OTL logfile created on: 9/9/2011 7:40:14 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 88.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 141.69 Gb Total Space | 124.20 Gb Free Space | 87.66% Space Free | Partition Type: NTFS
Drive D: | 7.45 Gb Total Space | 3.79 Gb Free Space | 50.83% Space Free | Partition Type: FAT32
Drive I: | 141.74 Gb Total Space | 141.61 Gb Free Space | 99.91% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - [2011/04/18 12:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/02/08 00:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2010/04/27 10:52:26 | 000,090,480 | ---- | M] () [Auto] -- C:\Documents and Settings\User\SimpleHelp_SimpleGatewayService\SimpleService.exe -- (SimpleHelpSimpleGatewayService)
SRV - [2009/12/16 16:09:34 | 000,049,152 | ---- | M] (Sage (UK) Limited) [Auto] -- C:\Program Files\Common Files\Sage SData\Sage.SData.Service.exe -- (Sage SData Service)
SRV - [2009/02/06 07:11:05 | 000,110,592 | ---- | M] () [Auto] -- C:\WINDOWS\system32\services.exe -- (PlugPlay)
SRV - [2009/02/06 07:11:05 | 000,110,592 | ---- | M] () [Auto] -- C:\WINDOWS\system32\services.exe -- (Eventlog)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2011/04/14 16:28:42 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/04/04 19:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011/03/16 11:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/03/01 09:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 03:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV - [2011/02/10 02:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 02:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/07 01:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2009/06/29 07:59:14 | 000,142,592 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/06/26 21:47:54 | 000,013,856 | ---- | M] (Acer, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\int15.sys -- (int15)
DRV - [2008/04/14 23:00:00 | 000,042,112 | ---- | M] () [Kernel | System] -- C:\WINDOWS\system32\drivers\imapi.sys -- (Imapi)
DRV - [2007/12/10 12:59:36 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\TVicPort.sys -- (tvicport)
DRV - [2007/12/10 12:59:36 | 000,006,080 | ---- | M] (Zeal SoftStudio) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\zntport.sys -- (zntport)
DRV - [2007/07/02 04:02:46 | 004,432,384 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/12/24 17:37:48 | 000,016,800 | ---- | M] (HP) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hppaufd0.sys -- (dot4ufd)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
IE - HKU\User_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
IE - HKU\User_ON_C\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\User_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
IE - HKU\User_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/08/09 04:05:53 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2008/04/14 23:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe ( )
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\imekrmig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LaunchApp]  File not found
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\User_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} http://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB (Hewlett-Packard Printer Diagnostics)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272377599625 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: 
O24 - Desktop BackupWallPaper: 
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/02/11 18:29:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/06/18 16:13:16 | 000,000,090 | ---- | M] () - D:\AUTORUN.INF -- [ FAT32 ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2011/09/09 10:20:08 | 000,000,000 | RH-D | C] -- C:\VProRecovery
[2011/09/09 08:17:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
[2011/09/09 06:01:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Start Menu\Programs\CyberLink PowerDVD
[2011/09/09 05:56:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\IETldCache
[2011/09/09 05:35:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Malwarebytes
[2011/09/09 05:35:57 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/09/09 05:35:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/09/09 05:35:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/09/09 05:35:53 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/09/09 05:35:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/09/08 11:04:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2011/08/25 04:10:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\Yahoo
[2011/08/25 04:04:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo!
[2011/08/25 04:04:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2011/08/25 04:04:10 | 000,000,000 | ---D | C] -- C:\Program Files\Yahoo!
[2011/08/25 04:04:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Yahoo!
[2011/08/25 04:01:54 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2011/08/17 09:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\Credit Control
[2010/04/27 17:43:23 | 000,016,384 | ---- | C] ( ) -- C:\WINDOWS\System32\ClearEvent.exe
[2009/08/12 10:12:42 | 000,184,320 | R--- | C] ( ) -- C:\WINDOWS\System32\SgE.interop.MSXML2.dll
[2008/11/25 13:37:10 | 000,049,152 | ---- | C] ( ) -- C:\WINDOWS\Interop.IWshRuntimeLibrary.dll
[2008/01/03 13:21:04 | 000,049,152 | ---- | C] ( ) -- C:\WINDOWS\System32\SysMonitor.exe
[2006/12/12 05:59:08 | 000,184,320 | ---- | C] ( ) -- C:\WINDOWS\System32\Interop.MSXML2.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2011/09/09 13:13:10 | 2137,247,744 | -HS- | M] () -- C:\hiberfil.sys
[2011/09/09 13:13:09 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/09/09 11:04:43 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2011/09/09 10:30:57 | 000,331,480 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/09/09 06:04:08 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/09/09 06:03:37 | 000,000,000 | ---- | M] () -- C:\WINDOWS\3585663855
[2011/09/09 05:44:08 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{DE934E5F-72D5-4D9A-97CC-0EE17514E23D}.job
[2011/09/09 05:35:57 | 000,000,788 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/09 05:35:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/09/08 11:04:31 | 000,000,000 | -HS- | M] () -- C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
[2011/09/08 04:00:37 | 131,425,651 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/09/05 10:06:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Sage Accounts
[2011/09/05 09:49:11 | 083,636,198 | ---- | M] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic 2011 final backup before update5 9 2011.001
[2011/09/05 09:47:25 | 083,636,190 | ---- | M] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic 2011-09-05 14-46-25.001
[2011/09/05 09:46:11 | 083,636,152 | ---- | M] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic 2011-09-05 14-45-02.001
[2011/09/05 06:39:16 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\User\Desktop\WORD.lnk
[2011/09/05 06:36:38 | 000,000,037 | ---- | M] () -- C:\WINDOWS\iltwain.ini
[2011/09/05 04:10:41 | 000,001,896 | ---- | M] () -- C:\WINDOWS\System32\SGLCH32.USR
[2011/09/01 06:36:15 | 000,002,495 | ---- | M] () -- C:\Documents and Settings\User\Desktop\EXCEL.lnk
[2011/08/31 04:01:00 | 000,114,063 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/08/26 04:05:44 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/08/25 04:07:13 | 000,000,819 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/08/24 10:38:15 | 000,078,848 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Publication2.pub
[2011/08/23 11:28:35 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/08/22 10:31:07 | 000,001,679 | ---- | M] () -- C:\WINDOWS\Payroll.ini
[2011/08/16 08:19:54 | 083,612,889 | ---- | M] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic Post Year End Back Up 2011.001
[2011/08/16 08:10:42 | 082,105,629 | ---- | M] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic Pre year end close 2011 spare.001
[2011/08/11 04:03:21 | 000,446,136 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/08/11 04:03:21 | 000,073,216 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2011/09/09 11:59:34 | 2137,247,744 | -HS- | C] () -- C:\hiberfil.sys
[2011/09/09 05:35:57 | 000,000,788 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/09/08 11:04:31 | 000,000,000 | -HS- | C] () -- C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
[2011/09/08 10:45:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\3585663855
[2011/09/05 09:48:43 | 083,636,198 | ---- | C] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic 2011 final backup before update5 9 2011.001
[2011/09/05 09:46:57 | 083,636,190 | ---- | C] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic 2011-09-05 14-46-25.001
[2011/09/05 09:45:32 | 083,636,152 | ---- | C] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic 2011-09-05 14-45-02.001
[2011/08/26 04:23:12 | 000,000,420 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{DE934E5F-72D5-4D9A-97CC-0EE17514E23D}.job
[2011/08/24 10:38:15 | 000,078,848 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Publication2.pub
[2011/08/16 08:19:25 | 083,612,889 | ---- | C] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic Post Year End Back Up 2011.001
[2011/08/16 08:10:15 | 082,105,629 | ---- | C] () -- C:\Documents and Settings\User\My Documents\SageAccts Frant Road Clinic Pre year end close 2011 spare.001
[2011/07/27 08:20:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\SageFolderBrowser.dll
[2011/07/27 08:20:34 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\SageEventHandler.exe
[2011/07/27 08:20:30 | 000,249,856 | ---- | C] () -- C:\WINDOWS\System32\SGCDlg32.dll
[2011/07/27 08:20:24 | 000,282,624 | ---- | C] () -- C:\WINDOWS\System32\SGList32.dll
[2011/07/27 08:20:22 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\SGAppBar.dll
[2011/07/27 08:20:20 | 000,258,048 | ---- | C] () -- C:\WINDOWS\System32\SGSchemeXml.dll
[2011/07/27 08:20:18 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\SgStat32.dll
[2011/07/27 08:20:16 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\SGSchemeDefault.dll
[2011/07/27 08:20:16 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\SGSchemeXP.dll
[2011/07/27 08:20:10 | 000,278,528 | ---- | C] () -- C:\WINDOWS\System32\SGTool32.dll
[2011/07/27 08:20:10 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\SGTBar32.dll
[2011/07/27 08:20:08 | 000,241,664 | ---- | C] () -- C:\WINDOWS\System32\SGWebBrowser.dll
[2011/07/27 08:20:04 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\SGSTDREG.dll
[2011/07/27 08:20:02 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\SGSchemeManager.dll
[2011/07/27 08:20:02 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\SGJPEG32.dll
[2011/07/27 08:20:02 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\SGLogo32.dll
[2011/07/27 08:20:00 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\SG3D32.dll
[2011/07/27 08:19:58 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\SGHelp32.dll
[2011/07/27 08:19:58 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\SGIntl32.dll
[2011/07/27 08:19:50 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\SGRegister.dll
[2011/07/27 08:19:48 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\SGCom32.dll
[2011/07/27 08:10:06 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\SGCtrlEx.dll
[2011/07/27 08:01:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\SGDt32.dll
[2011/07/25 11:51:12 | 000,001,205 | ---- | C] () -- C:\WINDOWS\SAGEINTL.INI
[2011/07/25 11:51:12 | 000,000,005 | -HS- | C] () -- C:\WINDOWS\System32\CdI5T.drv
[2011/05/17 07:44:19 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/26 12:54:28 | 000,187,072 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/09/27 07:39:10 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\SageSantander.dll
[2010/09/14 07:35:38 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\SageBankOfAmerica.dll
[2010/05/24 04:21:08 | 000,000,083 | ---- | C] () -- C:\WINDOWS\SGREP32.INI
[2010/04/29 07:00:30 | 000,000,011 | ---- | C] () -- C:\WINDOWS\hpljp300xg.ini
[2010/04/29 06:58:28 | 000,000,011 | ---- | C] () -- C:\WINDOWS\hpljp300xm.ini
[2010/04/29 06:20:51 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\Install.exe
[2010/04/29 05:59:13 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/04/29 05:58:49 | 000,001,679 | ---- | C] () -- C:\WINDOWS\Payroll.ini
[2010/04/29 05:57:50 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\SGRep32.dll
[2010/04/29 05:57:50 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\SGLch32.dll
[2010/04/29 05:57:50 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\RepDes32.exe
[2010/04/29 05:57:30 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\_RegTLB.dll
[2010/04/27 17:46:12 | 000,000,050 | ---- | C] () -- C:\WINDOWS\commercial.ini
[2010/04/27 17:45:46 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\WavXMapDrive.bat
[2010/04/27 17:42:11 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\drivers\int15_64.sys
[2010/04/27 17:34:11 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2010/04/27 17:32:40 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\fusioncache.dat
[2010/04/27 10:41:23 | 000,000,037 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2010/04/27 09:59:28 | 000,073,728 | R--- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2010/04/27 09:48:32 | 000,000,686 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/10/23 06:25:10 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\SgDate.dll
[2009/06/12 04:20:52 | 000,571,320 | ---- | C] () -- C:\WINDOWS\HPISExe.dat
[2009/02/11 19:37:28 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/02/11 19:36:58 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/02/11 19:24:42 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2009/02/11 19:09:10 | 000,331,480 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/02/11 19:03:40 | 000,446,136 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2009/02/11 19:03:40 | 000,073,216 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2009/02/11 18:53:04 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2009/02/11 18:52:28 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2009/02/11 18:52:28 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2009/02/11 18:52:28 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2009/02/11 18:29:00 | 000,004,473 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/02/11 18:27:22 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/02/09 22:31:20 | 000,000,115 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2008/07/30 22:37:26 | 000,006,782 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2008/04/14 23:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 23:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 23:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 23:00:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\services.exe
[2008/04/14 23:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 23:00:00 | 000,042,112 | ---- | C] () -- C:\WINDOWS\System32\drivers\imapi.sys
[2008/04/14 23:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 23:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 23:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/14 23:00:00 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2008/04/14 23:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008/02/15 16:21:56 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2008/01/14 12:47:06 | 000,099,712 | ---- | C] () -- C:\WINDOWS\HPBroker.dll
[2006/11/01 10:50:40 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\PDFInstall.exe
[2006/08/28 21:30:04 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2006/05/29 02:05:58 | 000,303,104 | ---- | C] () -- C:\WINDOWS\CreateLnk.exe
[2003/01/07 03:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/05/24 08:34:46 | 000,032,768 | ---- | C] () -- C:\WINDOWS\AMOVE.EXE
[2001/12/26 19:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001/09/04 02:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001/08/25 05:04:08 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/25 05:02:42 | 000,004,524 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/07/30 19:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001/07/24 01:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[1998/03/25 20:12:00 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\SgHmZLib.dll
[1998/03/19 20:00:00 | 000,001,048 | -HS- | C] () -- C:\WINDOWS\System32\TMailRL.sys
[1998/03/19 20:00:00 | 000,001,048 | -HS- | C] () -- C:\WINDOWS\System32\TMail3FL.SYS
[1998/03/19 20:00:00 | 000,001,048 | -HS- | C] () -- C:\WINDOWS\System32\rlfnlf.sys
[1998/03/19 20:00:00 | 000,001,048 | -HS- | C] () -- C:\WINDOWS\System32\flfnlf.sys
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2010/10/27 07:11:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\AVG10
[2011/01/19 10:24:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Sage
[2010/04/27 09:07:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Wave Systems Corp
[2011/09/08 11:15:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/27 07:08:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/10/27 07:11:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2010/04/27 15:06:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eSobi
[2011/06/01 04:10:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/12/09 05:39:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sage
[2010/04/27 09:08:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Wave Systems Corp
[2011/09/09 05:44:08 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{DE934E5F-72D5-4D9A-97CC-0EE17514E23D}.job
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 816 bytes -> C:\WINDOWS\3585663855:2417772330.exe
< End of report >