Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Google re-direct virus [Solved]


  • This topic is locked This topic is locked

#1
Davidw1971

Davidw1971

    New Member

  • Member
  • Pip
  • 6 posts
Hi,

I got infected last week by the a Google redirect virus, after hours of trying to get rid of the problem, including following your very own forum advice I gave up and decided to completely re-format and re-install!!

After re-installation, everything was clean and clear of the virus - great!!

HOWEVER!! Just now I was searching on google for something and something strange started again, the page seemed to redirect and then a windows pop up appeared asking me to allow or cancel a software download! Anyway I cancelled and closed down everything. But now the virus is back again!!!! Everytime I click on a link in google I get redirected to an external ad. Nightmare!

I have had a quick look again at your forum and have downloaded and run Hijack this. This was the output:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:17:47, on 22/02/2012
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HPQ\IAM\bin\asghost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [Anti-phishing Domain Advisor] "C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe

--
End of file - 8377 bytes

Have you got any idea's what I may have picked up and how to get rid?
  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there Hijackthis is no longer good enough to search for the current malware

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Select All Users
  • Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    consrv.dll
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    /md5stop
    hklm\software\clients\startmenuinternet|command /rs
    hklm\software\clients\startmenuinternet|command /64 /rs
    C:\Windows\assembly\tmp\U\*.* /s
    C:\Program Files\Common Files\ComObjects\*.* /s
    %Temp%\smtmp\1\*.*
    %Temp%\smtmp\2\*.*
    %Temp%\smtmp\3\*.*
    %Temp%\smtmp\4\*.*
    CREATERESTOREPOINT
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Post both logs

THEN

Download aswMBR.exe ( 4.1mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan

Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply

Posted Image
  • 0

#3
Davidw1971

Davidw1971

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
Hi, Thanks for the quick reply.

I have run OTL, here are the resulting files:

OTL.txt:

OTL logfile created on: 22/02/2012 23:26:45 - Run 1
OTL by OldTimer - Version 3.2.33.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

247.36 Mb Total Physical Memory | 79.84 Mb Available Physical Memory | 32.28% Memory free
706.20 Mb Paging File | 212.25 Mb Available in Paging File | 30.06% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 30.68 Gb Total Space | 13.01 Gb Free Space | 42.40% Space Free | Partition Type: NTFS
Drive D: | 6.59 Gb Total Space | 0.57 Gb Free Space | 8.72% Space Free | Partition Type: NTFS

Computer Name: DNALAPTOP | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/02/22 23:20:26 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2011/01/19 15:02:44 | 000,232,104 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe
PRC - [2010/03/25 18:42:36 | 000,388,096 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
PRC - [2006/02/15 15:43:16 | 000,892,928 | ---- | M] () -- C:\WINDOWS\SMINST\Scheduler.exe
PRC - [2006/02/14 18:56:08 | 000,122,880 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\HPQ\HP ProtectTools Security Manager\pthosttr.exe
PRC - [2005/12/23 20:44:26 | 000,491,606 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe
PRC - [2005/08/31 12:20:00 | 000,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE
PRC - [2005/06/29 19:06:54 | 000,043,008 | ---- | M] (Cognizance Corporation) -- C:\Program Files\HPQ\IAM\Bin\asghost.exe
PRC - [2004/08/04 08:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [1999/10/22 11:00:32 | 000,043,520 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe


========== Modules (No Company Name) ==========

MOD - [2006/02/15 15:43:16 | 000,892,928 | ---- | M] () -- C:\WINDOWS\SMINST\Scheduler.exe
MOD - [2005/12/23 20:44:26 | 000,491,606 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe
MOD - [2004/06/01 09:39:56 | 000,094,274 | ---- | M] () -- C:\WINDOWS\system32\HPBHEALR.DLL
MOD - [1999/10/26 12:32:14 | 000,050,176 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 4.0\Distillr\adistres.dll
MOD - [1999/10/22 11:00:32 | 000,043,520 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (MySQL)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2004/08/11 07:46:56 | 000,483,328 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- c:\Program Files\Windows Media Connect\mswmccds.exe -- (WmcCds) Windows Media Connect (WMC)
SRV - [2004/08/11 04:50:42 | 000,028,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect\mswmcls.exe -- (WmcCdsLs) Windows Media Connect (WMC)


========== Driver Services (SafeList) ==========

DRV - [2006/07/31 01:00:08 | 001,155,584 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/03/30 21:39:48 | 000,130,432 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500)
DRV - [2006/02/09 01:00:04 | 000,142,720 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) Broadcom NetLink ™
DRV - [2006/02/09 01:00:04 | 000,045,312 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/01/19 13:50:40 | 001,428,096 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2006/01/19 13:50:14 | 000,424,320 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2006/01/19 07:45:00 | 000,057,096 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2005/09/19 21:24:20 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)
DRV - [2005/09/19 21:24:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2005/09/19 21:23:52 | 000,007,808 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2005/08/31 12:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2005/08/31 12:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2005/08/31 12:20:00 | 000,086,524 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2005/08/31 12:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2005/08/31 12:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2005/08/31 12:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2005/08/31 12:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)
DRV - [2005/08/25 19:16:52 | 000,005,628 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2005/08/25 19:16:16 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)
DRV - [2004/08/04 08:00:00 | 000,200,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RMCast.sys -- (RMCAST)
DRV - [2004/08/04 08:00:00 | 000,072,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mqac.sys -- (MQAC)
DRV - [2001/08/17 19:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)



O1 HOSTS File: ([2004/08/04 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (HP Credential Manager for ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
O4 - HKLM..\Run: [CognizanceTS] C:\Program Files\HPQ\IAM\Bin\AsTsVcc.dll (Cognizance Corporation)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\WINDOWS\CREATOR\Remind_XP.exe ()
O4 - HKLM..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe ()
O4 - HKLM..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe (InterVideo Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe (InterVideo Inc.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Translate English Word - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{69559416-C392-47D4-AD1E-9380630012C4}: DhcpNameServer = 194.168.4.100 194.168.8.100
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\OneCard: DllName - (C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll) - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll (Cognizance Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\HP Cityscape.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\HP Cityscape.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 23:07:00 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{ed7a728d-5b0f-11e1-bfe9-0014a5d0ec4b}\Shell - "" = AutoRun
O33 - MountPoints2\{ed7a728d-5b0f-11e1-bfe9-0014a5d0ec4b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ed7a728d-5b0f-11e1-bfe9-0014a5d0ec4b}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/02/22 23:20:20 | 000,583,680 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/02/22 18:34:18 | 000,000,000 | ---D | C] -- C:\!KillBox
[2012/02/22 18:15:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\HiJackThis
[2012/02/22 18:15:47 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2012/02/22 10:02:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\includes
[2012/02/21 15:41:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\ICAClient
[2012/02/21 15:40:30 | 000,000,000 | ---D | C] -- C:\Program Files\Citrix
[2012/02/21 13:24:51 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2012/02/21 13:23:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Batchwork
[2012/02/21 09:18:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Corel
[2012/02/21 09:01:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Acrobat 4.0
[2012/02/21 08:58:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\WINDOWS
[2012/02/20 17:37:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR
[2012/02/20 17:37:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\WinRAR
[2012/02/20 17:37:03 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012/02/20 09:20:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\AdobeUM
[2012/02/20 09:13:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\HP
[2012/02/20 09:13:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Hewlett-Packard
[2012/02/20 09:12:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
[2012/02/20 09:08:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2012/02/20 09:07:44 | 000,000,000 | -H-D | C] -- C:\Config.Msi
[2012/02/20 08:51:17 | 000,018,560 | R--- | C] (Windows ® Codename Longhorn DDK provider) -- C:\WINDOWS\System32\HPWPAUSB.sys
[2012/02/19 21:25:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Google
[2012/02/19 21:25:09 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012/02/19 21:22:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\tiinst
[2012/02/19 21:22:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\InterVideo WinDVD
[2012/02/19 21:21:38 | 000,000,000 | ---D | C] -- C:\Program Files\InterVideo
[2012/02/19 21:19:08 | 000,000,000 | ---D | C] -- C:\Program Files\Program Shortcuts
[2012/02/19 21:15:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2012/02/19 21:11:46 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2012/02/19 21:10:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\i386
[2012/02/19 20:49:55 | 000,000,000 | ---D | C] -- C:\WINDOWS
[2012/02/19 20:41:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SendBlaster
[2012/02/19 20:41:47 | 000,000,000 | ---D | C] -- C:\Program Files\SendBlaster
[2012/02/19 20:40:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\smg
[2012/02/19 20:40:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Slides
[2012/02/19 20:40:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Shipping_Pkg
[2012/02/19 20:39:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\pics
[2012/02/19 20:39:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\New Folder
[2012/02/19 20:39:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\mysql-gui-tools-noinstall-5.0-r17-win32
[2012/02/19 20:39:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\minn kota
[2012/02/19 20:39:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\mes
[2012/02/19 20:39:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\images
[2012/02/19 20:39:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\boatgorillaz auto update 2011
[2012/02/19 20:39:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\2011 UK Auto Update Program
[2012/02/19 20:39:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\100marine auto update 2011
[2012/02/19 20:37:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe
[2012/02/19 20:30:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Cactus020
[2012/02/19 20:30:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Boatgorillaz
[2012/02/19 20:29:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Boatbitz
[2012/02/19 20:29:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\AIS400 INSTALLATION DISK
[2012/02/19 20:27:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Tetra
[2012/02/19 20:27:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\New Folder
[2012/02/19 20:26:59 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Videos
[2012/02/19 20:26:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\nasa
[2012/02/19 20:26:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\My Data Sources
[2012/02/19 20:26:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\mesltd
[2012/02/19 20:22:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Marine DNA
[2012/02/19 20:22:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Leading Edge
[2012/02/19 20:22:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\inspection
[2012/02/19 20:22:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Harry old trafford
[2012/02/19 20:22:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\harry
[2012/02/19 20:22:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Downloads
[2012/02/19 20:22:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\database backups
[2012/02/19 20:22:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Corel User Files
[2012/02/19 20:22:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\cap images
[2012/02/19 20:21:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Cactus Fishing
[2012/02/19 20:15:18 | 000,000,000 | ---D | C] -- C:\Program Files\Netscape
[2012/02/19 20:11:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\PSpad
[2012/02/19 20:10:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\PSPad editor
[2012/02/19 20:10:49 | 000,000,000 | ---D | C] -- C:\Program Files\PSPad editor
[2012/02/19 20:05:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CorelDRAW Graphics Suite X3
[2012/02/19 20:05:01 | 000,000,000 | ---D | C] -- C:\Program Files\Corel
[2012/02/19 20:05:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Corel
[2012/02/19 18:49:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
[2012/02/19 18:48:58 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
[2012/02/19 18:48:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012/02/19 18:47:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\SHELLNEW
[2012/02/19 18:46:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012/02/19 18:46:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012/02/19 18:44:50 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2012/02/19 16:53:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Dynamic
[2012/02/19 16:53:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Sites
[2012/02/19 16:53:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\SiteClasses
[2012/02/19 16:53:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\antiphishing-mystart3_6dn
[2012/02/19 16:53:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor
[2012/02/19 16:53:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\AceFTP 3 Freeware
[2012/02/19 16:53:11 | 000,000,000 | ---D | C] -- C:\Program Files\Visicom Media
[2012/02/19 16:49:57 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/02/19 16:48:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\MySQL
[2012/02/19 16:46:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\MySQL
[2012/02/19 16:41:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\MySQL
[2012/02/19 16:40:53 | 000,000,000 | ---D | C] -- C:\Program Files\MySQL
[2012/02/19 16:40:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MySQL
[2012/02/19 16:36:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[2012/02/19 16:36:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2012/02/19 16:33:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Sun
[2012/02/19 16:31:56 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\PrivacIE
[2012/02/19 16:30:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities
[2012/02/19 16:28:47 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\IETldCache
[2012/02/19 16:22:41 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2012/02/19 15:47:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Macromedia
[2012/02/19 15:47:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Adobe
[2012/02/19 14:52:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
[2012/02/19 14:52:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US
[2012/02/19 14:51:49 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie7
[2012/02/19 14:51:29 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
[2012/02/19 14:51:00 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
[2012/02/19 14:28:36 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\UserData
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/02/22 23:20:26 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/02/22 18:17:24 | 000,002,463 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/02/22 15:20:16 | 000,000,318 | ---- | M] () -- C:\WINDOWS\tasks\Poabvvrmwl.job
[2012/02/22 15:20:11 | 000,118,784 | RHS- | M] () -- C:\WINDOWS\System32\kbd101as.dll
[2012/02/22 11:32:25 | 000,016,711 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\301616.pdf
[2012/02/22 11:29:27 | 000,016,750 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\301615.pdf
[2012/02/22 10:06:13 | 000,012,800 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Settings.cfg
[2012/02/21 21:01:08 | 000,009,865 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-30.jpg
[2012/02/21 20:52:18 | 000,026,974 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-20.gif
[2012/02/21 19:36:16 | 000,026,218 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-10.gif
[2012/02/21 19:21:30 | 000,033,217 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZRAYC90BUN1.jpg
[2012/02/21 17:56:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/02/21 17:56:35 | 259,444,736 | -HS- | M] () -- C:\hiberfil.sys
[2012/02/21 13:35:13 | 000,394,542 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/02/21 13:35:13 | 000,056,968 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/02/21 13:30:37 | 000,299,640 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/02/21 10:58:10 | 000,012,041 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\DHL Payment 210212.pdf
[2012/02/21 09:30:48 | 000,011,432 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\Crewsaver Payment 210212.pdf
[2012/02/21 09:18:21 | 000,000,952 | -HS- | M] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2012/02/21 09:01:02 | 000,000,910 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
[2012/02/21 08:58:04 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012/02/21 08:58:04 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012/02/20 14:56:30 | 000,281,008 | ---- | M] () -- C:\price.csv
[2012/02/20 09:15:00 | 000,163,142 | ---- | M] () -- C:\WINDOWS\hpoins28.dat
[2012/02/19 21:21:38 | 000,001,714 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk
[2012/02/19 21:21:10 | 000,001,743 | RHS- | M] () -- C:\WINDOWS\System32\drivers\103C_HP_NTBK_HP Compaq nx6310 (RH327ET#ABU)_YN_0U_QCNU644F9C6_E404611004_46_I30AA_SHP_VKBC Version 58.12_B68YDU Ver. F.09_T060915_WXP2_L409_M248_J40_7Intel_8Celeron M 430_91.73_#120219_N14E4170C_(RH327ET#ABU).MRK
[2012/02/19 21:19:23 | 000,002,970 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2012/02/19 21:19:16 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2012/02/19 21:12:26 | 000,008,192 | ---- | M] () -- C:\WINDOWS\REGLOCS.OLD
[2012/02/19 21:10:27 | 000,000,060 | ---- | M] () -- C:\WINDOWS\System32\SYSDRV.DAT
[2012/02/19 20:41:53 | 000,001,683 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SendBlaster.lnk
[2012/02/19 20:10:52 | 000,000,709 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\PSPad.lnk
[2012/02/19 20:10:52 | 000,000,691 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\PSPad.lnk
[2012/02/19 18:55:38 | 000,000,792 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2012/02/19 18:50:33 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2012/02/19 16:53:13 | 000,000,904 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\AceFTP 3 Freeware.lnk
[2012/02/19 16:46:29 | 000,001,771 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\MySQL Administrator.lnk
[2012/02/19 16:28:50 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/02/19 14:52:54 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/02/19 14:41:47 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/02/18 17:25:00 | 000,002,088 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\configure.php
[2012/02/17 21:05:07 | 000,001,305 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\index.html
[2012/01/27 14:36:29 | 000,278,537 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\mes_email.csv
[2012/01/25 11:16:01 | 000,021,827 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\MES_MAIL_OUT.html
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/02/22 18:15:48 | 000,002,463 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/02/22 15:20:13 | 000,000,318 | ---- | C] () -- C:\WINDOWS\tasks\Poabvvrmwl.job
[2012/02/22 15:20:11 | 000,118,784 | RHS- | C] () -- C:\WINDOWS\System32\kbd101as.dll
[2012/02/22 11:32:25 | 000,016,711 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\301616.pdf
[2012/02/22 11:29:24 | 000,016,750 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\301615.pdf
[2012/02/21 21:01:06 | 000,009,865 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-30.jpg
[2012/02/21 20:52:55 | 000,026,974 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-20.gif
[2012/02/21 19:36:48 | 000,026,218 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-10.gif
[2012/02/21 19:21:27 | 000,033,217 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZRAYC90BUN1.jpg
[2012/02/21 10:58:09 | 000,012,041 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\DHL Payment 210212.pdf
[2012/02/21 09:30:45 | 000,011,432 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Crewsaver Payment 210212.pdf
[2012/02/21 09:18:20 | 000,000,952 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2012/02/21 09:01:02 | 000,000,910 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
[2012/02/21 09:00:55 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\Msvcrt10.dll
[2012/02/21 08:58:04 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012/02/21 08:58:04 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012/02/20 17:18:34 | 000,002,088 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\configure.php
[2012/02/20 14:56:30 | 000,281,008 | ---- | C] () -- C:\price.csv
[2012/02/20 10:18:50 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\korwbrkr.lex
[2012/02/20 10:18:50 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2012/02/20 10:18:50 | 000,002,060 | ---- | C] () -- C:\WINDOWS\System32\noise.jpn
[2012/02/20 10:18:50 | 000,001,486 | ---- | C] () -- C:\WINDOWS\System32\noise.kor
[2012/02/20 10:18:47 | 000,211,938 | ---- | C] () -- C:\WINDOWS\System32\lcphrase.tbl
[2012/02/20 10:18:47 | 000,146,126 | ---- | C] () -- C:\WINDOWS\System32\array30.tab
[2012/02/20 10:18:47 | 000,116,285 | ---- | C] () -- C:\WINDOWS\System32\msdayi.tbl
[2012/02/20 10:18:47 | 000,110,566 | ---- | C] () -- C:\WINDOWS\System32\arphr.tbl
[2012/02/20 10:18:47 | 000,044,370 | ---- | C] () -- C:\WINDOWS\System32\acode.tbl
[2012/02/20 10:18:47 | 000,044,370 | ---- | C] () -- C:\WINDOWS\System32\a234.tbl
[2012/02/20 10:18:47 | 000,043,242 | ---- | C] () -- C:\WINDOWS\System32\phoncode.tbl
[2012/02/20 10:18:47 | 000,024,114 | ---- | C] () -- C:\WINDOWS\System32\lcptr.tbl
[2012/02/20 10:18:47 | 000,018,600 | ---- | C] () -- C:\WINDOWS\System32\arrayhw.tab
[2012/02/20 10:18:47 | 000,016,312 | ---- | C] () -- C:\WINDOWS\System32\arptr.tbl
[2012/02/20 10:18:47 | 000,004,071 | ---- | C] () -- C:\WINDOWS\System32\phon.tbl
[2012/02/20 10:18:47 | 000,002,714 | ---- | C] () -- C:\WINDOWS\System32\phonptr.tbl
[2012/02/20 10:18:47 | 000,001,460 | ---- | C] () -- C:\WINDOWS\System32\a15.tbl
[2012/02/20 10:18:47 | 000,000,700 | ---- | C] () -- C:\WINDOWS\System32\dayiptr.tbl
[2012/02/20 10:18:47 | 000,000,520 | ---- | C] () -- C:\WINDOWS\System32\dayiphr.tbl
[2012/02/20 10:18:40 | 001,223,500 | ---- | C] () -- C:\WINDOWS\System32\WINZM.MB
[2012/02/20 10:18:39 | 001,783,864 | ---- | C] () -- C:\WINDOWS\System32\WINPY.MB
[2012/02/20 10:18:39 | 001,564,868 | ---- | C] () -- C:\WINDOWS\System32\WINSP.MB
[2012/02/20 10:18:37 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2012/02/20 10:18:37 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2012/02/20 10:18:31 | 013,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2012/02/20 10:18:16 | 000,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2012/02/20 10:18:14 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2012/02/20 10:18:07 | 000,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2012/02/20 10:18:04 | 000,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2012/02/20 09:06:42 | 000,163,142 | ---- | C] () -- C:\WINDOWS\hpoins28.dat
[2012/02/20 09:06:42 | 000,000,796 | ---- | C] () -- C:\WINDOWS\hpomdl28.dat
[2012/02/20 08:51:17 | 000,294,912 | R--- | C] () -- C:\WINDOWS\System32\copydrvUsb.exe
[2012/02/20 08:51:17 | 000,010,621 | R--- | C] () -- C:\WINDOWS\System32\HPWPAUSB.cat
[2012/02/20 08:51:17 | 000,001,962 | R--- | C] () -- C:\WINDOWS\System32\HPWPAUSB.inf
[2012/02/19 21:22:00 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2012/02/19 21:22:00 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2012/02/19 21:22:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2012/02/19 21:22:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2012/02/19 21:22:00 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2012/02/19 21:22:00 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2012/02/19 21:21:38 | 000,001,714 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk
[2012/02/19 21:21:04 | 000,001,743 | RHS- | C] () -- C:\WINDOWS\System32\drivers\103C_HP_NTBK_HP Compaq nx6310 (RH327ET#ABU)_YN_0U_QCNU644F9C6_E404611004_46_I30AA_SHP_VKBC Version 58.12_B68YDU Ver. F.09_T060915_WXP2_L409_M248_J40_7Intel_8Celeron M 430_91.73_#120219_N14E4170C_(RH327ET#ABU).MRK
[2012/02/19 21:12:26 | 000,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD
[2012/02/19 21:11:06 | 259,444,736 | -HS- | C] () -- C:\hiberfil.sys
[2012/02/19 21:10:27 | 000,000,060 | ---- | C] () -- C:\WINDOWS\System32\SYSDRV.DAT
[2012/02/19 20:41:53 | 000,001,683 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SendBlaster.lnk
[2012/02/19 20:40:30 | 006,530,130 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\marine dna ad template.cdr
[2012/02/19 20:40:30 | 002,986,800 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Kiera Williams.JPG
[2012/02/19 20:40:30 | 000,079,229 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\dixons order
[2012/02/19 20:40:30 | 000,021,827 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\MES_MAIL_OUT.html
[2012/02/19 20:40:30 | 000,001,947 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\auto_complete.gif
[2012/02/19 20:40:30 | 000,001,305 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\index.html
[2012/02/19 20:40:30 | 000,000,158 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\.htaccess
[2012/02/19 20:40:30 | 000,000,053 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\googleb4bf3b82812fa1a8.html
[2012/02/19 20:40:30 | 000,000,024 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\.HTPASSCP
[2012/02/19 20:40:30 | 000,000,022 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\.HTPASSWD
[2012/02/19 20:40:28 | 017,609,038 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Shipping_Pkg.zip
[2012/02/19 20:40:27 | 018,924,788 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\sendblaster163.zip
[2012/02/19 20:40:24 | 050,585,930 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\images.zip
[2012/02/19 20:40:24 | 002,772,408 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ImageConverter_Setup.zip
[2012/02/19 20:40:24 | 000,125,819 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\mcafee receipt.pdf
[2012/02/19 20:40:24 | 000,121,528 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\quotation_71210.pdf
[2012/02/19 20:40:24 | 000,032,077 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Easyspace Invoice.pdf
[2012/02/19 20:40:24 | 000,013,055 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\quotation.pdf
[2012/02/19 20:39:29 | 001,535,562 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\products.csv
[2012/02/19 20:39:29 | 000,753,581 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\NAVIMO_2011.csv
[2012/02/19 20:39:29 | 000,486,358 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\navimo_new_products.csv
[2012/02/19 20:39:29 | 000,085,044 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\plastprice.csv
[2012/02/19 20:39:29 | 000,075,592 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\newprice.csv
[2012/02/19 20:39:29 | 000,040,988 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Futura_XBlkCn_BT_Extra_Black_(wwww.font-cat.com).ttf
[2012/02/19 20:39:29 | 000,015,893 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\barton.csv
[2012/02/19 20:39:29 | 000,000,870 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\cactus_specials.csv
[2012/02/19 20:29:33 | 003,550,256 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\planets.cdr
[2012/02/19 20:29:33 | 001,014,277 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\wrar35b6.exe
[2012/02/19 20:29:33 | 000,557,398 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\orderof.cdr
[2012/02/19 20:29:33 | 000,086,607 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Tetra S330 Drawing.pdf
[2012/02/19 20:29:33 | 000,001,370 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\nondel.CSV
[2012/02/19 20:29:31 | 027,901,861 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\New Project 20110401 1455.sql
[2012/02/19 20:29:30 | 020,759,650 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\New Project 20100812 1406.sql
[2012/02/19 20:29:30 | 001,473,122 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\mes custom info.cdr
[2012/02/19 20:29:30 | 000,614,352 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\jib_reefing_system_GB.pdf
[2012/02/19 20:29:30 | 000,573,993 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\EORI Application.pdf
[2012/02/19 20:29:30 | 000,278,537 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\mes_email.csv
[2012/02/19 20:29:30 | 000,127,132 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\email.csv
[2012/02/19 20:29:30 | 000,122,779 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\mdna_email.csv
[2012/02/19 20:29:30 | 000,050,388 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\kitchen power.cdr
[2012/02/19 20:29:30 | 000,041,950 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\kitchen.cdr
[2012/02/19 20:29:29 | 001,861,086 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\danielle front cover.cdr
[2012/02/19 20:29:28 | 015,296,840 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\danielle book cover.cdr
[2012/02/19 20:29:28 | 000,976,490 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Backup_of_mes custom info.cdr
[2012/02/19 20:29:28 | 000,557,386 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Backup_of_orderof.cdr
[2012/02/19 20:29:28 | 000,045,392 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\bayblade.cdr
[2012/02/19 20:29:28 | 000,041,952 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Backup_of_kitchen.cdr
[2012/02/19 20:29:28 | 000,002,543 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\BARTCHANGE.csv
[2012/02/19 20:29:27 | 021,191,741 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Backup21910 20100921 0955.sql
[2012/02/19 20:10:52 | 000,000,709 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\PSPad.lnk
[2012/02/19 20:10:52 | 000,000,691 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\PSPad.lnk
[2012/02/19 18:55:38 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2012/02/19 18:50:33 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012/02/19 16:53:48 | 000,012,800 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Settings.cfg
[2012/02/19 16:53:13 | 000,000,904 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\AceFTP 3 Freeware.lnk
[2012/02/19 16:46:29 | 000,001,771 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\MySQL Administrator.lnk

========== LOP Check ==========

[2012/02/19 16:53:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Dynamic
[2012/02/21 15:46:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\ICAClient
[2012/02/21 10:14:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\MySQL
[2006/08/24 05:39:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SampleView
[2012/02/19 16:56:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SiteClasses
[2012/02/20 10:26:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Sites
[2012/02/19 16:53:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor
[2012/02/19 16:40:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MySQL
[2012/02/22 15:20:16 | 000,000,318 | ---- | M] () -- C:\WINDOWS\Tasks\Poabvvrmwl.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: EXPLORER.EXE >
[2004/08/04 08:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\explorer.exe

< MD5 for: SVCHOST.EXE >
[2004/08/04 08:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\system32\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 08:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 08:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\system32\winlogon.exe

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2009/03/08 04:32:54 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2009/03/08 04:32:54 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2009/03/08 04:32:54 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2009/03/08 04:32:54 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2009/03/08 04:32:54 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2009/03/08 04:32:54 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< C:\Windows\assembly\tmp\U\*.* /s >

< C:\Program Files\Common Files\ComObjects\*.* /s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< End of report >





Extras.txt:

OTL Extras logfile created on: 22/02/2012 23:26:45 - Run 1
OTL by OldTimer - Version 3.2.33.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

247.36 Mb Total Physical Memory | 79.84 Mb Available Physical Memory | 32.28% Memory free
706.20 Mb Paging File | 212.25 Mb Available in Paging File | 30.06% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 30.68 Gb Total Space | 13.01 Gb Free Space | 42.40% Space Free | Partition Type: NTFS
Drive D: | 6.59 Gb Total Space | 0.57 Gb Free Space | 8.72% Space Free | Partition Type: NTFS

Computer Name: DNALAPTOP | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\SMINST\Scheduler.exe" = C:\WINDOWS\SMINST\Scheduler.exe:*:Enabled:Scheduler -- ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{32A72502-BC2C-4C39-ACEA-BC3D463F0697}" = EN
"{33933681-9A64-4A5C-97F5-4F6AEDB9FA0F}" = MySQL Server 5.5
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.00 H1
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F9F7336-6DF8-476F-ABF6-C70A17FAF619}" = HP Backup and Recovery Manager Installer
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 E1
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = TIPCI
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E98F23B-1328-4322-A6EC-2EDC8FC3A4FE}" = FontNav
"{5D97A4A7-C274-4B63-86D9-07A33435F505}" = InterVideo DVD Check
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}" = CorelDRAW Graphics Suite X3
"{8A2DA523-38FD-49DA-88E9-6BCDD7CCE9CF}" = MySQL Administrator 1.1
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{914E1AB1-DCA0-4A7D-935F-B58C4B887A2B}" = HP ProtectTools Security Manager 2.00 C3
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{99716D64-2AD1-40E0-86F1-EA5DA90E3E0A}" = SendBlaster
"{9F7AF7CD-E3D0-4C68-A3BA-C76C359B3AA8}" = LightScribe 1.4.105.1
"{A7AD8CEF-72D7-4FE4-8A14-DDD09DC86074}" = HP Notebook Accessories Product Tour
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1033-7B44-A70500000002}" = Adobe Reader 7.0.5
"{AE052EF7-2640-48D7-8915-69B810D975CB}" = HP BIOS Configuration for ProtectTools 2.00 E1
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{B9F4C05D-E42F-4E9A-A73F-FDD9355319FB}" = HP Credential Manager for ProtectTools
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{BE8A9C2C-8E41-445B-A746-BEB0B1F992F8}" = DJ_AIO_03_F4200_Software_Min
"{C3B6AEB1-390C-4792-8677-CD87F8B2C959}" = HP Deskjet F4200 All-In-One Driver 11.0 03
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{C94E45B0-6AA6-4FB9-9AAE-22085F631880}" = VBA
"{DB0781F5-06D2-49BB-87B5-00F3B834FC3B}" = HP User Guides 0015
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E0DBC47C-ED3F-4A1B-A929-9A26DAAA14B3}" = Application Installer 4.00.B5
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{EBFEEB3F-3E3B-4725-A4E0-376144CE4F76}" = Citrix XenApp Web Plugin
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F6869CD2-3DB4-476D-A4C7-B3AE7C3ACF7B}" = Windows Media Connect
"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
"AceFTP 3 Freeware" = AceFTP 3 Freeware
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Anti-phishing Domain Advisor" = Anti-phishing Domain Advisor
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PSPad editor_is1" = PSPad editor
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WGA" = Windows Genuine Advantage Validation Tool
"Windows Media Connect" = Windows Media Connect
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR archiver

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 20/02/2012 16:00:57 | Computer Name = DNALAPTOP | Source = Application Hang | ID = 1002
Description = Hanging application Aceftp3free.exe, version 3.8.0.3, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 21/02/2012 05:28:14 | Computer Name = DNALAPTOP | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.5604.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 21/02/2012 06:49:57 | Computer Name = DNALAPTOP | Source = Microsoft Office 11 | ID = 1000
Description = Faulting application winword.exe, version 11.0.5604.0, stamp 3f314a2f,
faulting module winword.exe, version 11.0.5604.0, stamp 3f314a2f, debug? 0, fault
address 0x001f718f.

Error - 21/02/2012 06:50:40 | Computer Name = DNALAPTOP | Source = Microsoft Office 11 | ID = 1000
Description = Faulting application winword.exe, version 11.0.5604.0, stamp 3f314a2f,
faulting module winword.exe, version 11.0.5604.0, stamp 3f314a2f, debug? 0, fault
address 0x001f718f.

Error - 21/02/2012 06:50:55 | Computer Name = DNALAPTOP | Source = Microsoft Office 11 | ID = 1000
Description = Faulting application winword.exe, version 11.0.5604.0, stamp 3f314a2f,
faulting module winword.exe, version 11.0.5604.0, stamp 3f314a2f, debug? 0, fault
address 0x001f718f.

Error - 21/02/2012 06:51:58 | Computer Name = DNALAPTOP | Source = Microsoft Office 11 | ID = 1000
Description = Faulting application winword.exe, version 11.0.5604.0, stamp 3f314a2f,
faulting module winword.exe, version 11.0.5604.0, stamp 3f314a2f, debug? 0, fault
address 0x001f718f.

Error - 21/02/2012 06:52:26 | Computer Name = DNALAPTOP | Source = Microsoft Office 11 | ID = 1000
Description = Faulting application winword.exe, version 11.0.5604.0, stamp 3f314a2f,
faulting module winword.exe, version 11.0.5604.0, stamp 3f314a2f, debug? 0, fault
address 0x001f718f.

Error - 21/02/2012 15:11:53 | Computer Name = DNALAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module urlmon.dll, version 8.0.6001.18702, fault address 0x0004f903.

Error - 21/02/2012 16:14:49 | Computer Name = DNALAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module unknown, version 0.0.0.0, fault address 0x83000401.

[ System Events ]
Error - 21/02/2012 11:41:25 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Citrix\ICA
Client\MFC80.DLL. Reference error message: The operation completed successfully.
.

Error - 21/02/2012 11:41:26 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842786
Description = Component identity found in manifest does not match the identity of
the component requested

Error - 21/02/2012 11:41:26 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842810
Description = Syntax error in manifest or policy file "C:\PROGRA~1\Citrix\ICACLI~1\Microsoft.VC80.MFCLOC.MANIFEST"
on line 5.

Error - 21/02/2012 11:41:26 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\PROGRA~1\Citrix\ICACLI~1\MFC80.DLL.
Reference
error message: The operation completed successfully. .

Error - 22/02/2012 08:04:11 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842786
Description = Component identity found in manifest does not match the identity of
the component requested

Error - 22/02/2012 08:04:11 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842810
Description = Syntax error in manifest or policy file "C:\Program Files\Citrix\ICA
Client\Microsoft.VC80.MFCLOC.MANIFEST" on line 5.

Error - 22/02/2012 08:04:11 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Citrix\ICA
Client\MFC80.DLL. Reference error message: The operation completed successfully.
.

Error - 22/02/2012 08:04:12 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842786
Description = Component identity found in manifest does not match the identity of
the component requested

Error - 22/02/2012 08:04:12 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842810
Description = Syntax error in manifest or policy file "C:\PROGRA~1\Citrix\ICACLI~1\Microsoft.VC80.MFCLOC.MANIFEST"
on line 5.

Error - 22/02/2012 08:04:12 | Computer Name = DNALAPTOP | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\PROGRA~1\Citrix\ICACLI~1\MFC80.DLL.
Reference
error message: The operation completed successfully. .


< End of report >



I am about to run the aswMBR.exe and will post the results.
  • 0

#4
Davidw1971

Davidw1971

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
aswMBR.exe results:

aswMBR version 0.9.9.1649 Copyright© 2011 AVAST Software
Run date: 2012-02-22 23:40:33
-----------------------------
23:40:33.281 OS Version: Windows 5.1.2600 Service Pack 2
23:40:33.281 Number of processors: 1 586 0xE08
23:40:33.296 ComputerName: DNALAPTOP UserName:
23:40:36.078 Initialize success
23:41:15.406 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
23:41:15.406 Disk 0 Vendor: HTS54104 MB2O Size: 38166MB BusType: 3
23:41:15.437 Disk 0 MBR read successfully
23:41:15.437 Disk 0 MBR scan
23:41:15.453 Disk 0 unknown MBR code
23:41:15.453 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 31413 MB offset 63
23:41:15.484 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 6747 MB offset 64335600
23:41:15.500 Disk 0 scanning sectors +78155280
23:41:15.578 Disk 0 scanning C:\WINDOWS\system32\drivers
23:41:20.171 Service scanning
23:41:33.593 Modules scanning
23:41:42.234 Module: C:\WINDOWS\System32\DLA\DLADResN.SYS **SUSPICIOUS**
23:41:45.234 Disk 0 trace - called modules:
23:41:45.328 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys
23:41:45.906 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8128c030]
23:41:45.921 3 CLASSPNP.SYS[f954b05b] -> nt!IofCallDriver -> \Device\0000007f[0x812c2f18]
23:41:45.937 5 ACPI.sys[f93c1620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x812b6030]
23:41:45.953 Scan finished successfully
23:42:03.531 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
23:42:03.562 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"
  • 0

#5
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
What anti virus are you running ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Commands
    [CREATERESTOREPOINT]

    :OTL
    O33 - MountPoints2\{ed7a728d-5b0f-11e1-bfe9-0014a5d0ec4b}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
    [2012/02/22 15:20:16 | 000,000,318 | ---- | M] () -- C:\WINDOWS\tasks\Poabvvrmwl.job
    [2012/02/22 15:20:11 | 000,118,784 | RHS- | M] () -- C:\WINDOWS\System32\kbd101as.dll

    :Files
    ipconfig /flushdns /c

    :Commands
    [emptytemp]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

  • 0

#6
Davidw1971

Davidw1971

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
Thanks for your help with all this.

Below is the log from the final OTL scan:

OTL logfile created on: 23/02/2012 22:40:38 - Run 2
OTL by OldTimer - Version 3.2.33.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

247.36 Mb Total Physical Memory | 27.58 Mb Available Physical Memory | 11.15% Memory free
603.20 Mb Paging File | 274.54 Mb Available in Paging File | 45.51% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 30.68 Gb Total Space | 13.51 Gb Free Space | 44.05% Space Free | Partition Type: NTFS
Drive D: | 6.59 Gb Total Space | 0.57 Gb Free Space | 8.72% Space Free | Partition Type: NTFS

Computer Name: DNALAPTOP | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/02/22 23:20:26 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2011/01/19 15:02:44 | 000,232,104 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe
PRC - [2006/02/15 15:43:16 | 000,892,928 | ---- | M] () -- C:\WINDOWS\SMINST\Scheduler.exe
PRC - [2006/02/14 18:56:08 | 000,122,880 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\HPQ\HP ProtectTools Security Manager\pthosttr.exe
PRC - [2005/12/23 20:44:26 | 000,491,606 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe
PRC - [2005/09/24 05:05:26 | 000,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
PRC - [2005/08/31 12:20:00 | 000,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE
PRC - [2005/06/29 19:06:54 | 000,043,008 | ---- | M] (Cognizance Corporation) -- C:\Program Files\HPQ\IAM\Bin\asghost.exe
PRC - [2004/08/04 08:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [1999/10/22 11:00:32 | 000,043,520 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe


========== Modules (No Company Name) ==========

MOD - [2006/02/15 15:43:16 | 000,892,928 | ---- | M] () -- C:\WINDOWS\SMINST\Scheduler.exe
MOD - [2005/12/23 20:44:26 | 000,491,606 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe
MOD - [2004/06/01 09:39:56 | 000,094,274 | ---- | M] () -- C:\WINDOWS\system32\HPBHEALR.DLL
MOD - [2003/07/14 22:44:34 | 000,102,968 | ---- | M] () -- C:\Program Files\Microsoft Office\OFFICE11\OUTLCTL.DLL
MOD - [1999/10/26 12:32:14 | 000,050,176 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 4.0\Distillr\adistres.dll
MOD - [1999/10/22 11:00:32 | 000,043,520 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (MySQL)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2004/08/11 07:46:56 | 000,483,328 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- c:\Program Files\Windows Media Connect\mswmccds.exe -- (WmcCds) Windows Media Connect (WMC)
SRV - [2004/08/11 04:50:42 | 000,028,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect\mswmcls.exe -- (WmcCdsLs) Windows Media Connect (WMC)


========== Driver Services (SafeList) ==========

DRV - [2006/07/31 01:00:08 | 001,155,584 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/03/30 21:39:48 | 000,130,432 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500)
DRV - [2006/02/09 01:00:04 | 000,142,720 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) Broadcom NetLink ™
DRV - [2006/02/09 01:00:04 | 000,045,312 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/01/19 13:50:40 | 001,428,096 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2006/01/19 13:50:14 | 000,424,320 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2006/01/19 07:45:00 | 000,057,096 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2005/09/19 21:24:20 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)
DRV - [2005/09/19 21:24:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2005/09/19 21:23:52 | 000,007,808 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2005/08/31 12:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2005/08/31 12:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2005/08/31 12:20:00 | 000,086,524 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2005/08/31 12:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2005/08/31 12:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2005/08/31 12:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2005/08/31 12:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)
DRV - [2005/08/25 19:16:52 | 000,005,628 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2005/08/25 19:16:16 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)
DRV - [2004/08/04 08:00:00 | 000,200,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RMCast.sys -- (RMCAST)
DRV - [2004/08/04 08:00:00 | 000,072,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mqac.sys -- (MQAC)
DRV - [2001/08/17 19:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)



O1 HOSTS File: ([2004/08/04 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (HP Credential Manager for ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
O4 - HKLM..\Run: [CognizanceTS] C:\Program Files\HPQ\IAM\Bin\AsTsVcc.dll (Cognizance Corporation)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\WINDOWS\CREATOR\Remind_XP.exe ()
O4 - HKLM..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe ()
O4 - HKLM..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe (InterVideo Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe (InterVideo Inc.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Translate English Word - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{69559416-C392-47D4-AD1E-9380630012C4}: DhcpNameServer = 194.168.4.100 194.168.8.100
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\OneCard: DllName - (C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll) - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll (Cognizance Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\HP Cityscape.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\HP Cityscape.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 23:07:00 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/23 22:33:01 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/02/22 23:40:16 | 004,730,880 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/02/22 23:20:20 | 000,583,680 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/02/22 18:34:18 | 000,000,000 | ---D | C] -- C:\!KillBox
[2012/02/22 18:15:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\HiJackThis
[2012/02/22 18:15:47 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2012/02/22 10:02:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\includes
[2012/02/21 15:41:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\ICAClient
[2012/02/21 15:40:30 | 000,000,000 | ---D | C] -- C:\Program Files\Citrix
[2012/02/21 13:24:51 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2012/02/21 13:23:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Batchwork
[2012/02/21 09:18:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Corel
[2012/02/21 09:01:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Acrobat 4.0
[2012/02/21 08:58:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\WINDOWS
[2012/02/20 17:37:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR
[2012/02/20 17:37:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\WinRAR
[2012/02/20 17:37:03 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012/02/20 09:20:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\AdobeUM
[2012/02/20 09:13:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\HP
[2012/02/20 09:13:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Hewlett-Packard
[2012/02/20 09:12:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
[2012/02/20 09:08:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2012/02/20 09:07:44 | 000,000,000 | -H-D | C] -- C:\Config.Msi
[2012/02/20 08:51:17 | 000,018,560 | R--- | C] (Windows ® Codename Longhorn DDK provider) -- C:\WINDOWS\System32\HPWPAUSB.sys
[2012/02/19 21:25:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Google
[2012/02/19 21:25:09 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012/02/19 21:22:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\tiinst
[2012/02/19 21:22:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\InterVideo WinDVD
[2012/02/19 21:21:38 | 000,000,000 | ---D | C] -- C:\Program Files\InterVideo
[2012/02/19 21:19:08 | 000,000,000 | ---D | C] -- C:\Program Files\Program Shortcuts
[2012/02/19 21:15:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2012/02/19 21:11:46 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2012/02/19 21:10:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\i386
[2012/02/19 20:49:55 | 000,000,000 | ---D | C] -- C:\WINDOWS
[2012/02/19 20:41:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SendBlaster
[2012/02/19 20:41:47 | 000,000,000 | ---D | C] -- C:\Program Files\SendBlaster
[2012/02/19 20:40:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\smg
[2012/02/19 20:40:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Slides
[2012/02/19 20:40:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Shipping_Pkg
[2012/02/19 20:39:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\pics
[2012/02/19 20:39:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\New Folder
[2012/02/19 20:39:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\mysql-gui-tools-noinstall-5.0-r17-win32
[2012/02/19 20:39:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\minn kota
[2012/02/19 20:39:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\mes
[2012/02/19 20:39:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\images
[2012/02/19 20:39:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\boatgorillaz auto update 2011
[2012/02/19 20:39:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\2011 UK Auto Update Program
[2012/02/19 20:39:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\100marine auto update 2011
[2012/02/19 20:37:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe
[2012/02/19 20:30:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Cactus020
[2012/02/19 20:30:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Boatgorillaz
[2012/02/19 20:29:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Boatbitz
[2012/02/19 20:29:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\AIS400 INSTALLATION DISK
[2012/02/19 20:27:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Tetra
[2012/02/19 20:27:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\New Folder
[2012/02/19 20:26:59 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Videos
[2012/02/19 20:26:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\nasa
[2012/02/19 20:26:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\My Data Sources
[2012/02/19 20:26:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\mesltd
[2012/02/19 20:22:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Marine DNA
[2012/02/19 20:22:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Leading Edge
[2012/02/19 20:22:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\inspection
[2012/02/19 20:22:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Harry old trafford
[2012/02/19 20:22:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\harry
[2012/02/19 20:22:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Downloads
[2012/02/19 20:22:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\database backups
[2012/02/19 20:22:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Corel User Files
[2012/02/19 20:22:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\cap images
[2012/02/19 20:21:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Cactus Fishing
[2012/02/19 20:15:18 | 000,000,000 | ---D | C] -- C:\Program Files\Netscape
[2012/02/19 20:11:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\PSpad
[2012/02/19 20:10:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\PSPad editor
[2012/02/19 20:10:49 | 000,000,000 | ---D | C] -- C:\Program Files\PSPad editor
[2012/02/19 20:05:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CorelDRAW Graphics Suite X3
[2012/02/19 20:05:01 | 000,000,000 | ---D | C] -- C:\Program Files\Corel
[2012/02/19 20:05:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Corel
[2012/02/19 18:49:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
[2012/02/19 18:48:58 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
[2012/02/19 18:48:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012/02/19 18:47:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\SHELLNEW
[2012/02/19 18:46:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012/02/19 18:46:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012/02/19 18:44:50 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2012/02/19 16:53:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Dynamic
[2012/02/19 16:53:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Sites
[2012/02/19 16:53:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\SiteClasses
[2012/02/19 16:53:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\antiphishing-mystart3_6dn
[2012/02/19 16:53:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor
[2012/02/19 16:53:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\AceFTP 3 Freeware
[2012/02/19 16:53:11 | 000,000,000 | ---D | C] -- C:\Program Files\Visicom Media
[2012/02/19 16:49:57 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/02/19 16:48:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\MySQL
[2012/02/19 16:46:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\MySQL
[2012/02/19 16:41:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\MySQL
[2012/02/19 16:40:53 | 000,000,000 | ---D | C] -- C:\Program Files\MySQL
[2012/02/19 16:40:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MySQL
[2012/02/19 16:36:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[2012/02/19 16:36:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2012/02/19 16:33:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Sun
[2012/02/19 16:31:56 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\PrivacIE
[2012/02/19 16:30:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities
[2012/02/19 16:28:47 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\IETldCache
[2012/02/19 16:22:41 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2012/02/19 15:47:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Macromedia
[2012/02/19 15:47:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Adobe
[2012/02/19 14:52:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
[2012/02/19 14:52:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US
[2012/02/19 14:51:49 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie7
[2012/02/19 14:51:29 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
[2012/02/19 14:51:00 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
[2012/02/19 14:28:36 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\UserData

========== Files - Modified Within 30 Days ==========

[2012/02/23 22:37:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/02/23 22:36:56 | 259,444,736 | -HS- | M] () -- C:\hiberfil.sys
[2012/02/23 18:03:09 | 000,039,478 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZFURTZT14.jpg
[2012/02/23 18:02:23 | 000,028,507 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZFURTZT9.jpg
[2012/02/23 16:58:29 | 000,006,486 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\Quotation 23-02-12.pdf
[2012/02/23 15:15:08 | 000,012,800 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Settings.cfg
[2012/02/23 15:02:58 | 000,003,871 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\privacy.php
[2012/02/23 12:30:27 | 000,040,230 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\P300.gif
[2012/02/23 11:49:29 | 000,016,905 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\301617.pdf
[2012/02/23 11:35:51 | 000,007,372 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\careers.php
[2012/02/23 11:33:54 | 000,009,240 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\returns.php
[2012/02/23 11:05:50 | 000,007,967 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\warrantee.php
[2012/02/23 11:04:09 | 000,006,412 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\payoptions.php
[2012/02/23 11:01:15 | 000,024,102 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\aboutus.php
[2012/02/23 10:46:00 | 000,008,015 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\mes_logo_1.gif
[2012/02/23 10:38:41 | 000,011,654 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Graphic1.jpg
[2012/02/23 10:37:21 | 000,043,573 | ---- | M] () -- C:\WINDOWS\FontData.fdb
[2012/02/23 00:02:22 | 000,005,667 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\main_price_import.php
[2012/02/22 23:57:43 | 000,022,774 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\new_price.csv
[2012/02/22 23:42:03 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/02/22 23:40:31 | 004,730,880 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/02/22 23:20:26 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/02/22 18:17:24 | 000,002,463 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/02/22 11:32:25 | 000,016,711 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\301616.pdf
[2012/02/22 11:29:27 | 000,016,750 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\301615.pdf
[2012/02/21 21:01:08 | 000,009,865 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-30.jpg
[2012/02/21 20:52:18 | 000,026,974 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-20.gif
[2012/02/21 19:36:16 | 000,026,218 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-10.gif
[2012/02/21 19:21:30 | 000,033,217 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ZRAYC90BUN1.jpg
[2012/02/21 13:35:13 | 000,394,542 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/02/21 13:35:13 | 000,056,968 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/02/21 13:30:37 | 000,299,640 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/02/21 10:58:10 | 000,012,041 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\DHL Payment 210212.pdf
[2012/02/21 09:30:48 | 000,011,432 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\Crewsaver Payment 210212.pdf
[2012/02/21 09:18:21 | 000,000,952 | -HS- | M] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2012/02/21 09:01:02 | 000,000,910 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
[2012/02/21 08:58:04 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012/02/21 08:58:04 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012/02/20 14:56:30 | 000,281,008 | ---- | M] () -- C:\price.csv
[2012/02/20 09:15:00 | 000,163,142 | ---- | M] () -- C:\WINDOWS\hpoins28.dat
[2012/02/19 21:21:38 | 000,001,714 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk
[2012/02/19 21:21:10 | 000,001,743 | RHS- | M] () -- C:\WINDOWS\System32\drivers\103C_HP_NTBK_HP Compaq nx6310 (RH327ET#ABU)_YN_0U_QCNU644F9C6_E404611004_46_I30AA_SHP_VKBC Version 58.12_B68YDU Ver. F.09_T060915_WXP2_L409_M248_J40_7Intel_8Celeron M 430_91.73_#120219_N14E4170C_(RH327ET#ABU).MRK
[2012/02/19 21:19:23 | 000,002,970 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2012/02/19 21:19:16 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2012/02/19 21:12:26 | 000,008,192 | ---- | M] () -- C:\WINDOWS\REGLOCS.OLD
[2012/02/19 21:10:27 | 000,000,060 | ---- | M] () -- C:\WINDOWS\System32\SYSDRV.DAT
[2012/02/19 20:41:53 | 000,001,683 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SendBlaster.lnk
[2012/02/19 20:10:52 | 000,000,709 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\PSPad.lnk
[2012/02/19 20:10:52 | 000,000,691 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\PSPad.lnk
[2012/02/19 18:55:38 | 000,000,792 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2012/02/19 18:50:33 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2012/02/19 16:53:13 | 000,000,904 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\AceFTP 3 Freeware.lnk
[2012/02/19 16:46:29 | 000,001,771 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\MySQL Administrator.lnk
[2012/02/19 16:28:50 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/02/19 14:52:54 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/02/19 14:41:47 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/02/18 17:25:00 | 000,002,088 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\configure.php
[2012/02/17 21:05:07 | 000,001,305 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\index.html
[2012/01/27 14:36:29 | 000,278,537 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\mes_email.csv
[2012/01/25 11:16:01 | 000,021,827 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\MES_MAIL_OUT.html

========== Files Created - No Company Name ==========

[2012/02/23 18:03:08 | 000,039,478 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZFURTZT14.jpg
[2012/02/23 18:02:21 | 000,028,507 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZFURTZT9.jpg
[2012/02/23 15:51:45 | 000,006,486 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Quotation 23-02-12.pdf
[2012/02/23 15:00:05 | 000,006,494 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\filenames.php
[2012/02/23 14:59:19 | 000,003,262 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\files.php
[2012/02/23 14:53:59 | 000,021,152 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\english.php
[2012/02/23 14:51:21 | 000,003,871 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\privacy.php
[2012/02/23 12:30:49 | 000,040,230 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\P300.gif
[2012/02/23 11:49:28 | 000,016,905 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\301617.pdf
[2012/02/23 11:34:58 | 000,007,372 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\careers.php
[2012/02/23 11:06:27 | 000,009,240 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\returns.php
[2012/02/23 11:04:46 | 000,007,967 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\warrantee.php
[2012/02/23 11:03:25 | 000,006,412 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\payoptions.php
[2012/02/23 10:57:03 | 000,024,102 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\aboutus.php
[2012/02/23 10:40:48 | 000,008,015 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\mes_logo_1.gif
[2012/02/23 10:37:19 | 000,043,573 | ---- | C] () -- C:\WINDOWS\FontData.fdb
[2012/02/23 10:33:58 | 000,011,654 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Graphic1.jpg
[2012/02/23 00:01:05 | 000,005,667 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\main_price_import.php
[2012/02/22 23:57:40 | 000,022,774 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\new_price.csv
[2012/02/22 23:42:03 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/02/22 18:15:48 | 000,002,463 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/02/22 11:32:25 | 000,016,711 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\301616.pdf
[2012/02/22 11:29:24 | 000,016,750 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\301615.pdf
[2012/02/21 21:01:06 | 000,009,865 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-30.jpg
[2012/02/21 20:52:55 | 000,026,974 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-20.gif
[2012/02/21 19:36:48 | 000,026,218 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZGAR010-11372-10.gif
[2012/02/21 19:21:27 | 000,033,217 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ZRAYC90BUN1.jpg
[2012/02/21 10:58:09 | 000,012,041 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\DHL Payment 210212.pdf
[2012/02/21 09:30:45 | 000,011,432 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Crewsaver Payment 210212.pdf
[2012/02/21 09:18:20 | 000,000,952 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2012/02/21 09:01:02 | 000,000,910 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
[2012/02/21 09:00:55 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\Msvcrt10.dll
[2012/02/21 08:58:04 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012/02/21 08:58:04 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012/02/20 17:18:34 | 000,002,088 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\configure.php
[2012/02/20 14:56:30 | 000,281,008 | ---- | C] () -- C:\price.csv
[2012/02/20 10:18:50 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\korwbrkr.lex
[2012/02/20 10:18:50 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2012/02/20 10:18:50 | 000,002,060 | ---- | C] () -- C:\WINDOWS\System32\noise.jpn
[2012/02/20 10:18:50 | 000,001,486 | ---- | C] () -- C:\WINDOWS\System32\noise.kor
[2012/02/20 10:18:47 | 000,211,938 | ---- | C] () -- C:\WINDOWS\System32\lcphrase.tbl
[2012/02/20 10:18:47 | 000,146,126 | ---- | C] () -- C:\WINDOWS\System32\array30.tab
[2012/02/20 10:18:47 | 000,116,285 | ---- | C] () -- C:\WINDOWS\System32\msdayi.tbl
[2012/02/20 10:18:47 | 000,110,566 | ---- | C] () -- C:\WINDOWS\System32\arphr.tbl
[2012/02/20 10:18:47 | 000,044,370 | ---- | C] () -- C:\WINDOWS\System32\acode.tbl
[2012/02/20 10:18:47 | 000,044,370 | ---- | C] () -- C:\WINDOWS\System32\a234.tbl
[2012/02/20 10:18:47 | 000,043,242 | ---- | C] () -- C:\WINDOWS\System32\phoncode.tbl
[2012/02/20 10:18:47 | 000,024,114 | ---- | C] () -- C:\WINDOWS\System32\lcptr.tbl
[2012/02/20 10:18:47 | 000,018,600 | ---- | C] () -- C:\WINDOWS\System32\arrayhw.tab
[2012/02/20 10:18:47 | 000,016,312 | ---- | C] () -- C:\WINDOWS\System32\arptr.tbl
[2012/02/20 10:18:47 | 000,004,071 | ---- | C] () -- C:\WINDOWS\System32\phon.tbl
[2012/02/20 10:18:47 | 000,002,714 | ---- | C] () -- C:\WINDOWS\System32\phonptr.tbl
[2012/02/20 10:18:47 | 000,001,460 | ---- | C] () -- C:\WINDOWS\System32\a15.tbl
[2012/02/20 10:18:47 | 000,000,700 | ---- | C] () -- C:\WINDOWS\System32\dayiptr.tbl
[2012/02/20 10:18:47 | 000,000,520 | ---- | C] () -- C:\WINDOWS\System32\dayiphr.tbl
[2012/02/20 10:18:40 | 001,223,500 | ---- | C] () -- C:\WINDOWS\System32\WINZM.MB
[2012/02/20 10:18:39 | 001,783,864 | ---- | C] () -- C:\WINDOWS\System32\WINPY.MB
[2012/02/20 10:18:39 | 001,564,868 | ---- | C] () -- C:\WINDOWS\System32\WINSP.MB
[2012/02/20 10:18:37 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2012/02/20 10:18:37 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2012/02/20 10:18:31 | 013,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2012/02/20 10:18:16 | 000,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2012/02/20 10:18:14 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2012/02/20 10:18:07 | 000,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2012/02/20 10:18:04 | 000,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2012/02/20 09:06:42 | 000,163,142 | ---- | C] () -- C:\WINDOWS\hpoins28.dat
[2012/02/20 09:06:42 | 000,000,796 | ---- | C] () -- C:\WINDOWS\hpomdl28.dat
[2012/02/20 08:51:17 | 000,294,912 | R--- | C] () -- C:\WINDOWS\System32\copydrvUsb.exe
[2012/02/20 08:51:17 | 000,010,621 | R--- | C] () -- C:\WINDOWS\System32\HPWPAUSB.cat
[2012/02/20 08:51:17 | 000,001,962 | R--- | C] () -- C:\WINDOWS\System32\HPWPAUSB.inf
[2012/02/19 21:22:00 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2012/02/19 21:22:00 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2012/02/19 21:22:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2012/02/19 21:22:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2012/02/19 21:22:00 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2012/02/19 21:22:00 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2012/02/19 21:21:38 | 000,001,714 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk
[2012/02/19 21:21:04 | 000,001,743 | RHS- | C] () -- C:\WINDOWS\System32\drivers\103C_HP_NTBK_HP Compaq nx6310 (RH327ET#ABU)_YN_0U_QCNU644F9C6_E404611004_46_I30AA_SHP_VKBC Version 58.12_B68YDU Ver. F.09_T060915_WXP2_L409_M248_J40_7Intel_8Celeron M 430_91.73_#120219_N14E4170C_(RH327ET#ABU).MRK
[2012/02/19 21:12:26 | 000,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD
[2012/02/19 21:11:06 | 259,444,736 | -HS- | C] () -- C:\hiberfil.sys
[2012/02/19 21:10:27 | 000,000,060 | ---- | C] () -- C:\WINDOWS\System32\SYSDRV.DAT
[2012/02/19 20:41:53 | 000,001,683 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SendBlaster.lnk
[2012/02/19 20:40:30 | 006,530,130 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\marine dna ad template.cdr
[2012/02/19 20:40:30 | 002,986,800 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Kiera Williams.JPG
[2012/02/19 20:40:30 | 000,079,229 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\dixons order
[2012/02/19 20:40:30 | 000,021,827 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\MES_MAIL_OUT.html
[2012/02/19 20:40:30 | 000,001,947 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\auto_complete.gif
[2012/02/19 20:40:30 | 000,001,305 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\index.html
[2012/02/19 20:40:30 | 000,000,158 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\.htaccess
[2012/02/19 20:40:30 | 000,000,053 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\googleb4bf3b82812fa1a8.html
[2012/02/19 20:40:30 | 000,000,024 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\.HTPASSCP
[2012/02/19 20:40:30 | 000,000,022 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\.HTPASSWD
[2012/02/19 20:40:28 | 017,609,038 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Shipping_Pkg.zip
[2012/02/19 20:40:27 | 018,924,788 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\sendblaster163.zip
[2012/02/19 20:40:24 | 050,585,930 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\images.zip
[2012/02/19 20:40:24 | 002,772,408 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ImageConverter_Setup.zip
[2012/02/19 20:40:24 | 000,125,819 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\mcafee receipt.pdf
[2012/02/19 20:40:24 | 000,121,528 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\quotation_71210.pdf
[2012/02/19 20:40:24 | 000,032,077 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Easyspace Invoice.pdf
[2012/02/19 20:40:24 | 000,013,055 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\quotation.pdf
[2012/02/19 20:39:29 | 001,535,562 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\products.csv
[2012/02/19 20:39:29 | 000,753,581 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\NAVIMO_2011.csv
[2012/02/19 20:39:29 | 000,486,358 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\navimo_new_products.csv
[2012/02/19 20:39:29 | 000,085,044 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\plastprice.csv
[2012/02/19 20:39:29 | 000,075,592 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\newprice.csv
[2012/02/19 20:39:29 | 000,040,988 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Futura_XBlkCn_BT_Extra_Black_(wwww.font-cat.com).ttf
[2012/02/19 20:39:29 | 000,015,893 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\barton.csv
[2012/02/19 20:39:29 | 000,000,870 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\cactus_specials.csv
[2012/02/19 20:29:33 | 003,550,256 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\planets.cdr
[2012/02/19 20:29:33 | 001,014,277 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\wrar35b6.exe
[2012/02/19 20:29:33 | 000,557,398 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\orderof.cdr
[2012/02/19 20:29:33 | 000,086,607 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Tetra S330 Drawing.pdf
[2012/02/19 20:29:33 | 000,001,370 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\nondel.CSV
[2012/02/19 20:29:31 | 027,901,861 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\New Project 20110401 1455.sql
[2012/02/19 20:29:30 | 020,759,650 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\New Project 20100812 1406.sql
[2012/02/19 20:29:30 | 001,473,122 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\mes custom info.cdr
[2012/02/19 20:29:30 | 000,614,352 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\jib_reefing_system_GB.pdf
[2012/02/19 20:29:30 | 000,573,993 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\EORI Application.pdf
[2012/02/19 20:29:30 | 000,278,537 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\mes_email.csv
[2012/02/19 20:29:30 | 000,127,132 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\email.csv
[2012/02/19 20:29:30 | 000,122,779 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\mdna_email.csv
[2012/02/19 20:29:30 | 000,050,388 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\kitchen power.cdr
[2012/02/19 20:29:30 | 000,041,950 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\kitchen.cdr
[2012/02/19 20:29:29 | 001,861,086 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\danielle front cover.cdr
[2012/02/19 20:29:28 | 015,296,840 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\danielle book cover.cdr
[2012/02/19 20:29:28 | 000,976,490 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Backup_of_mes custom info.cdr
[2012/02/19 20:29:28 | 000,557,386 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Backup_of_orderof.cdr
[2012/02/19 20:29:28 | 000,045,392 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\bayblade.cdr
[2012/02/19 20:29:28 | 000,041,952 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Backup_of_kitchen.cdr
[2012/02/19 20:29:28 | 000,002,543 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\BARTCHANGE.csv
[2012/02/19 20:29:27 | 021,191,741 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\Backup21910 20100921 0955.sql
[2012/02/19 20:10:52 | 000,000,709 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\PSPad.lnk
[2012/02/19 20:10:52 | 000,000,691 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\PSPad.lnk
[2012/02/19 18:55:38 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2012/02/19 18:50:33 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012/02/19 16:53:48 | 000,012,800 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Settings.cfg
[2012/02/19 16:53:13 | 000,000,904 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\AceFTP 3 Freeware.lnk
[2012/02/19 16:46:29 | 000,001,771 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\MySQL Administrator.lnk

========== LOP Check ==========

[2012/02/19 16:53:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Dynamic
[2012/02/21 15:46:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\ICAClient
[2012/02/23 12:53:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\MySQL
[2006/08/24 05:39:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SampleView
[2012/02/19 16:56:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SiteClasses
[2012/02/23 14:48:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Sites
[2012/02/19 16:53:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor
[2012/02/19 16:40:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MySQL

========== Purity Check ==========



< End of report >
  • 0

#7
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
I can see no indication of an Antivirus, are you running one

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
  • 0

#8
Davidw1971

Davidw1971

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
Hi,

I don't run an anti-virus! dangerous I know, however I find they grind my old - low memory PC to a hault. I usually pretty careful and know when things don't look right. I haven't had a bad virus for a good 15 years! Normally I can get rid of any nasties myself, but this one stumped me!

Results from MBAM as follows:

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.24.02

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: DNALAPTOP [administrator]

24/02/2012 20:57:54
mbam-log-2012-02-24 (20-57-54).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 168759
Time elapsed: 6 minute(s), 57 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
  • 0

#9
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Avast is quite a lightweight antivirus - it might be worth giving that a try

And maybe add a tad more RAM

Anywho what are the current problems ?
  • 0

#10
Davidw1971

Davidw1971

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
Looks like its all sorted - thank you VERY much for all your help!

I still don't understand how I managed to download the same virus twice in 1 week, I'm thinking it may have been a rogue e-mail that I opened, although I did'nt open any attachments.

And maybe the virus was lurking in the backup I made before I re-formated the hard drive, although I didn't back up any system files.

Anyway, All OK now, hopefully for the foreseable future!

Thanks Once again.
  • 0

#11
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
I would recommend that you try Avast to see if it runs OK, also I would highly recommend that you update to SP3

Subject to no further problems :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Commands
    [emptytemp]
    [CLEARALLRESTOREPOINTS]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Click Yes to confirm.
  • Click OK.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Posted Image Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe :wave:
  • 0

#12
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP