: 1924
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B2F8A0 ] TID: 1928
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89D049A0 ] TID: 1932
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BCE030 ] TID: 1944
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89D04718 ] TID: 1948
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B70DA8 ] TID: 1952
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B05DA8 ] TID: 1956
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B8BDA8 ] TID: 1960
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89D2A558 ] TID: 1964
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89AFE8A0 ] TID: 1972
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B325C8 ] TID: 1976
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B89328 ] TID: 1992, 7012468 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BCADA8 ] TID: 1996
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BEB030 ] TID: 2004
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BDE030 ] TID: 2008
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x8780C2F8 ] TID: 2012
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x87CAA030 ] TID: 2032
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BAD878 ] TID: 2036
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B76350 ] TID: 2044
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89B543A0 ] TID: 2076, 3407986 bytes
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x898E4DA8 ] TID: 2104
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x898E8DA8 ] TID: 2108
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B73030 ] TID: 2116
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x898DE8A0 ] TID: 2120
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x89737540 ] TID: 2124
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x8985E628 ] TID: 2132
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x8B6E48A0 ] TID: 2144
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x896F5DA8 ] TID: 2148
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x8B6E4DA8 ] TID: 2156
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89DD2DA8 ] TID: 2180
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x898CCDA8 ] TID: 2196
0x8055C700 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x89D27DA8 ] TID: 2204
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x893A6DA8 ] TID: 2212
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x89749030 ] TID: 2220
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89AF9DA8 ] TID: 2224
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x89E81030 ] TID: 2232
0x8055C700 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x898355C0 ] TID: 2244
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x89737AD0 ] TID: 2252
0x8055C700 Faked ServiceTable-->wcescomm.exe [ ETHREAD 0x89372AD0 ] TID: 2264
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x898095F0 ] TID: 2268
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x895EB460 ] TID: 2276
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x898CD8A0 ] TID: 2280
0x8055C700 Faked ServiceTable-->cmdagent.exe [ ETHREAD 0x898BF8A0 ] TID: 2284
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x897915C8 ] TID: 2300
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B7B830 ] TID: 2316
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89D1FDA8 ] TID: 2356
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B7CDA8 ] TID: 2360
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x898B98A0 ] TID: 2364
0x8055C700 Faked ServiceTable-->schedul2.exe [ ETHREAD 0x898A32D0 ] TID: 2376
0x8055C700 Faked ServiceTable-->schedul2.exe [ ETHREAD 0x8981BDA8 ] TID: 2380
0x8055C700 Faked ServiceTable-->schedul2.exe [ ETHREAD 0x898A45C8 ] TID: 2384
0x8055C700 Faked ServiceTable-->schedul2.exe [ ETHREAD 0x898AC630 ] TID: 2388, 7602273 bytes
0x8055C700 Faked ServiceTable-->schedul2.exe [ ETHREAD 0x89B29AD0 ] TID: 2392
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x896BD878 ] TID: 2416
0x8055C700 Faked ServiceTable-->Crypserv.exe [ ETHREAD 0x89B05AE0 ] TID: 2432
0x8055C700 Faked ServiceTable-->sqlwriter.exe [ ETHREAD 0x8B6D78A8 ] TID: 2440
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x898B7548 ] TID: 2448
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B675B8 ] TID: 2452
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x89E6B030 ] TID: 2456
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B15618 ] TID: 2460, 663104 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x88B3E3A0 ] TID: 2476
0x8055C700 Faked ServiceTable-->Crypserv.exe [ ETHREAD 0x89B85DA8 ] TID: 2480
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89802AD0 ] TID: 2488
0x8055C700 Faked ServiceTable-->essvr.exe [ ETHREAD 0x89B05030 ] TID: 2500
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x897DD540 ] TID: 2504
0x8055C700 Faked ServiceTable-->FolderSizeSvc.exe [ ETHREAD 0x89802DA8 ] TID: 2516
0x8055C700 Faked ServiceTable-->FolderSizeSvc.exe [ ETHREAD 0x89AFE030 ] TID: 2524
0x8055C700 Faked ServiceTable-->FolderSizeSvc.exe [ ETHREAD 0x898AC030 ] TID: 2528, 6619256 bytes
0x8055C700 Faked ServiceTable-->FolderSizeSvc.exe [ ETHREAD 0x898CD030 ] TID: 2532
0x8055C700 Faked ServiceTable-->FolderSizeSvc.exe [ ETHREAD 0x89B00030 ] TID: 2536
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x88D7D8A8 ] TID: 2540
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8970DAD0 ] TID: 2548
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x89E0CB48 ] TID: 2564
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x898413C0 ] TID: 2572
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x895AF030 ] TID: 2640
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x895F6A20 ] TID: 2644, 3014761 bytes
0x8055C700 Faked ServiceTable-->jqs.exe [ ETHREAD 0x89814630 ] TID: 2648
0x8055C700 Faked ServiceTable-->jqs.exe [ ETHREAD 0x898155B8 ] TID: 2652
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x8975C3A8 ] TID: 2660
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x897F2DA8 ] TID: 2664
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89616DA8 ] TID: 2700
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x897278A0 ] TID: 2704
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89D51DA8 ] TID: 2708
0x8055C700 Faked ServiceTable-->LSSrvc.exe [ ETHREAD 0x89C1A5C0 ] TID: 2712, 5963776 bytes
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x897DCDA8 ] TID: 2728
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8965A5D8 ] TID: 2732
0x8055C700 Faked ServiceTable-->essvr.exe [ ETHREAD 0x89B29DA8 ] TID: 2744
0x8055C700 Faked ServiceTable-->MailWasher.exe [ ETHREAD 0x89081C98 ] TID: 2748
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x89E13B48 ] TID: 2764
0x8055C700 Faked ServiceTable-->essvr.exe [ ETHREAD 0x8B6CE8A0 ] TID: 2780
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8894D958 ] TID: 2800, 7536686 bytes
0x8055C700 Faked ServiceTable-->GoogleCrashHandler.exe [ ETHREAD 0x898B5538 ] TID: 2816, 2949120 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8988F3B8 ] TID: 2820
0x8055C700 Faked ServiceTable-->GoogleCrashHandler.exe [ ETHREAD 0x898B5DA8 ] TID: 2824
0x8055C700 Faked ServiceTable-->GoogleCrashHandler.exe [ ETHREAD 0x89BC1DA8 ] TID: 2828
0x8055C700 Faked ServiceTable-->GoogleCrashHandler.exe [ ETHREAD 0x89C19DA8 ] TID: 2832
0x8055C700 Faked ServiceTable-->jqs.exe [ ETHREAD 0x89803DA8 ] TID: 2840
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x89858DA8 ] TID: 2844
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x89869630 ] TID: 2848
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x896BADA8 ] TID: 2856, 6619256 bytes
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x897DCAD0 ] TID: 2860
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x88D5BD20 ] TID: 2864
0x8055C700 Faked ServiceTable-->ramaint.exe [ ETHREAD 0x89DD4DA8 ] TID: 2880
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8972FDA8 ] TID: 2904
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x8B6D0430 ] TID: 2908, 7471172 bytes
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89855DA8 ] TID: 2912
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x8B5EE5B8 ] TID: 2916
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x89BCC5D8 ] TID: 2920, 6357104 bytes
0x8055C700 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x89B588A0 ] TID: 2936
0x8055C700 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x8B707540 ] TID: 2940
0x8055C700 Faked ServiceTable-->AvastUI.exe [ ETHREAD 0x880D0550 ] TID: 2952
0x8055C700 Faked ServiceTable-->LMIGuardian.exe [ ETHREAD 0x89BC45E0 ] TID: 2956
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89620DA8 ] TID: 2964, 19293688 bytes
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x89BC0B18 ] TID: 2976
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x8943E8A0 ] TID: 2980
0x8055C700 Faked ServiceTable-->alg.exe [ ETHREAD 0x8B6CA5D8 ] TID: 2984
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x8B6E08A0 ] TID: 2988
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89624878 ] TID: 2992
0x8055C700 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x89BA4DA8 ] TID: 3004
0x8055C700 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x89C7B8A0 ] TID: 3008
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89757030 ] TID: 3012
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x897DBDA8 ] TID: 3016
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x898DB8A0 ] TID: 3020, 7864368 bytes
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x89BCFDA8 ] TID: 3024
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89731AD0 ] TID: 3028
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x897B85A8 ] TID: 3036, 458761 bytes
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x88D5B5C8 ] TID: 3040, 6553646 bytes
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89769618 ] TID: 3048
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x897B3030 ] TID: 3064
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x896ED030 ] TID: 3068
0x8055C700 Faked ServiceTable-->mbamservice.exe [ ETHREAD 0x898DBDA8 ] TID: 3072, 4259909 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BAF5B8 ] TID: 3076
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89B04DA8 ] TID: 3092
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89E29DA8 ] TID: 3100
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x8B6DFDA8 ] TID: 3112, 130 bytes
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x89D908A0 ] TID: 3124, 1047136 bytes
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x89D88320 ] TID: 3128
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89C7D5B8 ] TID: 3136
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89D885B8 ] TID: 3140
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89B4EAB8 ] TID: 3144
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89D91DA8 ] TID: 3148
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89B4DDA8 ] TID: 3152
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89D7D5B8 ] TID: 3156
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x898105B8 ] TID: 3160
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89D93DA8 ] TID: 3164, 2097184 bytes
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x897DD030 ] TID: 3172
0x8055C700 Faked ServiceTable-->alg.exe [ ETHREAD 0x897AD8A0 ] TID: 3176
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89CD38A0 ] TID: 3204
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x897E98A0 ] TID: 3208
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89B4BDA8 ] TID: 3212
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x8986BDA8 ] TID: 3220
0x8055C700 Faked ServiceTable-->alg.exe [ ETHREAD 0x897A9DA8 ] TID: 3232
0x8055C700 Faked ServiceTable-->Process Blocker.exe [ ETHREAD 0x89D4A878 ] TID: 3236
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89685DA8 ] TID: 3256
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89656DA8 ] TID: 3260, 3342385 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x88B527C8 ] TID: 3264
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8966F5E0 ] TID: 3268
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89780DA8 ] TID: 3276
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89C13DA8 ] TID: 3280
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x898DB5B8 ] TID: 3284
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89B4CDA8 ] TID: 3288
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x8986DDA8 ] TID: 3292
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x89D43DA8 ] TID: 3296
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89D4A030 ] TID: 3300
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89BC1030 ] TID: 3304
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x8B3FC8A0 ] TID: 3316
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89D4A548 ] TID: 3328
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89D90030 ] TID: 3332, 5439580 bytes
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89D4ADA8 ] TID: 3336
0x8055C700 Faked ServiceTable-->sqlbrowser.exe [ ETHREAD 0x898B05B8 ] TID: 3352
0x8055C700 Faked ServiceTable-->sqlbrowser.exe [ ETHREAD 0x89B33DA8 ] TID: 3356
0x8055C700 Faked ServiceTable-->sqlbrowser.exe [ ETHREAD 0x89B14DA8 ] TID: 3364
0x8055C700 Faked ServiceTable-->sqlbrowser.exe [ ETHREAD 0x8986E5C8 ] TID: 3372
0x8055C700 Faked ServiceTable-->sqlbrowser.exe [ ETHREAD 0x89CD2840 ] TID: 3376
0x8055C700 Faked ServiceTable-->sqlbrowser.exe [ ETHREAD 0x89B13AD0 ] TID: 3380
0x8055C700 Faked ServiceTable-->sqlbrowser.exe [ ETHREAD 0x89B59030 ] TID: 3384
0x8055C700 Faked ServiceTable-->sqlbrowser.exe [ ETHREAD 0x89B4B030 ] TID: 3388
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B61030 ] TID: 3400
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89CD1DA8 ] TID: 3420
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x898CB878 ] TID: 3424
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B0DDA8 ] TID: 3428
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B1E538 ] TID: 3468
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B49DA8 ] TID: 3476
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x898DA5B8 ] TID: 3480
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x897438A0 ] TID: 3484
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x89BE5DA8 ] TID: 3488
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x88CA2030 ] TID: 3496
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x8AAF3030 ] TID: 3500
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x8AAF3568 ] TID: 3504
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x89CCFAC8 ] TID: 3524
0x8055C700 Faked ServiceTable-->smlogsvc.exe [ ETHREAD 0x89D49030 ] TID: 3528
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x892EBDA8 ] TID: 3540
0x8055C700 Faked ServiceTable-->smlogsvc.exe [ ETHREAD 0x89B1A8A0 ] TID: 3544
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8982DDA8 ] TID: 3556
0x8055C700 Faked ServiceTable-->smlogsvc.exe [ ETHREAD 0x897EADA8 ] TID: 3560
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x87B672B0 ] TID: 3564
0x8055C700 Faked ServiceTable-->rapimgr.exe [ ETHREAD 0x8941DDA8 ] TID: 3588
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89131958 ] TID: 3596
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89684628 ] TID: 3604
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x896779A0 ] TID: 3608
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x8918A990 ] TID: 3628
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B61DA8 ] TID: 3632
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8B6ED548 ] TID: 3640
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8970EDA8 ] TID: 3648
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BCD030 ] TID: 3652
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89CCF5B8 ] TID: 3656
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x898315B8 ] TID: 3660
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8974E470 ] TID: 3664
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BE2DA8 ] TID: 3668
0x8055C700 Faked ServiceTable-->rapimgr.exe [ ETHREAD 0x89419DA8 ] TID: 3672
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89CCEDA8 ] TID: 3676
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89825DA8 ] TID: 3680
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8962BDA8 ] TID: 3692
0x8055C700 Faked ServiceTable-->uphclean.exe [ ETHREAD 0x898305B8 ] TID: 3696
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x8907A200 ] TID: 3716
0x8055C700 Faked ServiceTable-->LogMeIn.exe [ ETHREAD 0x89BFBAF8 ] TID: 3728
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8974B8A0 ] TID: 3732
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B3AB18 ] TID: 3740
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x897BE5D0 ] TID: 3776
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x8B318DA8 ] TID: 3784
0x8055C700 Faked ServiceTable-->MailWasher.exe [ ETHREAD 0x897F62B8 ] TID: 3792
0x8055C700 Faked ServiceTable-->TeaTimer.exe [ ETHREAD 0x894415C0 ] TID: 3800
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x88469180 ] TID: 3820
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B0B030 ] TID: 3856
0x8055C700 Faked ServiceTable-->mbamservice.exe [ ETHREAD 0x89E277F0 ] TID: 3888
0x8055C700 Faked ServiceTable-->WLService.exe [ ETHREAD 0x896F75B8 ] TID: 3948
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89865DA8 ] TID: 3952
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x896AF2D0 ] TID: 3960
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x898D88A8 ] TID: 3964
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89B46938 ] TID: 3976
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89B365C0 ] TID: 3980
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x897F65C0 ] TID: 3988
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x897E2DA8 ] TID: 4000
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89619DA8 ] TID: 4056
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x8B6EA030 ] TID: 4060
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x8B6D6030 ] TID: 4064
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x897618A0 ] TID: 4068
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x898735B8 ] TID: 4072
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x897D8DA8 ] TID: 4080
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89651AD0 ] TID: 4084
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x89BE2030 ] TID: 4104
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x89735DA8 ] TID: 4108
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x8975BAD0 ] TID: 4112
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x895CFDA8 ] TID: 4116
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x89608DA8 ] TID: 4120
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x895D1DA8 ] TID: 4124
0x8055C700 Faked ServiceTable-->FolderSizeSvc.exe [ ETHREAD 0x88D003A0 ] TID: 4132
0x8055C700 Faked ServiceTable-->FolderSizeSvc.exe [ ETHREAD 0x88BCD030 ] TID: 4140
0x8055C700 Faked ServiceTable-->FolderSizeSvc.exe [ ETHREAD 0x888F0030 ] TID: 4144
0x8055C700 Faked ServiceTable-->FolderSizeSvc.exe [ ETHREAD 0x88BCB3A0 ] TID: 4164
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x88CFA3A0 ] TID: 4172
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x88BBCAF0 ] TID: 4176
0x8055C700 Faked ServiceTable-->WUSB54Gv42.exe [ ETHREAD 0x89636AD8 ] TID: 4204
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x87DD40A0 ] TID: 4288
0x8055C700 Faked ServiceTable-->jqs.exe [ ETHREAD 0x87B1EDA8 ] TID: 4328
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x898D2DA8 ] TID: 4356
0x8055C700 Faked ServiceTable-->MailWasher.exe [ ETHREAD 0x88D3EDA8 ] TID: 4360
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x88AB73A0 ] TID: 4372
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x88E29030 ] TID: 4376
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x88CF93A0 ] TID: 4388
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x8903ADA8 ] TID: 4408
0x8055C700 Faked ServiceTable-->wcescomm.exe [ ETHREAD 0x88EE3030 ] TID: 4424
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x88E0E800 ] TID: 4460
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x88E0F5D0 ] TID: 4488
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8931FC78 ] TID: 4496
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8739F428 ] TID: 4512
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x88D4EDA8 ] TID: 4520
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x87451438 ] TID: 4532
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x874450F0 ] TID: 4592
0x8055C700 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x87D9C1B8 ] TID: 4596
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x89B88DA8 ] TID: 4648
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x88448B88 ] TID: 4696
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x8945CAD8 ] TID: 4712
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x88D4B368 ] TID: 4724
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x88FB8DA8 ] TID: 4788
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8988A8F0 ] TID: 4804
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x896BD5C8 ] TID: 4888
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89B09DA8 ] TID: 4900
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8985F628 ] TID: 4924
0x8055C700 Faked ServiceTable-->TeaTimer.exe [ ETHREAD 0x89B59DA8 ] TID: 4928
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x89181720 ] TID: 4936
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x895E08A8 ] TID: 4956
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x88028640 ] TID: 4996
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x89BE2838 ] TID: 5004
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x8855B998 ] TID: 5008
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x881D2030 ] TID: 5028
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x895D4DA8 ] TID: 5032
0x8055C700 Faked ServiceTable-->csrss.exe [ ETHREAD 0x89767DA8 ] TID: 5048
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8B6E22C8 ] TID: 5076
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x888075D0 ] TID: 5104
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x89D9E030 ] TID: 5108
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x892EADA8 ] TID: 5120
0x8055C700 Faked ServiceTable-->services.exe [ ETHREAD 0x89734620 ] TID: 5144
0x8055C700 Faked ServiceTable-->mbamservice.exe [ ETHREAD 0x890E38F8 ] TID: 5156
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8740A458 ] TID: 5172
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x88E90B58 ] TID: 5180
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x894976E0 ] TID: 5184
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x895C0540 ] TID: 5208
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x898605B8 ] TID: 5228
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x889EAD00 ] TID: 5248
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x8977C4F0 ] TID: 5260
0x8055C700 Faked ServiceTable-->lsass.exe [ ETHREAD 0x8908DDA8 ] TID: 5296
0x8055C700 Faked ServiceTable-->sqlservr.exe [ ETHREAD 0x88ED9120 ] TID: 5320
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x88F70030 ] TID: 5348
0x8055C700 Faked ServiceTable-->MailWasher.exe [ ETHREAD 0x88DB1030 ] TID: 5360
0x8055C700 Faked ServiceTable-->AvastUI.exe [ ETHREAD 0x88F73328 ] TID: 5364
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x88A6D428 ] TID: 5436
0x8055C700 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x87BF8AE0 ] TID: 5440
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x8959B8B0 ] TID: 5476
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x89460DA8 ] TID: 5480
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8906D8B0 ] TID: 5488
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x88DE3948 ] TID: 5496
0x8055C700 Faked ServiceTable-->explorer.exe [ ETHREAD 0x895B68A0 ] TID: 5508, 4325888 bytes
0x8055C700 Faked ServiceTable-->explorer.exe [ ETHREAD 0x89494AD0 ] TID: 5516
0x8055C700 Faked ServiceTable-->explorer.exe [ ETHREAD 0x89EDEDA8 ] TID: 5524
0x8055C700 Faked ServiceTable-->firefox.exe [ ETHREAD 0x88E36AC8 ] TID: 5564
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x872C2030 ] TID: 5584
0x8055C700 Faked ServiceTable-->AvastSvc.exe [ ETHREAD 0x88E96938 ] TID: 5680
0x8055C700 Faked ServiceTable-->explorer.exe [ ETHREAD 0x895A3030 ] TID: 5708
0x8055C700 Faked ServiceTable-->searchindexer.exe [ ETHREAD 0x897EE8A8 ] TID: 5808
0x8055C700 Faked ServiceTable-->AvastUI.exe [ ETHREAD 0x89594560 ] TID: 5824
0x8055C700 Faked ServiceTable-->svchost.exe [ ETHREAD 0x88956840 ] TID: 5836
0x8055C700 Faked ServiceTable-->AvastUI.exe [ ETHREAD 0x89E7F8B0 ] TID: 5864
0x8055C700 Faked ServiceTable-->LMIGuardian.exe [ ETHREAD 0x8959A030 ] TID: 5888
0x8055C700 Faked ServiceTable-->LogMeInSystray.exe [ ETHREAD 0x895915C0 ] TID: 5928
0x8055C700 Faked ServiceTable-->AvastUI.exe [ ETHREAD 0x8946ADA8 ] TID: 5976
0x8055C700 Faked ServiceTable-->mbamgui.exe [ ETHREAD 0x89E305C0 ] TID: 6004
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x8958F5D8 ] TID: 6044
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x894728A0 ] TID: 6056
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x893B5DA8 ] TID: 6060
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x894888A0 ] TID: 6064
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x895A6DA8 ] TID: 6128
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x89E30030 ] TID: 6136
0x8055C700 Faked ServiceTable-->cfp.exe [ ETHREAD 0x895AE030 ] TID: 6140
0xA8275A40 Unknown thread object [ ETHREAD 0x8ABFA030 ] , 600 bytes
0xA8278980 Unknown thread object [ ETHREAD 0x8B6F76F0 ] , 600 bytes


At the end it said "!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)", but it didn't copy it to the report.

Here's the OTL log after the reboot. I'll run OTL again, as you mentioned, and post the log afterwards.

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
========== FILES ==========
File\Folder C:\Windows\tasks\at*.job not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Application Data

User: Default User
->Temp folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes

User: Music
->Temp folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: Music.RUSSELL
->Temp folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 131072 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: Russell Alexander
->Temp folder emptied: 200978587 bytes
->Java cache emptied: 19153 bytes
->FireFox cache emptied: 40362636 bytes
->Google Chrome cache emptied: 22083002 bytes
->Flash cache emptied: 11213 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6807809 bytes
Session Manager Temp folder emptied: 0 bytes
Session Manager Tmp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 37776 bytes

Total Files Cleaned = 258.00 mb


OTL by OldTimer - Version 3.2.7.0 log created on 07302010_113129

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\NetworkService\Local Settings\Temp\Perflib_Perfdata_c0c.dat not found!
File\Folder C:\Documents and Settings\NetworkService\Local Settings\Temp\Perflib_Perfdata_d78.dat not found!
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...


BTW - after reboot, iexplore.exe tried to run again, but was blocked by Process Blocker.
  • 0

Advertisements

#122
therealex
Posted 30 July 2010 - 11:35 AM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
And here's the OTL scan:

OTL logfile created on: 7/30/2010 1:11:46 PM - Run 4
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Russell Alexander\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48.04 Gb Total Space | 7.17 Gb Free Space | 14.94% Space Free | Partition Type: NTFS
Drive D: | 12.65 Gb Total Space | 2.90 Gb Free Space | 22.92% Space Free | Partition Type: FAT32
Drive E: | 35.94 Gb Total Space | 24.47 Gb Free Space | 68.08% Space Free | Partition Type: NTFS
Drive F: | 35.74 Gb Total Space | 19.17 Gb Free Space | 53.65% Space Free | Partition Type: NTFS
Drive G: | 35.80 Gb Total Space | 21.26 Gb Free Space | 59.37% Space Free | Partition Type: NTFS
Drive H: | 35.79 Gb Total Space | 18.72 Gb Free Space | 52.29% Space Free | Partition Type: NTFS
Drive I: | 41.57 Gb Total Space | 25.10 Gb Free Space | 60.37% Space Free | Partition Type: NTFS
Drive J: | 10.65 Gb Total Space | 3.62 Gb Free Space | 34.02% Space Free | Partition Type: FAT32
Drive K: | 8.65 Gb Total Space | 3.05 Gb Free Space | 35.26% Space Free | Partition Type: FAT32
Drive L: | 11.74 Gb Total Space | 2.54 Gb Free Space | 21.60% Space Free | Partition Type: FAT32
Drive M: | 9.47 Gb Total Space | 4.92 Gb Free Space | 51.99% Space Free | Partition Type: FAT32
Drive N: | 21.32 Gb Total Space | 7.24 Gb Free Space | 33.99% Space Free | Partition Type: FAT32
Drive O: | 2.15 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive P: | 2.49 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive Q: | 465.76 Gb Total Space | 215.80 Gb Free Space | 46.33% Space Free | Partition Type: NTFS
Drive W: | 149.05 Gb Total Space | 63.00 Gb Free Space | 42.27% Space Free | Partition Type: NTFS

Computer Name: RUSSELL
Current User Name: Russell Alexander
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Russell Alexander\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardian.exe (LogMeIn, Inc.)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Process Blocker\Tray Informer.exe (Softros Systems, Inc.)
PRC - C:\Program Files\Process Blocker\Process Blocker.exe (Softros Systems, Inc.)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
PRC - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Gigabyte\EasySaver\essvr.exe ()
PRC - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
PRC - C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft ActiveSync\rapimgr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\fpdisp5a.exe (FinePrint Software, LLC)
PRC - C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
PRC - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe (Linksys)
PRC - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe (GEMTEKS)
PRC - F:\UPHClean\uphclean.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SYSTEM32\Crypserv.exe (Kenonic Controls Ltd.)
PRC - H:\Roland\VSC32\vscvol.exe (Roland)
PRC - H:\Roland\VSC32\Vsc32Cnf.exe (Roland)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Russell Alexander\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\SYSTEM32\guard32.dll (COMODO)
MOD - C:\WINDOWS\SYSTEM32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (WUSB54Gv42SVC) -- File not found
SRV - (PnkBstrA) -- File not found
SRV - (LQAN) -- File not found
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (LMIMaint) -- C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
SRV - (cmdAgent) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Process Blocker) -- C:\Program Files\Process Blocker\Process Blocker.exe (Softros Systems, Inc.)
SRV - (afcdpsrv) -- C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (TomTomHOMEService) -- e:\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (AcrSch2Svc) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (IntuitUpdateService) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) -- C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (C-DillaCdaC11BA) -- C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE (C-Dilla Ltd)
SRV - (ES lite Service) -- C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE ()
SRV - (SQLWriter) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (SQLBrowser) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (LVSrvLauncher) -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.)
SRV - (LVPrcSrv) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LogMeIn) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
SRV - (Capture Device Service) -- C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe (InterVideo Inc.)
SRV - (UleadBurningHelper) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (QBCFMonitorService) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
SRV - (QBFCService) -- C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)
SRV - (ServiceLayer) -- C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe (Nokia.)
SRV - (FolderSize) -- C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
SRV - (Macromedia Licensing Service) -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe ()
SRV - (UPHClean) -- F:\UPHClean\uphclean.exe (Microsoft Corporation)
SRV - (PortReporter) -- C:\Program Files\PortReporter\PortReporter.exe ()
SRV - (GEARSecurity) -- C:\WINDOWS\SYSTEM32\gearsec.exe (GEAR Software)
SRV - (BR) -- C:\WINDOWS\br.dll ()
SRV - (Crypkey License) -- C:\WINDOWS\System32\Crypserv.exe (Kenonic Controls Ltd.)


========== Driver Services (SafeList) ==========

DRV - (gdrv) -- C:\WINDOWS\gdrv.sys (Windows ® 2000 DDK provider)
DRV - (aswTdi) -- C:\WINDOWS\SYSTEM32\DRIVERS\aswTdi.sys (ALWIL Software)
DRV - (aswSP) -- C:\WINDOWS\SYSTEM32\DRIVERS\aswSP.sys (ALWIL Software)
DRV - (aswRdr) -- C:\WINDOWS\SYSTEM32\DRIVERS\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) -- C:\WINDOWS\SYSTEM32\DRIVERS\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) -- C:\WINDOWS\SYSTEM32\DRIVERS\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) -- C:\WINDOWS\SYSTEM32\DRIVERS\aavmker4.sys (ALWIL Software)
DRV - (Partizan) -- C:\WINDOWS\Partizan.log ()
DRV - (RegGuard) -- C:\WINDOWS\SYSTEM32\DRIVERS\regguard.sys (Greatis Software)
DRV - (LMIRfsClientNP) -- C:\WINDOWS\SYSTEM32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (cmdGuard) -- C:\WINDOWS\SYSTEM32\DRIVERS\cmdGuard.sys (COMODO)
DRV - (Inspect) -- C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (cmdHlp) -- C:\WINDOWS\SYSTEM32\DRIVERS\cmdhlp.sys (COMODO)
DRV - (MBAMProtector) -- C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys (Malwarebytes Corporation)
DRV - (L6DP) -- C:\WINDOWS\SYSTEM32\DRIVERS\l6dp.sys (Line 6)
DRV - (afcdp) -- C:\WINDOWS\SYSTEM32\DRIVERS\afcdp.sys (Acronis)
DRV - (tdrpman258) Acronis Try&Decide and Restore Points filter (build 258) -- C:\WINDOWS\system32\DRIVERS\tdrpm258.sys (Acronis)
DRV - (timounter) -- C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis)
DRV - (snapman) -- C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (NPF) -- C:\WINDOWS\SYSTEM32\DRIVERS\npf.sys (CACE Technologies, Inc.)
DRV - (atksgt) -- C:\WINDOWS\SYSTEM32\DRIVERS\atksgt.sys ()
DRV - (lirsgt) -- C:\WINDOWS\SYSTEM32\DRIVERS\lirsgt.sys ()
DRV - (L6TPortB) -- C:\WINDOWS\SYSTEM32\DRIVERS\L6TPortB.sys (Line 6)
DRV - (ati2mtag) -- C:\WINDOWS\SYSTEM32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (mcdbus) -- C:\WINDOWS\SYSTEM32\DRIVERS\mcdbus.sys (MagicISO, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\SYSTEM32\DRIVERS\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (nv) -- C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (RTHDMIAzAudService) -- C:\WINDOWS\SYSTEM32\DRIVERS\RtKHDMI.sys (Realtek Semiconductor Corp.)
DRV - (RTLE8023xp) -- C:\WINDOWS\SYSTEM32\DRIVERS\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (LMIRfsDriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (MPE) -- C:\WINDOWS\SYSTEM32\DRIVERS\MPE.sys (Microsoft Corporation)
DRV - (nm) -- C:\WINDOWS\SYSTEM32\DRIVERS\nmnt.sys (Microsoft Corporation)
DRV - (gameenum) -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) -- C:\WINDOWS\SYSTEM32\DRIVERS\usbaudio.sys (Microsoft Corporation)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\SYSTEM32\DRIVERS\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (LMIInfo) -- C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)
DRV - (yukonwxp) -- C:\WINDOWS\SYSTEM32\DRIVERS\yk51x86.sys (Marvell)
DRV - (LVcKap) -- C:\WINDOWS\SYSTEM32\DRIVERS\Lvckap.sys (Logitech Inc.)
DRV - (LVPr2Mon) -- C:\WINDOWS\SYSTEM32\DRIVERS\LVPr2Mon.sys ()
DRV - (LVMVDrv) -- C:\WINDOWS\SYSTEM32\DRIVERS\LVMVdrv.sys (Logitech Inc.)
DRV - (DNE) -- C:\WINDOWS\SYSTEM32\DRIVERS\dne2000.sys (Deterministic Networks, Inc.)
DRV - (MCSTRM) -- C:\WINDOWS\SYSTEM32\DRIVERS\mcstrm.sys (RealNetworks, Inc.)
DRV - (U6000ALL) HDTV110 TV Box(ALL) -- C:\WINDOWS\SYSTEM32\DRIVERS\dmdcap.sys ()
DRV - (AmdPPM) -- C:\WINDOWS\SYSTEM32\DRIVERS\AmdPPM.sys (Advanced Micro Devices)
DRV - (SCDEmu) -- C:\WINDOWS\SYSTEM32\DRIVERS\scdemu.sys (PowerISO Computing, Inc.)
DRV - (emuumidi) -- C:\WINDOWS\SYSTEM32\DRIVERS\emuumidi.sys (E-MU Systems)
DRV - (mirrorv3) -- C:\WINDOWS\SYSTEM32\DRIVERS\rminiv3.sys (Famatech International Corp.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\SYSTEM32\DRIVERS\alcxwdm.sys (Realtek Semiconductor Corp.)
DRV - (AnyDVD) -- C:\WINDOWS\SYSTEM32\DRIVERS\AnyDVD.sys (SlySoft, Inc.)
DRV - (Aspi32) -- C:\WINDOWS\SYSTEM32\DRIVERS\ASPI32.SYS (Adaptec)
DRV - (dvd_2K) -- C:\WINDOWS\SYSTEM32\DRIVERS\dvd_2k.sys (Sonic Solutions)
DRV - (mmc_2K) -- C:\WINDOWS\SYSTEM32\DRIVERS\mmc_2k.sys (Sonic Solutions)
DRV - (WUSB54GPV4SRV) -- C:\WINDOWS\SYSTEM32\DRIVERS\rt2500usb.sys (Ralink Technology Inc.)
DRV - (MDC8021X) WPA Security Protocol (IEEE 802.1x) -- C:\WINDOWS\SYSTEM32\DRIVERS\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (CX23880) -- C:\WINDOWS\SYSTEM32\DRIVERS\cx88vid.sys (Conexant Systems, Inc.)
DRV - (CX88XBAR) -- C:\WINDOWS\SYSTEM32\DRIVERS\cx88xbar.sys (Conexant Systems, Inc.)
DRV - (ElbyCDIO) -- C:\WINDOWS\SYSTEM32\DRIVERS\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (drvmcdb) -- C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (CdaC15BA) -- C:\WINDOWS\SYSTEM32\DRIVERS\CDAC15BA.SYS ()
DRV - (VGAUTI) -- C:\WINDOWS\SYSTEM32\DRIVERS\vgauti.sys ()
DRV - (cmudau) -- C:\WINDOWS\SYSTEM32\DRIVERS\cmudau.sys (C-Media Inc)
DRV - (DgiVecp) -- C:\WINDOWS\SYSTEM32\DRIVERS\DGIVECP.SYS (DeviceGuys, Inc.)
DRV - (SI3112r) -- C:\WINDOWS\system32\DRIVERS\SI3112r.sys (Silicon Image, Inc.)
DRV - (PalmUSBD) -- C:\WINDOWS\SYSTEM32\DRIVERS\PalmUSBD.sys (Palm, Inc.)
DRV - (NSNDIS5) -- C:\WINDOWS\SYSTEM32\nsndis5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (RD1006) -- C:\WINDOWS\SYSTEM32\DRIVERS\rdwm1006.sys (Roland Corporation)
DRV - (incdrm) -- C:\WINDOWS\SYSTEM32\DRIVERS\incdrm.sys (Ahead Software AG)
DRV - (AR5211) -- C:\WINDOWS\SYSTEM32\DRIVERS\ar5211.sys ()
DRV - (SiFilter) -- C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (GTNDIS5) -- C:\WINDOWS\SYSTEM32\GTNDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (nvnforce) Service for NVIDIA® nForce™ -- C:\WINDOWS\SYSTEM32\DRIVERS\nvapu.sys (NVIDIA Corporation)
DRV - (nvax) Service for NVIDIA® nForce™ -- C:\WINDOWS\SYSTEM32\DRIVERS\nvax.sys (NVIDIA Corporation)
DRV - (Ser2pl) -- C:\WINDOWS\SYSTEM32\DRIVERS\ser2pl.sys (Prolific Technology Inc.)
DRV - (NVENET) -- C:\WINDOWS\SYSTEM32\DRIVERS\NVENET.sys (NVIDIA Corporation)
DRV - (nv_agp) -- C:\WINDOWS\system32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (QCPro) Logitech QuickCam Pro USB(PID_D001) -- C:\WINDOWS\SYSTEM32\DRIVERS\p35u.sys (Logitech Inc.)
DRV - (ms_mpu401) -- C:\WINDOWS\SYSTEM32\DRIVERS\msmpu401.sys (Microsoft Corporation)
DRV - (s3legacy) -- C:\WINDOWS\SYSTEM32\DRIVERS\s3legacy.sys (Microsoft Corporation)
DRV - (HCF_MSFT) -- C:\WINDOWS\SYSTEM32\DRIVERS\HCF_MSFT.sys (Conexant)
DRV - (EL90XBC) -- C:\WINDOWS\SYSTEM32\DRIVERS\el90xbc5.sys (3Com Corporation)
DRV - (vsc32) -- C:\WINDOWS\SYSTEM32\DRIVERS\vsc.sys (Roland)
DRV - (RVIEGVST) -- C:\Program Files\Roland\Virtual Sound Canvas VST\RVIEg01VST.sys (Roland)
DRV - (RVIEG01) -- C:\Program Files\Roland\Virtual Sound Canvas DXi\RVIEg01.sys (Roland)
DRV - (sysid) -- C:\WINDOWS\SYSTEM32\DRIVERS\sysid.sys ()
DRV - (NetworkX) -- C:\WINDOWS\system32\ckldrv.sys ()
DRV - (aslm75) -- C:\WINDOWS\SYSTEM32\DRIVERS\ASLM75.SYS ()


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = MSN Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.msn.co...rst=1&noredir=1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\SYSTEM32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 0.0.0.0:80

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "engine://F%3A%5Cnetscape%5Csearchplugins%5CSBWeb_01.src"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.0.586
FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.2.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [email protected]:3.3.4
FF - prefs.js..extensions.enabledItems: {50997114-a686-4585-8fb9-ce1093a1cf75}:2.7.0.14
FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:7.1.20100408Wb1
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.3

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/12/18 15:14:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2010/03/05 21:23:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/06/08 00:40:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/25 14:28:33 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/01 17:50:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Components: f:\netscape\Components [2010/01/18 14:10:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Plugins: f:\netscape\Plugins [2010/06/21 21:40:11 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.2\Extensions\\Components: f:\netscape\Components [2010/01/18 14:10:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.2\Extensions\\Plugins: f:\netscape\Plugins [2010/06/21 21:40:11 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.3\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2009/07/22 22:44:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.3\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2010/06/01 17:50:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2009/07/22 22:44:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2010/06/01 17:50:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.1.0.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2009/07/22 22:44:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.1.0.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2010/06/01 17:50:31 | 000,000,000 | ---D | M]

[2009/06/11 18:19:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Extensions
[2008/05/21 22:32:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/06/11 18:19:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Extensions\[email protected]
[2010/07/25 14:43:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions
[2010/05/25 00:08:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/23 11:41:49 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/06/09 22:53:36 | 000,000,000 | ---D | M] (audiocandy.com Radio Toolbar) -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{50997114-a686-4585-8fb9-ce1093a1cf75}
[2009/06/13 14:28:31 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2007/01/04 15:12:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\[email protected]
[2010/03/24 18:04:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\[email protected]
[2010/07/11 15:00:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\[email protected]
[2009/05/06 08:39:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\[email protected]
[2008/09/21 18:56:18 | 000,000,900 | ---- | M] () -- C:\Documents and Settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\searchplugins\conduit.xml
[2010/07/25 14:43:10 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/05/23 22:31:25 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/05/29 09:18:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/01 13:58:18 | 000,023,000 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll
[2010/04/01 13:58:19 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll
[2008/04/10 16:00:54 | 000,044,360 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\atgpcdec.dll
[2008/04/10 16:00:54 | 000,107,928 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\atgpcext.dll
[2007/03/22 14:57:10 | 000,057,504 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll
[2010/04/12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2008/01/04 16:57:08 | 001,335,600 | ---- | M] (DivX,Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
[2008/01/07 18:14:26 | 000,098,304 | ---- | M] (DivX, Inc) -- C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
[2007/05/03 17:36:48 | 000,493,608 | ---- | M] (iLinc Communications, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\NPil86.dll
[2008/06/27 16:03:12 | 001,446,440 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
[2005/12/05 22:31:00 | 000,114,688 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npmozax.dll
[2003/11/18 13:37:32 | 000,241,664 | ---- | M] (Musicnotes, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npmusicn.dll
[2010/04/01 13:58:20 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
[2006/10/26 20:12:16 | 000,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
[2009/12/21 18:34:06 | 000,103,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
[2009/09/09 21:42:55 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
[2009/09/09 21:42:55 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
[2009/09/09 21:42:55 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
[2009/09/09 21:42:55 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
[2009/09/09 21:42:55 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
[2009/09/09 21:42:55 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
[2009/09/09 21:42:55 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
[2009/01/12 19:07:00 | 002,633,728 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npRACtrl.dll
[2005/08/09 13:42:54 | 000,057,344 | ---- | M] (America Online, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npunagi2.dll
[2007/07/18 15:54:00 | 000,245,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\unicows.dll
[2010/04/01 11:56:18 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml
[2010/04/01 11:56:18 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml
[2010/04/01 11:56:18 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml
[2010/04/01 11:56:18 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
[2010/04/01 11:56:18 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2010/04/01 11:56:18 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml
[2010/04/01 11:56:18 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: ([2010/07/08 10:56:14 | 000,411,183 | R--- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14235 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM32\msdxm.ocx ()
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [FinePrint Dispatcher v5] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe (FinePrint Software, LLC)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [vsc32cnf.exe] h:\Roland\VSC32\Vsc32Cnf.exe (Roland)
O4 - HKLM..\Run: [vscvol.exe] h:\Roland\VSC32\vscvol.exe (Roland)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\SYSTEM32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKLM..\RunOnceEx: [Flags] Reg Error: Invalid data type. File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 253
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun- = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun- = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 253
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EditLevel = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetHood = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFavoritesMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsHistory = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCommonGroups = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnforceShellExtensionSecurity = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetConnectDisconnect = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartBanner = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun- = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun- = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Open with BitPump - C:\Program Files\AnalogX\BitPump\ieint.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_20.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - Reg Error: Key error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe (America Online, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\Msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\Msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\SYSTEM32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\SYSTEM32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\SYSTEM32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000032 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000033 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000034 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000036 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000037 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000038 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000039 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000040 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000041 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000042 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000043 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000044 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000045 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000046 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000047 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000048 - C:\WINDOWS\SYSTEM32\mswsock.dll (Microsoft Corporation)
O12 - Plugin for: .pl - M:\INTERN~1\PLUGINS\NPSibelius.dll File not found
O15 - HKCU\..Trusted Domains: accountonline.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: line6.net ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {00000160-0000-0010-8000-00AA00389B71} http://codecs.micros...pha/msaudio.cab (Reg Error: Key error.)
O16 - DPF: {00000161-0000-0010-8000-00AA00389B71} http://codecs.micros...386/msaudio.cab (Reg Error: Key error.)
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} Reg Error: Value error. (SupportSoft SmartIssue)
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} Reg Error: Value error. (SupportSoft Script Runner Class)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} Reg Error: Value error. (QuickTime Object)
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {0B72CCA4-5F11-11D0-9CB5-0000C0EC9FDB} Reg Error: Value error. (Street Technologies ActiveX Control Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Reg Error: Key error.)
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} http://inst.c-wss.co...ml/gtdownlr.cab (Reg Error: Key error.)
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://codecs.micros...386/wmv9dmo.cab (Reg Error: Key error.)
O16 - DPF: {3A6514CD-A457-11D4-8AF3-000102686B79} http://www.bugnosis....oads/webbug.cab (Bugnosis)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} http://a1540.g.akama...meInstaller.exe (Reg Error: Key error.)
O16 - DPF: {4248083C-9656-11D2-8B7F-00105A17847A} http://mplayer.com/j...nup/mplayer.exe (Reg Error: Key error.)
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} Reg Error: Value error. (PWMediaSendControl Class)
O16 - DPF: {6D5FCFCB-FA6C-4CFB-9918-5F0A9F7365F2} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} Reg Error: Value error. (InstallShield International Setup Player)
O16 - DPF: {76A2A0AB-38B7-46DB-8E47-F10CDE4D7920} http://aerial.leepa....plugins/NCS.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8C6C6922-6258-44AC-9912-53964AC55276} http://217.160.140.6...d/xloader10.cab (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupd...7998.7923842593 (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CEBC955E-58AF-11D2-A30A-00A0C903492B} http://windowsupdate...en/actsetup.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} Reg Error: Value error. (ActiveDataObj Class)
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} Reg Error: Value error. (Live Collaboration)
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {FDC7A535-4070-4B92-A0EA-D9994BCC0DC5} Reg Error: Value error. (IERPCtl Class)
O16 - DPF: ChatSpace Java Client 2.1.0.84 http://63.102.227.45/Java/cs4ms084.cab (Reg Error: Key error.)
O16 - DPF: Dialpad Java Applet http://www.dialpad.c...et/src/vscp.cab (Reg Error: Key error.)
O16 - DPF: Dialpad US Java Applet http://www.dialpad.c...et/src/vscp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: Internet Explorer Classes for Java Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: Serome Web2Phone http://www.dialpad.com/applet/vscp.cab (Reg Error: Key error.)
O16 - DPF: Yahoo! Backgammon http://download.game...nts/y/at0_x.cab (Reg Error: Key error.)
O16 - DPF: Yahoo! PagerLite http://jpager.yahoo.com/m6/msgr.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 68.237.161.12
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\SYSTEM32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\SYSTEM32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\ole db\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\SYSTEM32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\SYSTEM32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\SYSTEM32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\SYSTEM32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\SYSTEM32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\SYSTEM32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\SYSTEM32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\SYSTEM32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\SYSTEM32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\SYSTEM32\browseui.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\CASTLE.BMP
O24 - Desktop BackupWallPaper: C:\WINDOWS\CASTLE.BMP
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {F552DDE6-2090-4bf4-B924-6141E87789A5} - q:\REGRUN~3\RRShell.dll File not found
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2002/05/07 17:24:24 | 000,000,928 | -HS- | M] () - C:\AUTOEXEC.BAK -- [ NTFS ]
O32 - AutoRun File - [2004/11/19 00:25:40 | 000,000,728 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2002/04/15 14:23:36 | 000,000,898 | -HS- | M] () - C:\AUTOEXEC.DOS -- [ NTFS ]
O32 - AutoRun File - [2000/06/21 17:17:56 | 000,001,014 | -HS- | M] () - C:\AUTOEXEC.OLD -- [ NTFS ]
O32 - AutoRun File - [2009/05/25 16:18:41 | 000,000,000 | ---D | M] - E:\auto hypnosis -- [ NTFS ]
O32 - AutoRun File - [2009/05/25 21:27:50 | 000,000,000 | ---D | M] - H:\Auto-Tune -- [ NTFS ]
O32 - AutoRun File - [2005/11/06 19:36:30 | 000,000,000 | ---D | M] - M:\autorun - list startup autoruns -- [ FAT32 ]
O32 - AutoRun File - [2007/09/26 23:02:52 | 000,000,063 | R--- | M] () - P:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/07/30 11:30:44 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Russell Alexander\Desktop\OTL.exe
[2010/07/20 11:34:38 | 000,000,000 | ---D | C] -- G:\My Documents\Any Video Converter
[2010/07/20 11:34:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Russell Alexander\Application Data\AnvSoft
[2010/07/18 12:57:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Russell Alexander\Application Data\Sony Corporation
[2010/07/18 12:57:26 | 000,000,000 | ---D | C] -- G:\My Documents\Sony PMB
[2010/07/13 14:39:51 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helpsvc.exe
[2010/07/12 14:30:07 | 000,052,296 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\WINDOWS\System32\drivers\PROCMON20.SYS
[2010/07/08 14:10:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Russell Alexander\Application Data\Mp3tag
[2010/07/08 10:48:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\COMODO
[2010/07/08 10:42:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Comodo Downloader
[2010/07/04 16:27:37 | 000,000,000 | ---D | C] -- C:\Program Files\ExamForce
[2010/07/04 16:27:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ExamForce
[2010/07/04 16:27:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{05D170EA-EFB5-452D-962D-D92C2A56BBAD}
[2010/07/03 13:52:47 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{5C3746DC-6E28-45B6-8913-E01C01F14227}
[2010/07/02 12:10:50 | 000,000,000 | ---D | C] -- C:\_OTL
[1 C:\WINDOWS\System\*.tmp files -> C:\WINDOWS\System\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/30 13:11:30 | 000,000,446 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{8DFA899A-AA07-44DE-8D3D-8F75C1C957F1}.job
[2010/07/30 12:40:47 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/30 12:40:46 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/30 12:40:00 | 000,001,026 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-362288127-839522115-1003UA.job
[2010/07/30 12:33:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/30 11:51:41 | 000,016,608 | ---- | M] (Windows ® 2000 DDK provider) -- C:\WINDOWS\gdrv.sys
[2010/07/30 11:51:27 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/30 11:51:05 | 000,178,544 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2010/07/30 11:33:46 | 025,427,968 | ---- | M] () -- C:\Documents and Settings\Russell Alexander\ntuser.dat
[2010/07/30 11:33:39 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Russell Alexander\ntuser.ini
[2010/07/30 10:18:42 | 000,133,632 | ---- | M] () -- C:\Documents and Settings\Russell Alexander\Desktop\RKUnhookerLE.EXE
[2010/07/30 02:40:01 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-362288127-839522115-1003Core.job
[2010/07/27 20:45:29 | 000,000,135 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/07/25 15:24:35 | 000,080,896 | ---- | M] () -- C:\Documents and Settings\Russell Alexander\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/21 12:07:39 | 000,000,425 | ---- | M] () -- C:\Documents and Settings\Russell Alexander\Desktop\Shortcut to movtoavi.exe.lnk
[2010/07/20 17:29:18 | 000,000,071 | ---- | M] () -- C:\WINDOWS\BBW_INFO.INI
[2010/07/20 11:34:25 | 000,000,392 | ---- | M] () -- C:\Documents and Settings\Russell Alexander\Desktop\Any Video Converter.lnk
[2010/07/19 21:33:26 | 000,013,206 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/07/19 21:03:24 | 003,190,496 | -H-- | M] () -- C:\Documents and Settings\Russell Alexander\Local Settings\Application Data\IconCache.db
[2010/07/19 11:42:09 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\Russell Alexander\Local Settings\Application Data\PUTTY.RND
[2010/07/15 18:52:44 | 000,003,121 | ---- | M] () -- G:\My Documents\RBF2010.nra
[2010/07/15 18:47:51 | 000,674,716 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/15 18:47:51 | 000,553,652 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/07/15 18:47:51 | 000,107,934 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/07/12 14:30:08 | 000,052,296 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\WINDOWS\System32\drivers\PROCMON20.SYS
[2010/07/08 14:46:09 | 000,042,904 | ---- | M] () -- C:\WINDOWS\CDPLAYER.INI
[2010/07/08 10:56:14 | 000,411,183 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/05 12:06:54 | 000,040,752 | ---- | M] () -- G:\My Documents\joanne_witch.jpg
[2010/07/02 12:27:35 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Russell Alexander\Desktop\OTL.exe
[2010/07/01 18:11:58 | 000,000,110 | ---- | M] () -- C:\WINDOWS\treeprt.ini
[1 C:\WINDOWS\System\*.tmp files -> C:\WINDOWS\System\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/30 10:18:42 | 000,133,632 | ---- | C] () -- C:\Documents and Settings\Russell Alexander\Desktop\RKUnhookerLE.EXE
[2010/07/21 12:07:39 | 000,000,425 | ---- | C] () -- C:\Documents and Settings\Russell Alexander\Desktop\Shortcut to movtoavi.exe.lnk
[2010/07/20 11:34:25 | 000,000,392 | ---- | C] () -- C:\Documents and Settings\Russell Alexander\Desktop\Any Video Converter.lnk
[2010/07/05 12:06:54 | 000,040,752 | ---- | C] () -- G:\My Documents\joanne_witch.jpg
[2010/07/01 14:24:07 | 000,003,121 | ---- | C] () -- G:\My Documents\RBF2010.nra
[2010/06/30 18:00:12 | 000,396,656 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/05/28 17:05:43 | 000,015,944 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/03/11 13:01:39 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2010/01/29 10:23:44 | 000,000,130 | ---- | C] () -- C:\WINDOWS\cfplogvw.INI
[2009/11/15 22:29:04 | 000,000,383 | ---- | C] () -- C:\WINDOWS\GearBox.ini
[2009/10/20 14:19:30 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2009/08/24 21:25:18 | 000,279,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2009/08/24 21:25:09 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2009/08/20 12:29:13 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009/08/20 12:29:13 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/08/20 12:28:00 | 000,000,036 | -H-- | C] () -- C:\WINDOWS\System32\swk.ini
[2009/06/30 10:48:40 | 000,000,459 | ---- | C] () -- C:\WINDOWS\avpr.ini
[2009/04/14 00:58:14 | 000,676,224 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2009/01/15 09:19:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009/01/15 09:19:00 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009/01/15 09:19:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009/01/15 09:19:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/12/16 04:50:46 | 000,032,768 | R--- | C] () -- C:\WINDOWS\System32\cmdrvrmu.dll
[2008/12/14 20:58:09 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\GTTunerCard.dll
[2008/12/14 20:58:09 | 000,237,646 | ---- | C] () -- C:\WINDOWS\System32\Snap_device.dll
[2008/12/14 20:58:08 | 000,069,707 | ---- | C] () -- C:\WINDOWS\System32\DISP_OPT1.dll
[2008/12/13 21:53:49 | 000,230,784 | R--- | C] () -- C:\WINDOWS\System32\drivers\dmdcap.sys
[2008/12/13 21:53:45 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2008/11/19 01:13:42 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcfriend.INI
[2008/11/04 00:29:20 | 000,002,294 | ---- | C] () -- C:\WINDOWS\U3DEDIT2.INI
[2008/09/12 20:40:30 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll
[2008/06/28 16:47:22 | 000,000,175 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2008/06/28 16:47:01 | 000,000,650 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2008/06/23 16:19:36 | 002,379,776 | ---- | C] () -- C:\WINDOWS\System32\tlvenh23.dll
[2008/05/26 17:00:02 | 000,001,762 | ---- | C] () -- C:\WINDOWS\System32\emuumidi.ini
[2008/05/26 17:00:02 | 000,000,038 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2008/03/28 16:22:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QuickInstall.INI
[2008/03/14 13:20:10 | 000,001,668 | ---- | C] () -- C:\WINDOWS\System32\WLAN.INI
[2008/02/22 00:26:44 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\GTW32N50.dll
[2008/01/04 16:57:22 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008/01/04 16:57:22 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008/01/04 16:56:24 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/10/11 18:59:24 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/07/04 23:01:31 | 000,002,777 | ---- | C] () -- C:\WINDOWS\TVC8XDrv.ini
[2007/06/19 08:59:36 | 000,070,400 | ---- | C] () -- C:\WINDOWS\System32\PhysXLoader.dll
[2007/04/20 07:57:30 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2007/04/20 07:57:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2007/03/22 14:57:50 | 000,051,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\atnt40k.sys
[2007/03/06 13:39:44 | 000,006,656 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsProbe.sys
[2007/02/09 18:59:33 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2007/02/09 18:59:32 | 000,471,552 | ---- | C] () -- C:\WINDOWS\System32\Smab.dll
[2007/02/08 00:07:50 | 000,000,144 | ---- | C] () -- C:\WINDOWS\Eudcedit.ini
[2007/02/04 15:17:09 | 000,003,082 | ---- | C] () -- C:\WINDOWS\System32\affv11300p3now.sys
[2007/01/30 12:24:14 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2007/01/23 14:11:42 | 000,000,107 | ---- | C] () -- C:\WINDOWS\IfoEdit.INI
[2007/01/15 19:33:18 | 000,002,307 | R--- | C] () -- C:\WINDOWS\Cmudau.ini
[2007/01/09 19:39:45 | 000,000,041 | ---- | C] () -- C:\WINDOWS\System32\ccafeaaaee_d.dll
[2006/11/03 19:49:11 | 000,000,958 | ---- | C] () -- C:\WINDOWS\APDFPRP.INI
[2006/11/03 19:16:11 | 000,000,095 | ---- | C] () -- C:\WINDOWS\crackpdf.INI
[2006/09/18 14:37:50 | 000,000,530 | ---- | C] () -- C:\WINDOWS\System32\tx12_ic.ini
[2006/09/18 14:37:48 | 000,667,280 | ---- | C] () -- C:\WINDOWS\System32\tx12.dll
[2006/06/26 00:57:04 | 000,000,048 | ---- | C] () -- C:\WINDOWS\FileNamesinQueue.ini
[2006/06/17 20:04:40 | 000,000,174 | ---- | C] () -- C:\WINDOWS\MyDrivers.ini
[2006/05/07 18:19:24 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ciaUni40.dll
[2006/03/06 10:41:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\AMV_DecDLL.dll
[2006/02/18 17:33:08 | 000,000,029 | ---- | C] () -- C:\WINDOWS\AudACM.ini
[2006/02/08 23:29:20 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\DVDEncoder.dll
[2006/02/07 12:59:00 | 000,000,067 | ---- | C] () -- C:\WINDOWS\Kingdia DVD Ripper.INI
[2006/02/07 11:28:47 | 000,000,067 | ---- | C] () -- C:\WINDOWS\Arc DVD Copy.INI
[2006/02/06 21:40:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2006/02/05 19:12:47 | 000,000,066 | ---- | C] () -- C:\WINDOWS\Speed Video Converter.INI
[2005/12/18 11:40:27 | 000,009,728 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.DLL
[2005/11/07 00:17:24 | 000,000,059 | ---- | C] () -- C:\WINDOWS\Crypkey.ini
[2005/11/07 00:17:21 | 000,024,608 | ---- | C] () -- C:\WINDOWS\System32\Ckldrv.sys
[2005/11/07 00:17:21 | 000,018,432 | ---- | C] () -- C:\WINDOWS\Setup_ck.dll
[2005/11/01 11:09:23 | 000,777,728 | ---- | C] () -- C:\WINDOWS\System32\SSLSVC.DLL
[2005/11/01 11:09:23 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\xmltok.dll
[2005/11/01 11:09:23 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\xmlparse.dll
[2005/11/01 11:09:22 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\lang_cfml.dll
[2005/11/01 11:09:22 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\xml_datagrove.dll
[2005/10/24 02:16:11 | 000,205,312 | R--- | C] () -- C:\WINDOWS\pw32a.dll
[2005/09/29 15:18:34 | 000,000,072 | ---- | C] () -- C:\WINDOWS\NPRiff.INI
[2005/09/04 22:56:54 | 000,468,480 | ---- | C] () -- C:\WINDOWS\System32\NMDll.dll
[2005/09/04 22:56:54 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\HDBHO.dll
[2005/09/04 22:56:54 | 000,020,480 | ---- | C] () -- C:\WINDOWS\yhl.dll
[2005/09/04 22:56:54 | 000,007,168 | ---- | C] () -- C:\WINDOWS\lq.dll
[2005/07/15 14:35:56 | 000,831,488 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2005/07/09 23:36:57 | 000,000,101 | ---- | C] () -- C:\WINDOWS\FCJCP.INI
[2005/06/24 10:18:40 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\muangsys.dll
[2005/06/24 10:18:40 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\muadisp.dll
[2005/05/12 03:23:54 | 000,000,026 | ---- | C] () -- C:\WINDOWS\FPKPMSV.INI
[2005/04/20 02:02:46 | 000,000,004 | ---- | C] () -- C:\WINDOWS\System32\micr0st.dll
[2005/04/15 10:41:12 | 000,005,568 | ---- | C] () -- C:\WINDOWS\System32\drivers\sysid.sys
[2005/04/15 02:16:02 | 000,000,931 | ---- | C] () -- C:\WINDOWS\PVAStrumento.ini
[2005/02/26 18:47:05 | 000,351,776 | R--- | C] () -- C:\WINDOWS\System32\drivers\ar5211.sys
[2005/02/26 18:47:05 | 000,351,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar52119x.sys
[2005/02/22 04:24:05 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2005/02/21 02:02:21 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2005/02/16 07:33:05 | 000,523,264 | ---- | C] () -- C:\WINDOWS\System32\pano12.dll
[2005/02/05 08:38:20 | 000,536,576 | ---- | C] () -- C:\WINDOWS\System32\CIASecurity.dll
[2005/02/03 01:30:22 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\sysinfo.sys
[2005/01/28 11:59:39 | 000,000,016 | ---- | C] () -- C:\WINDOWS\System32\mswin32.drv
[2005/01/23 17:06:31 | 000,000,048 | ---- | C] () -- C:\WINDOWS\QFNONL.INI
[2004/12/31 13:15:06 | 000,000,351 | ---- | C] () -- C:\WINDOWS\WHOffice.INI
[2004/12/18 11:13:52 | 000,000,135 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2004/11/30 04:10:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\besched.dll
[2004/11/22 00:55:02 | 000,000,139 | ---- | C] () -- C:\WINDOWS\msicpl.ini
[2004/11/21 12:28:35 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\NMH040A.DLL
[2004/11/21 02:42:52 | 000,011,376 | ---- | C] () -- C:\WINDOWS\System32\drivers\CDAC15BA.SYS
[2004/11/20 16:19:05 | 000,000,010 | ---- | C] () -- C:\WINDOWS\System32\wfxhelp21.dll
[2004/11/20 12:10:55 | 000,000,038 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2004/11/20 11:28:56 | 000,038,401 | ---- | C] () -- C:\WINDOWS\System32\RdCi1006.dll
[2004/11/20 11:09:29 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS4w.DLL
[2004/11/20 09:45:36 | 000,018,253 | ---- | C] () -- C:\WINDOWS\System32\ssnvfx.ini
[2004/11/20 09:40:40 | 000,006,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASLM75.SYS
[2004/11/20 09:36:01 | 000,003,611 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2004/11/20 09:35:59 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2004/11/20 03:10:14 | 000,172,128 | ---- | C] () -- C:\WINDOWS\HOST.INI
[2004/11/20 03:10:14 | 000,006,596 | ---- | C] () -- C:\WINDOWS\Astro.INI
[2004/11/20 03:10:14 | 000,005,737 | ---- | C] () -- C:\WINDOWS\pixcache.ini
[2004/11/20 03:10:14 | 000,002,472 | ---- | C] () -- C:\WINDOWS\INTUPROF.INI
[2004/11/20 03:10:14 | 000,002,297 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2004/11/20 03:10:14 | 000,001,604 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2004/11/20 03:10:14 | 000,001,401 | ---- | C] () -- C:\WINDOWS\webpos2.ini
[2004/11/20 03:10:14 | 000,001,205 | ---- | C] () -- C:\WINDOWS\HPFdjc16.ini
[2004/11/20 03:10:14 | 000,000,751 | ---- | C] () -- C:\WINDOWS\Bti.ini
[2004/11/20 03:10:14 | 000,000,641 | ---- | C] () -- C:\WINDOWS\letsdraw.ini
[2004/11/20 03:10:14 | 000,000,546 | ---- | C] () -- C:\WINDOWS\epspmgr4.ini
[2004/11/20 03:10:14 | 000,000,530 | ---- | C] () -- C:\WINDOWS\Audition.ini
[2004/11/20 03:10:14 | 000,000,442 | ---- | C] () -- C:\WINDOWS\hpfsched.ini
[2004/11/20 03:10:14 | 000,000,316 | ---- | C] () -- C:\WINDOWS\BELT.INI
[2004/11/20 03:10:14 | 000,000,217 | ---- | C] () -- C:\WINDOWS\vidwiz.ini
[2004/11/20 03:10:14 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2004/11/20 03:10:14 | 000,000,124 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2004/11/20 03:10:14 | 000,000,108 | ---- | C] () -- C:\WINDOWS\epconfig.ini
[2004/11/20 03:10:14 | 000,000,083 | ---- | C] () -- C:\WINDOWS\IMPORTCLIENT.INI
[2004/11/20 03:10:14 | 000,000,041 | ---- | C] () -- C:\WINDOWS\winampa.ini
[2004/11/20 03:10:13 | 000,042,904 | ---- | C] () -- C:\WINDOWS\CDPLAYER.INI
[2004/11/20 03:10:13 | 000,025,607 | ---- | C] () -- C:\WINDOWS\CSTBOX.INI
[2004/11/20 03:10:13 | 000,022,109 | ---- | C] () -- C:\WINDOWS\cool.ini
[2004/11/20 03:10:13 | 000,012,327 | ---- | C] () -- C:\WINDOWS\IOS.INI
[2004/11/20 03:10:13 | 000,011,568 | ---- | C] () -- C:\WINDOWS\CDEX.INI
[2004/11/20 03:10:13 | 000,010,677 | ---- | C] () -- C:\WINDOWS\coolkb2k.ini
[2004/11/20 03:10:13 | 000,008,893 | ---- | C] () -- C:\WINDOWS\NETDET.INI
[2004/11/20 03:10:13 | 000,006,553 | ---- | C] () -- C:\WINDOWS\COUNTRY.INI
[2004/11/20 03:10:13 | 000,005,617 | R--- | C] () -- C:\WINDOWS\msosetup.ini
[2004/11/20 03:10:13 | 000,005,253 | ---- | C] () -- C:\WINDOWS\GWPRESET.INI
[2004/11/20 03:10:13 | 000,005,068 | ---- | C] () -- C:\WINDOWS\DELETEFI.INI
[2004/11/20 03:10:13 | 000,004,260 | ---- | C] () -- C:\WINDOWS\firstaid.ini
[2004/11/20 03:10:13 | 000,003,598 | ---- | C] () -- C:\WINDOWS\HTMLHELP.INI
[2004/11/20 03:10:13 | 000,003,555 | ---- | C] () -- C:\WINDOWS\GWS.INI
[2004/11/20 03:10:13 | 000,003,148 | ---- | C] () -- C:\WINDOWS\TELEPHON.INI
[2004/11/20 03:10:13 | 000,002,707 | ---- | C] () -- C:\WINDOWS\WPUNIMIX.INI
[2004/11/20 03:10:13 | 000,002,481 | ---- | C] () -- C:\WINDOWS\WINCODE.INI
[2004/11/20 03:10:13 | 000,002,443 | ---- | C] () -- C:\WINDOWS\HPFCSS16.INI
[2004/11/20 03:10:13 | 000,002,292 | ---- | C] () -- C:\WINDOWS\7THLEVEL.INI
[2004/11/20 03:10:13 | 000,002,034 | ---- | C] () -- C:\WINDOWS\DATAFAX.INI
[2004/11/20 03:10:13 | 000,002,001 | ---- | C] () -- C:\WINDOWS\U3DEDIT.INI
[2004/11/20 03:10:13 | 000,001,944 | ---- | C] () -- C:\WINDOWS\FORGE32.INI
[2004/11/20 03:10:13 | 000,001,856 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/11/20 03:10:13 | 000,001,778 | ---- | C] () -- C:\WINDOWS\gvox.ini
[2004/11/20 03:10:13 | 000,001,770 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI
[2004/11/20 03:10:13 | 000,001,370 | ---- | C] () -- C:\WINDOWS\tefview.ini
[2004/11/20 03:10:13 | 000,001,357 | ---- | C] () -- C:\WINDOWS\PLTWIN02.INI
[2004/11/20 03:10:13 | 000,001,165 | ---- | C] () -- C:\WINDOWS\GL_MMP.INI
[2004/11/20 03:10:13 | 000,001,047 | ---- | C] () -- C:\WINDOWS\pae.ini
[2004/11/20 03:10:13 | 000,001,043 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2004/11/20 03:10:13 | 000,000,940 | ---- | C] () -- C:\WINDOWS\MEDIAPAQ.INI
[2004/11/20 03:10:13 | 000,000,865 | ---- | C] () -- C:\WINDOWS\DOSREP.INI
[2004/11/20 03:10:13 | 000,000,856 | ---- | C] () -- C:\WINDOWS\PRESS BLASTER.INI
[2004/11/20 03:10:13 | 000,000,787 | ---- | C] () -- C:\WINDOWS\SCANREG.INI
[2004/11/20 03:10:13 | 000,000,767 | ---- | C] () -- C:\WINDOWS\efscan.ini
[2004/11/20 03:10:13 | 000,000,764 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2004/11/20 03:10:13 | 000,000,763 | ---- | C] () -- C:\WINDOWS\rtcwgoty.INI
[2004/11/20 03:10:13 | 000,000,739 | ---- | C] () -- C:\WINDOWS\Mpcwin02.ini
[2004/11/20 03:10:13 | 000,000,666 | ---- | C] () -- C:\WINDOWS\clikbook.ini
[2004/11/20 03:10:13 | 000,000,634 | ---- | C] () -- C:\WINDOWS\QIII.INI
[2004/11/20 03:10:13 | 000,000,581 | ---- | C] () -- C:\WINDOWS\goldwave.ini
[2004/11/20 03:10:13 | 000,000,549 | ---- | C] () -- C:\WINDOWS\rsagent.ini
[2004/11/20 03:10:13 | 000,000,448 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2004/11/20 03:10:13 | 000,000,445 | ---- | C] () -- C:\WINDOWS\CTDEL.INI
[2004/11/20 03:10:13 | 000,000,436 | ---- | C] () -- C:\WINDOWS\LAPLAYER.INI
[2004/11/20 03:10:13 | 000,000,404 | ---- | C] () -- C:\WINDOWS\TSCKL.INI
[2004/11/20 03:10:13 | 000,000,394 | ---- | C] () -- C:\WINDOWS\ACROREAD.INI
[2004/11/20 03:10:13 | 000,000,382 | ---- | C] () -- C:\WINDOWS\MSREGUSR.INI
[2004/11/20 03:10:13 | 000,000,364 | ---- | C] () -- C:\WINDOWS\NETSCAPE.INI
[2004/11/20 03:10:13 | 000,000,337 | ---- | C] () -- C:\WINDOWS\MIDIPLYR.INI
[2004/11/20 03:10:13 | 000,000,336 | ---- | C] () -- C:\WINDOWS\dffont.ini
[2004/11/20 03:10:13 | 000,000,320 | ---- | C] () -- C:\WINDOWS\Fwupload.ini
[2004/11/20 03:10:13 | 000,000,305 | ---- | C] () -- C:\WINDOWS\Rdin0006.ini
[2004/11/20 03:10:13 | 000,000,300 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2004/11/20 03:10:13 | 000,000,300 | ---- | C] () -- C:\WINDOWS\JETSUITE.INI
[2004/11/20 03:10:13 | 000,000,296 | ---- | C] () -- C:\WINDOWS\moffice.ini
[2004/11/20 03:10:13 | 000,000,263 | ---- | C] () -- C:\WINDOWS\WAVEPLYR.INI
[2004/11/20 03:10:13 | 000,000,259 | ---- | C] () -- C:\WINDOWS\cbtsys.ini
[2004/11/20 03:10:13 | 000,000,247 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2004/11/20 03:10:13 | 000,000,247 | ---- | C] () -- C:\WINDOWS\MPPAGER.INI
[2004/11/20 03:10:13 | 000,000,243 | ---- | C] () -- C:\WINDOWS\HOMESITE.ini
[2004/11/20 03:10:13 | 000,000,240 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2004/11/20 03:10:13 | 000,000,237 | ---- | C] () -- C:\WINDOWS\swacnfg.ini
[2004/11/20 03:10:13 | 000,000,231 | ---- | C] () -- C:\WINDOWS\Ac3api.ini
[2004/11/20 03:10:13 | 000,000,217 | ---- | C] () -- C:\WINDOWS\oh4win.INI
[2004/11/20 03:10:13 | 000,000,214 | ---- | C] () -- C:\WINDOWS\CJBMF.INI
[2004/11/20 03:10:13 | 000,000,205 | ---- | C] () -- C:\WINDOWS\pcmagcd.ini
[2004/11/20 03:10:13 | 000,000,204 | ---- | C] () -- C:\WINDOWS\rtpatch.ini
[2004/11/20 03:10:13 | 000,000,194 | ---- | C] () -- C:\WINDOWS\appr.ini
[2004/11/20 03:10:13 | 000,000,190 | ---- | C] () -- C:\WINDOWS\ctsyn.ini
[2004/11/20 03:10:13 | 000,000,187 | ---- | C] () -- C:\WINDOWS\PROFILER.INI
[2004/11/20 03:10:13 | 000,000,186 | ---- | C] () -- C:\WINDOWS\HEXpert.ini
[2004/11/20 03:10:13 | 000,000,178 | ---- | C] () -- C:\WINDOWS\TESTOUT.INI
[2004/11/20 03:10:13 | 000,000,171 | ---- | C] () -- C:\WINDOWS\INTUIT.INI
[2004/11/20 03:10:13 | 000,000,157 | ---- | C] () -- C:\WINDOWS\VSTUDIO.INI
[2004/11/20 03:10:13 | 000,000,156 | ---- | C] () -- C:\WINDOWS\JustAudio.ini
[2004/11/20 03:10:13 | 000,000,153 | ---- | C] () -- C:\WINDOWS\ThumbsCD.ini
[2004/11/20 03:10:13 | 000,000,143 | ---- | C] () -- C:\WINDOWS\SYSMIXER.INI
[2004/11/20 03:10:13 | 000,000,131 | ---- | C] () -- C:\WINDOWS\NETSPEED.INI
[2004/11/20 03:10:13 | 000,000,127 | ---- | C] () -- C:\WINDOWS\MRCLOCK.INI
[2004/11/20 03:10:13 | 000,000,127 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
[2004/11/20 03:10:13 | 000,000,123 | ---- | C] () -- C:\WINDOWS\SURFSTATS.INI
[2004/11/20 03:10:13 | 000,000,121 | ---- | C] () -- C:\WINDOWS\WILD.INI
[2004/11/20 03:10:13 | 000,000,120 | ---- | C] () -- C:\WINDOWS\WINFILE.INI
[2004/11/20 03:10:13 | 000,000,116 | ---- | C] () -- C:\WINDOWS\MEDIARCK.INI
[2004/11/20 03:10:13 | 000,000,116 | ---- | C] () -- C:\WINDOWS\IELnkbak.ini
[2004/11/20 03:10:13 | 000,000,114 | ---- | C] () -- C:\WINDOWS\CDPLYR.INI
[2004/11/20 03:10:13 | 000,000,110 | ---- | C] () -- C:\WINDOWS\treeprt.ini
[2004/11/20 03:10:13 | 000,000,105 | ---- | C] () -- C:\WINDOWS\mapiuid.ini
[2004/11/20 03:10:13 | 000,000,102 | ---- | C] () -- C:\WINDOWS\UABMAIN.INI
[2004/11/20 03:10:13 | 000,000,095 | ---- | C] () -- C:\WINDOWS\WAVEMAN.INI
[2004/11/20 03:10:13 | 000,000,091 | ---- | C] () -- C:\WINDOWS\ap_bat.ini
[2004/11/20 03:10:13 | 000,000,083 | ---- | C] () -- C:\WINDOWS\photos30.ini
[2004/11/20 03:10:13 | 000,000,081 | ---- | C] () -- C:\WINDOWS\JAUDIO.INI
[2004/11/20 03:10:13 | 000,000,076 | ---- | C] () -- C:\WINDOWS\MC.INI
[2004/11/20 03:10:13 | 000,000,071 | ---- | C] () -- C:\WINDOWS\BBW_INFO.INI
[2004/11/20 03:10:13 | 000,000,070 | ---- | C] () -- C:\WINDOWS\efaxview.ini
[2004/11/20 03:10:13 | 000,000,070 | ---- | C] () -- C:\WINDOWS\asym.ini
[2004/11/20 03:10:13 | 000,000,068 | ---- | C] () -- C:\WINDOWS\MYNAPSTER.INI
[2004/11/20 03:10:13 | 000,000,068 | ---- | C] () -- C:\WINDOWS\FPXPRESS.INI
[2004/11/20 03:10:13 | 000,000,066 | ---- | C] () -- C:\WINDOWS\ds2000.ini
[2004/11/20 03:10:13 | 000,000,064 | ---- | C] () -- C:\WINDOWS\SETSCAN.INI
[2004/11/20 03:10:13 | 000,000,064 | ---- | C] () -- C:\WINDOWS\Patch.ini
[2004/11/20 03:10:13 | 000,000,063 | ---- | C] () -- C:\WINDOWS\CTDELLAU.INI
[2004/11/20 03:10:13 | 000,000,061 | ---- | C] () -- C:\WINDOWS\URLPROXY.INI
[2004/11/20 03:10:13 | 000,000,060 | ---- | C] () -- C:\WINDOWS\ZDDBVIEW.INI
[2004/11/20 03:10:13 | 000,000,060 | ---- | C] () -- C:\WINDOWS\POWERPNT.INI
[2004/11/20 03:10:13 | 000,000,058 | ---- | C] () -- C:\WINDOWS\WDIRECT.INI
[2004/11/20 03:10:13 | 000,000,058 | ---- | C] () -- C:\WINDOWS\JUSTAUDIO_BASE.INI
[2004/11/20 03:10:13 | 000,000,057 | ---- | C] () -- C:\WINDOWS\m2khd.ini
[2004/11/20 03:10:13 | 000,000,054 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2004/11/20 03:10:13 | 000,000,054 | ---- | C] () -- C:\WINDOWS\TCWIN.INI
[2004/11/20 03:10:13 | 000,000,054 | ---- | C] () -- C:\WINDOWS\setihome.ini
[2004/11/20 03:10:13 | 000,000,053 | ---- | C] () -- C:\WINDOWS\BYCLEAN.INI
[2004/11/20 03:10:13 | 000,000,051 | ---- | C] () -- C:\WINDOWS\NSREX.INI
[2004/11/20 03:10:13 | 000,000,044 | ---- | C] () -- C:\WINDOWS\EXCHNG32.INI
[2004/11/20 03:10:13 | 000,000,041 | ---- | C] () -- C:\WINDOWS\FILERECOVER.INI
[2004/11/20 03:10:13 | 000,000,039 | ---- | C] () -- C:\WINDOWS\VIDEOWAVE.INI
[2004/11/20 03:10:13 | 000,000,038 | ---- | C] () -- C:\WINDOWS\magix.ini
[2004/11/20 03:10:13 | 000,000,038 | ---- | C] () -- C:\WINDOWS\dswplug.ini
[2004/11/20 03:10:13 | 000,000,037 | ---- | C] () -- C:\WINDOWS\PROSYS.INI
[2004/11/20 03:10:13 | 000,000,037 | ---- | C] () -- C:\WINDOWS\JRMXDLL.INI
[2004/11/20 03:10:13 | 000,000,037 | ---- | C] () -- C:\WINDOWS\FZDUMP.INI
[2004/11/20 03:10:13 | 000,000,037 | ---- | C] () -- C:\WINDOWS\coolmp3.ini
[2004/11/20 03:10:13 | 000,000,036 | ---- | C] () -- C:\WINDOWS\CYBERD.INI
[2004/11/20 03:10:13 | 000,000,035 | ---- | C] () -- C:\WINDOWS\A4W.INI
[2004/11/20 03:10:13 | 000,000,032 | ---- | C] () -- C:\WINDOWS\aebpr.ini
[2004/11/20 03:10:13 | 000,000,030 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2004/11/20 03:10:13 | 000,000,028 | ---- | C] () -- C:\WINDOWS\LAVAPLAY.INI
[2004/11/20 03:10:13 | 000,000,027 | ---- | C] () -- C:\WINDOWS\ACROGRAF.INI
[2004/11/20 03:10:13 | 000,000,026 | ---- | C] () -- C:\WINDOWS\NDW.INI
[2004/11/20 03:10:13 | 000,000,026 | ---- | C] () -- C:\WINDOWS\cleantray.ini
[2004/11/20 03:10:13 | 000,000,024 | ---- | C] () -- C:\WINDOWS\TB60.INI
[2004/11/20 03:10:13 | 000,000,024 | ---- | C] () -- C:\WINDOWS\SOL.INI
[2004/11/20 03:10:13 | 000,000,024 | ---- | C] () -- C:\WINDOWS\ms_shell.ini
[2004/11/20 03:10:13 | 000,000,024 | ---- | C] () -- C:\WINDOWS\@loha.ini
[2004/11/20 03:10:13 | 000,000,022 | ---- | C] () -- C:\WINDOWS\SHAREMEM.INI
[2004/11/20 03:10:13 | 000,000,020 | ---- | C] () -- C:\WINDOWS\MP3com103best.ini
[2004/11/20 03:10:13 | 000,000,015 | ---- | C] () -- C:\WINDOWS\MTB40.INI
[2004/11/20 03:10:13 | 000,000,011 | ---- | C] () -- C:\WINDOWS\Msdevctl.ini
[2004/11/04 16:08:33 | 000,229,376 | ---- | C] () -- C:\WINDOWS\System32\ISP2000.dll
[2004/09/24 10:00:36 | 000,039,208 | ---- | C] () -- C:\WINDOWS\System32\drivers\vgauti.sys
[2004/09/24 09:58:38 | 000,039,208 | ---- | C] () -- C:\WINDOWS\System32\drivers\msicpl.sys
[2004/09/24 01:38:41 | 000,189,952 | ---- | C] () -- C:\WINDOWS\QCARD32.DLL
[2004/09/16 13:26:40 | 000,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/09/11 19:36:40 | 000,009,728 | ---- | C] () -- C:\WINDOWS\System32\sysinfoX64.sys
[2004/07/20 20:15:15 | 000,022,464 | ---- | C] () -- C:\WINDOWS\System32\USB2SER.SYS
[2004/07/12 17:07:21 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll
[2004/05/05 23:32:52 | 000,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll
[2004/05/05 23:32:52 | 000,023,552 | ---- | C] () -- C:\WINDOWS\xobglu32.dll
[2004/03/08 19:15:44 | 000,000,002 | ---- | C] () -- C:\WINDOWS\r105t1.dll
[2004/02/18 18:32:39 | 000,905,290 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2004/02/10 19:15:36 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2004/01/27 07:13:02 | 000,421,888 | ---- | C] () -- C:\WINDOWS\System32\OpenQuicktimeLib_dec.dll
[2003/10/02 01:00:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lockout.dll
[2003/10/02 01:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\lockres.dll
[2003/07/10 19:54:47 | 000,335,872 | ---- | C] () -- C:\WINDOWS\System32\ldf252.dll
[2003/05/25 14:57:06 | 000,000,016 | ---- | C] () -- C:\WINDOWS\MOUSEDRW.DLL
[2003/05/22 09:06:21 | 000,071,749 | ---- | C] () -- C:\WINDOWS\HCExtOutput.dll
[2003/05/14 07:37:10 | 000,009,472 | ---- | C] () -- C:\WINDOWS\unsqz.dll
[2003/05/14 07:37:07 | 000,205,312 | R--- | C] () -- C:\WINDOWS\patchw32.A534.dll
[2003/05/14 07:37:07 | 000,164,864 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[2003/05/14 07:37:07 | 000,000,117 | ---- | C] () -- C:\WINDOWS\smp32.dll
[2003/05/14 07:37:05 | 000,081,920 | ---- | C] () -- C:\WINDOWS\asr32311.dll
[2003/05/14 07:37:05 | 000,001,846 | ---- | C] () -- C:\WINDOWS\br.dll
[2003/05/14 07:37:04 | 000,000,380 | ---- | C] () -- C:\WINDOWS\WINRDP10.SYS
[2003/05/14 07:36:52 | 000,001,077 | ---- | C] () -- C:\WINDOWS\Mgxclean.sys
[2003/05/14 07:36:51 | 000,025,600 | ---- | C] () -- C:\WINDOWS\MEMBOOT.DLL
[2003/05/14 07:36:50 | 000,187,392 | ---- | C] () -- C:\WINDOWS\LTANN62N.DLL
[2003/05/14 07:36:50 | 000,175,616 | ---- | C] () -- C:\WINDOWS\LFFAX62N.DLL
[2003/05/14 07:36:50 | 000,158,720 | ---- | C] () -- C:\WINDOWS\LFCMP62N.DLL
[2003/05/14 07:36:50 | 000,110,080 | ---- | C] () -- C:\WINDOWS\LFPNG62N.DLL
[2003/05/14 07:36:50 | 000,076,288 | ---- | C] () -- C:\WINDOWS\LTIMG62N.DLL
[2003/05/14 07:36:50 | 000,047,616 | ---- | C] () -- C:\WINDOWS\LFTIF62N.DLL
[2003/05/14 07:36:50 | 000,043,008 | ---- | C] () -- C:\WINDOWS\LTFIL62N.DLL
[2003/05/14 07:36:50 | 000,029,184 | ---- | C] () -- C:\WINDOWS\LTWND62N.DLL
[2003/05/14 07:36:50 | 000,027,136 | ---- | C] () -- C:\WINDOWS\LFLMA62N.DLL
[2003/05/14 07:36:50 | 000,024,576 | ---- | C] () -- C:\WINDOWS\LFICA62N.DLL
[2003/05/14 07:36:50 | 000,024,064 | ---- | C] () -- C:\WINDOWS\LTTWN62N.DLL
[2003/05/14 07:36:50 | 000,023,552 | ---- | C] () -- C:\WINDOWS\LFPCX62N.DLL
[2003/05/14 07:36:50 | 000,023,552 | ---- | C] () -- C:\WINDOWS\LFLMB62N.DLL
[2003/05/14 07:36:50 | 000,022,528 | ---- | C] () -- C:\WINDOWS\LFEPS62N.DLL
[2003/05/14 07:36:50 | 000,022,016 | ---- | C] () -- C:\WINDOWS\LFPCT62N.DLL
[2003/05/14 07:36:50 | 000,022,016 | ---- | C] () -- C:\WINDOWS\LFGIF62N.DLL
[2003/05/14 07:36:50 | 000,022,016 | ---- | C] () -- C:\WINDOWS\LFBMP62N.DLL
[2003/05/14 07:36:50 | 000,020,480 | ---- | C] () -- C:\WINDOWS\LFPSD62N.DLL
[2003/05/14 07:36:50 | 000,019,968 | ---- | C] () -- C:\WINDOWS\LFWMF62N.DLL
[2003/05/14 07:36:50 | 000,019,968 | ---- | C] () -- C:\WINDOWS\LFTGA62N.DLL
[2003/05/14 07:36:50 | 000,019,456 | ---- | C] () -- C:\WINDOWS\LFWPG62N.DLL
[2003/05/14 07:36:50 | 000,018,944 | ---- | C] () -- C:\WINDOWS\LFIMG62N.DLL
[2003/05/14 07:36:50 | 000,018,432 | ---- | C] () -- C:\WINDOWS\LFRAS62N.DLL
[2003/05/14 07:36:50 | 000,018,432 | ---- | C] () -- C:\WINDOWS\LFMSP62N.DLL
[2003/05/14 07:36:50 | 000,017,920 | ---- | C] () -- C:\WINDOWS\LFMAC62N.DLL
[2003/05/14 07:36:50 | 000,017,920 | ---- | C] () -- C:\WINDOWS\LFCAL62N.DLL
[2003/05/14 07:36:50 | 000,017,408 | ---- | C] () -- C:\WINDOWS\LFWFX62N.DLL
[2003/05/14 07:36:49 | 000,058,368 | ---- | C] () -- C:\WINDOWS\ICQMAPI.DLL
[2003/05/14 07:36:49 | 000,035,328 | ---- | C] () -- C:\WINDOWS\INETWH32.DLL
[2003/05/14 07:36:49 | 000,009,136 | ---- | C] () -- C:\WINDOWS\INETWH16.DLL
[2003/05/14 07:36:44 | 000,202,752 | ---- | C] () -- C:\WINDOWS\CDAC14BA.DLL
[2003/05/14 07:36:43 | 000,038,400 | ---- | C] () -- C:\WINDOWS\ARSENAL.DLL
[2003/03/25 05:49:02 | 000,152,064 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2003/03/25 05:49:02 | 000,066,560 | ---- | C] () -- C:\WINDOWS\System32\atiyuv12.dll
[2003/03/07 02:05:46 | 000,115,712 | ---- | C] () -- C:\WINDOWS\System32\Crush32.dll
[2002/12/19 21:15:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\SAWZip.dll
[2002/08/28 11:42:10 | 000,016,973 | ---- | C] () -- C:\WINDOWS\System32\ZWebAuth.dll
[2002/08/14 13:39:05 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\Oxfwapi.dll
[2002/07/28 01:03:15 | 000,308,928 | ---- | C] () -- C:\WINDOWS\System32\ivflt08.dll
[2002/07/28 01:03:10 | 000,211,456 | ---- | C] () -- C:\WINDOWS\System32\ivbas08.dll
[2002/06/18 22:35:00 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\Msvcrt10.dll
[2002/05/20 18:34:58 | 000,041,047 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll
[2002/05/20 16:29:56 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\PTISTP.DLL
[2002/05/18 14:08:12 | 000,107,008 | ---- | C] () -- C:\WINDOWS\System32\FXTLS432.DLL
[2002/05/11 11:26:39 | 000,043,008 | ---- | C] () -- C:\WINDOWS\System32\LTFIL61N.DLL
[2002/05/11 11:26:39 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFGIF61N.DLL
[2002/05/11 11:26:39 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\LFTGA61N.DLL
[2002/05/11 11:26:38 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\LFFAX61N.DLL
[2002/05/11 11:26:38 | 000,158,720 | ---- | C] () -- C:\WINDOWS\System32\LFCMP61N.DLL
[2002/05/11 11:26:38 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\LFPNG61N.DLL
[2002/05/11 11:26:38 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\LFTIF61N.DLL
[2002/05/11 11:26:38 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\LFPCX61N.DLL
[2002/05/11 11:26:38 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\LFPCD61N.DLL
[2002/05/07 16:26:28 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\xfxdll.dll
[2002/05/07 16:24:57 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\WAVhsp32.dll
[2002/05/07 16:24:57 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Wavlbsys.dll
[2002/05/07 16:24:39 | 000,115,712 | ---- | C] () -- C:\WINDOWS\System32\vboxp403.dll.bak
[2002/05/07 16:24:05 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
[2002/05/07 16:24:03 | 000,377,856 | ---- | C] () -- C:\WINDOWS\System32\tx32.dll
[2002/05/07 16:23:58 | 000,121,856 | ---- | C] () -- C:\WINDOWS\System32\tsd2.dll
[2002/05/07 16:23:57 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\treeprt.dll
[2002/05/07 16:22:58 | 000,141,824 | ---- | C] () -- C:\WINDOWS\System32\SETUPLIB.DLL
[2002/05/07 16:22:20 | 000,061,952 | ---- | C] () -- C:\WINDOWS\System32\rmmerge2.DLL
[2002/05/07 16:22:20 | 000,009,728 | ---- | C] () -- C:\WINDOWS\System32\rmevents.DLL
[2002/05/07 16:22:18 | 000,270,336 | ---- | C] () -- C:\WINDOWS\System32\regxplor.dll
[2002/05/07 16:21:57 | 000,471,040 | ---- | C] () -- C:\WINDOWS\System32\QTExporter.dll
[2002/05/07 16:21:52 | 000,280,576 | ---- | C] () -- C:\WINDOWS\System32\pxd_kom.dll
[2002/05/07 16:21:16 | 000,026,112 | ---- | C] () -- C:\WINDOWS\System32\PIXTHK32.DLL
[2002/05/07 16:20:59 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL
[2002/05/07 16:20:50 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\Nmocod.dll
[2002/05/07 16:13:14 | 001,513,984 | ---- | C] () -- C:\WINDOWS\System32\MgxRdr80.dll
[2002/05/07 16:12:48 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\LPNG.DLL
[2002/05/07 16:12:48 | 000,204,288 | ---- | C] () -- C:\WINDOWS\System32\LSXConfig.dll
[2002/05/07 16:11:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2002/05/07 16:11:35 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[2002/05/07 16:11:14 | 000,056,832 | R--- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
[2002/05/07 16:10:13 | 000,025,088 | ---- | C] () -- C:\WINDOWS\System32\ifl_gif.dll
[2002/05/07 16:09:18 | 000,031,232 | ---- | C] () -- C:\WINDOWS\System32\ide32.dll
[2002/05/07 16:09:15 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Hyperman.dll
[2002/05/07 16:09:12 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\Gt4vqt.DLL
[2002/05/07 16:09:03 | 000,311,296 | ---- | C] () -- C:\WINDOWS\System32\fxstudio.dll
[2002/05/07 16:09:01 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\freeisys.dll
[2002/05/07 16:08:52 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\eabtstrp.dll
[2002/05/07 16:08:43 | 000,282,624 | ---- | C] () -- C:\WINDOWS\System32\drumpad.dll
[2002/05/07 16:07:31 | 000,015,872 | ---- | C] () -- C:\WINDOWS\System32\D2Icons.Dll
[2002/05/07 15:59:59 | 000,292,352 | ---- | C] () -- C:\WINDOWS\System32\cfproject.dll
[2002/05/07 15:59:59 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\cfmsg.dll
[2002/05/07 15:59:44 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\CFFPTree.dll
[2002/05/07 15:57:52 | 000,075,976 | ---- | C] () -- C:\WINDOWS\System32\BASSDEC.dll
[2002/05/07 15:51:44 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\animation.dll
[2002/05/07 15:47:40 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[2002/04/16 04:41:40 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\memtest.dll
[2002/04/11 20:53:44 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[2002/04/11 10:47:52 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\msmscoin.dll
[2002/03/25 10:03:26 | 001,865,572 | ---- | C] () -- C:\WINDOWS\System32\ewctl32.dll
[2002/01/06 05:08:16 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2001/09/17 12:20:02 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2001/07/07 04:00:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
[1999/07/23 13:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[1999/07/23 10:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll
[1999/01/22 13:46:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/10/11 01:07:38 | 000,088,576 | ---- | C] () -- C:\WINDOWS\System32\Iticheck.dll
[1998/09/05 05:43:14 | 000,115,712 | ---- | C] () -- C:\WINDOWS\System32\vboxp403.dll
[1995/10/16 19:55:44 | 000,009,136 | ---- | C] () -- C:\WINDOWS\System32\INETWH16.DLL
[1980/01/01 00:00:00 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\MEMBG.DLL
[1980/01/01 00:00:00 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ICMFILTER.DLL
[1980/01/01 00:00:00 | 000,000,025 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

========== Alternate Data Streams ==========

@Alternate Data Stream - 165 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:33C073C1
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
< End of report >
  • 0

#123
therealex
Posted 31 July 2010 - 12:05 PM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
I disabled Process Blocker so that iexplore could run. I blocked it from going on the net by using Comodo, which reported that it was consistently trying to reach the loopback address - I guess Teatime has already blocked the sites it was trying to get to, as happened before.

I did this so that I could run RkU when the attempts actually occurred, which seems to be every hour at a regular interval. I ran it with everything enabled, and got a pretty long report. I also just ran it again with only Drivers and Processes enabled, then with Drivers, Processes and Stealth enabled.

I've attached the last two as a zip file to this. I see that iexplore is listed in stealth as a fake table, but so are a ton of other programs. Any ideas would be very welcome!

- Russ

Attached Files


  • 0

#124
therealex
Posted 03 August 2010 - 10:01 PM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
I don't believe this. I just got back, been a particularly terrible day, and what do I see? A pop-up from Avast! saying it blocked C:\Windows\Temp\setup.exe

That hasn't shown its ugly face in two months. Now it's back. And Malwarebytes can't seem to find anything, Avast! stops it but can't find out what's generating it, none of the programs I've used here seem to work - can you tell I'm getting frustrated? How can these malware guys be better than everybody else put together?!?
  • 0

#125
therealex
Posted 03 August 2010 - 10:12 PM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
Okay, now that my little rant is over, check this out:
I copied iexplore.exe from a known, good source. It was 658k. I put it into my Internet Explorer folder. It changed, before my eyes, from 658k to 624k.
The Hash checksum changed as well:
Original (good) file:
2C32E3E596CFE660353753EABEFB0540 *iexplore.exe
Changed file:
B60DDDD2D63CE41CB8C487FCFBB6419E *iexplore.exe

So, now that we know this, what the heck does it mean?
  • 0

#126
myrti
Posted 07 August 2010 - 09:17 AM

myrti

    Expert

  • Expert
  • 2,580 posts
So sorry about the delay, somehow my reply must have been eaten by the forum gnomes :)

Have you recently applied Windows Updates? There has been a cumulative update for Internet Explorer that changed iexplore.exe. It has been causing lots of AVP to block it from accessing the internet.

Both files belong to legit versions of internet explorer according to the MD5.

Is the setup.exe getting recreated permanently? Or did it only show once? It might be possible to track it's creation with Process Monitor if it gets recreated frequently then.

Can you please also run another scan with Rootkit Unhooker, checking the following options: SSDT, shadowed SSDT and Code Hooks.

regards myrti
  • 0

#127
therealex
Posted 07 August 2010 - 10:15 AM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts

So sorry about the delay, somehow my reply must have been eaten by the forum gnomes :)

Have you recently applied Windows Updates? There has been a cumulative update for Internet Explorer that changed iexplore.exe. It has been causing lots of AVP to block it from accessing the internet.

Both files belong to legit versions of internet explorer according to the MD5.

Is the setup.exe getting recreated permanently? Or did it only show once? It might be possible to track it's creation with Process Monitor if it gets recreated frequently then.

Can you please also run another scan with Rootkit Unhooker, checking the following options: SSDT, shadowed SSDT and Code Hooks.

regards myrti


Hey Myrti,

I was wondering what happened to you! :) Iexplore is being blocked because I'M blocking it, not an AVP. The setup.exe only seemed to run that one time, on 8/3. So far, it hasn't repeated (according to Avast.)

Also, I found someone on the Malwarebytes forum who seems to have the same thing. He was advised to run a new version of Combofix, which found "Bootkit Whistler" (see this page. Think I should run CF again?
I've attached the scan results because it won't post (too big!) I have to do it in two parts.

Attached Files


  • 0

#128
therealex
Posted 07 August 2010 - 10:16 AM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
And here's part 2

Attached Files


  • 0

#129
myrti
Posted 07 August 2010 - 01:57 PM

myrti

    Expert

  • Expert
  • 2,580 posts
Hi,

yes, please download a new copy of ComboFix and run it. Both esage bootkit remover and mbrcheck do check for whistler, so I would be surprised if this showed something to that effect, however you never know.

regards myrti
  • 0

#130
therealex
Posted 14 August 2010 - 12:40 PM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
Sorry for the delay, but it's been a [bleep] of a week (emphasis on [bleep].) My system started giving my all kinds of BSODs, usually 0x0000007e or 00000050. I tested the memory and found one module was bad. Even with one "good" module installed (according to memtest), I still get 50 errors when I tried to update Teatimer - which I've disabled now, btw. No point in using it, since it didn't seem to stop anything and other programs are doing the job anyway.

I was about to post the CF log when I realized that I had used System Restore to set my system back to August 10, and the CF log was from August 12th! I'll run it again and post later on today when I get back.
  • 0

Advertisements

#131
therealex
Posted 15 August 2010 - 11:01 AM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
Here it is:

ComboFix 10-08-14.02 - Russell Alexander 08/15/2010 7:13.5.3 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1790.652 [GMT -4:00]
Running from: c:\documents and settings\Russell Alexander\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FILEMON
-------\Legacy_PROCEXP141


((((((((((((((((((((((((( Files Created from 2010-07-15 to 2010-08-15 )))))))))))))))))))))))))))))))
.

2010-08-14 13:20 . 2010-08-14 13:20 -------- d-----w- c:\windows\system32\wbem\Repository
2010-08-13 23:45 . 2010-01-29 02:12 95232 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2010-08-05 12:38 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-05 12:38 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-05 02:53 . 2010-08-05 02:53 -------- d-----w- c:\documents and settings\Russell Alexander\Local Settings\Application Data\CutePDF Writer
2010-08-05 02:53 . 2010-08-05 02:53 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\SanDisk
2010-08-04 04:10 . 2010-08-04 04:10 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\FastSum
2010-08-03 16:22 . 2010-08-04 04:35 -------- d-----w- c:\temp\Internet Explorer
2010-07-20 15:34 . 2010-07-20 15:34 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\AnvSoft
2010-07-18 16:57 . 2010-07-18 16:57 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\Sony Corporation

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-15 11:29 . 2009-05-24 13:33 16608 ----a-w- c:\windows\gdrv.sys
2010-08-15 11:13 . 2007-04-05 01:55 -------- d-----w- c:\program files\LogMeIn
2010-08-15 07:05 . 2009-04-14 05:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-14 17:58 . 2004-11-20 07:09 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\MailWasherPro
2010-08-14 17:10 . 2005-11-06 22:31 -------- d-----w- c:\program files\Debugging Tools for Windows
2010-08-14 03:29 . 2009-05-26 20:05 94208 ----a-w- c:\windows\DUMP8b19.tmp
2010-08-13 23:44 . 2009-05-24 13:39 -------- d-----w- c:\program files\ATI Technologies
2010-08-13 23:44 . 2009-05-24 13:44 -------- d-----w- c:\program files\ATI
2010-08-13 23:14 . 2010-08-14 13:18 257718 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2010-08-13 22:53 . 2009-05-26 20:05 94208 ----a-w- c:\windows\DUMP757e.tmp
2010-08-13 19:37 . 2009-05-26 20:05 94208 ----a-w- c:\windows\DUMP75fb.tmp
2010-08-13 18:31 . 2006-12-22 21:52 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\Uniblue
2010-08-13 02:00 . 2005-01-28 15:59 16 ----a-w- c:\windows\system32\mswin32.drv
2010-08-05 12:38 . 2010-05-24 23:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-05 12:38 . 2008-10-26 21:02 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\Malwarebytes
2010-08-05 12:38 . 2008-10-26 21:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-03 01:45 . 2010-05-31 17:37 1 ----a-w- c:\documents and settings\Russell Alexander\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-08-03 00:43 . 2010-08-03 00:43 79872 ----a-w- c:\documents and settings\Russell Alexander\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
2010-08-03 00:43 . 2010-08-03 00:43 354744 ----a-w- c:\documents and settings\Russell Alexander\Application Data\SanDisk\Sansa Updater\SansaUpdaterInstall.exe
2010-08-03 00:43 . 2010-08-03 00:43 574344 ----a-w- c:\documents and settings\Russell Alexander\Application Data\SanDisk\Sansa Updater\SansaUpdater.exe
2010-07-30 08:50 . 2007-05-12 17:40 -------- d-----w- c:\program files\Support Tools
2010-07-29 01:51 . 2009-08-20 16:27 -------- d-----w- c:\program files\3gp Player
2010-07-25 01:08 . 2007-02-08 03:11 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-07-24 17:23 . 2010-07-24 17:23 10134 ----a-r- c:\documents and settings\Russell Alexander\Application Data\Microsoft\Installer\{C4BEACC0-723F-4F45-B49F-B5F764B9508B}\_E4D7F0B90B4AAB741E8A7E.exe
2010-07-24 17:23 . 2010-07-24 17:23 10134 ----a-r- c:\documents and settings\Russell Alexander\Application Data\Microsoft\Installer\{C4BEACC0-723F-4F45-B49F-B5F764B9508B}\_50ABBB772E2B24408D0FC8.exe
2010-07-24 17:23 . 2010-07-24 17:23 7358 ----a-r- c:\documents and settings\Russell Alexander\Application Data\Microsoft\Installer\{C4BEACC0-723F-4F45-B49F-B5F764B9508B}\_EB213C1A14B1D1FE95B8EA.exe
2010-07-24 17:23 . 2010-07-24 17:23 7358 ----a-r- c:\documents and settings\Russell Alexander\Application Data\Microsoft\Installer\{C4BEACC0-723F-4F45-B49F-B5F764B9508B}\_6FEFF9B68218417F98F549.exe
2010-07-24 17:23 . 2010-07-24 17:23 10134 ----a-r- c:\documents and settings\Russell Alexander\Application Data\Microsoft\Installer\{C4BEACC0-723F-4F45-B49F-B5F764B9508B}\_737160A4E315734415D0C6.exe
2010-07-23 21:22 . 2010-08-08 23:08 1496064 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-07-23 21:22 . 2010-08-08 23:08 43008 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-07-23 21:22 . 2010-08-08 23:08 338944 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-07-23 21:22 . 2010-08-08 23:08 346112 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-07-19 19:07 . 2010-05-31 16:56 -------- d-----w- c:\program files\OpenOffice.org 3
2010-07-17 04:02 . 2004-11-24 02:47 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\Syntrillium
2010-07-10 14:36 . 2010-07-08 18:10 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\Mp3tag
2010-07-08 14:50 . 2010-07-08 14:48 -------- d-----w- c:\documents and settings\All Users\Application Data\COMODO
2010-07-08 14:45 . 2008-11-26 05:29 -------- d-----w- c:\program files\COMODO
2010-07-08 14:43 . 2010-07-08 14:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2010-07-07 16:32 . 2004-11-20 07:09 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\Canon
2010-07-04 20:30 . 2010-07-03 17:52 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{5C3746DC-6E28-45B6-8913-E01C01F14227}
2010-07-04 20:27 . 2010-07-04 20:27 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{05D170EA-EFB5-452D-962D-D92C2A56BBAD}
2010-07-04 20:27 . 2010-07-04 20:27 -------- d-----w- c:\program files\ExamForce
2010-07-04 20:27 . 2010-07-04 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\ExamForce
2010-06-30 16:20 . 2006-07-05 21:36 -------- d-----w- c:\program files\Unlocker
2010-06-30 12:31 . 2004-11-20 06:49 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-28 20:57 . 2010-06-29 19:05 38848 ----a-w- c:\windows\avastSS.scr
2010-06-28 20:57 . 2009-04-29 22:48 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-06-28 20:37 . 2009-04-29 22:49 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-06-28 20:37 . 2009-04-29 22:49 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-06-28 20:33 . 2009-04-29 22:49 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-06-28 20:32 . 2009-04-29 22:49 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-06-28 20:32 . 2009-04-29 22:49 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-06-28 20:32 . 2009-04-29 22:49 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-06-28 20:32 . 2009-04-29 22:49 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-06-27 16:47 . 2005-03-10 15:43 -------- d-----w- c:\program files\Common Files\AOL
2010-06-27 16:44 . 2005-03-10 15:44 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2010-06-27 16:42 . 2005-03-10 15:47 -------- d-----w- c:\documents and settings\Russell Alexander\Application Data\AOL
2010-06-23 13:44 . 2004-11-20 06:49 1851904 ------w- c:\windows\system32\win32k.sys
2010-06-22 03:20 . 2009-04-14 14:16 -------- d-----w- c:\program files\Microsoft.NET
2010-06-22 03:05 . 2005-03-10 15:43 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads
2010-06-22 01:48 . 2010-06-22 01:48 -------- d-----w- c:\program files\ESET
2010-06-21 15:27 . 2004-11-20 06:49 354304 ------w- c:\windows\system32\drivers\srv.sys
2010-06-19 17:05 . 2007-01-10 20:44 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-17 14:03 . 2004-11-20 06:48 80384 ------w- c:\windows\system32\iccvid.dll
2010-06-14 20:06 . 2010-05-25 03:59 24416 ----a-w- c:\windows\system32\drivers\regguard.sys
2010-06-14 14:31 . 2004-11-20 07:06 744448 ------w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-11-20 06:48 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-09 21:17 . 2007-06-02 21:58 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2010-06-09 21:17 . 2007-04-05 01:55 29568 ----a-w- c:\windows\system32\LMIport.dll
2010-06-09 21:17 . 2007-04-05 01:55 87424 ----a-w- c:\windows\system32\LMIinit.dll
2010-06-04 16:47 . 2010-06-10 02:53 52224 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{50997114-a686-4585-8fb9-ce1093a1cf75}\components\FFExternalAlert.dll
2010-06-04 16:47 . 2010-06-10 02:53 101376 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{50997114-a686-4585-8fb9-ce1093a1cf75}\components\RadioWMPCore.dll
2010-06-04 15:55 . 2010-06-04 15:55 229312 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-06-01 23:00 . 2010-06-01 23:00 278288 ----a-w- c:\windows\system32\guard32.dll
2010-06-01 23:00 . 2010-06-01 23:00 87824 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-06-01 23:00 . 2010-06-01 23:00 25240 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-06-01 23:00 . 2010-06-01 23:00 15464 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-05-31 17:38 . 2010-05-31 17:38 686080 ----a-w- c:\documents and settings\Russell Alexander\Application Data\OpenOffice.org\3\user\uno_packages\cache\uno_packages\DB.tmp_\sun-pdfimport.oxt\pdfimport.uno.dll
2010-05-31 17:38 . 2010-05-31 17:38 568832 ----a-w- c:\documents and settings\Russell Alexander\Application Data\OpenOffice.org\3\user\uno_packages\cache\uno_packages\DB.tmp_\sun-pdfimport.oxt\msvcp90.dll
2010-05-31 17:38 . 2010-05-31 17:38 655872 ----a-w- c:\documents and settings\Russell Alexander\Application Data\OpenOffice.org\3\user\uno_packages\cache\uno_packages\DB.tmp_\sun-pdfimport.oxt\msvcr90.dll
2010-05-31 17:38 . 2010-05-31 17:38 583168 ----a-w- c:\documents and settings\Russell Alexander\Application Data\OpenOffice.org\3\user\uno_packages\cache\uno_packages\DB.tmp_\sun-pdfimport.oxt\xpdfimport.exe
2010-05-31 17:38 . 2010-05-31 17:38 224768 ----a-w- c:\documents and settings\Russell Alexander\Application Data\OpenOffice.org\3\user\uno_packages\cache\uno_packages\DB.tmp_\sun-pdfimport.oxt\msvcm90.dll
2010-05-31 17:25 . 2010-05-31 17:25 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-05-31 16:42 . 2007-10-09 12:36 1 ----a-w- c:\documents and settings\Russell Alexander\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-05-30 23:06 . 2010-05-28 21:05 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-05-29 13:18 . 2010-05-29 13:18 503808 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6d3ce1d6-n\msvcp71.dll
2010-05-29 13:18 . 2010-05-29 13:18 499712 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6d3ce1d6-n\jmc.dll
2010-05-29 13:18 . 2010-05-29 13:18 348160 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6d3ce1d6-n\msvcr71.dll
2010-05-29 13:18 . 2010-05-29 13:18 61440 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-419705bf-n\decora-sse.dll
2010-05-29 13:18 . 2010-05-29 13:18 12800 ----a-w- c:\documents and settings\Russell Alexander\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-419705bf-n\decora-d3d.dll
2010-05-29 01:14 . 2010-05-29 01:14 12872 ----a-w- c:\windows\system32\bootdelete.exe
2002-05-08 03:42 . 2002-05-07 17:50 11079 ---h--w- c:\program files\folder.htt
2001-12-02 08:18 . 2002-05-07 18:26 1586 ------w- c:\program files\MSO_INST.LOG
2008-04-10 20:00 . 2007-03-22 18:57 44360 ------w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2008-04-10 20:00 . 2007-03-22 18:57 107928 ------w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2007-07-18 19:54 . 2007-04-05 01:56 245408 ----a-w- c:\program files\mozilla firefox\plugins\unicows.dll
2009-11-18 18:03 . 2009-11-18 18:03 0 --sha-w- c:\windows\All Users\DRM\Cache\Indiv01.tmp
2002-06-24 11:59 . 2003-05-14 11:37 1025 --sh--w- c:\windows\page files\maxmeg.sys
2004-11-05 15:27 . 2004-07-24 17:45 10022 --sh--w- c:\windows\SYSTEM\KGyGaAvL.sys
2006-05-03 09:06 . 2007-02-09 22:58 163328 --sh--r- c:\windows\SYSTEM32\flvDX.dll
2007-02-21 10:47 . 2007-06-02 21:54 31232 --sh--r- c:\windows\SYSTEM32\msfDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@="{7D688A77-C613-11D0-999B-00C04FD655E1}"
[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2010-07-27 06:30 8462336 ----a-w- c:\windows\SYSTEM32\shell32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]
"vscvol.exe"="h:\roland\VSC32\vscvol.exe" [2000-02-09 36864]
"vsc32cnf.exe"="h:\roland\VSC32\vsc32cnf.exe" [2000-02-07 36864]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2007-04-17 63048]
"FinePrint Dispatcher v5"="c:\windows\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" [2006-09-27 503808]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-06-01 2039240]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Printing Migration"="c:\windows\system32\spool\migrate.dll" [2001-08-23 30208]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"<NO NAME>"= 00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"<NO NAME>"= 00000000

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{F552DDE6-2090-4bf4-B924-6141E87789A5}"= "q:\regrun~3\RRShell.dll" [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2010-06-09 21:17 87424 ----a-w- c:\windows\SYSTEM32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SYSTEM32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI7"=vscapi.dll
"WAVE6"=vscapi.dll
"wave1"=rddv1006.dll
"midi2"=rddv1006.dll
"mixer1"=rddv1006.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Russell Alexander^Start Menu^Programs^Startup^HotSync Manager.lnk]
backup=c:\windows\pss\HotSync Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Russell Alexander^Start Menu^Programs^Startup^Registration Ghost Recon Advanced Warfighter.LNK]
backup=c:\windows\pss\Registration Ghost Recon Advanced Warfighter.LNKStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Russell Alexander^Start Menu^Programs^Startup^World Community Grid Agent.lnk]
backup=c:\windows\pss\World Community Grid Agent.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
c:\program files\Common Files\AOL\ACS\AOLDial.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-10-14 15:28 133104 ----atw- c:\documents and settings\Russell Alexander\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
c:\program files\Common Files\AOL\1110494747\EE\AOLHostManager.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS]
2001-09-24 13:39 98304 ----a-w- c:\program files\Common Files\Logitech\QCDriver\LVComS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
e:\microsoft money\System\mnyexpr.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2005-09-01 00:27 1658592 ------w- c:\program files\Messenger\Msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 15:50 155648 ------w- c:\windows\SYSTEM32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-01-15 13:19 13680640 ----a-w- c:\windows\SYSTEM32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-01-15 13:19 86016 ----a-w- c:\windows\SYSTEM32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-01-15 13:19 1657376 ----a-w- c:\windows\SYSTEM32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SW20]
2006-01-03 14:58 208896 ------w- c:\windows\SYSTEM32\sw20.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SW24]
2006-01-03 14:59 69632 ------w- c:\windows\SYSTEM32\sw24.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemTray]
2001-08-23 18:00 3072 ------w- c:\windows\SYSTEM32\systray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"tmproxy"=2 (0x2)
"TmPfw"=2 (0x2)
"Tmntsrv"=2 (0x2)
"PcCtlCom"=2 (0x2)
"AOL TopSpeedMonitor"=3 (0x3)
"AOL ACS"=3 (0x3)
"Adobe LM Service"=3 (0x3)
"RoxLiveShare"=2 (0x2)
"LiveUpdate"=3 (0x3)
"iPodService"=3 (0x3)
"GoToMyPC"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ATI Launchpad"=
"RFAgent"=m:\registryfirstaid\rfagent.exe
"SpybotSD TeaTimer"=m:\spybot - search & destroy\TeaTimer.exe
"Steam"="m:\half-life 2\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"Tweak UI"=RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
"ATIPTA"=atiptaxx.exe
"StillImageMonitor"=c:\windows\SYSTEM32\STIMON.EXE
"QuickTime Task"="c:\windows\SYSTEM32\qttask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\AnalogX\\BitPump\\bitpump.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"f:\\QuickBooks 2007\\QBDBMgrN.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"h:\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
"d:\\Painkiller Overdose\\Bin\\Overdose.exe"=
"d:\\Painkiller Overdose\\Bin\\OverdoseEditor.exe"=
"d:\\Painkiller Overdose\\Bin\\OverdoseServer.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\SYSTEM32\DRIVERS\SI3112r.sys [5/12/2004 2:01 PM 97408]
R0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);c:\windows\SYSTEM32\DRIVERS\tdrpm258.sys [12/15/2009 7:06 PM 911680]
R1 aswSP;aswSP;c:\windows\SYSTEM32\DRIVERS\aswSP.sys [4/29/2009 6:49 PM 165456]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\SYSTEM32\DRIVERS\cmdGuard.sys [6/4/2010 11:55 AM 229312]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\SYSTEM32\DRIVERS\cmdhlp.sys [6/1/2010 7:00 PM 25240]
R2 aswFsBlk;aswFsBlk;c:\windows\SYSTEM32\DRIVERS\aswFsBlk.sys [4/29/2009 6:49 PM 17744]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [5/24/2009 9:37 AM 68136]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [6/2/2007 5:58 PM 12856]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/5/2010 8:38 AM 304464]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\SYSTEM32\DRIVERS\npf.sys [10/20/2009 2:19 PM 50704]
R2 Process Blocker;Process Blocker;c:\program files\Process Blocker\Process Blocker.exe [4/22/2010 6:35 PM 106712]
R2 RVIEGVST;VSC VST Engine;c:\program files\Roland\Virtual Sound Canvas VST\RVIEg01VST.sys [12/19/2009 8:02 PM 188276]
R3 L6DP;L6DP;c:\windows\SYSTEM32\DRIVERS\l6dp.sys [9/29/2006 12:05 PM 29312]
R3 L6TPortB;Service - Line 6 TonePort UX2;c:\windows\SYSTEM32\DRIVERS\L6TPortB.sys [1/15/2010 5:28 PM 532992]
R3 MBAMProtector;MBAMProtector;c:\windows\SYSTEM32\DRIVERS\mbam.sys [8/5/2010 8:38 AM 20952]
R3 vsc32;Virtual Sound Canvas 3.2;c:\windows\SYSTEM32\DRIVERS\vsc.sys [1/1/2006 10:31 PM 951284]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys --> c:\windows\system32\drivers\Partizan.sys [?]
S2 CX88XBAR;KWorld PVR 883 Crossbar;c:\windows\SYSTEM32\DRIVERS\cx88xbar.sys [7/4/2007 11:01 PM 8960]
S2 gupdate1c929d241ac157c;Google Update Service (gupdate1c929d241ac157c);c:\program files\Google\Update\GoogleUpdate.exe [10/9/2008 1:45 AM 133104]
S3 afcdp;afcdp;c:\windows\SYSTEM32\DRIVERS\afcdp.sys [12/15/2009 7:06 PM 160288]
S3 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [12/15/2009 7:06 PM 2480048]
S3 BR;BR;c:\docume~1\RUSSEL~1\LOCALS~1\Temp\BR.exe --> c:\docume~1\RUSSEL~1\LOCALS~1\Temp\BR.exe [?]
S3 emuumidi;E-MU USB-MIDI Driver;c:\windows\SYSTEM32\DRIVERS\emuumidi.sys [3/14/2007 2:11 PM 37120]
S3 LQAN;LQAN;c:\docume~1\RUSSEL~1\LOCALS~1\Temp\LQAN.exe --> c:\docume~1\RUSSEL~1\LOCALS~1\Temp\LQAN.exe [?]
S3 PortReporter;Port Reporter;c:\program files\PortReporter\PortReporter.exe [5/28/2010 10:14 AM 90183]
S3 QCPro;Logitech QuickCam Pro USB(PID_D001);c:\windows\SYSTEM32\DRIVERS\p35u.sys [7/28/2008 9:15 PM 116448]
S3 RD1006;Roland UA-100;c:\windows\SYSTEM32\DRIVERS\rdwm1006.sys [11/20/2004 11:28 AM 169086]
S3 RegGuard;RegGuard;c:\windows\SYSTEM32\DRIVERS\regguard.sys [5/24/2010 11:59 PM 24416]
S3 s3legacy;s3legacy;c:\windows\SYSTEM32\DRIVERS\s3legacy.sys [10/22/2006 7:40 PM 65664]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
S3 sysid;sysid;c:\windows\SYSTEM32\DRIVERS\sysid.sys [4/15/2005 10:41 AM 5568]
S3 TomTomHOMEService;TomTomHOMEService;e:\tomtom home 2\TomTomHOMEService.exe [11/13/2009 7:31 AM 92008]
S3 U6000ALL;HDTV110 TV Box(ALL);c:\windows\SYSTEM32\DRIVERS\dmdcap.sys [12/13/2008 9:53 PM 230784]
S3 VGAUTI;VGAUTI;c:\windows\SYSTEM32\DRIVERS\vgauti.sys [9/24/2004 10:00 AM 39208]

--- Other Services/Drivers In Memory ---

*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 14:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 00:12 73216 ------w- c:\program files\Outlook Express\setup50.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 00:12 73216 ------w- c:\program files\Outlook Express\setup50.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 00:12 73216 ------w- c:\program files\Outlook Express\setup50.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 00:12 73216 ------w- c:\program files\Outlook Express\setup50.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 00:12 73216 ------w- c:\program files\Outlook Express\setup50.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
2001-03-23 20:17 7168 ------w- c:\windows\SYSTEM32\updcrl.exe
.
Contents of the 'Scheduled Tasks' folder

2010-08-15 c:\windows\Tasks\User_Feed_Synchronization-{8DFA899A-AA07-44DE-8D3D-8F75C1C957F1}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mWindow Title = Microsoft Internet Explorer provided by MSN
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 0.0.0.0:80
IE: &AOL Toolbar search
IE: Add to Google Photos Screensa&ver
IE: Append to Existing PDF
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Open with BitPump - c:\program files\AnalogX\BitPump\ieint.htm
Trusted Zone: accountonline.com\www
Trusted Zone: intuit.com\ttlc
Trusted Zone: line6.net
Trusted Zone: turbotax.com
DPF: ChatSpace Java Client 2.1.0.84 - hxxp://63.102.227.45/Java/cs4ms084.cab
DPF: Dialpad Java Applet - hxxp://www.dialpad.com/applet/src/vscp.cab
DPF: Dialpad US Java Applet - hxxp://www.dialpad.com/applet/src/vscp.cab
DPF: DirectAnimation Java Classes
DPF: Internet Explorer Classes for Java
DPF: Microsoft XML Parser for Java
DPF: Serome Web2Phone - hxxp://www.dialpad.com/applet/vscp.cab
DPF: {0B72CCA4-5F11-11D0-9CB5-0000C0EC9FDB}
DPF: {76A2A0AB-38B7-46DB-8E47-F10CDE4D7920} - hxxp://aerial.leepa.org/ecwplugins/NCS.cab
DPF: {8C6C6922-6258-44AC-9912-53964AC55276} - hxxp://217.160.140.67/download/xloader10.cab
FF - ProfilePath - c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{50997114-a686-4585-8fb9-ce1093a1cf75}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\{50997114-a686-4585-8fb9-ce1093a1cf75}\components\RadioWMPCore.dll
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff36\gears.dll
FF - plugin: c:\documents and settings\Russell Alexander\Application Data\Mozilla\Firefox\Profiles\8658kj9u.default\extensions\[email protected]\plugins\npRACtrl.dll
FF - plugin: c:\documents and settings\Russell Alexander\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPil86.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: d:\download manager\npfpdlm.dll
FF - plugin: e:\realplayer\Netscape6\nppl3260.dll
FF - plugin: e:\realplayer\Netscape6\nprjplug.dll
FF - plugin: e:\realplayer\Netscape6\nprpjplug.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\npdrmv2.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\npdsplay.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\npmusicn.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\npmusicn.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\NPOFF12.DLL
FF - plugin: f:\netscape\PROGRAM\Plugins\NPOFF12.DLL
FF - plugin: f:\netscape\PROGRAM\Plugins\npqtplugin.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\npqtplugin2.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\npqtplugin3.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\npqtplugin4.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\npqtplugin5.dll
FF - plugin: f:\netscape\PROGRAM\Plugins\npwmsdrm.dll
FF - plugin: h:\itunes\Mozilla Plugins\npitunes.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-All ATI Software - c:\program files\ATI Technologies\UninstallAll\AtiCimUn.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-15 12:13
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\$$$\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a4,0b,a3,4e,39,fb,e1,6f,e1,7c,f9,09,76,5c,d0,e0,d9,0e,ec,64,a2,c4,5d,
4e,3c,3a,17,fd,d8,d5,45,ce,84,0f,56,9c,36,87,46,b0,27,5a,d4,94,1a,a2,81,1e,\
"??"=hex:2f,b6,6f,45,ee,e2,ec,0a,29,d5,69,d3,55,fd,2c,18

[HKEY_USERS\$$$\Software\SecuROM\License information*]
"datasecu"=hex:6f,91,c5,60,f2,a7,ec,97,fb,4d,3b,d0,fa,f6,8e,df,06,cb,82,79,08,
86,f8,1e,01,f3,7d,36,f8,ec,4f,8f,08,44,5c,98,6f,40,1b,c1,c2,e6,2c,72,65,59,\
"rkeysecu"=hex:73,4b,7f,dc,46,37,cb,05,e3,5a,b5,93,98,58,9d,72

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1328)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll

- - - - - - - > 'lsass.exe'(1384)
c:\windows\system32\rddv1006.dll

- - - - - - - > 'explorer.exe'(4544)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\LMIRfsClientNP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\windows\system32\crypserv.exe
c:\program files\FolderSize\FolderSizeSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\smlogsvc.exe
f:\uphclean\uphclean.exe
c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
.
**************************************************************************
.
Completion time: 2010-08-15 12:22:35 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-15 16:22
ComboFix2.txt 2010-08-12 22:45

Pre-Run: 8,588,025,856 bytes free
Post-Run: 7,713,518,592 bytes free

- - End Of File - - 858AB68E59A255B2B897D1A796D8D23F
  • 0

#132
myrti
Posted 19 August 2010 - 02:45 AM

myrti

    Expert

  • Expert
  • 2,580 posts
Hi,

I have consulted with other helpers and I'm sorry to say that at this point there is nothing else we can think of, that we could try. The connections are a mystery. I would not rule out the possibility that the connections aren't malicious and "only" cause by some borderline software, but I can't be sure.

I don't see where the connections are coming from or what is calling the svchost to start iexplore. So sadly as a last resort the only safe solution is to do a reformat. This should put you in the clear and remove the connections.

Sorry that this couldn't come to a happier ending.

regards myrti
  • 0

#133
therealex
Posted 19 August 2010 - 06:21 AM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
well, I appreciate all of your efforts - I know how much time is involved in this sort of thing. We've given it over three months and tried a million things. I'm going to give it a little longer and see if there is any other way I can find it out, and if so I will PM you and let you know the answer (since I assume this thread will close).

Hate it when the bad guys win! It's definitely malicious, since it's trying to access sites "behind my back", but at least the host file seems to be blocking it all.

- Russ
  • 0

#134
myrti
Posted 20 August 2010 - 02:26 AM

myrti

    Expert

  • Expert
  • 2,580 posts
Hi,

yes please! I would absolutely love to know what is causing this if you find out. Even more I would love to find out how it was able to fool us as it did.

I will be closing this thread, so PM would be great. :)

I'll pass on the follow up cleaning, updating and tools removal as I am sure you know what to look for and how to do it yourself. :)

Lemme know if I shall archive this, or if you would like to discuss some more things.

regards myrti
  • 0

#135
therealex
Posted 20 August 2010 - 03:57 AM

therealex

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 112 posts
Hi,
Archive is fine, and if I find the answer I'll put it in a new thread.

- Russ
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP