Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

malwarebytes keeps blocking malicious websites every few mins [Closed]

Started by sam gibson , May 09 2012 04:36 PM

This topic is locked

#1
sam gibson

Posted 09 May 2012 - 04:36 PM

Member

Member
12 posts

Hello, hopefully someone can help me!

malwarebytes keeps blocking malicious websites every few minutes, ive ran combosfix, asw and tdskiller and attatched logs here. i have no idea where to go from here.

thanks, sam

Attached Files

aswMBR.txt 1.58KB 83 downloads
ComboFix.txt 7.58KB 71 downloads
TDSSKiller.2.7.34.0_09.05.2012_10.06.35_log.txt 81.95KB 74 downloads
avast.txt 365bytes 81 downloads

Edited by sam gibson, 09 May 2012 - 04:38 PM.

#2
Essexboy

Posted 11 May 2012 - 01:34 PM

GeekU Moderator

Retired Staff
69,964 posts

Hi there I will need an OTL scan to see what is running on your system

Does Avast alert on the websites blocked ?

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Post both logs

#3
sam gibson

Posted 14 May 2012 - 11:26 PM

Member

Topic Starter
Member
12 posts

Thanks... essexboy!

Listen avast doesnt pick up anything, only malwarebytes.

Here are the reports.

thanks again, appreciated.

OTL logfile created on: 5/15/2012 12:07:18 AM - Run 1
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.71 Gb Available Physical Memory | 62.09% Memory free
4.59 Gb Paging File | 3.31 Gb Available in Paging File | 72.04% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 117.19 Gb Total Space | 30.30 Gb Free Space | 25.86% Space Free | Partition Type: NTFS
Drive D: | 115.69 Gb Total Space | 44.27 Gb Free Space | 38.27% Space Free | Partition Type: NTFS
Drive E: | 7.39 Gb Total Space | 5.88 Gb Free Space | 79.54% Space Free | Partition Type: FAT32

Computer Name: SAMGIBSON | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/14 23:58:23 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2012/04/29 21:29:36 | 000,932,736 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.0.2\ToolbarUpdater.exe
PRC - [2012/04/29 21:29:14 | 001,116,544 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/04/04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/03/16 19:05:26 | 000,108,544 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\vlc.exe
PRC - [2012/03/06 19:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2009/12/02 00:45:56 | 000,468,480 | ---- | M] (Entru Inc.) -- C:\Program Files\Auto Shutdown\AutoShutdown.exe
PRC - [2008/04/13 23:42:24 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe
PRC - [2008/04/13 23:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (No Company Name) ==========

MOD - [2012/05/14 14:08:14 | 001,759,232 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12051401\algo.dll
MOD - [2012/04/29 21:29:39 | 000,130,944 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.0.2\SiteSafety.dll
MOD - [2012/04/29 21:29:36 | 000,932,736 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.0.2\ToolbarUpdater.exe
MOD - [2012/04/29 21:29:14 | 001,116,544 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2012/04/28 09:39:06 | 011,808,768 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\c10da0d085962c408e00eccef9aeda10\System.Web.ni.dll
MOD - [2012/04/28 09:38:37 | 000,962,560 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\632f78462381354a89ae5438fac70a91\System.Configuration.ni.dll
MOD - [2012/04/28 09:38:23 | 000,026,624 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\8151afc0a3999445a21cfbec0cf214b3\Accessibility.ni.dll
MOD - [2012/04/28 09:10:36 | 001,687,552 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3097.37114__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:36 | 000,270,336 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3097.37069__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:36 | 000,204,800 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3097.37130__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:36 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3097.37107__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:36 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3097.37090__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:35 | 000,077,824 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3097.37332__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:35 | 000,065,536 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3097.37287__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:35 | 000,036,864 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3097.37237__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:34 | 000,483,328 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3097.37372__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:13 | 000,135,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3097.37379__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:13 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3097.37084__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:12 | 000,090,112 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3097.37306__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:10 | 000,438,272 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3097.37093__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:10 | 000,225,280 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3097.37137__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:09 | 000,401,408 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3097.37278__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:09 | 000,376,832 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3097.37239__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:09 | 000,307,200 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3097.37153__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:09 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3097.37238__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:09 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3097.37239__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:09 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3097.37277__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:08 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3091.17956__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2012/04/28 09:10:08 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3091.17968__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3091.17961__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3091.17977__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3091.17980__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3091.18004__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3091.17978__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3091.18004__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,006,656 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2012/04/28 09:10:07 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3091.17957__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2012/04/28 09:10:07 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3091.17970__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3091.17992__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2012/04/28 09:10:07 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3091.18001__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3091.17954__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2012/04/28 09:10:07 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3091.18035__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2012/04/28 09:10:07 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3091.17981__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2012/04/28 09:10:07 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3091.17970__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3091.17968__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3091.17961__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3091.17980__90ba9c70f846762e\DEM.OS.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3091.17981__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3091.17967__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3091.17987__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3091.17982__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,065,536 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3091.17993__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,049,152 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3091.17990__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3091.17992__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3091.17976__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3091.17982__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3091.17983__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2012/04/28 09:10:05 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3091.17990__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2012/04/28 09:10:05 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3091.17979__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2012/04/28 09:10:05 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2012/04/28 09:10:05 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Foundation\2.0.3091.17977__90ba9c70f846762e\APM.Foundation.dll
MOD - [2012/04/28 09:10:05 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3091.17968__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2012/04/28 09:09:58 | 000,011,264 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3097.37411__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll
MOD - [2012/04/28 09:09:57 | 000,106,496 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3097.37359__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2012/04/28 09:09:57 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3097.37356__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2012/04/28 09:09:57 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3097.37396__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2012/04/28 09:09:57 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3091.17961__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2012/04/28 09:09:57 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3091.17965__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2012/04/28 09:09:57 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3091.17977__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2012/04/28 09:09:57 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3091.17963__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll
MOD - [2012/04/28 09:09:57 | 000,014,848 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
MOD - [2012/04/28 09:09:57 | 000,013,312 | ---- | M] () -- C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll
MOD - [2012/04/28 09:09:57 | 000,007,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3097.37059__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2012/04/28 09:09:56 | 000,397,312 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3097.37100__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2012/04/28 09:09:56 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3097.37062__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2012/04/28 09:09:56 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3097.37060__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2012/04/28 09:09:56 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3091.17979__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2012/04/28 09:09:56 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3091.17978__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2012/04/28 09:09:56 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3091.17977__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2012/04/28 09:09:55 | 000,995,328 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3097.37077__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2012/04/28 09:09:55 | 000,069,632 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3097.37061__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2012/04/28 09:09:55 | 000,057,344 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Server\2.0.3097.37057__90ba9c70f846762e\APM.Server.dll
MOD - [2012/04/28 09:09:55 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3097.37058__90ba9c70f846762e\AEM.Server.dll
MOD - [2012/04/28 09:09:55 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3091.17970__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2012/04/28 09:09:55 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2012/04/28 09:09:55 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3097.37358__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2012/04/28 09:09:55 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3091.17993__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2012/04/28 09:07:21 | 005,640,192 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\2b1770ef26f36e47b2a3df4348395d63\System.Xml.ni.dll
MOD - [2012/04/28 09:07:13 | 013,107,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1939ba304c62404b9a4d6dece3482839\System.Windows.Forms.ni.dll
MOD - [2012/04/28 09:06:57 | 001,626,112 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\d92ce22a77961746baa987ba94010293\System.Drawing.ni.dll
MOD - [2012/04/28 09:06:52 | 008,093,696 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\621889bafcb6e64d96ab3726839a145e\System.ni.dll
MOD - [2012/04/28 09:06:37 | 011,411,456 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\1460f10fb13ba443a062cdd63e348d4e\mscorlib.ni.dll
MOD - [2012/04/28 09:05:58 | 000,299,008 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2012/03/16 19:05:26 | 000,111,104 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\libvlc.dll
MOD - [2012/03/16 19:05:26 | 000,108,544 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\vlc.exe
MOD - [2012/03/16 19:05:26 | 000,077,824 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\mmx\libi420_rgb_mmx_plugin.dll
MOD - [2012/03/16 19:05:26 | 000,051,200 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll
MOD - [2012/03/16 19:05:26 | 000,049,664 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_output\libaout_directx_plugin.dll
MOD - [2012/03/16 19:05:26 | 000,044,544 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\mmx\libi420_yuy2_mmx_plugin.dll
MOD - [2012/03/16 19:05:26 | 000,041,984 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\mmx\libi422_yuy2_mmx_plugin.dll
MOD - [2012/03/16 19:05:26 | 000,037,376 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\mmxext\libmemcpymmxext_plugin.dll
MOD - [2012/03/16 19:05:24 | 000,106,496 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll
MOD - [2012/03/16 19:05:24 | 000,092,160 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll
MOD - [2012/03/16 19:05:22 | 011,595,264 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll
MOD - [2012/03/16 19:05:22 | 000,196,608 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll
MOD - [2012/03/16 19:05:18 | 000,386,560 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll
MOD - [2012/03/16 19:05:18 | 000,310,272 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll
MOD - [2012/03/16 19:05:18 | 000,265,216 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll
MOD - [2012/03/16 19:05:18 | 000,263,168 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll
MOD - [2012/03/16 19:05:18 | 000,184,832 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll
MOD - [2012/03/16 19:05:18 | 000,154,624 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll
MOD - [2012/03/16 19:05:18 | 000,051,200 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll
MOD - [2012/03/16 19:05:18 | 000,038,400 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll
MOD - [2012/03/16 19:05:16 | 009,942,016 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll
MOD - [2012/03/16 19:05:16 | 000,947,200 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll
MOD - [2012/03/16 19:05:14 | 001,719,296 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll
MOD - [2012/03/16 19:05:14 | 001,318,912 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,371,200 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,258,560 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,238,080 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,219,648 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,093,696 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,083,968 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\access\libzip_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,047,616 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,043,008 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,043,008 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libdts_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,042,496 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,041,472 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libmpeg_audio_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,040,448 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll
MOD - [2012/03/16 19:05:14 | 000,037,376 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll
MOD - [2012/03/16 19:05:12 | 000,038,400 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll
MOD - [2012/03/16 19:05:10 | 000,708,608 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll
MOD - [2012/03/16 19:05:10 | 000,043,520 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
MOD - [2012/03/16 19:05:10 | 000,035,840 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll
MOD - [2012/03/16 19:05:10 | 000,034,816 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_filter\libyuvp_plugin.dll
MOD - [2012/03/16 19:05:08 | 001,304,576 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll
MOD - [2012/03/16 19:05:08 | 000,403,968 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_filter\libswscale_plugin.dll
MOD - [2012/03/16 19:05:06 | 001,235,456 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,724,992 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libstream_filter_dash_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,440,832 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libstream_filter_httplive_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,070,144 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectx_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,070,144 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,056,320 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,051,200 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,044,544 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,042,496 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,040,960 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,040,960 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,037,888 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,036,864 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,036,352 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll
MOD - [2012/03/16 19:05:06 | 000,035,840 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libstream_filter_record_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,182,272 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdtstofloat32_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,139,264 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\sse2\libi420_rgb_sse2_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,052,736 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\sse2\libi420_yuy2_sse2_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,050,688 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\sse2\libi422_yuy2_sse2_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,046,592 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,036,864 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdtstospdif_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,036,864 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libconverter_fixed_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,035,328 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,034,816 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\liba52tospdif_plugin.dll
MOD - [2012/03/16 19:05:04 | 000,033,792 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat32_mixer_plugin.dll
MOD - [2012/03/16 19:05:02 | 002,285,056 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\libvlccore.dll
MOD - [2012/03/16 19:05:02 | 001,518,080 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll
MOD - [2012/03/16 19:05:02 | 000,135,168 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmpgatofixed32_plugin.dll
MOD - [2012/03/16 19:05:02 | 000,068,608 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\liba52tofloat32_plugin.dll
MOD - [2012/03/16 19:05:02 | 000,045,568 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll
MOD - [2012/03/16 19:05:02 | 000,040,960 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll
MOD - [2012/03/16 19:05:02 | 000,038,400 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll
MOD - [2012/03/16 19:05:02 | 000,036,352 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll
MOD - [2012/03/16 19:05:02 | 000,036,352 | ---- | M] () -- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll
MOD - [2012/02/20 21:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 21:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2008/04/13 23:42:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [Disabled | Unknown] -- C:\Program Files\AVAST Software\Avast\afwServ.exe -- (avast! Firewall)
SRV - [2012/04/29 21:29:36 | 000,932,736 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.0.2\ToolbarUpdater.exe -- (vToolbarUpdater11.0.2)
SRV - [2012/04/29 17:13:32 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2012/04/28 00:22:25 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2008/04/13 23:42:24 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (W3SVC)
SRV - [2008/04/13 23:42:24 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (SMTPSVC) Simple Mail Transfer Protocol (SMTP)
SRV - [2008/04/13 23:42:24 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (IISADMIN)
SRV - [2006/03/03 21:03:10 | 000,069,632 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (ap3u0n85)
DRV - [2012/04/29 16:47:44 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2012/04/27 23:56:04 | 004,800,000 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/03/06 19:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 19:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 19:02:43 | 000,024,408 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswKbd.sys -- (aswKbd)
DRV - [2012/03/06 19:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2012/03/06 19:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 19:01:39 | 000,095,704 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/03/06 19:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/03/06 18:58:29 | 000,024,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008/06/24 22:52:48 | 003,229,696 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/04/08 18:45:42 | 001,309,504 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008/03/19 14:26:24 | 000,175,104 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2007/04/16 16:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2006/11/28 16:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\XAudio.sys -- (XAudio)
DRV - [2006/06/09 09:38:24 | 000,006,909 | R--- | M] (Conexant Systems, Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\UIUSYS.SYS -- (UIUSys)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-583907252-1801674531-735574201-500\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.c...sa&d=2012-04-29 21:29:45&v=11.0.0.9&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-583907252-1801674531-735574201-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-583907252-1801674531-735574201-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..keyword.URL: "http://isearch.avg.c...9:45&sap=ku&q="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.0.2\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/04/28 09:13:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\ [2012/04/29 21:30:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/27 22:51:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/04/27 22:52:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/05/11 10:09:23 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\vro5im01.default\extensions
[2012/04/27 22:51:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/05/11 10:09:23 | 000,336,277 | ---- | M] () (No name found) -- C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\VRO5IM01.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI
[2012/04/28 09:13:55 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/04/20 20:19:34 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/29 21:28:50 | 000,003,749 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/04/20 20:18:25 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/20 20:18:25 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.168\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.168\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.168\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: YouTube = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
CHR - Extension: Gmail = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2007/08/11 01:58:33 | 000,000,768 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.0.0.9\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.0.0.9\AVG Secure Search_toolbar.dll ()
O3 - HKU\S-1-5-21-583907252-1801674531-735574201-500\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [AzMixerSel] C:\Program Files\Realtek\Audio\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-21-583907252-1801674531-735574201-500..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-583907252-1801674531-735574201-500..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-583907252-1801674531-735574201-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-583907252-1801674531-735574201-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-583907252-1801674531-735574201-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-583907252-1801674531-735574201-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 190.157.2.140 200.118.2.91
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB09170B-750A-460B-84D4-4D7E7B943FF5}: DhcpNameServer = 190.157.2.140 200.118.2.91
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.0.2\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/04/27 17:23:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1056

========== Files/Folders - Created Within 30 Days ==========

[2012/05/15 00:04:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\computer stuff virus
[2012/05/14 23:58:13 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/05/14 20:42:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\zilliana flore
[2012/05/12 01:43:07 | 000,000,000 | ---D | C] -- C:\Program Files\Jnes
[2012/05/11 20:49:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\flores
[2012/05/11 14:17:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2012/05/11 14:01:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\ConvertXToDVD
[2012/05/10 16:23:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Foxit Software
[2012/05/10 14:46:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Brazil
[2012/05/10 14:05:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\indigenous
[2012/05/10 00:13:05 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/05/09 01:20:49 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/05/09 01:20:49 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/05/09 01:20:49 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/05/09 01:20:49 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/05/09 01:20:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012/05/09 01:20:17 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/05/09 01:20:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Videos
[2012/05/09 01:20:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools
[2012/05/08 16:26:18 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012/05/08 00:11:34 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2012/05/07 23:44:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Vector Magic
[2012/05/06 14:29:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities
[2012/05/03 17:15:56 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012/05/03 17:15:48 | 000,000,000 | ---D | C] -- C:\Program Files\HP
[2012/05/02 16:56:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Amor
[2012/05/02 10:12:13 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2012/05/01 23:59:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\dvdcss
[2012/04/29 22:09:13 | 000,000,000 | ---D | C] -- C:\Program Files\MixMeister BPM Analyzer
[2012/04/29 21:30:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG Secure Search
[2012/04/29 21:29:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\AVG Secure Search
[2012/04/29 21:29:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2012/04/29 21:29:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2012/04/29 21:29:01 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search
[2012/04/29 21:18:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Vso
[2012/04/29 21:16:58 | 000,626,688 | ---- | C] (On2.com) -- C:\WINDOWS\System32\vp7vfw.dll
[2012/04/29 21:16:48 | 000,000,000 | ---D | C] -- C:\Program Files\VSO
[2012/04/29 21:12:11 | 000,000,000 | ---D | C] -- C:\Program Files\pazera-software
[2012/04/29 20:53:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\hardware software
[2012/04/29 20:53:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\hardware software
[2012/04/29 20:52:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe
[2012/04/29 20:48:27 | 000,000,000 | ---D | C] -- C:\Program Files\Foxit Software
[2012/04/29 20:21:39 | 000,000,000 | ---D | C] -- C:\Program Files\Rasterbater
[2012/04/29 19:46:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\FLEXnet
[2012/04/29 18:45:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Philipp Winterberg
[2012/04/29 18:45:16 | 000,000,000 | ---D | C] -- C:\Program Files\Free RAR Extract Frog
[2012/04/29 18:21:02 | 000,024,408 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswKbd.sys
[2012/04/29 18:20:52 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/04/29 18:20:52 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/04/29 17:46:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe
[2012/04/29 17:33:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2012/04/29 17:31:18 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2012/04/29 17:26:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2012/04/29 17:18:37 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012/04/29 17:13:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Macrovision Shared
[2012/04/29 17:11:35 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012/04/29 17:03:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
[2012/04/29 17:03:09 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
[2012/04/29 17:03:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012/04/29 17:02:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\SHELLNEW
[2012/04/29 17:02:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012/04/29 17:02:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012/04/29 16:57:37 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2012/04/29 16:52:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Video stuff
[2012/04/29 16:52:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Video stuff
[2012/04/29 16:52:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\TuneUpMedia
[2012/04/29 16:51:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus
[2012/04/29 16:51:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Antivirus
[2012/04/29 16:47:44 | 000,477,240 | ---- | C] (Duplex Secure Ltd.) -- C:\WINDOWS\System32\drivers\sptd.sys
[2012/04/29 16:47:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro
[2012/04/29 16:47:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\OpenCandy
[2012/04/29 16:47:06 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Pro
[2012/04/29 16:40:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
[2012/04/28 13:59:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2012/04/28 13:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012/04/28 12:23:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Skype
[2012/04/28 12:22:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012/04/28 12:22:46 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2012/04/28 12:22:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Skype
[2012/04/28 12:21:16 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\WINDOWS\System32\CSVer.dll
[2012/04/28 12:21:16 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2012/04/28 12:20:55 | 000,000,000 | ---D | C] -- C:\Intel
[2012/04/28 10:14:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ATI
[2012/04/28 10:14:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\ATI
[2012/04/28 10:14:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\ATI
[2012/04/28 09:14:16 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012/04/28 09:14:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Google
[2012/04/28 09:14:15 | 000,020,696 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/04/28 09:14:14 | 000,337,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/04/28 09:14:12 | 000,053,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/04/28 09:14:12 | 000,035,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/04/28 09:14:11 | 000,612,184 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/04/28 09:14:11 | 000,095,704 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/04/28 09:14:11 | 000,089,048 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/04/28 09:14:10 | 000,024,920 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/04/28 09:13:51 | 000,201,352 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/04/28 09:13:51 | 000,041,184 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/04/28 09:13:35 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012/04/28 09:13:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/04/28 09:07:48 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2012/04/28 09:07:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\uTorrent
[2012/04/28 09:05:46 | 000,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2012/04/28 09:05:14 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2012/04/28 09:03:54 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012/04/28 00:43:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\AutoShutdown
[2012/04/28 00:42:33 | 000,000,000 | ---D | C] -- C:\Program Files\Auto Shutdown
[2012/04/28 00:11:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Macromedia
[2012/04/28 00:11:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Adobe
[2012/04/28 00:08:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\vlc
[2012/04/28 00:05:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\IIS Temporary Compressed Files
[2012/04/28 00:05:39 | 000,000,000 | ---D | C] -- C:\Program Files\Vector Magic
[2012/04/28 00:05:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\FxsTmp
[2012/04/28 00:01:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Logfiles
[2012/04/28 00:01:33 | 000,000,000 | ---D | C] -- C:\Inetpub
[2012/04/27 23:59:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2012/04/27 23:58:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Lang
[2012/04/27 23:56:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RTCOM
[2012/04/27 23:56:37 | 002,808,832 | ---- | C] (RealTek Semicoductor Corp.) -- C:\WINDOWS\alcwzrd.exe
[2012/04/27 23:56:37 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2012/04/27 23:52:39 | 000,000,000 | ---D | C] -- C:\AMD
[2012/04/27 23:51:54 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2012/04/27 23:18:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2012/04/27 23:18:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[2012/04/27 23:17:47 | 000,000,000 | ---D | C] -- C:\Program Files\AMD
[2012/04/27 23:15:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\InstallShield
[2012/04/27 23:11:52 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/04/27 23:06:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Downloads
[2012/04/27 22:54:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Apple Computer
[2012/04/27 22:54:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Apple Computer
[2012/04/27 22:53:46 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012/04/27 22:53:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2012/04/27 22:53:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/04/27 22:53:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Apple
[2012/04/27 22:53:29 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2012/04/27 22:53:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Apple Computer
[2012/04/27 22:52:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2012/04/27 22:52:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple
[2012/04/27 22:52:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla
[2012/04/27 22:52:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Mozilla
[2012/04/27 22:51:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012/04/27 19:47:52 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\UserData
[2012/04/27 19:40:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[2012/04/27 19:37:43 | 000,000,000 | ---D | C] -- C:\Program Files\QMI
[2012/04/27 19:37:34 | 001,309,504 | R--- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\drivers\athw.sys
[2012/04/27 19:37:31 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012/04/27 19:37:16 | 000,393,216 | R--- | C] (Quanta Microsystems, Inc.) -- C:\WINDOWS\System32\QmiInstDev.exe
[2012/04/27 19:36:30 | 000,000,000 | ---D | C] -- C:\Program Files\CONEXANT
[2012/04/27 19:30:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2012/04/27 19:30:07 | 000,000,000 | ---D | C] -- C:\Program Files\Broadcom
[2012/04/27 19:07:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\activity types
[2012/04/27 19:00:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\CAR NEF FCE IELTS
[2012/04/27 18:59:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Conv Club
[2012/04/27 18:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\documentd
[2012/04/27 18:57:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Documents
[2012/04/27 18:53:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\EAN
[2012/04/27 18:53:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\English language
[2012/04/27 18:51:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\For External HD
[2012/04/27 18:50:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\grafetti
[2012/04/27 18:50:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Int business
[2012/04/27 18:50:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\lA UNITY
[2012/04/27 18:50:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Int Culture
[2012/04/27 18:49:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\kids lessons
[2012/04/27 18:18:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Teaching bits for sam
[2012/04/27 18:18:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Teaching
[2012/04/27 18:17:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\TED videos = subs
[2012/04/27 18:16:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\to print
[2012/04/27 17:58:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Identities
[2012/04/27 17:58:48 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
[2012/04/27 17:58:45 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Pictures
[2012/04/27 17:58:45 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Music
[2012/04/27 17:58:41 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Application Data\Microsoft
[2012/04/27 17:58:41 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Cookies
[2012/04/27 17:58:41 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent
[2012/04/27 17:58:41 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Application Data
[2012/04/27 17:58:41 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents
[2012/04/27 17:58:41 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Favorites
[2012/04/27 17:58:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\PrintHood
[2012/04/27 17:58:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\NetHood
[2012/04/27 17:58:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Local Settings
[2012/04/27 17:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft
[2012/04/27 17:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop
[2012/04/27 17:58:40 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\SendTo
[2012/04/27 17:58:40 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
[2012/04/27 17:58:40 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu
[2012/04/27 17:58:40 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories
[2012/04/27 17:58:40 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Templates
[2012/04/27 17:32:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
[2012/04/27 17:32:15 | 000,000,000 | --SD | C] -- C:\WINDOWS\System32\Microsoft
[2012/04/27 17:32:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2012/04/27 17:32:14 | 000,000,000 | --SD | C] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2012/04/27 17:32:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2012/04/27 17:26:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2012/04/27 17:26:52 | 000,000,000 | --SD | C] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2012/04/27 17:25:38 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2012/04/27 17:25:37 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2012/04/27 17:25:37 | 000,029,184 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2012/04/27 17:24:33 | 000,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2012/04/27 17:24:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom
[2012/04/27 17:24:02 | 000,000,000 | ---D | C] -- C:\Program Files\xerox
[2012/04/27 17:24:02 | 000,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2012/04/27 17:22:53 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\DRM
[2012/04/27 17:22:44 | 000,000,000 | --SD | C] -- C:\WINDOWS\Downloaded Program Files
[2012/04/27 17:22:44 | 000,000,000 | R--D | C] -- C:\WINDOWS\Offline Web Pages
[2012/04/27 17:22:34 | 000,000,000 | -H-D | C] -- C:\Program Files\WindowsUpdate
[2012/04/27 17:22:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DirectX
[2012/04/27 17:21:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Services
[2012/04/27 17:21:55 | 000,000,000 | --SD | C] -- C:\WINDOWS\Tasks
[2012/04/27 17:21:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MSSoap
[2012/04/27 17:21:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\srchasst
[2012/04/27 17:21:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Macromed
[2012/04/27 17:21:40 | 000,000,000 | ---D | C] -- C:\Program Files\Movie Maker
[2012/04/27 17:21:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Restore
[2012/04/27 17:21:14 | 000,000,000 | ---D | C] -- C:\Program Files\NetMeeting
[2012/04/27 17:21:11 | 000,000,000 | ---D | C] -- C:\Program Files\Outlook Express
[2012/04/27 17:21:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\System
[2012/04/27 17:20:59 | 000,000,000 | ---D | C] -- C:\Program Files\Internet Explorer
[2012/04/27 17:20:58 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
[2012/04/27 17:20:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Games
[2012/04/27 17:20:25 | 000,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications
[2012/04/27 17:20:18 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools
[2012/04/27 17:20:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\Registration
[2012/04/27 17:20:11 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Music
[2012/04/27 17:20:11 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Player
[2012/04/27 17:20:11 | 000,000,000 | ---D | C] -- C:\Program Files\Online Services
[2012/04/27 17:20:04 | 000,000,000 | ---D | C] -- C:\Program Files\Messenger
[2012/04/27 17:20:00 | 000,000,000 | ---D | C] -- C:\Program Files\MSN Gaming Zone
[2012/04/27 17:19:22 | 000,000,000 | ---D | C] -- C:\Program Files\MSN
[2012/04/27 17:19:21 | 000,281,088 | ---- | C] (Cinematronics) -- C:\WINDOWS\System32\dllcache\pinball.exe
[2012/04/27 17:19:20 | 000,000,000 | ---D | C] -- C:\Program Files\Windows NT
[2012/04/27 17:19:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US
[2012/04/27 17:19:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MsDtc
[2012/04/27 17:19:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Com
[2012/04/27 17:18:57 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[2012/04/27 17:18:39 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
[2012/04/27 12:13:54 | 000,000,000 | -HSD | C] -- C:\WINDOWS\Installer
[2012/04/27 12:13:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
[2012/04/27 12:13:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SpeechEngines
[2012/04/27 12:13:49 | 000,000,000 | R--D | C] -- C:\Program Files
[2012/04/27 12:13:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Microsoft Shared
[2012/04/27 12:13:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files
[2012/04/27 12:13:23 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup
[2012/04/27 12:13:23 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu
[2012/04/27 12:13:23 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents
[2012/04/27 12:13:23 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Templates
[2012/04/27 12:13:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Favorites
[2012/04/27 12:13:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Desktop
[2012/04/27 12:13:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot2
[2012/04/27 12:13:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot
[2012/04/27 12:13:05 | 000,000,000 | --SD | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2012/04/27 12:13:05 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\All Users\Application Data
[2012/04/27 12:12:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings
[2012/04/27 12:12:39 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2012/04/27 12:07:30 | 000,000,000 | R-SD | C] -- C:\WINDOWS\Fonts
[2012/04/27 12:07:30 | 000,000,000 | RHSD | C] -- C:\WINDOWS\System32\dllcache
[2012/04/27 12:07:30 | 000,000,000 | R--D | C] -- C:\WINDOWS\Web
[2012/04/27 12:07:30 | 000,000,000 | -H-D | C] -- C:\WINDOWS\inf
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\WinSxS
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wins
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wbem
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\usmt
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\twain_32
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Temp
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\system32
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\system
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\spool
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ShellExt
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Setup
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\security
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Resources
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\repair
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ras
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Provisioning
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\PeerNet
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\pchealth
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\oobe
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\npp
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Network Diagnostic
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\mui
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\mui
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\msapps
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\msagent
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Media
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\L2Schemas
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\java
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\inetsrv
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\IME
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ime
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\icsxml
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ias
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Help
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\export
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\etc
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ehome
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Driver Cache
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\disdn
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\dhcp
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Debug
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Cursors
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Connection Wizard
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\config
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Config
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\AppPatch
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\addins
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3com_dmi
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3076
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\2052
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1054
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1042
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1041
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1037
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1033
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1031
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1028
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1025
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/05/14 23:58:23 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/05/14 23:43:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/05/14 23:25:01 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/14 20:46:25 | 000,100,864 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/14 19:12:37 | 015,496,132 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Will_It_Blend_iPhone.avi
[2012/05/14 10:01:45 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Word.lnk
[2012/05/14 09:25:00 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/12 14:42:33 | 000,443,468 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/05/12 14:42:33 | 000,076,810 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/05/12 14:37:35 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/12 14:30:59 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/05/11 14:35:16 | 000,001,057 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\vso_ts_preview.xml
[2012/05/08 00:10:36 | 001,388,490 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\layer red.pdf
[2012/05/07 23:44:21 | 000,000,686 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Vector Magic.lnk
[2012/05/07 00:28:19 | 000,000,804 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/05/04 00:04:00 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Shortcut to 2012.lnk
[2012/05/03 23:23:08 | 001,428,056 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/03 17:20:57 | 000,123,135 | ---- | M] () -- C:\WINDOWS\HPHins12.dat
[2012/04/29 20:21:55 | 000,000,813 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Rasterbator.lnk
[2012/04/29 18:25:03 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/04/29 17:59:40 | 000,000,223 | RHS- | M] () -- C:\boot.ini
[2012/04/29 17:45:37 | 000,000,754 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Photoshop.lnk
[2012/04/29 17:04:03 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2012/04/29 14:44:00 | 000,000,777 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk
[2012/04/29 14:44:00 | 000,000,759 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
[2012/04/28 13:49:21 | 000,000,350 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Shortcut to Films.lnk
[2012/04/28 12:20:38 | 000,053,248 | ---- | M] (Windows XP Bundled build C-Centric Single User) -- C:\WINDOWS\System32\CSVer.dll
[2012/04/28 09:56:33 | 000,000,000 | ---- | M] () -- C:\WINDOWS\ativpsrm.bin
[2012/04/28 09:54:11 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/28 09:25:19 | 000,001,791 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/04/28 09:07:48 | 000,000,648 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/04/28 00:06:30 | 000,026,687 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/28 00:05:17 | 000,000,535 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2012/04/27 23:58:27 | 000,940,794 | ---- | M] () -- C:\WINDOWS\System32\LoopyMusic.wav
[2012/04/27 23:58:27 | 000,146,650 | ---- | M] () -- C:\WINDOWS\System32\BuzzingBee.wav
[2012/04/27 23:56:02 | 002,808,832 | ---- | M] (RealTek Semicoductor Corp.) -- C:\WINDOWS\alcwzrd.exe
[2012/04/27 23:55:57 | 000,000,553 | ---- | M] () -- C:\WINDOWS\USetup.iss
[2012/04/27 23:55:56 | 000,049,152 | ---- | M] () -- C:\WINDOWS\System32\ChCfg.exe
[2012/04/27 23:55:56 | 000,000,520 | ---- | M] () -- C:\WINDOWS\System32\drivers\RTEQEX1.dat
[2012/04/27 23:55:56 | 000,000,520 | ---- | M] () -- C:\WINDOWS\System32\drivers\RTEQEX0.dat
[2012/04/27 23:55:56 | 000,000,008 | ---- | M] () -- C:\WINDOWS\System32\drivers\rtkhdaud.dat
[2012/04/27 23:14:17 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2012/04/27 22:51:56 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/27 22:51:56 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Firefox.lnk
[2012/04/27 19:22:02 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\My Computer.lnk
[2012/04/27 17:58:59 | 000,000,779 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/27 17:58:58 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/04/27 17:26:56 | 000,008,192 | ---- | M] () -- C:\WINDOWS\REGLOCS.OLD
[2012/04/27 17:26:10 | 000,000,780 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2012/04/27 17:23:46 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012/04/27 17:23:46 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012/04/27 17:23:46 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2012/04/27 17:23:46 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2012/04/27 17:23:43 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2012/04/27 17:23:42 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2012/04/27 17:23:42 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2012/04/27 17:23:33 | 000,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2012/04/27 17:20:34 | 000,021,640 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2012/04/27 12:13:59 | 000,004,444 | ---- | M] () -- C:\WINDOWS\System32\pid.PNF
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/14 19:10:50 | 015,496,132 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Will_It_Blend_iPhone.avi
[2012/05/09 01:20:49 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/05/09 01:20:49 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/05/09 01:20:49 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/05/09 01:20:49 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/05/09 01:20:49 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/05/08 00:10:29 | 001,388,490 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\layer red.pdf
[2012/05/07 23:44:21 | 000,000,686 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Vector Magic.lnk
[2012/05/07 00:28:19 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/05/07 00:28:19 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk
[2012/05/04 00:04:00 | 000,000,791 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Shortcut to 2012.lnk
[2012/05/03 17:13:19 | 000,123,135 | ---- | C] () -- C:\WINDOWS\HPHins12.dat
[2012/05/03 17:13:19 | 000,014,916 | ---- | C] () -- C:\WINDOWS\hphmdl12.dat
[2012/05/03 17:13:07 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2012/05/03 17:12:51 | 000,000,056 | ---- | C] () -- C:\ut9x.bat
[2012/05/03 17:12:51 | 000,000,054 | ---- | C] () -- C:\ut.bat
[2012/04/29 21:18:39 | 000,001,057 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\vso_ts_preview.xml
[2012/04/29 20:21:55 | 000,000,813 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Rasterbator.lnk
[2012/04/29 17:45:37 | 000,000,754 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Photoshop.lnk
[2012/04/29 17:35:07 | 000,000,856 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Photoshop CS3.lnk
[2012/04/29 17:04:03 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012/04/29 17:04:01 | 000,002,497 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Word.lnk
[2012/04/29 16:47:44 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\DAEMON Tools Pro.lnk
[2012/04/29 14:44:00 | 000,000,777 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk
[2012/04/29 14:44:00 | 000,000,759 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
[2012/04/29 14:42:28 | 000,000,771 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Picasa 3.lnk
[2012/04/28 13:49:23 | 000,000,350 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Shortcut to Films.lnk
[2012/04/28 12:22:52 | 000,002,271 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype.lnk
[2012/04/28 09:56:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2012/04/28 09:45:12 | 000,000,009 | ---- | C] () -- C:\WINDOWS\System32\drivers\ahcix86
[2012/04/28 09:20:55 | 000,001,825 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome.lnk
[2012/04/28 09:20:55 | 000,001,791 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/04/28 09:14:21 | 000,000,900 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/28 09:14:20 | 000,000,896 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/28 09:07:48 | 000,000,648 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/04/28 09:03:10 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2012/04/28 09:03:10 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2012/04/28 09:03:10 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2012/04/28 09:03:10 | 000,013,052 | ---- | C] () -- C:\WINDOWS\atiogl.xml
[2012/04/28 09:03:09 | 000,174,819 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2012/04/28 09:03:09 | 000,007,167 | ---- | C] () -- C:\WINDOWS\System32\atifglpf.xml
[2012/04/28 00:42:33 | 000,001,645 | ---- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Auto Shutdown.lnk
[2012/04/28 00:42:33 | 000,001,639 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Auto Shutdown.lnk
[2012/04/28 00:05:13 | 000,000,535 | ---- | C] () -- C:\WINDOWS\System32\mapisvc.inf
[2012/04/28 00:05:12 | 000,021,791 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.ini
[2012/04/28 00:05:12 | 000,008,002 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.h
[2012/04/28 00:05:12 | 000,001,037 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.ini
[2012/04/28 00:05:12 | 000,000,773 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.h
[2012/04/28 00:04:51 | 000,038,576 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
[2012/04/28 00:04:51 | 000,005,379 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.h
[2012/04/28 00:04:50 | 000,010,225 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
[2012/04/28 00:04:50 | 000,002,024 | ---- | C] () -- C:\WINDOWS\System32\axctrnm.h
[2012/04/28 00:04:48 | 000,011,435 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
[2012/04/28 00:04:48 | 000,003,276 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.h
[2012/04/28 00:04:47 | 000,049,275 | ---- | C] () -- C:\WINDOWS\System32\wfospf.mib
[2012/04/28 00:04:47 | 000,038,608 | ---- | C] () -- C:\WINDOWS\System32\nipx.mib
[2012/04/28 00:04:47 | 000,034,317 | ---- | C] () -- C:\WINDOWS\System32\msiprip2.mib
[2012/04/28 00:04:47 | 000,026,236 | ---- | C] () -- C:\WINDOWS\System32\wins.mib
[2012/04/28 00:04:47 | 000,021,386 | ---- | C] () -- C:\WINDOWS\System32\mipx.mib
[2012/04/28 00:04:47 | 000,013,767 | ---- | C] () -- C:\WINDOWS\System32\msipbtp.mib
[2012/04/28 00:04:47 | 000,010,313 | ---- | C] () -- C:\WINDOWS\System32\mripsap.mib
[2012/04/28 00:04:47 | 000,004,332 | ---- | C] () -- C:\WINDOWS\System32\smi.mib
[2012/04/28 00:04:47 | 000,000,581 | ---- | C] () -- C:\WINDOWS\System32\msft.mib
[2012/04/28 00:04:46 | 000,107,882 | ---- | C] () -- C:\WINDOWS\System32\mib_ii.mib
[2012/04/28 00:04:46 | 000,048,593 | ---- | C] () -- C:\WINDOWS\System32\hostmib.mib
[2012/04/28 00:04:46 | 000,030,448 | ---- | C] () -- C:\WINDOWS\System32\mcastmib.mib
[2012/04/28 00:04:46 | 000,026,100 | ---- | C] () -- C:\WINDOWS\System32\lmmib2.mib
[2012/04/28 00:04:46 | 000,020,079 | ---- | C] () -- C:\WINDOWS\System32\http.mib
[2012/04/28 00:04:46 | 000,016,617 | ---- | C] () -- C:\WINDOWS\System32\authserv.mib
[2012/04/28 00:04:46 | 000,015,799 | ---- | C] () -- C:\WINDOWS\System32\ipforwd.mib
[2012/04/28 00:04:46 | 000,015,597 | ---- | C] () -- C:\WINDOWS\System32\accserv.mib
[2012/04/28 00:04:46 | 000,006,179 | ---- | C] () -- C:\WINDOWS\System32\ftp.mib
[2012/04/28 00:04:46 | 000,004,597 | ---- | C] () -- C:\WINDOWS\System32\dhcp.mib
[2012/04/28 00:04:46 | 000,000,698 | ---- | C] () -- C:\WINDOWS\System32\inetsrv.mib
[2012/04/28 00:04:45 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2012/04/28 00:04:45 | 000,001,361 | ---- | C] () -- C:\WINDOWS\System32\fxscount.h
[2012/04/27 23:58:27 | 000,146,650 | ---- | C] () -- C:\WINDOWS\System32\BuzzingBee.wav
[2012/04/27 23:58:26 | 000,940,794 | ---- | C] () -- C:\WINDOWS\System32\LoopyMusic.wav
[2012/04/27 23:57:28 | 000,000,553 | ---- | C] () -- C:\WINDOWS\USetup.iss
[2012/04/27 23:57:08 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2012/04/27 23:56:42 | 000,000,520 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTEQEX1.dat
[2012/04/27 23:56:42 | 000,000,520 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTEQEX0.dat
[2012/04/27 23:56:42 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtkhdaud.dat
[2012/04/27 23:45:07 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/27 23:18:56 | 005,631,520 | ---- | C] () -- C:\WINDOWS\System\DriveIcon.dll
[2012/04/27 23:14:17 | 000,001,554 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes.lnk
[2012/04/27 23:14:17 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2012/04/27 22:55:35 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/27 22:51:56 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/27 22:51:56 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Firefox.lnk
[2012/04/27 22:51:53 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/04/27 19:37:16 | 000,000,774 | R--- | C] () -- C:\WINDOWS\System32\QmiInfo.cfg
[2012/04/27 19:22:02 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\My Computer.lnk
[2012/04/27 18:16:13 | 000,100,864 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/04/27 17:58:58 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/04/27 17:58:48 | 000,000,779 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/27 17:26:56 | 000,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD
[2012/04/27 17:26:10 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2012/04/27 17:25:32 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2012/04/27 17:25:17 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2012/04/27 17:25:10 | 000,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2012/04/27 17:25:09 | 000,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2012/04/27 17:25:07 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2012/04/27 17:24:56 | 013,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2012/04/27 17:24:50 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2012/04/27 17:24:45 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll
[2012/04/27 17:24:36 | 000,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2012/04/27 17:23:46 | 000,002,625 | ---- | C] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/04/27 17:23:46 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012/04/27 17:23:46 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012/04/27 17:23:46 | 000,000,000 | ---- | C] () -- C:\CONFIG.SYS
[2012/04/27 17:23:46 | 000,000,000 | ---- | C] () -- C:\AUTOEXEC.BAT
[2012/04/27 17:23:42 | 000,023,392 | ---- | C] () -- C:\WINDOWS\System32\nscompat.tlb
[2012/04/27 17:23:42 | 000,016,832 | ---- | C] () -- C:\WINDOWS\System32\amcompat.tlb
[2012/04/27 17:23:41 | 000,316,640 | ---- | C] () -- C:\WINDOWS\WMSysPr9.prx
[2012/04/27 17:22:22 | 004,399,505 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nls302en.lex
[2012/04/27 17:22:07 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt256.bmp
[2012/04/27 17:22:07 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt.bmp
[2012/04/27 17:22:00 | 000,000,984 | ---- | C] () -- C:\WINDOWS\System32\dllcache\srframe.mmf
[2012/04/27 17:21:20 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msinfo.dll
[2012/04/27 17:20:34 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2012/04/27 17:19:46 | 000,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp
[2012/04/27 17:19:46 | 000,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp
[2012/04/27 17:19:46 | 000,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp
[2012/04/27 17:19:46 | 000,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp
[2012/04/27 17:19:46 | 000,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp
[2012/04/27 17:19:46 | 000,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp
[2012/04/27 17:19:46 | 000,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp
[2012/04/27 17:19:46 | 000,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp
[2012/04/27 17:19:46 | 000,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp
[2012/04/27 17:19:45 | 000,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp
[2012/04/27 17:19:45 | 000,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp
[2012/04/27 17:19:43 | 000,001,161 | ---- | C] () -- C:\WINDOWS\System32\usrlogon.cmd
[2012/04/27 17:19:42 | 000,003,286 | ---- | C] () -- C:\WINDOWS\System32\tslabels.h
[2012/04/27 17:19:41 | 000,000,768 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.h
[2012/04/27 17:19:36 | 000,063,488 | ---- | C] () -- C:\WINDOWS\System32\wmimgmt.msc
[2012/04/27 12:13:59 | 000,004,444 | ---- | C] () -- C:\WINDOWS\System32\pid.PNF
[2012/04/27 12:13:57 | 000,026,687 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012/04/27 12:13:54 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2012/04/27 12:13:51 | 001,685,606 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.spd
[2012/04/27 12:13:51 | 000,605,050 | ---- | C] () -- C:\WINDOWS\System32\dllcache\r1033tts.lxa
[2012/04/27 12:13:51 | 000,000,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.sdf
[2012/04/27 12:13:50 | 000,643,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ltts1033.lxa
[2012/04/27 12:13:31 | 000,001,688 | ---- | C] () -- C:\WINDOWS\System32\AUTOEXEC.NT
[2012/04/27 12:13:22 | 001,296,669 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP3.CAT
[2012/04/27 12:13:22 | 000,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2012/04/27 12:13:22 | 000,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2012/04/27 12:13:22 | 000,144,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\netfx.cat
[2012/04/27 12:13:22 | 000,112,918 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tabletpc.cat
[2012/04/27 12:13:22 | 000,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2012/04/27 12:13:22 | 000,034,747 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mediactr.cat
[2012/04/27 12:13:22 | 000,034,063 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT
[2012/04/27 12:13:22 | 000,026,991 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat
[2012/04/27 12:13:22 | 000,016,535 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT
[2012/04/27 12:13:22 | 000,014,433 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat
[2012/04/27 12:13:22 | 000,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2012/04/27 12:13:22 | 000,012,363 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2012/04/27 12:13:22 | 000,010,027 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2012/04/27 12:13:22 | 000,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2012/04/27 12:13:22 | 000,007,382 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2012/04/27 12:13:22 | 000,007,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmerrenu.cat
[2012/04/27 12:13:21 | 002,144,487 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT
[2012/04/27 12:13:21 | 000,522,220 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2012/04/27 12:12:38 | 001,428,056 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/04/27 12:12:05 | 000,000,223 | RHS- | C] () -- C:\boot.ini
[2012/04/27 12:12:01 | 000,000,780 | ---- | C] () -- C:\WINDOWS\System32\$winnt$.inf

========== LOP Check ==========

[2012/04/29 21:29:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\AVG Secure Search
[2012/04/29 17:31:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro
[2012/05/10 16:23:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Foxit Software
[2012/04/29 16:47:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\OpenCandy
[2012/04/29 18:45:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Philipp Winterberg
[2012/04/29 19:34:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\TuneUpMedia
[2012/05/12 20:26:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\uTorrent
[2012/05/11 14:35:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Vso
[2012/04/28 09:13:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/04/29 21:30:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2012/04/29 17:00:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
[2012/05/11 14:17:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2012/04/27 22:54:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/04/13 23:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 23:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/13 23:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: SVCHOST.EXE >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2008/04/13 23:42:38 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/13 23:42:38 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008/04/13 23:42:38 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/13 23:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/13 23:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/13 23:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/13 23:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/13 23:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/13 23:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< End of report >

Attached Files

OTL.Txt 206.35KB 55 downloads
Extras.Txt 36.71KB 75 downloads

#4
Essexboy

Posted 15 May 2012 - 11:36 AM

GeekU Moderator

Retired Staff
69,964 posts

Could you post the Malwarebytes logs that show the IP being blocked please

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from "Start with Windows"
Reboot and then run OTL
Posted Image

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (ap3u0n85)

:Files
ipconfig /flushdns /c

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

#5
sam gibson

Posted 15 May 2012 - 04:27 PM

Member

Topic Starter
Member
12 posts

alrigth here u go

OTL logfile created on: 5/15/2012 5:09:13 PM - Run 2
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.49 Gb Available Physical Memory | 54.24% Memory free
4.59 Gb Paging File | 2.93 Gb Available in Paging File | 63.75% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 117.19 Gb Total Space | 30.58 Gb Free Space | 26.09% Space Free | Partition Type: NTFS
Drive D: | 115.69 Gb Total Space | 46.19 Gb Free Space | 39.93% Space Free | Partition Type: NTFS

Computer Name: SAMGIBSON | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/14 23:58:23 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2012/04/29 21:29:36 | 000,932,736 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.0.2\ToolbarUpdater.exe
PRC - [2012/04/29 21:29:14 | 001,116,544 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012/04/27 21:07:02 | 001,224,176 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2012/04/20 20:18:58 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/04/04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/03/06 19:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2009/12/02 00:45:56 | 000,468,480 | ---- | M] (Entru Inc.) -- C:\Program Files\Auto Shutdown\AutoShutdown.exe
PRC - [2008/04/13 23:42:24 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe
PRC - [2008/04/13 23:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (No Company Name) ==========

MOD - [2012/05/15 14:12:02 | 001,759,232 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12051501\algo.dll
MOD - [2012/05/15 03:55:17 | 001,759,232 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12051500\algo.dll
MOD - [2012/04/29 21:29:39 | 000,130,944 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.0.2\SiteSafety.dll
MOD - [2012/04/29 21:29:36 | 000,932,736 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.0.2\ToolbarUpdater.exe
MOD - [2012/04/29 21:29:14 | 001,116,544 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2012/04/28 09:39:06 | 011,808,768 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\c10da0d085962c408e00eccef9aeda10\System.Web.ni.dll
MOD - [2012/04/28 09:38:37 | 000,962,560 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\632f78462381354a89ae5438fac70a91\System.Configuration.ni.dll
MOD - [2012/04/28 09:38:23 | 000,026,624 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\8151afc0a3999445a21cfbec0cf214b3\Accessibility.ni.dll
MOD - [2012/04/28 09:10:36 | 001,687,552 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3097.37114__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:36 | 000,270,336 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3097.37069__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:36 | 000,204,800 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3097.37130__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:36 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3097.37107__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:36 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3097.37090__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:35 | 000,077,824 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3097.37332__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:35 | 000,065,536 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3097.37287__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:35 | 000,036,864 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3097.37237__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:34 | 000,483,328 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3097.37372__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:13 | 000,135,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3097.37379__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:13 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3097.37084__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:12 | 000,090,112 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3097.37306__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:10 | 000,438,272 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3097.37093__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:10 | 000,225,280 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3097.37137__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:09 | 000,401,408 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3097.37278__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:09 | 000,376,832 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3097.37239__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2012/04/28 09:10:09 | 000,307,200 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3097.37153__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll
MOD - [2012/04/28 09:10:09 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3097.37238__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:09 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3097.37239__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:09 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3097.37277__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2012/04/28 09:10:08 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3091.17956__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2012/04/28 09:10:08 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3091.17968__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3091.17961__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3091.17977__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3091.17980__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3091.18004__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3091.17978__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3091.18004__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2012/04/28 09:10:08 | 000,006,656 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2012/04/28 09:10:07 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3091.17957__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2012/04/28 09:10:07 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3091.17970__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3091.17992__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2012/04/28 09:10:07 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3091.18001__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3091.17954__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2012/04/28 09:10:07 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3091.18035__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2012/04/28 09:10:07 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3091.17981__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2012/04/28 09:10:07 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3091.17970__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3091.17968__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3091.17961__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3091.17980__90ba9c70f846762e\DEM.OS.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3091.17981__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3091.17967__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3091.17987__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2012/04/28 09:10:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3091.17982__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,065,536 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3091.17993__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,049,152 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3091.17990__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3091.17992__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3091.17976__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3091.17982__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2012/04/28 09:10:06 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3091.17983__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2012/04/28 09:10:05 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3091.17990__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2012/04/28 09:10:05 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3091.17979__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2012/04/28 09:10:05 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2012/04/28 09:10:05 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Foundation\2.0.3091.17977__90ba9c70f846762e\APM.Foundation.dll
MOD - [2012/04/28 09:10:05 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3091.17968__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2012/04/28 09:09:58 | 000,011,264 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3097.37411__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll
MOD - [2012/04/28 09:09:57 | 000,106,496 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3097.37359__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2012/04/28 09:09:57 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3097.37356__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2012/04/28 09:09:57 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3097.37396__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2012/04/28 09:09:57 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3091.17961__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2012/04/28 09:09:57 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3091.17965__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2012/04/28 09:09:57 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3091.17977__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2012/04/28 09:09:57 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3091.17963__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll
MOD - [2012/04/28 09:09:57 | 000,014,848 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
MOD - [2012/04/28 09:09:57 | 000,013,312 | ---- | M] () -- C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll
MOD - [2012/04/28 09:09:57 | 000,007,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3097.37059__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2012/04/28 09:09:56 | 000,397,312 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3097.37100__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2012/04/28 09:09:56 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3097.37062__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2012/04/28 09:09:56 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3097.37060__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2012/04/28 09:09:56 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3091.17979__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2012/04/28 09:09:56 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3091.17978__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2012/04/28 09:09:56 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3091.17977__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2012/04/28 09:09:55 | 000,995,328 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3097.37077__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2012/04/28 09:09:55 | 000,069,632 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3097.37061__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2012/04/28 09:09:55 | 000,057,344 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Server\2.0.3097.37057__90ba9c70f846762e\APM.Server.dll
MOD - [2012/04/28 09:09:55 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3097.37058__90ba9c70f846762e\AEM.Server.dll
MOD - [2012/04/28 09:09:55 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3091.17970__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2012/04/28 09:09:55 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2012/04/28 09:09:55 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3097.37358__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2012/04/28 09:09:55 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3091.17993__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2012/04/28 09:07:21 | 005,640,192 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\2b1770ef26f36e47b2a3df4348395d63\System.Xml.ni.dll
MOD - [2012/04/28 09:07:13 | 013,107,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1939ba304c62404b9a4d6dece3482839\System.Windows.Forms.ni.dll
MOD - [2012/04/28 09:06:57 | 001,626,112 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\d92ce22a77961746baa987ba94010293\System.Drawing.ni.dll
MOD - [2012/04/28 09:06:52 | 008,093,696 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\621889bafcb6e64d96ab3726839a145e\System.ni.dll
MOD - [2012/04/28 09:06:37 | 011,411,456 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\1460f10fb13ba443a062cdd63e348d4e\mscorlib.ni.dll
MOD - [2012/04/28 09:05:58 | 000,299,008 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2012/04/27 23:45:05 | 008,797,344 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll
MOD - [2012/04/27 21:07:01 | 000,444,400 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.168\ppgooglenaclpluginchrome.dll
MOD - [2012/04/27 21:06:59 | 003,915,248 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.168\pdf.dll
MOD - [2012/04/27 21:05:34 | 000,122,880 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.168\avutil-51.dll
MOD - [2012/04/27 21:05:33 | 000,220,672 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.168\avformat-53.dll
MOD - [2012/04/27 21:05:32 | 001,747,456 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.168\avcodec-53.dll
MOD - [2012/04/27 20:09:18 | 008,743,584 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.168\gcswf32.dll
MOD - [2012/04/20 20:19:01 | 001,952,696 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/02/20 21:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 21:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009/02/26 10:45:08 | 000,024,912 | ---- | M] () -- C:\Program Files\Microsoft Office\Office12\Wordcnvpxy.cnv
MOD - [2008/04/13 23:42:04 | 001,288,192 | ---- | M] () -- C:\WINDOWS\system32\quartz.dll
MOD - [2008/04/13 23:42:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [Disabled | Unknown] -- C:\Program Files\AVAST Software\Avast\afwServ.exe -- (avast! Firewall)
SRV - [2012/04/29 21:29:36 | 000,932,736 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.0.2\ToolbarUpdater.exe -- (vToolbarUpdater11.0.2)
SRV - [2012/04/29 17:13:32 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2012/04/28 00:22:25 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2008/04/13 23:42:24 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (W3SVC)
SRV - [2008/04/13 23:42:24 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (SMTPSVC) Simple Mail Transfer Protocol (SMTP)
SRV - [2008/04/13 23:42:24 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (IISADMIN)
SRV - [2006/03/03 21:03:10 | 000,069,632 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (ap3u0n85)
DRV - [2012/04/29 16:47:44 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2012/04/27 23:56:04 | 004,800,000 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/03/06 19:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 19:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 19:02:43 | 000,024,408 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswKbd.sys -- (aswKbd)
DRV - [2012/03/06 19:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2012/03/06 19:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 19:01:39 | 000,095,704 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/03/06 19:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/03/06 18:58:29 | 000,024,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008/06/24 22:52:48 | 003,229,696 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/04/08 18:45:42 | 001,309,504 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008/03/19 14:26:24 | 000,175,104 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2007/04/16 16:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2006/11/28 16:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\XAudio.sys -- (XAudio)
DRV - [2006/06/09 09:38:24 | 000,006,909 | R--- | M] (Conexant Systems, Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\UIUSYS.SYS -- (UIUSys)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-583907252-1801674531-735574201-500\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.c...sa&d=2012-04-29 21:29:45&v=11.0.0.9&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-583907252-1801674531-735574201-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-583907252-1801674531-735574201-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..keyword.URL: "http://isearch.avg.c...9:45&sap=ku&q="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.0.2\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/04/28 09:13:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\ [2012/04/29 21:30:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/27 22:51:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/04/27 22:52:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/05/11 10:09:23 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\vro5im01.default\extensions
[2012/04/27 22:51:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/05/11 10:09:23 | 000,336,277 | ---- | M] () (No name found) -- C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\VRO5IM01.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI
[2012/04/28 09:13:55 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/04/20 20:19:34 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/29 21:28:50 | 000,003,749 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/04/20 20:18:25 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/20 20:18:25 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.168\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.168\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.168\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: YouTube = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
CHR - Extension: Gmail = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2007/08/11 01:58:33 | 000,000,768 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.0.0.9\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.0.0.9\AVG Secure Search_toolbar.dll ()
O3 - HKU\S-1-5-21-583907252-1801674531-735574201-500\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [AzMixerSel] C:\Program Files\Realtek\Audio\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-21-583907252-1801674531-735574201-500..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-583907252-1801674531-735574201-500..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-583907252-1801674531-735574201-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-583907252-1801674531-735574201-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-583907252-1801674531-735574201-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-583907252-1801674531-735574201-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 190.157.2.140 200.118.2.91
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB09170B-750A-460B-84D4-4D7E7B943FF5}: DhcpNameServer = 190.157.2.140 200.118.2.91
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.0.2\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/04/27 17:23:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

[CREATERESTOREPOINT]
Unable to start System Restore Service. Error code 1056

========== Files/Folders - Created Within 30 Days ==========

[2012/05/15 10:15:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\market research
[2012/05/15 00:04:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\computer stuff virus
[2012/05/14 23:58:13 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/05/14 20:42:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\zilliana flore
[2012/05/12 01:43:07 | 000,000,000 | ---D | C] -- C:\Program Files\Jnes
[2012/05/11 20:49:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\flores
[2012/05/11 14:17:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2012/05/11 14:01:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\ConvertXToDVD
[2012/05/10 16:23:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Foxit Software
[2012/05/10 14:46:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Brazil
[2012/05/10 14:05:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\indigenous
[2012/05/10 00:13:05 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/05/09 01:20:49 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/05/09 01:20:49 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/05/09 01:20:49 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/05/09 01:20:49 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/05/09 01:20:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012/05/09 01:20:17 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/05/09 01:20:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Videos
[2012/05/09 01:20:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools
[2012/05/08 16:26:18 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012/05/08 00:11:34 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2012/05/07 23:44:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Vector Magic
[2012/05/06 14:29:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities
[2012/05/03 17:15:56 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012/05/03 17:15:48 | 000,000,000 | ---D | C] -- C:\Program Files\HP
[2012/05/02 16:56:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Amor
[2012/05/02 10:12:13 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2012/05/01 23:59:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\dvdcss
[2012/04/29 22:09:13 | 000,000,000 | ---D | C] -- C:\Program Files\MixMeister BPM Analyzer
[2012/04/29 21:30:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG Secure Search
[2012/04/29 21:29:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\AVG Secure Search
[2012/04/29 21:29:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2012/04/29 21:29:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2012/04/29 21:29:01 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search
[2012/04/29 21:18:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Vso
[2012/04/29 21:16:58 | 000,626,688 | ---- | C] (On2.com) -- C:\WINDOWS\System32\vp7vfw.dll
[2012/04/29 21:16:48 | 000,000,000 | ---D | C] -- C:\Program Files\VSO
[2012/04/29 21:12:11 | 000,000,000 | ---D | C] -- C:\Program Files\pazera-software
[2012/04/29 20:53:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\hardware software
[2012/04/29 20:53:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\hardware software
[2012/04/29 20:52:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe
[2012/04/29 20:48:27 | 000,000,000 | ---D | C] -- C:\Program Files\Foxit Software
[2012/04/29 20:21:39 | 000,000,000 | ---D | C] -- C:\Program Files\Rasterbater
[2012/04/29 19:46:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\FLEXnet
[2012/04/29 18:45:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Philipp Winterberg
[2012/04/29 18:45:16 | 000,000,000 | ---D | C] -- C:\Program Files\Free RAR Extract Frog
[2012/04/29 18:21:02 | 000,024,408 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswKbd.sys
[2012/04/29 18:20:52 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/04/29 18:20:52 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/04/29 17:46:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe
[2012/04/29 17:33:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2012/04/29 17:31:18 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2012/04/29 17:26:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2012/04/29 17:18:37 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012/04/29 17:13:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Macrovision Shared
[2012/04/29 17:11:35 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012/04/29 17:03:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
[2012/04/29 17:03:09 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
[2012/04/29 17:03:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012/04/29 17:02:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\SHELLNEW
[2012/04/29 17:02:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012/04/29 17:02:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012/04/29 16:57:37 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2012/04/29 16:52:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Video stuff
[2012/04/29 16:52:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Video stuff
[2012/04/29 16:52:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\TuneUpMedia
[2012/04/29 16:51:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus
[2012/04/29 16:51:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Antivirus
[2012/04/29 16:47:44 | 000,477,240 | ---- | C] (Duplex Secure Ltd.) -- C:\WINDOWS\System32\drivers\sptd.sys
[2012/04/29 16:47:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro
[2012/04/29 16:47:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\OpenCandy
[2012/04/29 16:47:06 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Pro
[2012/04/29 16:40:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
[2012/04/28 13:59:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2012/04/28 13:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012/04/28 12:23:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Skype
[2012/04/28 12:22:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012/04/28 12:22:46 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2012/04/28 12:22:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Skype
[2012/04/28 12:21:16 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\WINDOWS\System32\CSVer.dll
[2012/04/28 12:21:16 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2012/04/28 12:20:55 | 000,000,000 | ---D | C] -- C:\Intel
[2012/04/28 10:14:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ATI
[2012/04/28 10:14:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\ATI
[2012/04/28 10:14:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\ATI
[2012/04/28 09:14:16 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012/04/28 09:14:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Google
[2012/04/28 09:14:15 | 000,020,696 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/04/28 09:14:14 | 000,337,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/04/28 09:14:12 | 000,053,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/04/28 09:14:12 | 000,035,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/04/28 09:14:11 | 000,612,184 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/04/28 09:14:11 | 000,095,704 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/04/28 09:14:11 | 000,089,048 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/04/28 09:14:10 | 000,024,920 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/04/28 09:13:51 | 000,201,352 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/04/28 09:13:51 | 000,041,184 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/04/28 09:13:35 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012/04/28 09:13:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/04/28 09:07:48 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2012/04/28 09:07:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\uTorrent
[2012/04/28 09:05:46 | 000,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2012/04/28 09:05:14 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2012/04/28 09:03:54 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012/04/28 00:43:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\AutoShutdown
[2012/04/28 00:42:33 | 000,000,000 | ---D | C] -- C:\Program Files\Auto Shutdown
[2012/04/28 00:11:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Macromedia
[2012/04/28 00:11:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Adobe
[2012/04/28 00:08:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\vlc
[2012/04/28 00:05:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\IIS Temporary Compressed Files
[2012/04/28 00:05:39 | 000,000,000 | ---D | C] -- C:\Program Files\Vector Magic
[2012/04/28 00:05:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\FxsTmp
[2012/04/28 00:01:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Logfiles
[2012/04/28 00:01:33 | 000,000,000 | ---D | C] -- C:\Inetpub
[2012/04/27 23:59:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2012/04/27 23:58:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Lang
[2012/04/27 23:56:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RTCOM
[2012/04/27 23:56:37 | 002,808,832 | ---- | C] (RealTek Semicoductor Corp.) -- C:\WINDOWS\alcwzrd.exe
[2012/04/27 23:56:37 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2012/04/27 23:52:39 | 000,000,000 | ---D | C] -- C:\AMD
[2012/04/27 23:51:54 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2012/04/27 23:18:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2012/04/27 23:18:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[2012/04/27 23:17:47 | 000,000,000 | ---D | C] -- C:\Program Files\AMD
[2012/04/27 23:15:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\InstallShield
[2012/04/27 23:11:52 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/04/27 23:06:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Downloads
[2012/04/27 22:54:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Apple Computer
[2012/04/27 22:54:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Apple Computer
[2012/04/27 22:53:46 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012/04/27 22:53:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2012/04/27 22:53:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/04/27 22:53:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Apple
[2012/04/27 22:53:29 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2012/04/27 22:53:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Apple Computer
[2012/04/27 22:52:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2012/04/27 22:52:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple
[2012/04/27 22:52:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla
[2012/04/27 22:52:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Mozilla
[2012/04/27 22:51:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012/04/27 19:47:52 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\UserData
[2012/04/27 19:40:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[2012/04/27 19:37:43 | 000,000,000 | ---D | C] -- C:\Program Files\QMI
[2012/04/27 19:37:34 | 001,309,504 | R--- | C] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\drivers\athw.sys
[2012/04/27 19:37:31 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012/04/27 19:37:16 | 000,393,216 | R--- | C] (Quanta Microsystems, Inc.) -- C:\WINDOWS\System32\QmiInstDev.exe
[2012/04/27 19:36:30 | 000,000,000 | ---D | C] -- C:\Program Files\CONEXANT
[2012/04/27 19:30:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2012/04/27 19:30:07 | 000,000,000 | ---D | C] -- C:\Program Files\Broadcom
[2012/04/27 19:07:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\activity types
[2012/04/27 19:00:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\CAR NEF FCE IELTS
[2012/04/27 18:59:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Conv Club
[2012/04/27 18:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\documentd
[2012/04/27 18:57:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Documents
[2012/04/27 18:53:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\EAN
[2012/04/27 18:53:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\English language
[2012/04/27 18:51:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\For External HD
[2012/04/27 18:50:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\grafetti
[2012/04/27 18:50:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Int business
[2012/04/27 18:50:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\lA UNITY
[2012/04/27 18:50:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Int Culture
[2012/04/27 18:49:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\kids lessons
[2012/04/27 18:18:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Teaching bits for sam
[2012/04/27 18:18:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Teaching
[2012/04/27 18:17:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\TED videos = subs
[2012/04/27 18:16:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\to print
[2012/04/27 17:58:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Identities
[2012/04/27 17:58:48 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
[2012/04/27 17:58:45 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Pictures
[2012/04/27 17:58:45 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Music
[2012/04/27 17:58:41 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Application Data\Microsoft
[2012/04/27 17:58:41 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Cookies
[2012/04/27 17:58:41 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent
[2012/04/27 17:58:41 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Application Data
[2012/04/27 17:58:41 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents
[2012/04/27 17:58:41 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Favorites
[2012/04/27 17:58:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\PrintHood
[2012/04/27 17:58:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\NetHood
[2012/04/27 17:58:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Local Settings
[2012/04/27 17:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft
[2012/04/27 17:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop
[2012/04/27 17:58:40 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\SendTo
[2012/04/27 17:58:40 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
[2012/04/27 17:58:40 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu
[2012/04/27 17:58:40 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories
[2012/04/27 17:58:40 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Templates
[2012/04/27 17:32:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
[2012/04/27 17:32:15 | 000,000,000 | --SD | C] -- C:\WINDOWS\System32\Microsoft
[2012/04/27 17:32:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2012/04/27 17:32:14 | 000,000,000 | --SD | C] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2012/04/27 17:32:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2012/04/27 17:26:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2012/04/27 17:26:52 | 000,000,000 | --SD | C] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2012/04/27 17:25:38 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2012/04/27 17:25:37 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2012/04/27 17:25:37 | 000,029,184 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2012/04/27 17:24:33 | 000,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2012/04/27 17:24:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom
[2012/04/27 17:24:02 | 000,000,000 | ---D | C] -- C:\Program Files\xerox
[2012/04/27 17:24:02 | 000,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2012/04/27 17:22:53 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\DRM
[2012/04/27 17:22:44 | 000,000,000 | --SD | C] -- C:\WINDOWS\Downloaded Program Files
[2012/04/27 17:22:44 | 000,000,000 | R--D | C] -- C:\WINDOWS\Offline Web Pages
[2012/04/27 17:22:34 | 000,000,000 | -H-D | C] -- C:\Program Files\WindowsUpdate
[2012/04/27 17:22:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DirectX
[2012/04/27 17:21:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Services
[2012/04/27 17:21:55 | 000,000,000 | --SD | C] -- C:\WINDOWS\Tasks
[2012/04/27 17:21:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MSSoap
[2012/04/27 17:21:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\srchasst
[2012/04/27 17:21:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Macromed
[2012/04/27 17:21:40 | 000,000,000 | ---D | C] -- C:\Program Files\Movie Maker
[2012/04/27 17:21:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Restore
[2012/04/27 17:21:14 | 000,000,000 | ---D | C] -- C:\Program Files\NetMeeting
[2012/04/27 17:21:11 | 000,000,000 | ---D | C] -- C:\Program Files\Outlook Express
[2012/04/27 17:21:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\System
[2012/04/27 17:20:59 | 000,000,000 | ---D | C] -- C:\Program Files\Internet Explorer
[2012/04/27 17:20:58 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
[2012/04/27 17:20:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Games
[2012/04/27 17:20:25 | 000,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications
[2012/04/27 17:20:18 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools
[2012/04/27 17:20:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\Registration
[2012/04/27 17:20:11 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Music
[2012/04/27 17:20:11 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Player
[2012/04/27 17:20:11 | 000,000,000 | ---D | C] -- C:\Program Files\Online Services
[2012/04/27 17:20:04 | 000,000,000 | ---D | C] -- C:\Program Files\Messenger
[2012/04/27 17:20:00 | 000,000,000 | ---D | C] -- C:\Program Files\MSN Gaming Zone
[2012/04/27 17:19:22 | 000,000,000 | ---D | C] -- C:\Program Files\MSN
[2012/04/27 17:19:21 | 000,281,088 | ---- | C] (Cinematronics) -- C:\WINDOWS\System32\dllcache\pinball.exe
[2012/04/27 17:19:20 | 000,000,000 | ---D | C] -- C:\Program Files\Windows NT
[2012/04/27 17:19:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US
[2012/04/27 17:19:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MsDtc
[2012/04/27 17:19:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Com
[2012/04/27 17:18:57 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[2012/04/27 17:18:39 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
[2012/04/27 12:13:54 | 000,000,000 | -HSD | C] -- C:\WINDOWS\Installer
[2012/04/27 12:13:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
[2012/04/27 12:13:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SpeechEngines
[2012/04/27 12:13:49 | 000,000,000 | R--D | C] -- C:\Program Files
[2012/04/27 12:13:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Microsoft Shared
[2012/04/27 12:13:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files
[2012/04/27 12:13:23 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup
[2012/04/27 12:13:23 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu
[2012/04/27 12:13:23 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents
[2012/04/27 12:13:23 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Templates
[2012/04/27 12:13:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Favorites
[2012/04/27 12:13:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Desktop
[2012/04/27 12:13:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot2
[2012/04/27 12:13:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot
[2012/04/27 12:13:05 | 000,000,000 | --SD | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2012/04/27 12:13:05 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\All Users\Application Data
[2012/04/27 12:12:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings
[2012/04/27 12:12:39 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2012/04/27 12:07:30 | 000,000,000 | R-SD | C] -- C:\WINDOWS\Fonts
[2012/04/27 12:07:30 | 000,000,000 | RHSD | C] -- C:\WINDOWS\System32\dllcache
[2012/04/27 12:07:30 | 000,000,000 | R--D | C] -- C:\WINDOWS\Web
[2012/04/27 12:07:30 | 000,000,000 | -H-D | C] -- C:\WINDOWS\inf
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\WinSxS
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wins
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wbem
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\usmt
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\twain_32
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Temp
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\system32
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\system
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\spool
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ShellExt
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Setup
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\security
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Resources
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\repair
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ras
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Provisioning
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\PeerNet
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\pchealth
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\oobe
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\npp
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Network Diagnostic
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\mui
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\mui
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\msapps
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\msagent
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Media
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\L2Schemas
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\java
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\inetsrv
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\IME
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ime
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\icsxml
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ias
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Help
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\export
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\etc
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ehome
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Driver Cache
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\disdn
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\dhcp
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Debug
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Cursors
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Connection Wizard
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\config
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Config
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\AppPatch
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\addins
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3com_dmi
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3076
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\2052
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1054
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1042
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1041
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1037
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1033
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1031
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1028
[2012/04/27 12:07:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1025
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/05/15 17:19:44 | 000,100,864 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/15 15:43:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/05/15 15:25:02 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/14 23:58:23 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/05/14 10:01:45 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Word.lnk
[2012/05/14 09:25:00 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/12 14:42:33 | 000,443,468 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/05/12 14:42:33 | 000,076,810 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/05/12 14:37:35 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/12 14:30:59 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/05/11 14:35:16 | 000,001,057 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\vso_ts_preview.xml
[2012/05/08 00:10:36 | 001,388,490 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\layer red.pdf
[2012/05/07 23:44:21 | 000,000,686 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Vector Magic.lnk
[2012/05/07 00:28:19 | 000,000,804 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/05/04 00:04:00 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Shortcut to 2012.lnk
[2012/05/03 23:23:08 | 001,428,056 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/03 17:20:57 | 000,123,135 | ---- | M] () -- C:\WINDOWS\HPHins12.dat
[2012/04/29 20:21:55 | 000,000,813 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Rasterbator.lnk
[2012/04/29 18:25:03 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/04/29 17:59:40 | 000,000,223 | RHS- | M] () -- C:\boot.ini
[2012/04/29 17:45:37 | 000,000,754 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Photoshop.lnk
[2012/04/29 17:04:03 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2012/04/29 14:44:00 | 000,000,777 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk
[2012/04/29 14:44:00 | 000,000,759 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
[2012/04/28 13:49:21 | 000,000,350 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Shortcut to Films.lnk
[2012/04/28 12:20:38 | 000,053,248 | ---- | M] (Windows XP Bundled build C-Centric Single User) -- C:\WINDOWS\System32\CSVer.dll
[2012/04/28 09:56:33 | 000,000,000 | ---- | M] () -- C:\WINDOWS\ativpsrm.bin
[2012/04/28 09:54:11 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/28 09:25:19 | 000,001,791 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/04/28 09:07:48 | 000,000,648 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/04/28 00:06:30 | 000,026,687 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/28 00:05:17 | 000,000,535 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2012/04/27 23:58:27 | 000,940,794 | ---- | M] () -- C:\WINDOWS\System32\LoopyMusic.wav
[2012/04/27 23:58:27 | 000,146,650 | ---- | M] () -- C:\WINDOWS\System32\BuzzingBee.wav
[2012/04/27 23:56:02 | 002,808,832 | ---- | M] (RealTek Semicoductor Corp.) -- C:\WINDOWS\alcwzrd.exe
[2012/04/27 23:55:57 | 000,000,553 | ---- | M] () -- C:\WINDOWS\USetup.iss
[2012/04/27 23:55:56 | 000,049,152 | ---- | M] () -- C:\WINDOWS\System32\ChCfg.exe
[2012/04/27 23:55:56 | 000,000,520 | ---- | M] () -- C:\WINDOWS\System32\drivers\RTEQEX1.dat
[2012/04/27 23:55:56 | 000,000,520 | ---- | M] () -- C:\WINDOWS\System32\drivers\RTEQEX0.dat
[2012/04/27 23:55:56 | 000,000,008 | ---- | M] () -- C:\WINDOWS\System32\drivers\rtkhdaud.dat
[2012/04/27 23:14:17 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2012/04/27 22:51:56 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/27 22:51:56 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Firefox.lnk
[2012/04/27 19:22:02 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\My Computer.lnk
[2012/04/27 17:58:59 | 000,000,779 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/27 17:58:58 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/04/27 17:26:56 | 000,008,192 | ---- | M] () -- C:\WINDOWS\REGLOCS.OLD
[2012/04/27 17:26:10 | 000,000,780 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2012/04/27 17:23:46 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012/04/27 17:23:46 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012/04/27 17:23:46 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2012/04/27 17:23:46 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2012/04/27 17:23:43 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2012/04/27 17:23:42 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2012/04/27 17:23:42 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2012/04/27 17:23:33 | 000,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2012/04/27 17:20:34 | 000,021,640 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2012/04/27 12:13:59 | 000,004,444 | ---- | M] () -- C:\WINDOWS\System32\pid.PNF
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/09 01:20:49 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/05/09 01:20:49 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/05/09 01:20:49 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/05/09 01:20:49 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/05/09 01:20:49 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/05/08 00:10:29 | 001,388,490 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\layer red.pdf
[2012/05/07 23:44:21 | 000,000,686 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Vector Magic.lnk
[2012/05/07 00:28:19 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/05/07 00:28:19 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk
[2012/05/04 00:04:00 | 000,000,791 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Shortcut to 2012.lnk
[2012/05/03 17:13:19 | 000,123,135 | ---- | C] () -- C:\WINDOWS\HPHins12.dat
[2012/05/03 17:13:19 | 000,014,916 | ---- | C] () -- C:\WINDOWS\hphmdl12.dat
[2012/05/03 17:13:07 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2012/05/03 17:12:51 | 000,000,056 | ---- | C] () -- C:\ut9x.bat
[2012/05/03 17:12:51 | 000,000,054 | ---- | C] () -- C:\ut.bat
[2012/04/29 21:18:39 | 000,001,057 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\vso_ts_preview.xml
[2012/04/29 20:21:55 | 000,000,813 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Rasterbator.lnk
[2012/04/29 17:45:37 | 000,000,754 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Photoshop.lnk
[2012/04/29 17:35:07 | 000,000,856 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Photoshop CS3.lnk
[2012/04/29 17:04:03 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012/04/29 17:04:01 | 000,002,497 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Word.lnk
[2012/04/29 16:47:44 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\DAEMON Tools Pro.lnk
[2012/04/29 14:44:00 | 000,000,777 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk
[2012/04/29 14:44:00 | 000,000,759 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
[2012/04/29 14:42:28 | 000,000,771 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Picasa 3.lnk
[2012/04/28 13:49:23 | 000,000,350 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Shortcut to Films.lnk
[2012/04/28 12:22:52 | 000,002,271 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype.lnk
[2012/04/28 09:56:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2012/04/28 09:45:12 | 000,000,009 | ---- | C] () -- C:\WINDOWS\System32\drivers\ahcix86
[2012/04/28 09:20:55 | 000,001,825 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome.lnk
[2012/04/28 09:20:55 | 000,001,791 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/04/28 09:14:21 | 000,000,900 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/28 09:14:20 | 000,000,896 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/28 09:07:48 | 000,000,648 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/04/28 09:03:10 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2012/04/28 09:03:10 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2012/04/28 09:03:10 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2012/04/28 09:03:10 | 000,013,052 | ---- | C] () -- C:\WINDOWS\atiogl.xml
[2012/04/28 09:03:09 | 000,174,819 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2012/04/28 09:03:09 | 000,007,167 | ---- | C] () -- C:\WINDOWS\System32\atifglpf.xml
[2012/04/28 00:42:33 | 000,001,645 | ---- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Auto Shutdown.lnk
[2012/04/28 00:42:33 | 000,001,639 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Auto Shutdown.lnk
[2012/04/28 00:05:13 | 000,000,535 | ---- | C] () -- C:\WINDOWS\System32\mapisvc.inf
[2012/04/28 00:05:12 | 000,021,791 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.ini
[2012/04/28 00:05:12 | 000,008,002 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.h
[2012/04/28 00:05:12 | 000,001,037 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.ini
[2012/04/28 00:05:12 | 000,000,773 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.h
[2012/04/28 00:04:51 | 000,038,576 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
[2012/04/28 00:04:51 | 000,005,379 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.h
[2012/04/28 00:04:50 | 000,010,225 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
[2012/04/28 00:04:50 | 000,002,024 | ---- | C] () -- C:\WINDOWS\System32\axctrnm.h
[2012/04/28 00:04:48 | 000,011,435 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
[2012/04/28 00:04:48 | 000,003,276 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.h
[2012/04/28 00:04:47 | 000,049,275 | ---- | C] () -- C:\WINDOWS\System32\wfospf.mib
[2012/04/28 00:04:47 | 000,038,608 | ---- | C] () -- C:\WINDOWS\System32\nipx.mib
[2012/04/28 00:04:47 | 000,034,317 | ---- | C] () -- C:\WINDOWS\System32\msiprip2.mib
[2012/04/28 00:04:47 | 000,026,236 | ---- | C] () -- C:\WINDOWS\System32\wins.mib
[2012/04/28 00:04:47 | 000,021,386 | ---- | C] () -- C:\WINDOWS\System32\mipx.mib
[2012/04/28 00:04:47 | 000,013,767 | ---- | C] () -- C:\WINDOWS\System32\msipbtp.mib
[2012/04/28 00:04:47 | 000,010,313 | ---- | C] () -- C:\WINDOWS\System32\mripsap.mib
[2012/04/28 00:04:47 | 000,004,332 | ---- | C] () -- C:\WINDOWS\System32\smi.mib
[2012/04/28 00:04:47 | 000,000,581 | ---- | C] () -- C:\WINDOWS\System32\msft.mib
[2012/04/28 00:04:46 | 000,107,882 | ---- | C] () -- C:\WINDOWS\System32\mib_ii.mib
[2012/04/28 00:04:46 | 000,048,593 | ---- | C] () -- C:\WINDOWS\System32\hostmib.mib
[2012/04/28 00:04:46 | 000,030,448 | ---- | C] () -- C:\WINDOWS\System32\mcastmib.mib
[2012/04/28 00:04:46 | 000,026,100 | ---- | C] () -- C:\WINDOWS\System32\lmmib2.mib
[2012/04/28 00:04:46 | 000,020,079 | ---- | C] () -- C:\WINDOWS\System32\http.mib
[2012/04/28 00:04:46 | 000,016,617 | ---- | C] () -- C:\WINDOWS\System32\authserv.mib
[2012/04/28 00:04:46 | 000,015,799 | ---- | C] () -- C:\WINDOWS\System32\ipforwd.mib
[2012/04/28 00:04:46 | 000,015,597 | ---- | C] () -- C:\WINDOWS\System32\accserv.mib
[2012/04/28 00:04:46 | 000,006,179 | ---- | C] () -- C:\WINDOWS\System32\ftp.mib
[2012/04/28 00:04:46 | 000,004,597 | ---- | C] () -- C:\WINDOWS\System32\dhcp.mib
[2012/04/28 00:04:46 | 000,000,698 | ---- | C] () -- C:\WINDOWS\System32\inetsrv.mib
[2012/04/28 00:04:45 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2012/04/28 00:04:45 | 000,001,361 | ---- | C] () -- C:\WINDOWS\System32\fxscount.h
[2012/04/27 23:58:27 | 000,146,650 | ---- | C] () -- C:\WINDOWS\System32\BuzzingBee.wav
[2012/04/27 23:58:26 | 000,940,794 | ---- | C] () -- C:\WINDOWS\System32\LoopyMusic.wav
[2012/04/27 23:57:28 | 000,000,553 | ---- | C] () -- C:\WINDOWS\USetup.iss
[2012/04/27 23:57:08 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2012/04/27 23:56:42 | 000,000,520 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTEQEX1.dat
[2012/04/27 23:56:42 | 000,000,520 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTEQEX0.dat
[2012/04/27 23:56:42 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtkhdaud.dat
[2012/04/27 23:45:07 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/27 23:18:56 | 005,631,520 | ---- | C] () -- C:\WINDOWS\System\DriveIcon.dll
[2012/04/27 23:14:17 | 000,001,554 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes.lnk
[2012/04/27 23:14:17 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2012/04/27 22:55:35 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/27 22:51:56 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/27 22:51:56 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Firefox.lnk
[2012/04/27 22:51:53 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/04/27 19:37:16 | 000,000,774 | R--- | C] () -- C:\WINDOWS\System32\QmiInfo.cfg
[2012/04/27 19:22:02 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\My Computer.lnk
[2012/04/27 18:16:13 | 000,100,864 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/04/27 17:58:58 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/04/27 17:58:48 | 000,000,779 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/27 17:26:56 | 000,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD
[2012/04/27 17:26:10 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2012/04/27 17:25:32 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2012/04/27 17:25:17 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2012/04/27 17:25:10 | 000,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2012/04/27 17:25:09 | 000,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2012/04/27 17:25:07 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2012/04/27 17:24:56 | 013,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2012/04/27 17:24:50 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2012/04/27 17:24:45 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll
[2012/04/27 17:24:36 | 000,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2012/04/27 17:23:46 | 000,002,625 | ---- | C] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/04/27 17:23:46 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012/04/27 17:23:46 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012/04/27 17:23:46 | 000,000,000 | ---- | C] () -- C:\CONFIG.SYS
[2012/04/27 17:23:46 | 000,000,000 | ---- | C] () -- C:\AUTOEXEC.BAT
[2012/04/27 17:23:42 | 000,023,392 | ---- | C] () -- C:\WINDOWS\System32\nscompat.tlb
[2012/04/27 17:23:42 | 000,016,832 | ---- | C] () -- C:\WINDOWS\System32\amcompat.tlb
[2012/04/27 17:23:41 | 000,316,640 | ---- | C] () -- C:\WINDOWS\WMSysPr9.prx
[2012/04/27 17:22:22 | 004,399,505 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nls302en.lex
[2012/04/27 17:22:07 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt256.bmp
[2012/04/27 17:22:07 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt.bmp
[2012/04/27 17:22:00 | 000,000,984 | ---- | C] () -- C:\WINDOWS\System32\dllcache\srframe.mmf
[2012/04/27 17:21:20 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msinfo.dll
[2012/04/27 17:20:34 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2012/04/27 17:19:46 | 000,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp
[2012/04/27 17:19:46 | 000,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp
[2012/04/27 17:19:46 | 000,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp
[2012/04/27 17:19:46 | 000,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp
[2012/04/27 17:19:46 | 000,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp
[2012/04/27 17:19:46 | 000,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp
[2012/04/27 17:19:46 | 000,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp
[2012/04/27 17:19:46 | 000,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp
[2012/04/27 17:19:46 | 000,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp
[2012/04/27 17:19:45 | 000,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp
[2012/04/27 17:19:45 | 000,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp
[2012/04/27 17:19:43 | 000,001,161 | ---- | C] () -- C:\WINDOWS\System32\usrlogon.cmd
[2012/04/27 17:19:42 | 000,003,286 | ---- | C] () -- C:\WINDOWS\System32\tslabels.h
[2012/04/27 17:19:41 | 000,000,768 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.h
[2012/04/27 17:19:36 | 000,063,488 | ---- | C] () -- C:\WINDOWS\System32\wmimgmt.msc
[2012/04/27 12:13:59 | 000,004,444 | ---- | C] () -- C:\WINDOWS\System32\pid.PNF
[2012/04/27 12:13:57 | 000,026,687 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012/04/27 12:13:54 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2012/04/27 12:13:51 | 001,685,606 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.spd
[2012/04/27 12:13:51 | 000,605,050 | ---- | C] () -- C:\WINDOWS\System32\dllcache\r1033tts.lxa
[2012/04/27 12:13:51 | 000,000,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.sdf
[2012/04/27 12:13:50 | 000,643,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ltts1033.lxa
[2012/04/27 12:13:31 | 000,001,688 | ---- | C] () -- C:\WINDOWS\System32\AUTOEXEC.NT
[2012/04/27 12:13:22 | 001,296,669 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP3.CAT
[2012/04/27 12:13:22 | 000,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2012/04/27 12:13:22 | 000,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2012/04/27 12:13:22 | 000,144,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\netfx.cat
[2012/04/27 12:13:22 | 000,112,918 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tabletpc.cat
[2012/04/27 12:13:22 | 000,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2012/04/27 12:13:22 | 000,034,747 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mediactr.cat
[2012/04/27 12:13:22 | 000,034,063 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT
[2012/04/27 12:13:22 | 000,026,991 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat
[2012/04/27 12:13:22 | 000,016,535 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT
[2012/04/27 12:13:22 | 000,014,433 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat
[2012/04/27 12:13:22 | 000,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2012/04/27 12:13:22 | 000,012,363 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2012/04/27 12:13:22 | 000,010,027 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2012/04/27 12:13:22 | 000,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2012/04/27 12:13:22 | 000,007,382 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2012/04/27 12:13:22 | 000,007,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmerrenu.cat
[2012/04/27 12:13:21 | 002,144,487 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT
[2012/04/27 12:13:21 | 000,522,220 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2012/04/27 12:12:38 | 001,428,056 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/04/27 12:12:05 | 000,000,223 | RHS- | C] () -- C:\boot.ini
[2012/04/27 12:12:01 | 000,000,780 | ---- | C] () -- C:\WINDOWS\System32\$winnt$.inf

========== LOP Check ==========

[2012/04/29 21:29:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\AVG Secure Search
[2012/04/29 17:31:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro
[2012/05/10 16:23:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Foxit Software
[2012/04/29 16:47:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\OpenCandy
[2012/04/29 18:45:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Philipp Winterberg
[2012/04/29 19:34:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\TuneUpMedia
[2012/05/15 17:21:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\uTorrent
[2012/05/11 14:35:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Vso
[2012/04/28 09:13:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/04/29 21:30:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2012/04/29 17:00:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
[2012/05/11 14:17:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2012/04/27 22:54:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

========== Purity Check ==========

========== Custom Scans ==========

< :OTL >

< DRV - File not found [Kernel | On_Demand | Unknown] -- -- (ap3u0n85) >

< >

< :Files >

< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.

< >

< :Commands >

< [resethosts] >

< [emptytemp] >

< [Reboot] >

< End of report >

Attached Files

OTL.Txt 184.25KB 48 downloads

#6
Essexboy

Posted 16 May 2012 - 11:24 AM

GeekU Moderator

Retired Staff
69,964 posts

What IP addresses is Malwarebytes blocking ?

#7
sam gibson

Posted 17 May 2012 - 03:20 PM

Member

Topic Starter
Member
12 posts

essex boy- whatever you did seemes to have cleared it up! no more connections! thanks so much, is there anything youd recomend to keep it this way, or to stop it if it happens in the future?

much thanks, sam

#8
Essexboy

Posted 17 May 2012 - 03:29 PM

GeekU Moderator

Retired Staff
69,964 posts

It was just a matter of resetting the DNS cache to defaults

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:Commands
[resethosts]
[emptytemp]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done

Remove ComboFix

Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
In the Run box, type in ComboFix /Uninstall
(Notice the space between the "x" and "/")
then click OK
Follow the prompts on the screen
A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Do not show hidden files and folders.
Click Yes to confirm.
Click OK.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Posted Image

Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe :wave:

#9
sam gibson

Posted 18 May 2012 - 08:41 AM

Member

Topic Starter
Member
12 posts

nooooo! i did the first scan, rebooted and the connections attempts are being blocked again by malwarebytes!

these are the addresses, 222.64.119.196 . 222.65.137.0 194.44.252.223

??! SAM

#10
Essexboy

Posted 18 May 2012 - 12:06 PM

GeekU Moderator

Retired Staff
69,964 posts

Is this in IE, Firefox or both. Also are the blocks inbound or outbound

#11
sam gibson

Posted 18 May 2012 - 01:19 PM

Member

Topic Starter
Member
12 posts

outgoing, i use firefox, but even if its closed the blocks happen. malwarebytes is doing to blocking

cheers, sam

#12
Essexboy

Posted 18 May 2012 - 01:22 PM

GeekU Moderator

Retired Staff
69,964 posts

Lets check out Firefox next

Please download GooredFix from one of the locations below and save it to your Desktop

Download Mirror #1
Download Mirror #2

Ensure all Firefox windows are closed.
To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
When prompted to run the scan, click Yes.
GooredFix will check for infections, and then a log will appear.

Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

#13
sam gibson

Posted 19 May 2012 - 04:32 PM

Member

Topic Starter
Member
12 posts

GooredFix by jpshortstuff (03.07.10.1)
Log created at 17:31 on 19/05/2012 (Administrator)
Firefox version 12.0 (en-US)

========== GooredScan ==========

(none)

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [03:51 28/04/2012]

C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\vro5im01.default\extensions\
(none)

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"[email protected]"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [14:13 28/04/2012]
"avg@toolbar"="C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\" [02:30 30/04/2012]

-=E.O.F=-

#14
Essexboy

Posted 20 May 2012 - 04:57 AM

GeekU Moderator

Retired Staff
69,964 posts

Hmm I have just had one recently similar to this (although Avast was alerting as well) and only one tool showed the location of the file for manual removal

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

Click the cog in the upper right
Posted Image

Select down to and including your main drive, once done select the Automatic scan tab and press Start Scan

Posted Image

Allow AVP to delete all infections found
Once it has finished select report tab (last tab)
Select Detected threats report from the left and press Save button
Save it to your desktop and attach to your next post

Now the Analysis

Rerun AVP and select the Manual Disinfection tab and press Start Gathering System Information

Posted Image