Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Google Redirect


  • Please log in to reply

#1
Cessna 210

Cessna 210

    Member

  • Member
  • PipPip
  • 23 posts
Hi,
Just recently I have been redirected when clicking on links in either Gmail or from a google search. I performed the steps listed for Malware removal but nothing was found during the scans. Below is my OTL scan log. Thanks for the help.
James

OTL logfile created on: 9/1/2011 4:16:55 PM - Run 2
OTL by OldTimer - Version 3.2.7.0 Folder = \\Server\SharedDocs
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 41.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 23.93 Gb Total Space | 3.39 Gb Free Space | 14.18% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 30.04 Gb Total Space | 19.10 Gb Free Space | 63.56% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JULIE
Current User Name: Kieser
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2011/08/17 11:52:04 | 008,090,496 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer.exe
PRC - [2011/08/17 11:52:04 | 002,358,656 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011/08/17 11:07:10 | 000,108,416 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\tv_w32.exe
PRC - [2011/02/18 17:37:16 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2011/02/16 15:49:08 | 000,088,176 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe
PRC - [2010/12/21 23:38:54 | 000,221,184 | ---- | M] ("winguardpro.com") -- E:\Programs\winguard\wgpro7.exe
PRC - [2010/11/30 14:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2010/11/11 13:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010/06/25 12:42:36 | 000,574,464 | ---- | M] (OldTimer Tools) -- \\Server\SharedDocs\OTL.exe
PRC - [2010/05/14 18:45:40 | 003,016,960 | ---- | M] (2BrightSparks) -- E:\Programs\SyncBack\SyncBack.exe
PRC - [2009/02/18 17:52:43 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/04/14 09:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/06/02 15:54:34 | 000,086,606 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2003/08/29 19:05:36 | 000,360,448 | ---- | M] () -- E:\Programs\SpywareGuard\sgmain.exe
PRC - [2003/08/29 11:14:58 | 000,233,472 | ---- | M] () -- E:\Programs\SpywareGuard\sgbhp.exe


========== Modules (SafeList) ==========

MOD - [2011/08/17 11:07:08 | 000,050,048 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\tv_w32.dll
MOD - [2011/04/08 16:56:28 | 000,018,176 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\sahook.dll
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2010/06/25 12:42:36 | 000,574,464 | ---- | M] (OldTimer Tools) -- \\Server\SharedDocs\OTL.exe
MOD - [2008/04/14 09:42:04 | 000,245,760 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\netui1.dll
MOD - [2008/04/14 09:42:04 | 000,080,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\netui0.dll
MOD - [2008/04/14 09:42:04 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ntlanman.dll
MOD - [2008/04/14 09:42:02 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\netrap.dll
MOD - [2008/04/14 09:41:54 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drprov.dll
MOD - [2008/04/14 09:41:52 | 000,025,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\davclnt.dll
MOD - [2008/04/14 09:40:22 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
MOD - [2008/04/14 03:09:26 | 002,897,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\xpsp2res.dll
MOD - [2004/08/04 06:00:00 | 000,149,019 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\crtdll.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (SynchronizationService.exe)
SRV - [2011/08/17 11:52:04 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011/02/18 17:37:16 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2011/02/16 15:49:08 | 000,088,176 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2010/11/11 13:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/05/17 13:11:40 | 000,229,376 | ---- | M] (Puran Software) [Disabled | Stopped] -- C:\WINDOWS\System32\PuranDefragS.exe -- (PuranDefrag)
SRV - [2008/05/07 19:29:38 | 000,122,880 | ---- | M] (CrypKey (Canada) Ltd.) [Disabled | Stopped] -- C:\WINDOWS\System32\Crypserv.exe -- (Crypkey License)
SRV - [2008/04/24 14:40:56 | 002,562,048 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Disabled | Stopped] -- C:\WINDOWS\System32\hasplms.exe -- (hasplms)
SRV - [2007/08/11 20:05:27 | 003,093,872 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2005/06/02 15:54:34 | 000,086,606 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2004/03/18 16:55:48 | 000,065,536 | ---- | M] (HP) [Disabled | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - [2011/09/01 15:24:24 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4CDCB48F-4D09-4C91-B4B8-BDFB4B2BD19A}\MpKslba650391.sys -- (MpKslba650391)
DRV - [2011/09/01 14:26:22 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4CDCB48F-4D09-4C91-B4B8-BDFB4B2BD19A}\MpKsl65aeb9d8.sys -- (MpKsl65aeb9d8)
DRV - [2010/11/22 00:27:41 | 000,011,264 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\uzqymzex.sys -- (uzqymzex)
DRV - [2010/10/24 22:25:38 | 000,165,264 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MpFilter.sys -- (MpFilter)
DRV - [2010/03/18 05:01:52 | 000,038,864 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2010/03/18 05:01:44 | 000,010,448 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidEqd.sys -- (LHidEqd)
DRV - [2010/03/18 05:01:36 | 000,040,912 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV - [2010/03/18 05:01:12 | 000,010,448 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2010/01/07 19:42:58 | 000,069,216 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\bdisk.sys -- (bdisk)
DRV - [2010/01/07 19:42:12 | 000,120,960 | ---- | M] (COMODO Security Solutions Inc.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\CBUFS.sys -- (CBUfs)
DRV - [2009/11/19 17:56:00 | 000,005,688 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DrmCVideo.sys -- (DrmCVideo)
DRV - [2009/11/19 17:55:36 | 000,023,096 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DrmCAudio.sys -- (DrmCAudio)
DRV - [2009/11/18 15:13:02 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt)
DRV - [2009/11/09 13:12:42 | 000,025,088 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\teamviewervpn.sys -- (teamviewervpn)
DRV - [2009/10/13 17:42:22 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys -- (WsAudio_DeviceS(5)) WsAudio_DeviceS(5)
DRV - [2009/10/13 17:42:22 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys -- (WsAudio_DeviceS(4)) WsAudio_DeviceS(4)
DRV - [2009/10/13 17:42:22 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys -- (WsAudio_DeviceS(3)) WsAudio_DeviceS(3)
DRV - [2009/10/13 17:42:22 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys -- (WsAudio_DeviceS(2)) WsAudio_DeviceS(2)
DRV - [2009/10/13 17:42:22 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys -- (WsAudio_DeviceS(1)) WsAudio_DeviceS(1)
DRV - [2008/04/14 04:06:40 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/14 04:06:40 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/14 00:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/03 12:47:32 | 000,031,104 | ---- | M] (Sony) [Video Capture] [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\VRDVC20X.SYS -- (VRDVC20)
DRV - [2008/03/18 17:09:16 | 000,350,720 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\aksfridge.sys -- (aksfridge)
DRV - [2008/03/17 12:45:52 | 000,019,584 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\ckldrv.sys -- (NetworkX)
DRV - [2008/02/11 17:55:04 | 000,586,240 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2005/04/18 10:19:29 | 000,008,552 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2004/12/06 22:09:58 | 000,369,024 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2004/11/01 20:52:46 | 000,272,568 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97)
DRV - [2004/08/18 15:53:54 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
DRV - [2004/08/03 23:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2004/06/17 21:57:02 | 000,200,064 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2004/06/17 21:55:38 | 000,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/06/17 21:55:04 | 001,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2004/05/13 11:19:22 | 000,182,688 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2004/02/13 17:46:00 | 000,017,153 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci)
DRV - [2001/08/17 15:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 15:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 15:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 15:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 15:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 14:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 14:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 14:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 14:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 14:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 14:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 14:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 14:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 14:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 14:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/08/27 14:21:19 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2011/09/01 15:16:12 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - E:\Programs\SpywareGuard\dlprotect.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [wg] E:\Programs\winguard\wgpro7.exe ("winguardpro.com")
O4 - HKLM..\Run: [WinGuard Pro] E:\Programs\winguard\wgpro7.exe ("winguardpro.com")
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\Kieser.JULIE.001\Start Menu\Programs\Startup\msseces.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Kieser.JULIE.001\Start Menu\Programs\Startup\SpywareGuard.lnk = E:\Programs\SpywareGuard\sgmain.exe ()
O4 - Startup: C:\Documents and Settings\Kieser.JULIE.001\Start Menu\Programs\Startup\SyncBack.lnk = E:\Programs\SyncBack\SyncBack.exe (2BrightSparks)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: category5.tv ([www] https in Trusted sites)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebo...toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft....k/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail....es/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1245951245109 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn...ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/...ploader_v10.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.5.3
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Kieser.JULIE.001\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Kieser.JULIE.001\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - E:\Programs\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 18:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2011/09/01 15:42:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\tdsskiller
[2011/09/01 15:39:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\GooredFix Backups
[2011/09/01 15:38:01 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\GooredFix.exe
[2011/08/24 17:04:23 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/08/24 16:56:13 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011/08/24 16:42:37 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2011/06/10 16:17:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\gtk-2.0
[2011/06/10 16:17:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kieser.JULIE.001\.thumbnails
[2011/06/10 16:08:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kieser.JULIE.001\.gimp-2.6
[2011/06/10 16:08:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kieser.JULIE.001\My Documents\gegl-0.0
[2011/06/10 16:06:10 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP-2.0
[2008/10/29 16:12:25 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\lexlog.dll

========== Files - Modified Within 90 Days ==========

[2011/09/01 15:57:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/01 15:41:22 | 001,390,139 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\tdsskiller.zip
[2011/09/01 15:38:01 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\GooredFix.exe
[2011/09/01 15:29:24 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/09/01 15:25:19 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/09/01 15:24:05 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/01 15:23:45 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2011/09/01 15:23:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/09/01 15:23:37 | 1333,198,848 | -HS- | M] () -- C:\hiberfil.sys
[2011/09/01 15:22:25 | 013,107,200 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\NTUSER.DAT
[2011/09/01 14:09:59 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{3B49B074-6A53-49FB-8F6B-25DC6217B6A0}.job
[2011/08/29 13:15:00 | 000,000,426 | ---- | M] () -- C:\WINDOWS\tasks\WebReg 20050813131557.job
[2011/08/27 14:14:36 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/08/26 18:46:09 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/08/24 23:38:59 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\ntuser.ini
[2011/08/24 22:39:30 | 000,034,441 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\order-receipt.pdf
[2011/08/24 17:07:35 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/24 16:21:19 | 000,000,364 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Laptop C Drive.job
[2011/08/24 16:21:17 | 000,000,364 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Laptop E Drive.job
[2011/08/14 23:29:18 | 000,001,868 | -H-- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\My Documents\Default.rdp
[2011/08/08 19:55:57 | 000,012,857 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\PC.jpg
[2011/08/08 18:49:38 | 000,000,800 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/08/08 18:49:36 | 000,000,782 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\Windows Media Player.lnk
[2011/08/08 18:17:39 | 000,613,472 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\mediaplayer-viral.zip
[2011/08/01 13:09:52 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2011/07/28 21:07:26 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\Microsoft Office Word 2007.lnk
[2011/07/18 11:42:38 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/07/18 11:32:54 | 000,318,744 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/07/18 08:56:20 | 000,508,770 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2011/07/18 08:56:20 | 000,446,360 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/07/18 08:56:20 | 000,073,400 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/07/18 08:45:44 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/07/07 17:10:37 | 000,024,064 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\My Documents\Valntine's journal entry.doc
[2011/07/06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/30 21:23:06 | 000,537,947 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card combo.png
[2011/06/30 21:19:51 | 000,021,439 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\movie strip banner.jpg
[2011/06/30 21:19:51 | 000,007,442 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\.recently-used.xbel
[2011/06/30 20:41:15 | 000,110,225 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card clip art2.png
[2011/06/30 20:09:03 | 000,048,665 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card clip art.png
[2011/06/30 19:32:52 | 000,087,918 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card.jpg
[2011/06/30 19:30:04 | 000,191,791 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card.xcf
[2011/06/29 21:29:11 | 000,000,329 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\movie strip box.jpg
[2011/06/29 21:23:51 | 000,000,927 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\movie strip.jpg
[2011/06/29 21:05:02 | 000,000,038 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\.gtk-bookmarks
[2011/06/11 01:26:51 | 000,004,083 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\110_F_27985587_JR7eCxctO2xTKZ9ZvIqWzPYrDRjhEvvO.jpg
[2011/06/11 01:26:51 | 000,004,083 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\110_F_27985587_JR7eCxctO2xTKZ9ZvIqWzPYrDRjhEvvO.jpg
[2011/06/10 23:05:05 | 000,102,734 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\globe.PSD
[2011/06/10 16:07:18 | 000,000,792 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\GIMP 2.lnk
[2011/06/10 15:55:07 | 000,002,110 | ---- | M] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\map.gif

========== Files Created - No Company Name ==========

[2011/09/01 15:41:22 | 001,390,139 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\tdsskiller.zip
[2011/08/24 22:39:25 | 000,034,441 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\order-receipt.pdf
[2011/08/24 17:07:35 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/08 19:56:04 | 000,012,857 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\PC.jpg
[2011/08/08 18:22:32 | 000,613,472 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\mediaplayer-viral.zip
[2011/08/01 18:52:15 | 000,000,424 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/06/30 21:23:05 | 000,537,947 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card combo.png
[2011/06/30 21:19:51 | 000,007,442 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\.recently-used.xbel
[2011/06/30 21:19:50 | 000,021,439 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\movie strip banner.jpg
[2011/06/30 20:41:15 | 000,110,225 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card clip art2.png
[2011/06/30 20:09:03 | 000,048,665 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card clip art.png
[2011/06/30 19:32:51 | 000,087,918 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card.jpg
[2011/06/29 21:27:20 | 000,000,329 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\movie strip box.jpg
[2011/06/29 21:20:27 | 000,191,791 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\watch card.xcf
[2011/06/29 21:19:03 | 000,000,927 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\movie strip.jpg
[2011/06/29 21:06:38 | 000,074,305 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\Salem Logo.png
[2011/06/29 21:05:02 | 000,000,038 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\.gtk-bookmarks
[2011/06/11 01:29:01 | 000,004,083 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\110_F_27985587_JR7eCxctO2xTKZ9ZvIqWzPYrDRjhEvvO.jpg
[2011/06/11 01:28:14 | 000,004,083 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\110_F_27985587_JR7eCxctO2xTKZ9ZvIqWzPYrDRjhEvvO.jpg
[2011/06/10 23:05:05 | 000,102,734 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\globe.PSD
[2011/06/10 16:17:02 | 000,002,110 | ---- | C] () -- C:\Documents and Settings\Kieser.JULIE.001\Desktop\map.gif
[2011/06/10 16:07:18 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\GIMP 2.lnk
[2010/11/22 00:27:50 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\vdqymzex.sys
[2010/11/22 00:27:41 | 000,011,264 | ---- | C] () -- C:\WINDOWS\System32\drivers\uzqymzex.sys
[2010/05/18 08:51:49 | 000,000,197 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2010/01/21 17:26:26 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2010/01/07 19:42:58 | 000,069,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\bdisk.sys
[2009/11/18 15:13:45 | 000,000,078 | ---- | C] () -- C:\WINDOWS\Crypkey.ini
[2009/11/18 15:13:41 | 000,019,584 | ---- | C] () -- C:\WINDOWS\System32\Ckldrv.sys
[2009/11/18 15:13:41 | 000,018,432 | ---- | C] () -- C:\WINDOWS\Setup_ck.dll
[2009/11/18 15:13:02 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2009/11/17 20:20:36 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\VPN.dll
[2009/10/07 15:44:02 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/08/22 11:12:34 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[2009/08/22 11:12:34 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\lfkodak.dll
[2009/08/22 11:12:29 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\cdTextCtl.dll
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/07/14 16:28:52 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2009/04/21 15:08:38 | 000,001,084 | ---- | C] () -- C:\WINDOWS\DKAAP2DD.ini
[2009/04/02 19:51:41 | 000,010,523 | ---- | C] () -- C:\WINDOWS\hpdj3740.ini
[2009/04/02 19:45:48 | 000,000,507 | ---- | C] () -- C:\WINDOWS\DKAAY2DD.ini
[2009/02/26 22:34:22 | 000,006,048 | ---- | C] () -- C:\WINDOWS\System32\MCC16.dll
[2007/12/13 18:07:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iplayer.INI
[2006/12/22 12:14:19 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/07/08 21:27:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006/04/30 01:34:04 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\WbxRMenu.dll
[2006/04/14 00:18:24 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\atonres.dll
[2006/04/14 00:18:24 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\WbxMSAI.dll
[2006/04/14 00:18:24 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\atonecli.dll
[2005/12/11 15:03:35 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\IPPCPUID.DLL
[2005/09/12 20:21:55 | 000,002,146 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2005/08/16 15:46:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2005/04/18 10:36:18 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/04/18 10:29:36 | 000,000,177 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/04/18 10:08:14 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/04/18 10:00:34 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2005/04/18 09:37:24 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\stac97co.dll
[2005/04/18 09:36:20 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2005/04/18 09:36:16 | 000,000,372 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/01/28 09:08:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/11 18:24:19 | 000,000,839 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/11 18:11:31 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

========== LOP Check ==========

[2010/07/07 22:04:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2005/12/11 15:02:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Newsoft
[2006/01/14 19:41:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2010/09/06 08:41:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Softouch
[2010/04/28 15:35:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Stardraw.com Ltd
[2011/09/01 14:55:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/02/27 03:46:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/05/31 18:00:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/01/21 13:36:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/08/18 15:10:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/02/11 14:43:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\acccore
[2009/02/11 14:42:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\AIM
[2009/02/11 14:43:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\AIMPro
[2011/03/13 23:05:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\Audacity
[2010/01/17 00:14:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\ClearPlay Inc
[2009/06/17 13:37:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\GetRightToGo
[2011/06/30 21:19:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\gtk-2.0
[2010/08/25 17:35:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\Leadertech
[2005/08/20 14:41:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\MSNInstaller
[2010/07/07 22:04:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\NCH Swift Sound
[2010/07/07 21:54:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\Recordpad
[2010/09/06 08:41:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\Softouch
[2011/07/07 13:02:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\TeamViewer
[2007/01/11 15:49:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kieser.JULIE.001\Application Data\Viewpoint
[2011/09/01 15:29:24 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/08/24 16:21:19 | 000,000,364 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack Laptop C Drive.job
[2011/08/24 16:21:17 | 000,000,364 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack Laptop E Drive.job
[2011/09/01 14:09:59 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{3B49B074-6A53-49FB-8F6B-25DC6217B6A0}.job
[2010/09/26 16:16:10 | 000,000,284 | ---- | M] () -- C:\WINDOWS\Tasks\wavepadDowngrade.job
[2010/09/26 16:16:11 | 000,000,284 | ---- | M] () -- C:\WINDOWS\Tasks\wavepadShakeIcon.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >
  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP