# Computer in Critical State! HELP ME PLZ!!!!!!!



## Chelsea-Buns (Oct 28, 2010)

The internet explorer settings will not set to no proxy settings in internet options under the connections tab, when you click automatic dectect and OK it goes right back to Use a Proxy Server for your LAN. Websites that are trying to be opened by Mozilla are redirected to another website automatically. Cannot run AVG program or Spybot to eradicate viruses or any malware programs. Attempted to uninstall Avg as well as Spybot, however when trying to reinstall will not allow due to an error that indicates to specify proxy settings and that a connection to the internet cannot be made. Was able to install avast AV but this had not fixed the problem. Also tried to install Avira but same issue with Avg not being able to specify proxy settings. As well when I re-open Fire Fox the proxy settings are changed every time to : Use a proxy server for your LAN and the HTTP is 127.0.0.1 port 50370. Not sure why it keeps changing.


!!! JUST DOWNLOADED HijackThis but it won't let me open the file... it is saying that I do not have the permissions to access this item. HELP!!!!


----------



## CatByte (Feb 24, 2009)

Hi,

Please do the following:

Please download *DDS* from either of these links

*LINK 1* 
*LINK 2*

and save it to your *desktop.*

Disable any script blocking protection
 Double click *dds.pif* to run the tool. 
When done, two *DDS.txt's* will open. 
Save both reports to your *desktop.*
---------------------------------------------------
*Please include the contents of the following in your next reply:*

*DDS.txt*
*Attach.txt*.

*NEXT*









Download *GMER Rootkit Scanner *from *here* or *here*.

 Extract the contents of the zipped file to desktop. 
 Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent . 
 If it gives you a warning about rootkit activity and asks if you want to run scan...click on *NO*.


_Click the image to enlarge it_

 In the right panel, you will see several boxes that have been checked. Uncheck the following ...
 IAT/EAT
 Drives/Partition other than Systemdrive (typically C:\) 
 Show All (don't miss this one)

 Then click the Scan button & wait for it to finish. 
 Once done click on the *[Save..]* button, and in the File name area, type in *"Gmer.txt"* or it will save as a .log file which cannot be uploaded to your post.

Save it where you can easily find it, such as your desktop, and attach it in your reply.

_**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries _


----------



## Chelsea-Buns (Oct 28, 2010)

Ok so it worked


----------



## CatByte (Feb 24, 2009)

Hi

You have attached the Attach.txt only, I need the DDS Log as well, and you attached the actual GMER program itself, I need the log that it produced after running it on your system

thanks

(Post them if you are having trouble attaching)


----------



## Chelsea-Buns (Oct 28, 2010)

*GMER 1.0.15.15477 - http://www.gmer.net
Rootkit scan 2010-11-02 07:45:16
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\CHYSAS~1\LOCALS~1\Temp\agtoapog.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0xA9BFDCAE]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwClose [0xA9C1A9A5]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0xA9BFFB34]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0xA9BFFB8C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0xA9BFFCA2]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateKey [0xA9C1A359]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0xA9BFFA8A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0xA9BFFBDC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0xA9BFFADE]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0xA9BFFC50]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0xA9BFDCD2]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteKey [0xA9C1B06B]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteValueKey [0xA9C1B321]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0xA9C003D4]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xA9C1AED6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xA9C1AD41]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0xA9BFDADA]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0xA9BFDCF6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0xA9C00548]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0xA9BFE7F8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0xA9BFFB64]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0xA9BFFBB4]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0xA9BFFCCC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenKey [0xA9C1A6B5]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0xA9BFFAB6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0xA9C0020C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0xA9BFFC1C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0xA9BFFB0C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0xA9C002F0]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0xA9BFFC7A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryKey [0xA9C1ABBC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0xA9BFE6BE]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryValueKey [0xA9C1AA0E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xA9C4E22E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwReplyWaitReceivePort [0xA9C0057E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwReplyWaitReceivePortEx [0xA9C00142]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwRestoreKey [0xA9C199CC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0xA9BFDD1A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0xA9BFDD3E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0xA9BFDB34]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetValueKey [0xA9C1B172]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0xA9BFDC44]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0xA9BFDC56]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xA9C5ABAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!RtlTraceDatabaseAdd + FC 8052D60C 1 Byte [00]
.text ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpcLevel + AF8 8053D64C 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x830f2ce0; RETF }
PAGE ntkrnlpa.exe!ObMakeTemporaryObject 805B1CE0 5 Bytes JMP A9C565D4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!ObInsertObject 805B8B58 5 Bytes JMP A9C57FFA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 805C73EA 7 Bytes JMP A9C5ABB2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
.text isapnp.sys F83C5200 18 Bytes [FF, 01, 00, 00, 80, 27, 00, ...]
.text isapnp.sys F83C5213 284 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text isapnp.sys F83C5330 5 Bytes [00, 00, 00, 00, 00]
.text isapnp.sys F83C5336 239 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text isapnp.sys F83C5426 241 Bytes [C7, 40, 30, 34, 00, 00, 00, ...]
.text ... 
.text C:\WINDOWS\system32\drivers\isapnp.sys section is writeable [0xF83C5200, 0x22AA4, 0xE8000020]
.data C:\WINDOWS\system32\drivers\isapnp.sys unknown last section [0xF83E7CE0, 0xCFA0, 0xC8000040]
.text Ntfs.sys F821AB4B 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x831081b4; RETF }
.text Ntfs.sys F821BF2F 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x831056d4; RETF }
.text Ntfs.sys F821CABB 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x830fc0dd; RETF }
PAGE Ntfs.sys F823E17E 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x830f8617; RETF }
PAGE Ntfs.sys F823E2EA 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x830fcbcd; RETF }
PAGE ... 
.text tcpip.sys!IPTransmit + 10FC A9DA2D3A 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x830eaf9a; RETF }
.text tcpip.sys!ARPRcv + E44 A9DA54F9 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x83106f72; RETF }
.text tcpip.sys!ARPRcv + 1063 A9DA5718 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x830ec155; RETF }
.text tcpip.sys!tcpxsum + 11246 A9DCD2A1 4 Bytes [FC, BC, 63, 82]
.text tcpip.sys!tcpxsum + 115DF A9DCD63A 4 Bytes [BC, 06, 78, 82]
.text tcpip.sys!tcpxsum + 11993 A9DCD9EE 4 Bytes [14, C1, 77, 82] {ADC AL, 0xc1; JA 0xffffffffffffff86}
PAGELK tcpip.sys!SendICMPErr + 17268 A9DEB042 4 Bytes [74, 4B, 18, 83]
.text wanarp.sys F866A3FD 13 Bytes [0E, 90, 83, EC, 04, C7, 04, ...] {PUSH CS; NOP ; SUB ESP, 0x4; MOV DWORD [ESP], 0x830ef718; RETF }
? C:\DOCUME~1\CHYSAS~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1524] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }
? C:\Documents and Settings\chysa strickland\Application Data\Microsoft\svchost.exe[1796] number of sections mismatch; time/date stamp mismatch; unknown module: .exeunknown module: OLEAUT32.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3784] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)

Device \FileSystem\Fastfat \FatCdrom aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

Device \Driver\iaStor -> DriverStartIo \Device\Ide\iaStor0 82564AEA
Device \Driver\iaStor -> DriverStartIo \Device\Ide\IAAStorageDevice-0 82564AEA

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

Device \FileSystem\Fastfat \Fat aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)

Device \Device\Ide\IAAStorageDevice-1 -> \??\IDE#DiskWDC_WD800JD-75MSA3______________________10.01E04#4&3836d654&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- EOF - GMER 1.0.15 ----
*


----------



## Chelsea-Buns (Oct 28, 2010)

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-11-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 04/07/2007 6:51:29 PM
System Uptime: 11/02/2010 7:21:08 AM (6336 hours ago)

Motherboard: Dell Inc. | | 0WG864
Processor: Intel(R) Celeron(R) CPU 3.06GHz | Microprocessor | 3059/533mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 71 GiB total, 31.228 GiB free.
D: is CDROM (CDFS)
E: is Removable

==== Disabled Device Manager Items =============

Class GUID: 
Description: Generic RNDIS
Device ID: USB\VID_0BB4&PID_0B0C\3FBF5000-7351-0801-040F-46E0DE5C03BE
Manufacturer: 
Name: Generic RNDIS
PNP Device ID: USB\VID_0BB4&PID_0B0C\3FBF5000-7351-0801-040F-46E0DE5C03BE
Service:

==== System Restore Points ===================

RP1: 23/10/2010 9:34:48 PM - System Checkpoint
RP2: 24/10/2010 12:53:28 PM - Removed Corel WordPerfect Office - iFilter.
RP3: 24/10/2010 12:54:44 PM - Removed Microsoft Office Outlook Connector
RP4: 24/10/2010 1:03:25 PM - Removed Microsoft Office Small Business Edition 2003
RP5: 24/10/2010 1:19:04 PM - Removed Microsoft Office Live Add-in 1.3
RP6: 24/10/2010 1:19:42 PM - Removed Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
RP7: 24/10/2010 1:22:12 PM - Removed Microsoft Visual C++ 2005 Redistributable
RP8: 24/10/2010 1:28:31 PM - Removed MSXML 4.0 SP2 (KB927978)
RP9: 24/10/2010 1:29:38 PM - Removed MSXML 4.0 SP2 (KB936181)
RP10: 24/10/2010 1:30:25 PM - Removed MSXML 4.0 SP2 (KB954430)
RP11: 24/10/2010 1:31:07 PM - Removed MSXML 4.0 SP2 (KB973688)
RP12: 24/10/2010 1:32:32 PM - Removed Windows Live Upload Tool
RP13: 24/10/2010 4:08:06 PM - avast! Pro Antivirus Setup
RP14: 26/10/2010 8:36:06 AM - Avg Update
RP15: 26/10/2010 4:56:48 PM - Removed AVG Free 9.0
RP16: 30/10/2010 8:31:38 AM - System Checkpoint

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Apple Mobile Device Support
Apple Software Update
ArcSoft Print Creations
ArcSoft Print Creations - Greeting Card
ArcSoft Print Creations - Photo Calendar
avast! Pro Antivirus
Compatibility Pack for the 2007 Office system
Conexant D850 56K V.9x DFVc Modem
Critical Update for Windows Media Player 11 (KB959772)
Dell Driver Reset Tool
Dell Support 3.2.1
Dell System Restore
Epson CreativeZone
Epson Event Manager
EPSON NX510 Series Printer Uninstall
EPSON Scan
Garmin Communicator Plugin
Google Toolbar for Internet Explorer
High Definition Audio Driver Package - KB835221
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel(R) Graphics Media Accelerator Driver
Intel(R) Matrix Storage Manager
Intel(R) PRO Network Connections
iTunes
J2SE Runtime Environment 5.0 Update 6
Java(TM) 6 Update 17
Java(TM) 6 Update 2
Junk Mail filter update
LimeWire 5.5.6
LoudMo Contextual Ad Assistant
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft LifeCam
Microsoft National Language Support Downlevel APIs
Microsoft Search Enhancement Pack
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Mozilla Firefox (3.6)
MSVCRT
Octoshape add-in for Adobe Flash Player
OpenMG Limited Patch 4.7-07-14-05-01
OpenMG Secure Module 4.7.00
OpenOffice.org 3.1
Popup Blocker (Windows Live Toolbar)
QuickTime
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
Sonic Activation Module
TBS WMP Plug-in
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
URL Assistant
WebFldrs XP
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

30/10/2010 8:14:09 AM, error: Dhcp [1002] - The IP address lease 10.100.2.2 for the Network Card with network address 001676DA3619 has been denied by the DHCP server 10.100.2.1 (The DHCP Server sent a DHCPNACK message).
27/10/2010 9:00:00 PM, error: Schedule [7901] - The At46.job command failed to start due to the following error: General access denied error
27/10/2010 9:00:00 PM, error: Schedule [7901] - The At22.job command failed to start due to the following error: General access denied error
26/10/2010 9:42:25 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\drivers\agp440.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.
26/10/2010 9:24:02 PM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 80603f43, parameter3 a8c82c20, parameter4 00000000.
26/10/2010 9:23:52 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file agp440.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.
26/10/2010 9:02:21 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
26/10/2010 9:00:33 PM, error: Service Control Manager [7034] - The System Restore Service service terminated unexpectedly. It has done this 1 time(s).
26/10/2010 9:00:33 PM, error: Service Control Manager [7034] - The Cryptographic Services service terminated unexpectedly. It has done this 1 time(s).
26/10/2010 9:00:33 PM, error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/10/2010 9:00:33 PM, error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
26/10/2010 9:00:33 PM, error: Service Control Manager [7031] - The Help and Support service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
26/10/2010 9:00:33 PM, error: Service Control Manager [7031] - The Help and Support service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
26/10/2010 9:00:33 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD ASPI32 aswSnx aswSP aswTdi Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
26/10/2010 9:00:33 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
26/10/2010 9:00:33 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
26/10/2010 9:00:33 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
26/10/2010 9:00:33 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
26/10/2010 9:00:33 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
26/10/2010 9:00:00 AM, error: Schedule [7901] - The At34.job command failed to start due to the following error: General access denied error
26/10/2010 9:00:00 AM, error: Schedule [7901] - The At10.job command failed to start due to the following error: General access denied error
26/10/2010 8:57:34 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
26/10/2010 8:56:44 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
26/10/2010 8:56:36 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
26/10/2010 8:00:00 PM, error: Schedule [7901] - The At45.job command failed to start due to the following error: General access denied error
26/10/2010 8:00:00 PM, error: Schedule [7901] - The At21.job command failed to start due to the following error: General access denied error
26/10/2010 8:00:00 AM, error: Schedule [7901] - The At9.job command failed to start due to the following error: General access denied error
26/10/2010 8:00:00 AM, error: Schedule [7901] - The At33.job command failed to start due to the following error: General access denied error
26/10/2010 7:00:00 PM, error: Schedule [7901] - The At44.job command failed to start due to the following error: General access denied error
26/10/2010 7:00:00 PM, error: Schedule [7901] - The At20.job command failed to start due to the following error: General access denied error
26/10/2010 7:00:00 AM, error: Schedule [7901] - The At8.job command failed to start due to the following error: General access denied error
26/10/2010 7:00:00 AM, error: Schedule [7901] - The At32.job command failed to start due to the following error: General access denied error
26/10/2010 6:00:00 PM, error: Schedule [7901] - The At43.job command failed to start due to the following error: General access denied error
26/10/2010 6:00:00 PM, error: Schedule [7901] - The At19.job command failed to start due to the following error: General access denied error
26/10/2010 6:00:00 AM, error: Schedule [7901] - The At7.job command failed to start due to the following error: General access denied error
26/10/2010 6:00:00 AM, error: Schedule [7901] - The At31.job command failed to start due to the following error: General access denied error
26/10/2010 5:03:55 PM, error: Service Control Manager [7023] - The ldrsvc service terminated with the following error: The specified module could not be found.
26/10/2010 5:03:55 PM, error: Service Control Manager [7023] - The IPSEC Services service terminated with the following error: The requested service provider could not be loaded or initialized.
26/10/2010 5:00:00 PM, error: Schedule [7901] - The At42.job command failed to start due to the following error: General access denied error
26/10/2010 5:00:00 PM, error: Schedule [7901] - The At18.job command failed to start due to the following error: General access denied error
26/10/2010 5:00:00 AM, error: Schedule [7901] - The At6.job command failed to start due to the following error: General access denied error
26/10/2010 5:00:00 AM, error: Schedule [7901] - The At30.job command failed to start due to the following error: General access denied error
26/10/2010 4:51:19 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.MFC. Reference error message: The referenced assembly is not installed on your system. .
26/10/2010 4:51:19 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\AVG\AVG9\avgui.exe. Reference error message: The operation completed successfully. .
26/10/2010 4:51:18 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.MFC could not be found and Last Error was The referenced assembly is not installed on your system.
26/10/2010 4:00:00 PM, error: Schedule [7901] - The At41.job command failed to start due to the following error: General access denied error
26/10/2010 4:00:00 PM, error: Schedule [7901] - The At17.job command failed to start due to the following error: General access denied error
26/10/2010 4:00:00 AM, error: Schedule [7901] - The At5.job command failed to start due to the following error: General access denied error
26/10/2010 4:00:00 AM, error: Schedule [7901] - The At29.job command failed to start due to the following error: General access denied error
26/10/2010 3:00:00 PM, error: Schedule [7901] - The At40.job command failed to start due to the following error: General access denied error
26/10/2010 3:00:00 PM, error: Schedule [7901] - The At16.job command failed to start due to the following error: General access denied error
26/10/2010 3:00:00 AM, error: Schedule [7901] - The At4.job command failed to start due to the following error: General access denied error
26/10/2010 3:00:00 AM, error: Schedule [7901] - The At28.job command failed to start due to the following error: General access denied error
26/10/2010 2:00:00 PM, error: Schedule [7901] - The At39.job command failed to start due to the following error: General access denied error
26/10/2010 2:00:00 PM, error: Schedule [7901] - The At15.job command failed to start due to the following error: General access denied error
26/10/2010 2:00:00 AM, error: Schedule [7901] - The At3.job command failed to start due to the following error: General access denied error
26/10/2010 2:00:00 AM, error: Schedule [7901] - The At27.job command failed to start due to the following error: General access denied error
26/10/2010 12:29:00 AM, error: Schedule [7901] - The At25.job command failed to start due to the following error: General access denied error
26/10/2010 12:00:01 PM, error: Schedule [7901] - The At37.job command failed to start due to the following error: General access denied error
26/10/2010 12:00:00 PM, error: Schedule [7901] - The At13.job command failed to start due to the following error: General access denied error
26/10/2010 11:00:00 PM, error: Schedule [7901] - The At48.job command failed to start due to the following error: General access denied error
26/10/2010 11:00:00 PM, error: Schedule [7901] - The At24.job command failed to start due to the following error: General access denied error
26/10/2010 11:00:00 AM, error: Schedule [7901] - The At36.job command failed to start due to the following error: General access denied error
26/10/2010 11:00:00 AM, error: Schedule [7901] - The At12.job command failed to start due to the following error: General access denied error
26/10/2010 10:00:01 PM, error: Schedule [7901] - The At47.job command failed to start due to the following error: General access denied error
26/10/2010 10:00:01 PM, error: Schedule [7901] - The At23.job command failed to start due to the following error: General access denied error
26/10/2010 10:00:00 AM, error: Schedule [7901] - The At35.job command failed to start due to the following error: General access denied error
26/10/2010 10:00:00 AM, error: Schedule [7901] - The At11.job command failed to start due to the following error: General access denied error
26/10/2010 1:00:00 PM, error: Schedule [7901] - The At38.job command failed to start due to the following error: General access denied error
26/10/2010 1:00:00 PM, error: Schedule [7901] - The At14.job command failed to start due to the following error: General access denied error
26/10/2010 1:00:00 AM, error: Schedule [7901] - The At26.job command failed to start due to the following error: General access denied error
26/10/2010 1:00:00 AM, error: Schedule [7901] - The At2.job command failed to start due to the following error: General access denied error
01/11/2010 1:50:19 PM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 80603f43, parameter3 a76c6c20, parameter4 00000000.

==== End Of File ===========================


----------



## CatByte (Feb 24, 2009)

hi,

i still need the DDS Log, that is the Attach.txt

sorry

thanks


----------



## Chelsea-Buns (Oct 28, 2010)

Sorry where do I get the Attach.txt from?


----------



## Chelsea-Buns (Oct 28, 2010)

I think I know what is missing, how do I disable the scripts?


----------



## CatByte (Feb 24, 2009)

You have provided the attach.txt twice
I need the actual DDS log

When DDS runs it produces two logs a DDS log and an Attach.txt, please post the DDS LOG

scripts are disabled when you disable your AV, that is not what is interfering as an Attach.txt is being produced, so a DDS Log, must be produced also.

Thanks


----------



## Chelsea-Buns (Oct 28, 2010)

I don't know where it is, I must be computer illiterate


----------



## CatByte (Feb 24, 2009)

Those are the same log.

I don't know why you ar not getting a DDS log.

DDS runs and produces two logs, they both open, one is called DDS Log, the other is called Attach.txt

Never mind that scanner

try this one

Download *OTL* to your Desktop 

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. 
Click on *Minimal Output *at the top 
Download *scan.txt *and save it to your *Desktop.* You may need to right click on it and select *"Save"* 
Double click inside the *Custom Scan box *at the bottom 
A window will appear saying *"Click Ok to load a custom scan from a file or Cancel to cancel"* 
Click the Ok button and navigate to the file *scan.txt *which we just saved to your desktop 
Select *scan.txt *and click Open. Writing will now appear under the Custom Scan box 
Click the *Quick Scan *button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. *OTL.Txt *and *Extras.Txt*. These are saved in the same location as OTL. 
Please copy *(Edit->Select All, Edit->Copy)* the contents of these files, one at a time and post them in your topic


----------



## Chelsea-Buns (Oct 28, 2010)

I'm trying to find the DDS LOG, I may have accidentally deleted it or not saved it where I can find it. I tried to re-run DDS to have a new dds log but it wont re-run?


----------



## Chelsea-Buns (Oct 28, 2010)

ok its scanning, sorry about the other one, I did it this morning, and I must not have saved the dds log properly. My bf is here now and can make sure this is being done right on my end. He took IT and Computer Science in University, so he can help me along


----------



## Chelsea-Buns (Oct 28, 2010)

OTL logfile created on: 02/11/2010 8:56:24 PM - Run 1
OTL by OldTimer - Version 3.2.17.2 Folder = C:\Documents and Settings\chysa strickland\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

502.00 Mb Total Physical Memory | 69.00 Mb Available Physical Memory | 14.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 31.22 Gb Free Space | 43.69% Space Free | Partition Type: NTFS
Unable to calculate disk information.

Computer Name: DCWDN4C1 | User Name: chysa strickland | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\chysa strickland\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\chysa strickland\Application Data\Microsoft\svchost.exe ()
PRC - C:\Documents and Settings\chysa strickland\Local Settings\Temp\dwm.exe ()
PRC - C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe ()
PRC - C:\Program Files\Alwil Software\Avast5\Setup\avast.setup (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Microsoft LifeCam\MSCamSvc.exe (Microsoft Corporation)
PRC - C:\WINDOWS\vVX1000.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\chysa strickland\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxPlugins.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\WMVCore.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll (Microsoft Corporation)
MOD - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll (Sun Microsystems, Inc.)
MOD - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\stlport_vc7145.dll (STLport Consulting, Inc.)
MOD - C:\WINDOWS\system32\winsta.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\sti.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\shgina.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\odbc32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\netui1.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\netui0.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\ntlanman.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\netrap.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvbvm60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msgina.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dinput.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\drprov.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\davclnt.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\odbcint.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\wmasf.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\PortableDeviceApi.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\serwvdrv.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\umdmxfrm.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (ldrsvc) -- C:\DOCUME~1\CHYSAS~1\LOCALS~1\Temp\clean_74842.dll File not found
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (ACDaemon) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe ()
SRV - (IAANTMON) Intel(R) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (MSCamSvc) -- C:\Program Files\Microsoft LifeCam\MSCamSvc.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (Xek85) -- C:\WINDOWS\System32\drivers\Xek85.sys File not found
DRV - (Xej62) -- C:\WINDOWS\System32\drivers\Xej62.sys File not found
DRV - (Wdi40) -- C:\WINDOWS\System32\drivers\Wdi40.sys File not found
DRV - (Wdi27) -- C:\WINDOWS\System32\drivers\Wdi27.sys File not found
DRV - (Vci30) -- C:\WINDOWS\System32\drivers\Vci30.sys File not found
DRV - (Vch62) -- C:\WINDOWS\System32\drivers\Vch62.sys File not found
DRV - (USB2_04) -- C:\WINDOWS\System32\drivers\nkv2.sys File not found
DRV - (Ubg84) -- C:\WINDOWS\System32\drivers\Ubg84.sys File not found
DRV - (Tag74) -- C:\WINDOWS\System32\drivers\Tag74.sys File not found
DRV - (Tag30) -- C:\WINDOWS\System32\drivers\Tag30.sys File not found
DRV - (Sag41) -- C:\WINDOWS\System32\drivers\Sag41.sys File not found
DRV - (restore) -- C:\WINDOWS\System32\drivers\restore.sys File not found
DRV - (Qwd28) -- C:\WINDOWS\System32\drivers\Qwd28.sys File not found
DRV - (Pvc74) -- C:\WINDOWS\System32\drivers\Pvc74.sys File not found
DRV - (Pvc28) -- C:\WINDOWS\System32\drivers\Pvc28.sys File not found
DRV - (Pvb05) -- C:\WINDOWS\System32\drivers\Pvb05.sys File not found
DRV - (Oua16) -- C:\WINDOWS\System32\drivers\Oua16.sys File not found
DRV - (Nty51) -- C:\WINDOWS\System32\drivers\Nty51.sys File not found
DRV - (Kqw41) -- C:\WINDOWS\System32\drivers\Kqw41.sys File not found
DRV - (Kqv27) -- C:\WINDOWS\System32\drivers\Kqv27.sys File not found
DRV - (Hnt17) -- C:\WINDOWS\System32\drivers\Hnt17.sys File not found
DRV - (Hns27) -- C:\WINDOWS\System32\drivers\Hns27.sys File not found
DRV - (Gms85) -- C:\WINDOWS\System32\drivers\Gms85.sys File not found
DRV - (Flq27) -- C:\WINDOWS\System32\drivers\Flq27.sys File not found
DRV - (Cin05) -- C:\WINDOWS\System32\drivers\Cin05.sys File not found
DRV - (ati7rwxx) -- C:\WINDOWS\System32\Drivers\ati7rwxx.sys File not found
DRV - (aswSnx) -- C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (Pvc41) -- C:\WINDOWS\system32\drivers\Pvc41.sys ()
DRV - (Jpv28) -- C:\WINDOWS\system32\drivers\Jpv28.sys ()
DRV - (usbaudio) USB Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (npf) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (e1express) Intel(R) -- C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (iaStor) -- C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (VX1000) -- C:\WINDOWS\system32\drivers\VX1000.sys (Microsoft Corporation)
DRV - (DSproct) -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys (GTek Technologies Ltd.)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (HSFHWBS2) -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (ASPI32) -- C:\WINDOWS\System32\drivers\Aspi32.sys (Adaptec)
DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370

========== FireFox ==========

FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50370
FF - prefs.js..network.proxy.type: 1

FF - HKLM\software\mozilla\Firefox\Extensions\\{191d3f14-ff4c-4895-bdea-db54526cb49a}: C:\Program Files\Adobe\Flash [2010/10/28 16:31:49 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{684EEE60-404C-40D2-8E90-DF22A568A0AB}: C:\Documents and Settings\chysa strickland\Local Settings\Application Data\{684EEE60-404C-40D2-8E90-DF22A568A0AB} [2009/10/28 21:55:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{B263A98A-C290-460A-B8F1-1C3405E865F1}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{B263A98A-C290-460A-B8F1-1C3405E865F1}\ [2009/10/29 07:13:11 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{9C82F334-8236-4180-B136-8A10B8571B6A}: C:\Documents and Settings\chysa strickland\Local Settings\Application Data\{9C82F334-8236-4180-B136-8A10B8571B6A} [2009/10/29 09:03:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{9B52B5AA-6616-42CD-9208-25F6E1C3B4C6}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{9B52B5AA-6616-42CD-9208-25F6E1C3B4C6}\ [2009/10/29 16:05:52 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{16DD6999-7DE2-4C5C-AA72-900FC0246FC9}: C:\Documents and Settings\chysa strickland\Local Settings\Application Data\{16DD6999-7DE2-4C5C-AA72-900FC0246FC9} [2009/10/29 19:11:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{CD312C35-B986-409F-8443-95827FAEB5A1}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{CD312C35-B986-409F-8443-95827FAEB5A1}\ [2009/10/31 07:56:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{C253B108-8C8B-48BB-971C-D62A33EA1A12}: C:\Documents and Settings\chysa strickland\Local Settings\Application Data\{C253B108-8C8B-48BB-971C-D62A33EA1A12} [2009/10/31 07:57:49 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{F70BED0B-AE4E-493E-A935-C0EADCA623ED}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{F70BED0B-AE4E-493E-A935-C0EADCA623ED}\ [2009/11/15 08:52:14 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/16 16:09:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/24 13:04:17 | 000,000,000 | ---D | M]

[2010/06/09 07:11:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Extensions
[2010/06/09 07:11:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Extensions\[email protected]
[2010/03/19 11:20:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Extensions\[email protected]
[2010/11/02 14:15:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions
[2010/02/19 07:24:34 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2009/09/01 23:00:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/10 11:21:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions\[email protected]
[2010/03/19 11:28:25 | 000,002,425 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\searchplugins\askcom.xml
[2007/11/12 18:48:12 | 000,002,031 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\searchplugins\facebook.xml
[2010/05/18 11:17:19 | 000,000,266 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\searchplugins\Search.xml
[2009/11/26 11:07:48 | 000,001,109 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\searchplugins\wowd-search.xml
[2010/11/02 14:15:50 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/05/18 11:18:09 | 000,000,000 | ---D | M] (LoudMo Contextual Ad Assistant) -- C:\Program Files\Mozilla Firefox\extensions\{c8bc1e13-0ec6-b761-a012-6980fdf27009}
[2008/09/11 19:44:05 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll

O1 HOSTS File: ([2010/02/14 09:01:43 | 000,349,922 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 163ns.com
O1 - Hosts: 127.0.0.1 www.163ns.com
O1 - Hosts: 11999 more lines...
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {12F77837-9CD4-B656-F349-EF2B5D978F9F} - C:\WINDOWS\System32\astqh.dll File not found
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (no name) - {401D1DD6-A46A-8CE5-1A66-FB8DBB238FCD} - C:\WINDOWS\System32\aso.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {6CFEF4BC-425A-3DDB-7A71-3CB60B49F1CD} - C:\WINDOWS\System32\yhmn.dll File not found
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (no name) - {79b3d672-a45a-6619-f0fb-4401342c4414} - C:\WINDOWS\iyeqanal.dll File not found
O2 - BHO: (Microsoft copyright) - {971D5B7B-F7DF-43ee-B771-6B7FA09975C3} - File not found
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll File not found
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll File not found
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (no name) - {CBE0AE25-13C9-6D4B-B929-4F761B3A00C6} - C:\WINDOWS\System32\bugwwtmu.dll File not found
O2 - BHO: (no name) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - No CLSID value found.
O2 - BHO: (flvpronetwork) - {da127091-7c9b-a25d-76b0-e0ace143d5e7} - C:\WINDOWS\System32\FOPYs--Ns_2_w.dll File not found
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll File not found
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll File not found
O4 - HKLM..\Run: [86034324] C:\DOCUME~1\ALLUSE~1\APPLIC~1\86034324\86034324.exe File not found
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Internet Connection Wizard Setup Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe File not found
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Regedit32] C:\WINDOWS\System32\regedit.exe File not found
O4 - HKLM..\Run: [svchost] C:\Documents and Settings\chysa strickland\Application Data\Microsoft\svchost.exe ()
O4 - HKLM..\Run: [VX1000] C:\WINDOWS\vVX1000.exe (Microsoft Corporation)
O4 - HKCU..\Run: [b37pvvurwoko] File not found
O4 - HKCU..\Run: [EPSON NX510 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFIA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [IJKUK66HMN] C:\DOCUME~1\CHYSAS~1\LOCALS~1\Temp\Rdr.exe File not found
O4 - HKCU..\Run: [Music System] C:\Users\Public\Favorites\csrss.exe (Microsoft Corporation)
F3 - HKCU WinNT: Load - (C:\DOCUME~1\CHYSAS~1\LOCALS~1\Temp\dwm.exe) - C:\Documents and Settings\chysa strickland\Local Settings\Temp\dwm.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\chysa strickland\Start Menu\Programs\IMVU\Run IMVU.lnk File not found
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.)
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} http://www.worldwinner.com/games/v50/tpir/tpir.cab (TPIR Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} http://www.worldwinner.com/games/v51/bejeweled/bejeweled.cab (Bejeweled Control)
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} http://zone.msn.com/bingame/dsh2/default/DinerDash2.1.0.0.68.cab (CPlayFirstDinerDash2Control Object)
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} http://sympatico.zone.msn.com/bingame/amad/default/atomaders.cab (AtlAtomadersCtlAttrib Class)
O16 - DPF: {7AA32FC7-133B-4AE7-998E-CED0D9829B12} http://axcab.wrs.mcboo.com/website.cab (luna Class)
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} http://zone.msn.com/bingame/chnz/default/mjolauncher.cab (MJLauncherCtrl Class)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {95A311CD-EC8E-452A-BCEC-B844EB616D03} http://www.worldwinner.com/games/v51/bejeweledtwist/bejeweledtwist.cab (BejeweledTwist Control)
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} http://www.worldwinner.com/games/v57/wof/wof.cab (WoF Control)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} http://zone.msn.com/bingame/fotg/default/ddfotg.1.0.0.37.cab (CPlayFirstddfotgControl Object)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/popcaploader_v10.cab (PopCapLoader Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.100.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.164.124,93.188.160.204
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll File not found
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe) - C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe ()
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\pmnonki: DllName - pmnonki.dll - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\chysa strickland\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\chysa strickland\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {E271F4E9-D46E-4C7A-8608-AFDD4A87E582} - C:\WINDOWS\System32\pmnonki.dll File not found
O29 - HKLM SecurityProviders - (msnsspc.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{1cc6e62a-e3ef-11dd-8b7b-001676da3619}\Shell\Setup\command - "" = C:\WINDOWS\System32\setup.exe -- [2008/04/13 20:12:34 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{524b724f-9ad2-11dd-8b3b-001676da3619}\Shell\Setup\command - "" = C:\WINDOWS\System32\setup.exe -- [2008/04/13 20:12:34 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{64ece5dd-2c66-11df-a096-001676da3619}\Shell\Setup\command - "" = C:\WINDOWS\System32\setup.exe -- [2008/04/13 20:12:34 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{f7ca953a-41db-11dd-8aff-001676da3619}\Shell\Setup\command - "" = C:\WINDOWS\System32\setup.exe -- [2008/04/13 20:12:34 | 000,023,040 | ---- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: ldrsvc - C:\DOCUME~1\CHYSAS~1\LOCALS~1\Temp\clean_74842.dll File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk - C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk - C:\PROGRA~1\DIGITA~1\DLG.exe - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe - (Lime Wire, LLC)
MsConfig - StartUpFolder: C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^Music System.exe - C:\Documents and Settings\chysa strickland\Start Menu\Programs\Startup\Music System.exe - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig - StartUpReg: *AntiVirus 2010* - hkey= - key= - C:\Documents and Settings\chysa strickland\Application Data\AntiVirus 2010\AntiVirus_Studio_2010.exe File not found
MsConfig - StartUpReg: *AVG7_CC* - hkey= - key= - C:\PROGRA~1\Grisoft\AVG7\avgcc.exe File not found
MsConfig - StartUpReg: *BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}* - hkey= - key= - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe File not found
MsConfig - StartUpReg: *ctfmon.exe* - hkey= - key= - File not found
MsConfig - StartUpReg: *DellSupport* - hkey= - key= - C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
MsConfig - StartUpReg: *HotKeysCmds* - hkey= - key= - File not found
MsConfig - StartUpReg: *IAAnotif* - hkey= - key= - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
MsConfig - StartUpReg: *IgfxTray* - hkey= - key= - File not found
MsConfig - StartUpReg: *ISUSPM Startup* - hkey= - key= - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
MsConfig - StartUpReg: *ISUSScheduler* - hkey= - key= - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
MsConfig - StartUpReg: *iTunesHelper* - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: *LifeCam* - hkey= - key= - C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
MsConfig - StartUpReg: *MSKDetectorExe* - hkey= - key= - C:\Program Files\McAfee\SpamKiller\MSKDetct.exe (McAfee, Inc.)
MsConfig - StartUpReg: *MSMSGS* - hkey= - key= - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: *MsnMsgr* - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig - StartUpReg: *Ohe* - hkey= - key= - C:\Documents and Settings\chysa strickland\My Documents\S?mantec\r?gsvr32.exe File not found
MsConfig - StartUpReg: *Persistence* - hkey= - key= - File not found
MsConfig - StartUpReg: *Sacbyo* - hkey= - key= - C:\Program Files\?ppPatch\?hkntfs.exe File not found
MsConfig - StartUpReg: *SigmatelSysTrayApp* - hkey= - key= - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
MsConfig - StartUpReg: *Smeuy* - hkey= - key= - C:\Documents and Settings\chysa strickland\My Documents\?ssembly\m?iexec.exe File not found
MsConfig - StartUpReg: *SpybotSD TeaTimer* - hkey= - key= - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe File not found
MsConfig - StartUpReg: *SunJavaUpdateSched* - hkey= - key= - C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: *Syizehokonipuco* - hkey= - key= - C:\WINDOWS\iyeqanal.DLL File not found
MsConfig - StartUpReg: *VX1000* - hkey= - key= - C:\WINDOWS\vVX1000.exe (Microsoft Corporation)
MsConfig - StartUpReg: *WinPop* - hkey= - key= - C:\Program Files\WinPop\winpop.exe File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: ati1otxx.sys - C:\WINDOWS\System32\Drivers\ati1otxx.sys File not found
SafeBootMin: ati2fkxx.sys - C:\WINDOWS\System32\Drivers\ati2fkxx.sys File not found
SafeBootMin: ati7rwxx.sys - C:\WINDOWS\System32\Drivers\ati7rwxx.sys File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: Cin05.sys - C:\WINDOWS\System32\drivers\Cin05.sys File not found
SafeBootMin: ctl_w32.sys - C:\WINDOWS\system32\drivers\ctl_w32.sys ()
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: Flq27.sys - C:\WINDOWS\System32\drivers\Flq27.sys File not found
SafeBootMin: Gms85.sys - C:\WINDOWS\System32\drivers\Gms85.sys File not found
SafeBootMin: Hns27.sys - C:\WINDOWS\System32\drivers\Hns27.sys File not found
SafeBootMin: Hnt17.sys - C:\WINDOWS\System32\drivers\Hnt17.sys File not found
SafeBootMin: Kqv27.sys - C:\WINDOWS\System32\drivers\Kqv27.sys File not found
SafeBootMin: Kqw41.sys - C:\WINDOWS\System32\drivers\Kqw41.sys File not found
SafeBootMin: Nty51.sys - C:\WINDOWS\System32\drivers\Nty51.sys File not found
SafeBootMin: Oua16.sys - C:\WINDOWS\System32\drivers\Oua16.sys File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: Pvb05.sys - C:\WINDOWS\System32\drivers\Pvb05.sys File not found
SafeBootMin: Pvc28.sys - C:\WINDOWS\System32\drivers\Pvc28.sys File not found
SafeBootMin: Pvc74.sys - C:\WINDOWS\System32\drivers\Pvc74.sys File not found
SafeBootMin: Qwd28.sys - C:\WINDOWS\System32\drivers\Qwd28.sys File not found
SafeBootMin: Sag41.sys - C:\WINDOWS\System32\drivers\Sag41.sys File not found
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: Tag30.sys - C:\WINDOWS\System32\drivers\Tag30.sys File not found
SafeBootMin: Ubg84.sys - C:\WINDOWS\System32\drivers\Ubg84.sys File not found
SafeBootMin: Vch62.sys - C:\WINDOWS\System32\drivers\Vch62.sys File not found
SafeBootMin: Vci30.sys - C:\WINDOWS\System32\drivers\Vci30.sys File not found
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: Wdi27.sys - C:\WINDOWS\System32\drivers\Wdi27.sys File not found
SafeBootMin: Wdi40.sys - C:\WINDOWS\System32\drivers\Wdi40.sys File not found
SafeBootMin: Xej62.sys - C:\WINDOWS\System32\drivers\Xej62.sys File not found
SafeBootMin: Xek85.sys - C:\WINDOWS\System32\drivers\Xek85.sys File not found
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: ati1otxx.sys - C:\WINDOWS\System32\Drivers\ati1otxx.sys File not found
SafeBootNet: ati2fkxx.sys - C:\WINDOWS\System32\Drivers\ati2fkxx.sys File not found
SafeBootNet: ati7rwxx.sys - C:\WINDOWS\System32\Drivers\ati7rwxx.sys File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: Cin05.sys - C:\WINDOWS\System32\drivers\Cin05.sys File not found
SafeBootNet: ctl_w32.sys - C:\WINDOWS\system32\drivers\ctl_w32.sys ()
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Flq27.sys - C:\WINDOWS\System32\drivers\Flq27.sys File not found
SafeBootNet: Gms85.sys - C:\WINDOWS\System32\drivers\Gms85.sys File not found
SafeBootNet: Hns27.sys - C:\WINDOWS\System32\drivers\Hns27.sys File not found
SafeBootNet: Hnt17.sys - C:\WINDOWS\System32\drivers\Hnt17.sys File not found
SafeBootNet: Kqv27.sys - C:\WINDOWS\System32\drivers\Kqv27.sys File not found
SafeBootNet: Kqw41.sys - C:\WINDOWS\System32\drivers\Kqw41.sys File not found
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: Nty51.sys - C:\WINDOWS\System32\drivers\Nty51.sys File not found
SafeBootNet: Oua16.sys - C:\WINDOWS\System32\drivers\Oua16.sys File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: Pvb05.sys - C:\WINDOWS\System32\drivers\Pvb05.sys File not found
SafeBootNet: Pvc28.sys - C:\WINDOWS\System32\drivers\Pvc28.sys File not found
SafeBootNet: Pvc74.sys - C:\WINDOWS\System32\drivers\Pvc74.sys File not found
SafeBootNet: Qwd28.sys - C:\WINDOWS\System32\drivers\Qwd28.sys File not found
SafeBootNet: Sag41.sys - C:\WINDOWS\System32\drivers\Sag41.sys File not found
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: Tag30.sys - C:\WINDOWS\System32\drivers\Tag30.sys File not found
SafeBootNet: TDI - Driver Group
SafeBootNet: Ubg84.sys - C:\WINDOWS\System32\drivers\Ubg84.sys File not found
SafeBootNet: Vch62.sys - C:\WINDOWS\System32\drivers\Vch62.sys File not found
SafeBootNet: Vci30.sys - C:\WINDOWS\System32\drivers\Vci30.sys File not found
SafeBootNet: vga.sys - Driver
SafeBootNet: Wdi27.sys - C:\WINDOWS\System32\drivers\Wdi27.sys File not found
SafeBootNet: Wdi40.sys - C:\WINDOWS\System32\drivers\Wdi40.sys File not found
SafeBootNet: Xej62.sys - C:\WINDOWS\System32\drivers\Xej62.sys File not found
SafeBootNet: Xek85.sys - C:\WINDOWS\System32\drivers\Xek85.sys File not found
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5CA109D3-A084-47E8-A9CB-D497322E3F50} - MSN Toolbar 3.0 & Silverlight 2.0
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {BCA4BCBE-EB6E-406B-B990-3BEBF3024B3B} - rundll32.exe "C:\Documents and Settings\chysa strickland\Application Data\Bitrix Security\tuduewai.dll", DllUnrer
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{7843d7aa-576a-4136-9766-8325ddce8fb1} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (86989378554953728)

========== Files/Folders - Created Within 30 Days ==========

[2010/11/02 20:53:07 | 000,576,000 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\OTL.exe
[2010/10/28 07:50:44 | 000,000,000 | ---D | C] -- C:\Program Files\Emsisoft Anti-Malware
[2010/10/28 07:50:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\My Documents\Anti-Malware
[2010/10/28 07:33:37 | 000,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2010/10/24 16:09:15 | 000,165,584 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/10/24 16:09:15 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/10/24 16:09:14 | 000,340,048 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2010/10/24 16:09:14 | 000,046,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/10/24 16:09:14 | 000,023,376 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/10/24 16:09:13 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/10/24 16:09:13 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/10/24 16:09:13 | 000,028,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/10/24 16:08:28 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2010/10/24 16:08:25 | 000,167,592 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/10/24 16:08:07 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/10/24 16:08:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/10/24 15:40:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/10/23 13:37:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\Application Data\Bitrix Security
[2010/10/23 13:37:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\Application Data\AntiVirus 2010
[2010/10/17 20:53:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\Application Data\OpenOffice.org
[2010/10/17 20:12:10 | 000,000,000 | ---D | C] -- C:\Program Files\JRE
[2010/10/17 20:10:27 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2010/10/17 19:47:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\Application Data\alot
[2010/10/11 17:26:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\My Documents\HTML
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/19 16:59:16 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/07/19 16:59:16 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/11/02 21:07:02 | 000,000,414 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{A4CD5A22-7976-457E-987E-FE09DCEF65B6}.job
[2010/11/02 21:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At46.job
[2010/11/02 21:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At22.job
[2010/11/02 20:53:08 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\OTL.exe
[2010/11/02 20:51:00 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/11/02 20:37:06 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010/11/02 20:34:03 | 000,623,616 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Desktop\dds(2).scr
[2010/11/02 20:12:00 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/11/02 20:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At45.job
[2010/11/02 20:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At21.job
[2010/11/02 19:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At44.job
[2010/11/02 19:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At20.job
[2010/11/02 18:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At43.job
[2010/11/02 18:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At19.job
[2010/11/02 17:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At42.job
[2010/11/02 17:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At18.job
[2010/11/02 16:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At41.job
[2010/11/02 16:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At17.job
[2010/11/02 15:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At40.job
[2010/11/02 15:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At16.job
[2010/11/02 14:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At39.job
[2010/11/02 14:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At15.job
[2010/11/02 13:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At38.job
[2010/11/02 13:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At14.job
[2010/11/02 12:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At37.job
[2010/11/02 12:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At13.job
[2010/11/02 11:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At36.job
[2010/11/02 11:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At12.job
[2010/11/02 10:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At35.job
[2010/11/02 10:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At11.job
[2010/11/02 09:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At34.job
[2010/11/02 09:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At10.job
[2010/11/02 08:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At9.job
[2010/11/02 08:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At33.job
[2010/11/02 07:47:23 | 000,286,404 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Desktop\gmer(2).zip
[2010/11/02 07:37:33 | 000,286,404 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Desktop\gmer.zip
[2010/11/02 07:22:59 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/02 07:22:34 | 000,000,332 | -HS- | M] () -- C:\WINDOWS\tasks\MWOTKB.job
[2010/11/02 07:21:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/02 07:21:37 | 526,295,040 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/02 07:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At8.job
[2010/11/02 07:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At32.job
[2010/11/02 06:55:54 | 000,623,616 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Desktop\dds.scr
[2010/11/02 06:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At7.job
[2010/11/02 06:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At31.job
[2010/11/02 05:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At6.job
[2010/11/02 05:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At30.job
[2010/11/02 04:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At5.job
[2010/11/02 04:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At29.job
[2010/11/02 03:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At4.job
[2010/11/02 03:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At28.job
[2010/11/02 02:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At3.job
[2010/11/02 02:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At27.job
[2010/11/02 01:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At26.job
[2010/11/02 01:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At2.job
[2010/11/02 00:29:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At25.job
[2010/11/01 23:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At48.job
[2010/11/01 23:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At24.job
[2010/11/01 22:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At47.job
[2010/11/01 22:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\At23.job
[2010/10/31 02:03:00 | 000,000,446 | ---- | M] () -- C:\WINDOWS\tasks\Driver Robot.job
[2010/10/27 08:20:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/24 16:09:16 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Pro Antivirus.lnk
[2010/10/24 16:09:14 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/10/24 13:58:57 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/24 13:49:11 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2010/10/24 13:38:39 | 000,309,192 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/23 18:55:38 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Local Settings\Application Data\prvlcl.dat
[2010/10/23 18:46:10 | 000,054,784 | RHS- | M] () -- C:\WINDOWS\System32\nddeapir0.dll
[2010/10/23 13:37:35 | 000,001,908 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus 2010.lnk
[2010/10/21 21:55:04 | 000,098,304 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/18 09:48:47 | 000,014,022 | ---- | M] () -- C:\Documents and Settings\chysa strickland\My Documents\Module 1 Unit 3 Chemical Elements Assignment.ods
[2010/10/17 20:16:31 | 000,000,905 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\OpenOffice.org 3.1.lnk
[2010/10/17 03:12:43 | 000,000,593 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/10/17 03:08:22 | 000,000,705 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI
[2010/10/15 18:36:01 | 000,000,535 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2010/10/15 18:30:46 | 000,002,516 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2010/10/15 18:30:19 | 000,000,088 | RHS- | M] () -- C:\Documents and Settings\All Users\Application Data\7C708295CE.sys
[2010/10/11 17:47:41 | 002,949,215 | ---- | M] () -- C:\Documents and Settings\chysa strickland\My Documents\calista elephant project.wpd
[2010/10/10 03:06:52 | 000,442,466 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/10/10 03:06:52 | 000,071,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/02 20:34:13 | 000,623,616 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Desktop\dds(2).scr
[2010/11/02 07:47:25 | 000,286,404 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Desktop\gmer(2).zip
[2010/11/02 07:37:42 | 000,286,404 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Desktop\gmer.zip
[2010/11/02 06:55:58 | 000,623,616 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Desktop\dds.scr
[2010/10/26 21:07:32 | 526,295,040 | -HS- | C] () -- C:\hiberfil.sys
[2010/10/24 16:09:16 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Pro Antivirus.lnk
[2010/10/24 13:58:57 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/23 18:48:00 | 000,000,310 | -H-- | C] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010/10/23 18:46:11 | 000,000,332 | -HS- | C] () -- C:\WINDOWS\tasks\MWOTKB.job
[2010/10/23 18:46:09 | 000,054,784 | RHS- | C] () -- C:\WINDOWS\System32\nddeapir0.dll
[2010/10/23 18:45:48 | 000,000,310 | -H-- | C] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/10/23 18:45:35 | 000,000,310 | -H-- | C] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/10/23 13:37:35 | 000,001,908 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus 2010.lnk
[2010/10/17 21:11:29 | 000,014,022 | ---- | C] () -- C:\Documents and Settings\chysa strickland\My Documents\Module 1 Unit 3 Chemical Elements Assignment.ods
[2010/10/17 20:16:31 | 000,000,905 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\OpenOffice.org 3.1.lnk
[2010/10/10 20:04:20 | 002,949,215 | ---- | C] () -- C:\Documents and Settings\chysa strickland\My Documents\calista elephant project.wpd
[2010/09/14 18:25:42 | 000,000,088 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\7C708295CE.sys
[2010/09/14 18:25:33 | 000,002,516 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2010/03/15 11:18:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\EEventManager.INI
[2010/02/06 20:29:10 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2010/02/06 20:22:33 | 000,000,079 | ---- | C] () -- C:\WINDOWS\EPNX510.ini
[2009/11/05 09:10:18 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Local Settings\Application Data\prvlcl.dat
[2009/10/28 21:50:13 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Application Data\wiaserva.log
[2008/06/03 14:21:21 | 000,000,022 | ---- | C] () -- C:\WINDOWS\iexplore.ini
[2008/04/23 05:52:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\Pvc41.sys
[2008/04/18 06:18:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\Jpv28.sys
[2008/02/21 14:01:36 | 000,000,014 | -H-- | C] () -- C:\WINDOWS\mmax_hren1.ini
[2008/02/15 03:17:50 | 000,000,705 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/01/17 15:56:29 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2007/12/06 15:41:20 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\drivers\ctl_w32.sys
[2007/11/24 13:50:47 | 000,532,480 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll
[2007/08/24 00:26:04 | 000,009,462 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Application Data\wklnhst.dat
[2007/07/13 01:10:40 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/07/11 00:10:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\AoADVDRipper.INI
[2007/07/10 00:51:24 | 000,002,516 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2007/07/10 00:51:24 | 000,000,088 | RHS- | C] () -- C:\WINDOWS\System32\5240E8750C.sys
[2007/07/06 08:39:20 | 000,098,304 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/07/04 19:03:31 | 000,015,498 | ---- | C] () -- C:\WINDOWS\VX1000.ini
[2006/11/21 15:58:19 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/11/21 15:53:53 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/11/21 15:49:50 | 000,001,448 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/11/21 15:25:13 | 000,348,880 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll
[2006/11/21 15:25:13 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4642.dll
[2006/11/21 15:23:32 | 000,000,493 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/04/22 19:00:10 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2004/08/10 15:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 15:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 14:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

========== LOP Check ==========

[2009/10/31 10:17:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\86034324
[2010/10/24 16:08:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/10/26 16:59:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2007/07/06 01:17:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Azureus
[2010/10/15 18:34:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Borland
[2009/10/29 19:09:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd
[2010/03/08 23:46:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz
[2010/02/06 20:44:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2010/10/24 15:40:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2008/06/03 14:21:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2009/03/06 23:14:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst
[2009/06/28 17:06:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2010/02/19 19:41:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpeedyPC
[2008/10/25 18:23:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/07/04 19:43:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YAHOO
[2009/10/31 10:01:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/07/30 23:46:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Ability5
[2010/10/17 19:49:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\alot
[2010/10/24 10:03:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\AntiVirus 2010
[2007/10/07 02:27:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Azureus
[2010/10/28 16:31:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Bitrix Security
[2010/02/14 05:18:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Epson
[2010/02/19 07:28:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\GARMIN
[2010/05/18 11:00:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\GmailHackerPro_Installer
[2010/05/18 11:15:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Hacks4Sale_installer
[2010/02/14 05:17:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Leader Technologies
[2010/02/06 20:42:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Leadertech
[2010/10/24 12:36:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\LimeWire
[2010/10/17 20:53:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\OpenOffice.org
[2009/03/06 23:14:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\PlayFirst
[2010/04/10 11:29:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\SmartDraw
[2007/11/01 17:00:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Template
[2010/06/09 07:13:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Vivox
[2007/07/15 00:40:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\WinTouch
[2010/07/23 09:31:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Wobym
[2010/07/23 09:31:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Zaga
[2010/11/02 09:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At10.job
[2010/11/02 10:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At11.job
[2010/11/02 11:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At12.job
[2010/11/02 12:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At13.job
[2010/11/02 13:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At14.job
[2010/11/02 14:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At15.job
[2010/11/02 15:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At16.job
[2010/11/02 16:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At17.job
[2010/11/02 17:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At18.job
[2010/11/02 18:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At19.job
[2010/11/02 01:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job
[2010/11/02 19:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At20.job
[2010/11/02 20:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At21.job
[2010/11/02 21:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At22.job
[2010/11/01 22:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At23.job
[2010/11/01 23:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At24.job
[2010/11/02 00:29:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At25.job
[2010/11/02 01:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At26.job
[2010/11/02 02:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At27.job
[2010/11/02 03:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At28.job
[2010/11/02 04:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At29.job
[2010/11/02 02:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At3.job
[2010/11/02 05:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At30.job
[2010/11/02 06:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At31.job
[2010/11/02 07:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At32.job
[2010/11/02 08:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At33.job
[2010/11/02 09:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At34.job
[2010/11/02 10:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At35.job
[2010/11/02 11:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At36.job
[2010/11/02 12:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At37.job
[2010/11/02 13:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At38.job
[2010/11/02 14:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At39.job
[2010/11/02 03:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At4.job
[2010/11/02 15:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At40.job
[2010/11/02 16:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At41.job
[2010/11/02 17:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At42.job
[2010/11/02 18:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At43.job
[2010/11/02 19:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At44.job
[2010/11/02 20:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At45.job
[2010/11/02 21:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At46.job
[2010/11/01 22:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At47.job
[2010/11/01 23:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At48.job
[2010/11/02 04:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At5.job
[2010/11/02 05:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At6.job
[2010/11/02 06:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At7.job
[2010/11/02 07:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At8.job
[2010/11/02 08:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\At9.job
[2010/10/31 02:03:00 | 000,000,446 | ---- | M] () -- C:\WINDOWS\Tasks\Driver Robot.job
[2010/11/02 07:22:34 | 000,000,332 | -HS- | M] () -- C:\WINDOWS\Tasks\MWOTKB.job
[2010/11/02 21:07:02 | 000,000,414 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{A4CD5A22-7976-457E-987E-FE09DCEF65B6}.job
[2010/11/02 20:51:00 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/11/02 20:12:00 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/11/02 20:37:06 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/10/24 13:49:11 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2004/08/10 15:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2006/11/21 15:28:38 | 000,005,941 | RH-- | M] () -- C:\dell.sdr
[2010/11/02 07:21:37 | 526,295,040 | -HS- | M] () -- C:\hiberfil.sys
[2010/07/22 14:44:29 | 000,152,088 | ---- | M] () -- C:\img2-001.raw
[2007/07/04 18:58:16 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2004/08/10 15:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2004/08/10 15:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/05 11:03:30 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/11/02 07:21:32 | 792,723,456 | -HS- | M] () -- C:\pagefile.sys
[2008/09/07 13:58:42 | 000,056,136 | ---- | M] () -- C:\playground.log
[2008/12/09 23:33:21 | 000,000,000 | ---- | M] () -- C:\plx_proxy.log
[2010/10/17 19:47:24 | 000,009,594 | ---- | M] () -- C:\scramble.log
[2008/10/11 20:28:20 | 000,000,232 | -H-- | M] () -- C:\sqmdata00.sqm
[2008/11/03 01:51:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2008/12/01 15:52:58 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2009/01/03 12:28:48 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2009/03/02 23:29:13 | 000,000,232 | -H-- | M] () -- C:\sqmdata04.sqm
[2009/01/03 12:37:22 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2009/01/17 14:12:05 | 000,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
[2009/01/31 21:37:45 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
[2009/04/17 15:38:38 | 000,000,268 | -H-- | M] () -- C:\sqmdata08.sqm
[2009/05/02 15:19:00 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
[2008/09/07 12:45:45 | 000,000,268 | -H-- | M] () -- C:\sqmdata10.sqm
[2008/09/07 16:52:02 | 000,000,268 | -H-- | M] () -- C:\sqmdata11.sqm
[2008/09/07 16:52:09 | 000,000,232 | -H-- | M] () -- C:\sqmdata12.sqm
[2008/09/07 16:52:17 | 000,000,172 | -H-- | M] () -- C:\sqmdata13.sqm
[2008/09/07 16:52:34 | 000,000,268 | -H-- | M] () -- C:\sqmdata14.sqm
[2008/09/07 16:53:11 | 000,000,268 | -H-- | M] () -- C:\sqmdata15.sqm
[2008/09/07 16:53:18 | 000,000,208 | -H-- | M] () -- C:\sqmdata16.sqm
[2008/09/09 15:46:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata17.sqm
[2008/10/10 21:22:17 | 000,000,268 | -H-- | M] () -- C:\sqmdata18.sqm
[2008/10/11 20:20:05 | 000,000,232 | -H-- | M] () -- C:\sqmdata19.sqm
[2008/10/11 20:28:20 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2008/11/03 01:51:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2008/12/01 15:52:58 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2009/01/03 12:28:48 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2009/03/02 23:29:12 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2009/01/03 12:37:22 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2009/01/17 14:12:05 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2009/01/31 21:37:45 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2009/04/17 15:38:38 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2009/05/02 15:18:59 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2008/09/07 12:45:45 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2008/09/07 16:52:02 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2008/09/07 16:52:09 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2008/09/07 16:52:17 | 000,000,172 | -H-- | M] () -- C:\sqmnoopt13.sqm
[2008/09/07 16:52:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
[2008/09/07 16:53:11 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
[2008/09/07 16:53:18 | 000,000,172 | -H-- | M] () -- C:\sqmnoopt16.sqm
[2008/09/09 15:46:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
[2008/10/10 21:22:17 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2008/10/11 20:20:04 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 15:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >
[2008/03/11 02:36:02 | 000,004,281 | -H-- | M] () -- C:\WINDOWS\mmhren22.jpg
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 11:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2009/07/10 13:15:46 | 000,306,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WLXPGSS.SCR
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2009/10/22 18:45:04 | 000,001,666 | -H-- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\LastFlashConfig.WFC
[2010/10/25 05:57:15 | 000,001,404 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\stor.cfg
[2010/10/23 18:51:42 | 000,099,840 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\svchost.exe

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 14:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/10 14:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/10 14:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/09/05 11:09:01 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >
[2006/11/21 15:44:10 | 000,264,750 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\TRANSFORMS=1033.mst

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/07/04 18:51:52 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/11/02 20:53:08 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2006/04/27 06:19:01 | 000,013,023 | ---- | M] () -- C:\WINDOWS\VX1000.src
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2009/10/19 21:54:50 | 000,070,984 | ---- | M] () -- C:\Documents and Settings\chysa strickland\g2mdlhlpx.exe

< %systemroot%\ADDINS\*.* >
[2004/08/04 07:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/07/04 18:51:50 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\chysa strickland\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2009/04/23 11:36:15 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\chysa strickland\Cookies\desktop.ini
[2010/11/02 07:22:13 | 000,262,144 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2008/04/13 20:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[2002/07/17 16:22:34 | 000,003,535 | ---- | M] () -- C:\WINDOWS\system\Wowpost.exe

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >
[7 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2007/07/13 00:53:12 | 000,002,238 | ---- | M] () -- C:\WINDOWS\system32\ClickToFindandFixErrors_Intl.ico
[2004/08/10 12:11:00 | 000,022,486 | ---- | M] () -- C:\WINDOWS\system32\lrnxp.ico
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >
[2002/07/17 16:22:34 | 000,003,535 | ---- | M] () -- C:\WINDOWS\system\Wowpost.exe

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/11/02 07:20:16 | 010,747,904 | ---- | M] () -- C:\Documents and Settings\chysa strickland\ntuser.dat

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >
[2010/10/23 13:37:24 | 000,112,128 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2008/10/14 15:44:50 | 000,309,144 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_DUPA30.EXE
[2007/11/15 00:02:00 | 000,175,616 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FAMTFIA.EXE
[2008/10/27 01:05:00 | 000,171,008 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FARNFIA.EXE
[2008/11/20 01:00:00 | 000,199,680 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIFIA.EXE
[2007/12/16 20:03:00 | 000,177,152 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FBCSFIA.EXE
[2008/12/15 05:51:00 | 000,136,192 | ---- | M] (SEIKO EPSON Corporation) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FHUTFIA.EXE
[2008/10/22 03:05:00 | 000,804,784 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FINSFIA.EXE
[2008/09/08 00:00:00 | 000,204,800 | ---- | M] (SEIKO EPSON CORP.) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FPREFIA.EXE
[2007/01/10 23:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S40RP7.EXE
[2007/12/16 23:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S40ST7.EXE

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.rpv /x >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< %USERPROFILE%\System\*.* >
[2010/04/10 14:14:00 | 000,000,086 | ---- | M] () -- C:\Documents and Settings\chysa strickland\System\win_qs8.jqx

< %systemroot%\Source\*.* >

< %systemroot%\system32\ac\*.* >

< %ProgramFiles%\MSDN\*.* >

< %AppData%\AdobeUM\winvcldll54\*.* /s >

< %ProgramFiles%\Internet Explorer\*.ico >

< %systemroot%\system32\*.ojo >

< %systemroot%\system32\d323s\*.* >

< %systemroot%\system32\re\*.* >

< %UserProfile%\Microsoft\*.dll >

< %UserProfile%\Microsoft\*.log >

< %systemroot%\Bios\*.* >

< %ProgramFiles%\Spool\*.* >

< %ProgramFiles%\promp3\*.* >

< %SYSTEMDRIVE%\Driver\*.* /s >

< %SYSTEMDRIVE%\inetserver.exe\*.* >

< %systemroot%\java\trustlib\*.* >

< %ProgramFiles%\Common Files\designer\*.exe >

< %ProgramFiles%\*. >
[2010/09/26 10:36:17 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2007/10/14 12:49:01 | 000,000,000 | ---D | M] -- C:\Program Files\Ahead
[2010/10/24 16:08:07 | 000,000,000 | ---D | M] -- C:\Program Files\Alwil Software
[2009/04/28 10:54:42 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2010/02/06 20:35:46 | 000,000,000 | ---D | M] -- C:\Program Files\ArcSoft
[2010/07/21 07:28:06 | 000,000,000 | ---D | M] -- C:\Program Files\Ask.com
[2009/11/01 04:33:34 | 000,000,000 | ---D | M] -- C:\Program Files\AVG
[2007/10/09 15:12:26 | 000,000,000 | ---D | M] -- C:\Program Files\Azureus
[2006/11/21 15:50:08 | 000,000,000 | ---D | M] -- C:\Program Files\BAE
[2010/02/06 19:59:43 | 000,000,000 | ---D | M] -- C:\Program Files\Cheat Engine
[2009/10/30 23:22:40 | 000,000,000 | ---D | M] -- C:\Program Files\Citrix
[2010/10/24 13:04:41 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2004/08/10 15:02:08 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2009/10/31 07:56:11 | 000,000,000 | ---D | M] -- C:\Program Files\CONEXANT
[2007/07/04 19:44:24 | 000,000,000 | ---D | M] -- C:\Program Files\Dell
[2006/11/21 15:54:12 | 000,000,000 | ---D | M] -- C:\Program Files\Dell Support
[2010/07/21 07:34:29 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2010/10/28 16:31:48 | 000,000,000 | ---D | M] -- C:\Program Files\DRPU PC Data Manager
[2010/11/02 07:21:32 | 000,000,000 | ---D | M] -- C:\Program Files\Emsisoft Anti-Malware
[2010/02/06 20:40:28 | 000,000,000 | ---D | M] -- C:\Program Files\epson
[2010/02/06 20:27:02 | 000,000,000 | ---D | M] -- C:\Program Files\Epson Software
[2008/12/21 02:05:31 | 000,000,000 | ---D | M] -- C:\Program Files\Garmin GPS Plugin
[2010/04/24 21:24:19 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2007/11/29 16:49:49 | 000,000,000 | ---D | M] -- C:\Program Files\Grisoft
[2010/02/25 15:11:45 | 000,000,000 | ---D | M] -- C:\Program Files\Incomplete
[2007/10/07 08:57:45 | 000,000,000 | ---D | M] -- C:\Program Files\Insider
[2010/01/15 18:25:30 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallJammer Registry
[2010/02/06 20:40:50 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2006/11/21 15:44:10 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2006/11/21 15:44:30 | 000,000,000 | ---D | M] -- C:\Program Files\InterActual
[2010/10/17 03:10:05 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2009/04/28 10:56:37 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2009/04/28 10:56:53 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2010/03/14 11:39:11 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2010/10/17 20:12:14 | 000,000,000 | ---D | M] -- C:\Program Files\JRE
[2010/04/01 08:04:34 | 000,000,000 | ---D | M] -- C:\Program Files\LimeWire
[2010/03/09 13:33:42 | 000,000,000 | ---D | M] -- C:\Program Files\LTCM Client
[2006/11/21 15:49:25 | 000,000,000 | ---D | M] -- C:\Program Files\McAfee
[2008/09/07 03:08:19 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2010/10/24 13:19:06 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2004/08/10 15:04:18 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/05/28 18:46:16 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft LifeCam
[2010/10/24 13:05:18 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/11/10 09:43:22 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2009/06/26 14:23:32 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Sync Framework
[2006/11/21 15:52:43 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2009/10/18 03:03:53 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2010/08/15 03:02:46 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/11/02 20:02:55 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2009/08/09 03:08:48 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2010/02/11 16:48:08 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
[2010/02/06 20:03:21 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2009/01/30 19:35:06 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Games
[2007/11/29 16:45:29 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2009/06/25 20:15:45 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Messenger
[2006/11/21 15:46:45 | 000,000,000 | ---D | M] -- C:\Program Files\MUSICMATCH
[2007/09/18 01:41:23 | 000,000,000 | ---D | M] -- C:\Program Files\Nero
[2008/09/05 11:05:15 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2010/01/05 16:58:24 | 000,000,000 | ---D | M] -- C:\Program Files\NortonInstaller
[2007/11/29 16:44:46 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2010/10/17 20:11:45 | 000,000,000 | ---D | M] -- C:\Program Files\OpenOffice.org 3
[2010/05/16 03:01:37 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2010/10/28 07:33:38 | 000,000,000 | ---D | M] -- C:\Program Files\Panda Security
[2009/04/28 10:56:07 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2009/08/09 03:08:38 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2007/09/24 19:16:04 | 000,000,000 | ---D | M] -- C:\Program Files\Roxio
[2009/06/03 17:49:03 | 000,000,000 | ---D | M] -- C:\Program Files\Sabi
[2006/11/21 15:42:40 | 000,000,000 | ---D | M] -- C:\Program Files\Sigmatel
[2007/11/24 13:51:13 | 000,000,000 | ---D | M] -- C:\Program Files\Sony
[2010/10/26 20:58:57 | 000,000,000 | ---D | M] -- C:\Program Files\Spybot - Search & Destroy
[2007/09/29 15:04:56 | 000,000,000 | ---D | M] -- C:\Program Files\Temporary
[2004/08/10 15:08:30 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2009/07/19 19:05:04 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2007/10/07 08:57:46 | 000,000,000 | ---D | M] -- C:\Program Files\WinAble
[2010/02/11 16:48:30 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2009/06/26 14:24:02 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live Toolbar
[2007/07/11 23:32:48 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2008/09/05 11:05:13 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2008/09/05 11:05:12 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2004/08/10 15:02:52 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2009/10/29 06:45:10 | 000,000,000 | ---D | M] -- C:\Program Files\WinPcap
[2004/08/10 15:04:18 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2009/01/30 19:44:43 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!

< %systemroot%\system32\*.tso >

< %ALLUSERSPROFILE%\Documents\Server\*.* >

< %systemroot%\*.pif >
[2004/08/04 07:00:00 | 000,000,707 | ---- | M] () -- C:\WINDOWS\_default.pif
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\system32\n7533\*.* >

< %systemroot%\Us18336\*.* >

< %systemroot%\system32\*.zip >

< %systemroot%\system32\*.wgo >

< %systemroot%\system32\dllcache\*.com >

< %systemroot%\system32\dllchache\*.* >

< %systemroot%\system32\038840\*.* >

< %systemroot%\system32\13E92A\*.* >

< %systemroot%\system32\1CB5AD\*.* >

< %systemroot%\system32\52682A\*.* >

< %USERPROFILE%\My Documents\*.htm >

< %SYSTEMDRIVE%\Mr_CF\*.* >

< %USERPROFILE%\My Documents\*.dll >

< %USERPROFILE%\My Documents\*.ccc >

< %systemroot%\system32\Sis\*.* >

< %systemroot%\Microsft\*.* >

< %SYSTEMDRIVE%\driverwinx.exe\*.* >

< %systemroot%\BifroXx\*.* >

< %SYSTEMDRIVE%\TSTP\*.* >

< %systemroot%\winsn\*.* >

< %ProgramFiles%\windata\*.* >

< %SYSTEMDRIVE%\msixxxxxxx.exe\*.* >

< %systemroot%\system32\*.sao >

< %systemroot%\system32\*.iem >

< %systemroot%\system32\*.mdd >

< %systemroot%\system32\*.wlo >

< %systemroot%\system32\*.skn >

< %SYSTEMDRIVE%\Winup\*.* >

< %SYSTEMDRIVE%\test\*.* >

< %systemroot%\system32\med\*.* >

< %systemroot%\Bifrost\*.* >

< %systemroot%\system32\explorer.exe\*.* >

< %UserProfile%\UserData\*.dat /x >

< %SYSTEMDRIVE%\Arquivo de programas\*.* >

< %ProgramFiles%\tcpview\*.* >

< %systemroot%\system32\*.lyo >

< %ProgramFiles%\huanbang2\*.* >

< %systemroot%\winhuanbang\*.* >

< %systemroot%\minrsv.ini\*.* >

< %systemroot%\assembly\GAC\*.* >

< %AppData%\Adobe\crtmswin91\*.* >

< %ProgramFiles%\Windows NT\Accessories\*.exe >
[2010/07/12 08:55:03 | 000,218,112 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows NT\Accessories\wordpad.exe

< %systemroot%\system32\*.pdo >

< %SYSTEMDRIVE%\APPDATASH\*.* >

< %SYSTEMDRIVE%\sy\*.* >

< %systemroot%\*.cot >

< %systemroot%\system32\*.html >

< %systemroot%\system32\win32.exe\*.* >

< %systemroot%\System32\9283\*.* >

< %systemroot%\System32\hardpol\*.* /s >

< %systemroot%\Fonts\*.dat >

< %ProgramFiles%\WinNTsystem operation\*.* >

< %SYSTEMDRIVE%\moneyxmexx.exe\*.* >

< %USERPROFILE%\Templates\*.exe >

< %SYSTEMDRIVE%\MSOCache\*.* >

< %systemroot%\inf\win\*.* >

< %SYSTEMDRIVE%\users\*.* /s >
[2010/05/18 11:29:15 | 004,546,560 | ---- | M] (Microsoft Corporation) -- C:\Users\Public\Favorites\csrss.exe

< %systemroot%\Media\*.exe >

< %systemroot%\Media\*.dll >

< %AppData%\AdobeUM\upldrvdrv2\*.* >

< %ProgramFiles%\wiselink\*.* >

< %systemroot%\*.wd >

< %systemroot%\boot\*.* >

< %systemroot%\ime\*.dll /x >

< %systemroot%\system32\GroupPolicy\User\Scripts\*.* /s >

< %systemroot%\system32\*.INS >

< %SYSTEMDRIVE%\Temporary\*.* >

< %AppData%\AdobeUM\vclvclupl66\*.* >

< %SYSTEMDRIVE%\KEY\*.* /s >

< %SYSTEMDRIVE%\INVRSO\*.* >

< %systemroot%\Config\Audit\*.* /s >

< %ProgramFiles%\facebook\*.* >

< %SystemRoot%\system32\___hptmp\*.* >

< %SystemRoot%\system32\Macromedia\*.* >

< %SystemRoot%\system32\Macrocmp\*.* >

< %systemroot%\ap0calypse_00CD1A40\*.* /s >

< %SYSTEMDRIVE%\bbotxxxxxx.exe\*.* >

< %systemroot%\cacher\*.* >

< %systemroot%\down\*.* >

< %systemroot%\up\*.* >

< HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download >
"CheckExeSignatures" = yes

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony\Providers|ProviderFileName6 /rs >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-17 07:12:55

========== Files - Unicode (All) ==========
[2010/11/01 17:40:41 | 000,000,000 | ---D | M](C:\Documents and Settings\chysa strickland\Favorites\??sorted Bookmarks) -- C:\Documents and Settings\chysa strickland\Favorites\韐ĳsorted Bookmarks
[2007/10/14 13:10:16 | 000,000,000 | ---D | M](C:\WINDOWS\System32\??crosoft.NET) -- C:\WINDOWS\System32\Μіcrosoft.NET
[2007/10/03 16:36:27 | 000,000,000 | ---D | M](C:\Program Files\??mantec) -- C:\Program Files\Ѕуmantec
[2007/10/03 16:36:27 | 000,000,000 | ---D | M](C:\Program Files\??mantec) -- C:\Program Files\Ѕуmantec
[2007/10/02 16:25:41 | 000,000,000 | ---D | M](C:\Program Files\?ppPatch) -- C:\Program Files\АppPatch
[2007/10/02 16:25:41 | 000,000,000 | ---D | M](C:\Program Files\?ppPatch) -- C:\Program Files\АppPatch
[2007/10/01 16:41:23 | 000,000,000 | ---D | M](C:\Program Files\Common Files\??crosoft) -- C:\Program Files\Common Files\Μіcrosoft
[2007/10/01 16:41:23 | 000,000,000 | ---D | M](C:\Program Files\Common Files\??crosoft) -- C:\Program Files\Common Files\Μіcrosoft
[2007/09/30 17:00:27 | 000,000,000 | ---D | M](C:\WINDOWS\System32\??crosoft) -- C:\WINDOWS\System32\Міcrosoft
[2007/09/30 17:00:27 | 000,000,000 | ---D | C](C:\WINDOWS\System32\??crosoft) -- C:\WINDOWS\System32\Міcrosoft
[2007/09/29 06:00:59 | 000,000,000 | ---D | C](C:\WINDOWS\System32\??crosoft.NET) -- C:\WINDOWS\System32\Μіcrosoft.NET
[2007/09/28 05:19:10 | 000,000,000 | ---D | M](C:\WINDOWS\W?nSxS) -- C:\WINDOWS\WіnSxS
[2007/09/28 05:19:10 | 000,000,000 | ---D | C](C:\WINDOWS\W?nSxS) -- C:\WINDOWS\WіnSxS
[2007/09/27 06:16:37 | 000,000,000 | ---D | M](C:\Program Files\F?nts) -- C:\Program Files\Fοnts
[2007/09/27 06:16:37 | 000,000,000 | ---D | M](C:\Program Files\F?nts) -- C:\Program Files\Fοnts
[2007/09/26 06:23:43 | 000,000,000 | ---D | M](C:\Program Files\S?mantec) -- C:\Program Files\Sуmantec
[2007/09/26 06:23:43 | 000,000,000 | ---D | M](C:\Program Files\S?mantec) -- C:\Program Files\Sуmantec
[2007/09/25 06:57:12 | 000,000,000 | ---D | M](C:\Documents and Settings\chysa strickland\My Documents\??crosoft) -- C:\Documents and Settings\chysa strickland\My Documents\Μіcrosoft
[2007/09/25 06:57:12 | 000,000,000 | ---D | C](C:\Documents and Settings\chysa strickland\My Documents\??crosoft) -- C:\Documents and Settings\chysa strickland\My Documents\Μіcrosoft
[2007/09/07 07:43:55 | 000,000,000 | ---D | M](C:\Program Files\Common Files\?dobe) -- C:\Program Files\Common Files\Аdobe
[2007/09/07 07:43:55 | 000,000,000 | ---D | M](C:\Program Files\Common Files\?dobe) -- C:\Program Files\Common Files\Аdobe
[2007/09/02 18:42:29 | 000,000,000 | ---D | M](C:\Program Files\Common Files\??crosoft.NET) -- C:\Program Files\Common Files\Міcrosoft.NET
[2007/09/02 18:42:29 | 000,000,000 | ---D | M](C:\Program Files\Common Files\??crosoft.NET) -- C:\Program Files\Common Files\Міcrosoft.NET
[2007/08/31 17:57:51 | 000,000,000 | ---D | M](C:\Program Files\Common Files\??stem32) -- C:\Program Files\Common Files\ѕуstem32
[2007/08/31 17:57:51 | 000,000,000 | ---D | M](C:\Program Files\Common Files\??stem32) -- C:\Program Files\Common Files\ѕуstem32
[2007/08/23 23:37:36 | 000,000,000 | ---D | M](C:\Program Files\?ppPatch) -- C:\Program Files\ΑppPatch
[2007/08/23 23:37:36 | 000,000,000 | ---D | M](C:\Program Files\?ppPatch) -- C:\Program Files\ΑppPatch
[2007/08/15 00:23:03 | 000,000,000 | ---D | M](C:\Program Files\??pPatch) -- C:\Program Files\ΑрpPatch
[2007/08/15 00:23:03 | 000,000,000 | ---D | M](C:\Program Files\??pPatch) -- C:\Program Files\ΑрpPatch
[2007/08/11 13:02:07 | 000,000,000 | ---D | M](C:\WINDOWS\?racle) -- C:\WINDOWS\Οracle
[2007/08/11 13:02:07 | 000,000,000 | ---D | C](C:\WINDOWS\?racle) -- C:\WINDOWS\Οracle
[2007/08/05 11:02:09 | 000,000,000 | ---D | M](C:\WINDOWS\F?nts) -- C:\WINDOWS\Fоnts
[2007/08/05 11:02:09 | 000,000,000 | ---D | C](C:\WINDOWS\F?nts) -- C:\WINDOWS\Fоnts
[2007/07/18 14:35:24 | 000,000,000 | ---D | M](C:\Program Files\?icrosoft.NET) -- C:\Program Files\Мicrosoft.NET
[2007/07/18 14:35:24 | 000,000,000 | ---D | M](C:\Program Files\?icrosoft.NET) -- C:\Program Files\Мicrosoft.NET
(C:\Program Files\S?mantec) -- C:\Program Files\Sуmantec
(C:\Program Files\F?nts) -- C:\Program Files\Fοnts
(C:\Program Files\Common Files\?dobe) -- C:\Program Files\Common Files\Аdobe
(C:\Program Files\Common Files\??stem32) -- C:\Program Files\Common Files\ѕуstem32
(C:\Program Files\Common Files\??crosoft.NET) -- C:\Program Files\Common Files\Міcrosoft.NET
(C:\Program Files\Common Files\??crosoft) -- C:\Program Files\Common Files\Μіcrosoft
(C:\Program Files\?ppPatch) -- C:\Program Files\АppPatch
(C:\Program Files\?ppPatch) -- C:\Program Files\ΑppPatch
(C:\Program Files\?icrosoft.NET) -- C:\Program Files\Мicrosoft.NET
(C:\Program Files\??pPatch) -- C:\Program Files\ΑрpPatch
(C:\Program Files\??mantec) -- C:\Program Files\Ѕуmantec

========== Alternate Data Streams ==========

@Alternate Data Stream - 166 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:82591FF7
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8C8F2D60
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:327F192C
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30FD0CBD

< End of report >


----------



## Chelsea-Buns (Oct 28, 2010)

OTL Extras logfile created on: 02/11/2010 8:56:24 PM - Run 1
OTL by OldTimer - Version 3.2.17.2 Folder = C:\Documents and Settings\chysa strickland\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

502.00 Mb Total Physical Memory | 69.00 Mb Available Physical Memory | 14.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 31.22 Gb Free Space | 43.69% Space Free | Partition Type: NTFS
Unable to calculate disk information.

Computer Name: DCWDN4C1 | User Name: chysa strickland | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNetisabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNetisabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNetisabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNetisabledxpsp2res.dll,-22002
"1044:TCP" = 1044:TCP:*:Enabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- File not found
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\Microsoft LifeCam\LifeCam.exe" = C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe -- (Microsoft Corporation)
"C:\Program Files\Microsoft LifeCam\LifeExp.exe" = C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe -- (Microsoft Corporation)
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found
"C:\Documents and Settings\chysa strickland\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe" = C:\Documents and Settings\chysa strickland\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe:*:Enabled:Octoshape add-in for Adobe Flash Player -- (Octoshape ApS)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)
"C:\Program Files\Java\jre1.6.0_02\launch4j-tmp\wowd.exe" = C:\Program Files\Java\jre1.6.0_02\launch4j-tmp\wowd.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\Epson Software\Event Manager\EEventManager.exe" = C:\Program Files\Epson Software\Event Manager\EEventManager.exe:*:Enabled:EEventManager.exe -- (SEIKO EPSON CORPORATION)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe -- File not found
"C:\Documents and Settings\chysa strickland\Application Data\IMVUClient\1VivoxVoice.exe" = C:\Documents and Settings\chysa strickland\Application Data\IMVUClient\1VivoxVoice.exe:*isabled:1VivoxVoice -- File not found
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- File not found
"C:\Program Files\AVG\AVG9\avgui.exe" = C:\Program Files\AVG\AVG9\avgui.exe:*:Enabled:AVG Free User Interface -- File not found
"C:\Documents and Settings\chysa strickland\My Documents\Downloads\ChromeSetup.exe" = C:\Documents and Settings\chysa strickland\My Documents\Downloads\ChromeSetup.exe:*:Enabled:ChromeSetup -- (Google Inc.)
"C:\Documents and Settings\chysa strickland\Local Settings\Temp\GoogleUpdate.exe7e2ad" = C:\Documents and Settings\chysa strickland\Local Settings\Temp\GoogleUpdate.exe7e2ad:*:Enabled:GoogleUpdate.exe7e2ad -- File not found
"C:\Documents and Settings\chysa strickland\Local Settings\Temp\GoogleUpdate.exede455" = C:\Documents and Settings\chysa strickland\Local Settings\Temp\GoogleUpdate.exede455:*:Enabled:GoogleUpdate.exede455 -- File not found
"C:\Documents and Settings\chysa strickland\Local Settings\Temp\CAN2_Dinner_.pdf" = C:\Documents and Settings\chysa strickland\Local Settings\Temp\CAN2_Dinner_.pdf:*:Enabled:CAN2_Dinner_ -- ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"__h-BIFaZR8" = LoudMo Contextual Ad Assistant
"{07453869-D17D-4159-A23D-0A956CE96448}" = ArcSoft Print Creations
"{0A0873E1-D9BA-4994-B85D-A0A331EF1F0C}" = Intel(R) PRO Network Connections
"{117CD9C0-0F15-4633-93D7-F957B50535A5}" = Popup Blocker (Windows Live Toolbar)
"{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = Epson Event Manager
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{4DEE75B1-B201-4DA3-A50F-007CDB00DA23}" = Microsoft LifeCam
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module
"{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}" = iTunes
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AFA20D47-69C3-4030-8DF8-D37466E70F13}" = Apple Mobile Device Support
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CA9ED5E4-1548-485B-A293-417840060158}" = ArcSoft Print Creations - Photo Calendar
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEE2252C-4035-4B27-8EC6-0B085DD3A413}" = Dell Support 3.2.1
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{E6C82F8F-2031-4825-8CC3-98C5960875C1}" = Epson CreativeZone
"{F04F9557-81A9-4293-BC49-2C216FA325A7}" = ArcSoft Print Creations - Greeting Card
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6970FBD-809A-4C51-BAB3-D94A04C6C8E7}" = Garmin Communicator Plugin
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast5" = avast! Pro Antivirus
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 56K V.9x DFVc Modem
"EPSON NX510 Series" = EPSON NX510 Series Printer Uninstall
"EPSON Scanner" = EPSON Scan
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"LimeWire" = LimeWire 5.5.6
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-14-05-01
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 21/10/2010 5:58:27 PM | Computer Name = DCWDN4C1 | Source = ESENT | ID = 473
Description = Catalog Database (1116) Database C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
was partially detached. Error -1032 encountered updating database headers.

Error - 23/10/2010 3:46:59 PM | Computer Name = DCWDN4C1 | Source = ESENT | ID = 490
Description = svchost (1092) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
for read / write access failed with system error 32 (0x00000020): "The process 
cannot access the file because it is being used by another process. ". The open
file operation will fail with error -1032 (0xfffffbf8).

Error - 23/10/2010 3:46:59 PM | Computer Name = DCWDN4C1 | Source = ESENT | ID = 454
Description = Catalog Database (1092) Database recovery/restore failed with unexpected
error -1032.

Error - 24/10/2010 12:51:07 PM | Computer Name = DCWDN4C1 | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Works -- Error 1706.No valid source could be found
for product Microsoft Works. The Windows installer cannot continue.

Error - 24/10/2010 12:52:02 PM | Computer Name = DCWDN4C1 | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Works -- Error 1706.No valid source could be found
for product Microsoft Works. The Windows installer cannot continue.

Error - 24/10/2010 12:52:02 PM | Computer Name = DCWDN4C1 | Source = MsiInstaller | ID = 1024
Description = Product: Microsoft Works - Update 'Security Update for Microsoft Works
8 (KB973636)' could not be installed. Error code 1603. Windows Installer can create
logs to help troubleshoot issues with installing software packages. Use the following
link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127

Error - 24/10/2010 12:52:02 PM | Computer Name = DCWDN4C1 | Source = MsiInstaller | ID = 1021
Description = Product: Microsoft Works - Update 'Security Update for Microsoft Works
8 (KB977304)' could not be removed. Error code 1603. Windows Installer can create
logs to help troubleshoot issues with installing software packages. Use the following
link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127

Error - 24/10/2010 1:52:33 PM | Computer Name = DCWDN4C1 | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting 
module unknown, version 0.0.0.0, fault address 0x001a624b.

Error - 24/10/2010 2:07:43 PM | Computer Name = DCWDN4C1 | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting 
module unknown, version 0.0.0.0, fault address 0x001a624b.

Error - 30/10/2010 11:02:10 AM | Computer Name = DCWDN4C1 | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.2.3667, faulting module
xul.dll, version 1.9.2.3667, fault address 0x00106dfa.

[ System Events ]
Error - 02/11/2010 5:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At18.job command failed to start due to the following error: %%2147942405

Error - 02/11/2010 5:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At42.job command failed to start due to the following error: %%2147942405

Error - 02/11/2010 6:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At19.job command failed to start due to the following error: %%2147942405

Error - 02/11/2010 6:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At43.job command failed to start due to the following error: %%2147942405

Error - 02/11/2010 7:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At20.job command failed to start due to the following error: %%2147942405

Error - 02/11/2010 7:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At44.job command failed to start due to the following error: %%2147942405

Error - 02/11/2010 8:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At21.job command failed to start due to the following error: %%2147942405

Error - 02/11/2010 8:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At45.job command failed to start due to the following error: %%2147942405

Error - 02/11/2010 9:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At22.job command failed to start due to the following error: %%2147942405

Error - 02/11/2010 9:00:00 PM | Computer Name = DCWDN4C1 | Source = Schedule | ID = 7901
Description = The At46.job command failed to start due to the following error: %%2147942405

< End of report >


----------



## CatByte (Feb 24, 2009)

Hi,

Please do the following:

Download *ComboFix *from one of the following locations:
*Link 1* 
*Link 2 *

VERY IMPORTANT !!! Save ComboFix.exe to your *Desktop *

* IMPORTANT - *Disable your AntiVirus and AntiSpyware applications*, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here 

Double click on *ComboFix.exe* & follow the prompts.
As part of it's process, *ComboFix will check to see if the Microsoft Windows Recovery Console* is installed. With malware infections being as they are today, it's *strongly recommended *to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.


Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.











Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:











*Click on Yes*, to continue scanning for malware.
When finished, it shall produce a log for you.* Please include the C:\ComboFix.txt in your next reply.*
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


----------



## Chelsea-Buns (Oct 28, 2010)

It won't let me open it, says Windows cannot access the specified device,path or file. You may not have the appropriate permissions to access the item.


----------



## Chelsea-Buns (Oct 28, 2010)

And I uploaded it to my desktop


----------



## CatByte (Feb 24, 2009)

Download Inherit and save it to your desk top
Drag the combofix icon into *Inherit.exe* Then wait for it to say* "OK" *

now try and run it


----------



## Chelsea-Buns (Oct 28, 2010)

It said the same thing as above


----------



## CatByte (Feb 24, 2009)

Hi,

Delete the copy that you have on your desktop

download a fresh copy, but rename it to *explorer.exe *before saving it to your desktop

now boot into safe mode and run it

to boot into safe mode > tap F8 repeatedly upon reboot until an option menu appears > arrow up to safe mode with networking.

Make certain all your security programs are disabled.

now give it a try


----------



## Chelsea-Buns (Oct 28, 2010)

So I cannot delete it, it is saying I do not have the permissions to do so again.


----------



## CatByte (Feb 24, 2009)

OK

Please do the following:

*We need to run an OTL Fix*

Please reopen







on your desktop.
*Copy* and *Paste* the following code into the







textbox. Do not include the word "*Code*"


```
:OTL
PRC - C:\Documents and Settings\chysa strickland\Application Data\Microsoft\svchost.exe ()
PRC - C:\Documents and Settings\chysa strickland\Local Settings\Temp\dwm.exe ()
PRC - C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe ()
DRV - (Pvc41) -- C:\WINDOWS\system32\drivers\Pvc41.sys ()
DRV - (Jpv28) -- C:\WINDOWS\system32\drivers\Jpv28.sys ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370
FF - prefs.js..network.proxy.http_port: 50370
FF - prefs.js..network.proxy.type: 1
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {12F77837-9CD4-B656-F349-EF2B5D978F9F} - C:\WINDOWS\System32\astqh.dll File not found
O2 - BHO: (no name) - {401D1DD6-A46A-8CE5-1A66-FB8DBB238FCD} - C:\WINDOWS\System32\aso.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {6CFEF4BC-425A-3DDB-7A71-3CB60B49F1CD} - C:\WINDOWS\System32\yhmn.dll File not found
O2 - BHO: (no name) - {79b3d672-a45a-6619-f0fb-4401342c4414} - C:\WINDOWS\iyeqanal.dll File not found
O2 - BHO: (Microsoft copyright) - {971D5B7B-F7DF-43ee-B771-6B7FA09975C3} - File not found
O2 - BHO: (no name) - {CBE0AE25-13C9-6D4B-B929-4F761B3A00C6} - C:\WINDOWS\System32\bugwwtmu.dll File not found
O2 - BHO: (no name) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [86034324] C:\DOCUME~1\ALLUSE~1\APPLIC~1\86034324\86034324.exe File not found
O4 - HKLM..\Run: [svchost] C:\Documents and Settings\chysa strickland\Application Data\Microsoft\svchost.exe ()
O4 - HKCU..\Run: [b37pvvurwoko] File not found
O4 - HKCU..\Run: [IJKUK66HMN] C:\DOCUME~1\CHYSAS~1\LOCALS~1\Temp\Rdr.exe File not found
F3 - HKCU WinNT: Load - (C:\DOCUME~1\CHYSAS~1\LOCALS~1\Temp\dwm.exe) - C:\Documents and Settings\chysa strickland\Local Settings\Temp\dwm.exe ()
O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe) - C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe ()
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.164.124,93.188.160.204
O20 - Winlogon\Notify\pmnonki: DllName - pmnonki.dll - File not found
O28 - HKLM ShellExecuteHooks: {E271F4E9-D46E-4C7A-8608-AFDD4A87E582} - C:\WINDOWS\System32\pmnonki.dll File not found
O33 - MountPoints2\{1cc6e62a-e3ef-11dd-8b7b-001676da3619}\Shell\Setup\command - "" = C:\WINDOWS\System32\setup.exe -- [2008/04/13 20:12:34 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{524b724f-9ad2-11dd-8b3b-001676da3619}\Shell\Setup\command - "" = C:\WINDOWS\System32\setup.exe -- [2008/04/13 20:12:34 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{64ece5dd-2c66-11df-a096-001676da3619}\Shell\Setup\command - "" = C:\WINDOWS\System32\setup.exe -- [2008/04/13 20:12:34 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{f7ca953a-41db-11dd-8aff-001676da3619}\Shell\Setup\command - "" = C:\WINDOWS\System32\setup.exe -- [2008/04/13 20:12:34 | 000,023,040 | ---- | M] (Microsoft Corporation)
MsConfig - StartUpReg: AntiVirus 2010 - hkey= - key= - C:\Documents and Settings\chysa strickland\Application Data\AntiVirus 2010\AntiVirus_Studio_2010.exe File not found
MsConfig - StartUpReg: Syizehokonipuco - hkey= - key= - C:\WINDOWS\iyeqanal.DLL File not found
SafeBootMin: Cin05.sys - C:\WINDOWS\System32\drivers\Cin05.sys File not found
SafeBootMin: ctl_w32.sys - C:\WINDOWS\system32\drivers\ctl_w32.sys ()
SafeBootMin: Flq27.sys - C:\WINDOWS\System32\drivers\Flq27.sys File not found
SafeBootMin: Gms85.sys - C:\WINDOWS\System32\drivers\Gms85.sys File not found
SafeBootMin: Hns27.sys - C:\WINDOWS\System32\drivers\Hns27.sys File not found
SafeBootMin: Hnt17.sys - C:\WINDOWS\System32\drivers\Hnt17.sys File not found
SafeBootMin: Kqv27.sys - C:\WINDOWS\System32\drivers\Kqv27.sys File not found
SafeBootMin: Kqw41.sys - C:\WINDOWS\System32\drivers\Kqw41.sys File not found
SafeBootMin: Nty51.sys - C:\WINDOWS\System32\drivers\Nty51.sys File not found
SafeBootMin: Oua16.sys - C:\WINDOWS\System32\drivers\Oua16.sys File not found
SafeBootMin: Pvb05.sys - C:\WINDOWS\System32\drivers\Pvb05.sys File not found
SafeBootMin: Pvc28.sys - C:\WINDOWS\System32\drivers\Pvc28.sys File not found
SafeBootMin: Pvc74.sys - C:\WINDOWS\System32\drivers\Pvc74.sys File not found
SafeBootMin: Qwd28.sys - C:\WINDOWS\System32\drivers\Qwd28.sys File not found
SafeBootMin: Sag41.sys - C:\WINDOWS\System32\drivers\Sag41.sys File not found
SafeBootMin: Tag30.sys - C:\WINDOWS\System32\drivers\Tag30.sys File not found
SafeBootMin: Ubg84.sys - C:\WINDOWS\System32\drivers\Ubg84.sys File not found
SafeBootMin: Vch62.sys - C:\WINDOWS\System32\drivers\Vch62.sys File not found
SafeBootMin: Vci30.sys - C:\WINDOWS\System32\drivers\Vci30.sys File not found
SafeBootMin: Wdi27.sys - C:\WINDOWS\System32\drivers\Wdi27.sys File not found
SafeBootMin: Wdi40.sys - C:\WINDOWS\System32\drivers\Wdi40.sys File not found
SafeBootMin: Xej62.sys - C:\WINDOWS\System32\drivers\Xej62.sys File not found
SafeBootMin: Xek85.sys - C:\WINDOWS\System32\drivers\Xek85.sys File not found
SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: ati1otxx.sys - C:\WINDOWS\System32\Drivers\ati1otxx.sys File not found
SafeBootNet: ati2fkxx.sys - C:\WINDOWS\System32\Drivers\ati2fkxx.sys File not found
SafeBootNet: ati7rwxx.sys - C:\WINDOWS\System32\Drivers\ati7rwxx.sys File not found
SafeBootNet: Cin05.sys - C:\WINDOWS\System32\drivers\Cin05.sys File not found
SafeBootNet: ctl_w32.sys - C:\WINDOWS\system32\drivers\ctl_w32.sys ()
SafeBootNet: Flq27.sys - C:\WINDOWS\System32\drivers\Flq27.sys File not found
SafeBootNet: Gms85.sys - C:\WINDOWS\System32\drivers\Gms85.sys File not found
SafeBootNet: Hns27.sys - C:\WINDOWS\System32\drivers\Hns27.sys File not found
SafeBootNet: Hnt17.sys - C:\WINDOWS\System32\drivers\Hnt17.sys File not found
SafeBootNet: Kqv27.sys - C:\WINDOWS\System32\drivers\Kqv27.sys File not found
SafeBootNet: Kqw41.sys - C:\WINDOWS\System32\drivers\Kqw41.sys File not found
SafeBootNet: Nty51.sys - C:\WINDOWS\System32\drivers\Nty51.sys File not found
SafeBootNet: Oua16.sys - C:\WINDOWS\System32\drivers\Oua16.sys File not found
SafeBootNet: Pvb05.sys - C:\WINDOWS\System32\drivers\Pvb05.sys File not found
SafeBootNet: Pvc28.sys - C:\WINDOWS\System32\drivers\Pvc28.sys File not found
SafeBootNet: Pvc74.sys - C:\WINDOWS\System32\drivers\Pvc74.sys File not found
SafeBootNet: Qwd28.sys - C:\WINDOWS\System32\drivers\Qwd28.sys File not found
SafeBootNet: Sag41.sys - C:\WINDOWS\System32\drivers\Sag41.sys File not found
SafeBootNet: Tag30.sys - C:\WINDOWS\System32\drivers\Tag30.sys File not found
SafeBootNet: Ubg84.sys - C:\WINDOWS\System32\drivers\Ubg84.sys File not found
SafeBootNet: Vch62.sys - C:\WINDOWS\System32\drivers\Vch62.sys File not found
SafeBootNet: Vci30.sys - C:\WINDOWS\System32\drivers\Vci30.sys File not found
SafeBootNet: Wdi27.sys - C:\WINDOWS\System32\drivers\Wdi27.sys File not found
SafeBootNet: Wdi40.sys - C:\WINDOWS\System32\drivers\Wdi40.sys File not found
SafeBootNet: Xej62.sys - C:\WINDOWS\System32\drivers\Xej62.sys File not found
SafeBootNet: Xek85.sys - C:\WINDOWS\System32\drivers\Xek85.sys File not found
ActiveX: {BCA4BCBE-EB6E-406B-B990-3BEBF3024B3B} - rundll32.exe "C:\Documents and Settings\chysa strickland\Application Data\Bitrix Security\tuduewai.dll", DllUnrer
[2010/10/23 13:37:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\Application Data\AntiVirus 2010
[2010/11/02 20:51:00 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/11/02 20:37:06 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010/11/02 20:12:00 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
2010/11/02 07:22:34 | 000,000,332 | -HS- | M] () -- C:\WINDOWS\tasks\MWOTKB.job
[2010/10/23 18:46:10 | 000,054,784 | RHS- | M] () -- C:\WINDOWS\System32\nddeapir0.dll
[2010/10/23 13:37:35 | 000,001,908 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus 2010.lnk
[2008/04/23 05:52:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\Pvc41.sys
[2008/04/18 06:18:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\Jpv28.sys
2007/12/06 15:41:20 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\drivers\ctl_w32.sys
[2009/10/31 10:17:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\86034324
[2010/10/24 10:03:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\AntiVirus 2010

:files
C:\WINDOWS\tasks\At*.job

:Commands
[resethosts]
[emptyflash]
[purity]
[emptytemp]
[Reboot]
```

*Push*








*OTL may ask to reboot the machine. Please do so if asked.*
*Click*







.
A report will open. *Copy* and *Paste* that report in your next reply.


----------



## Chelsea-Buns (Oct 28, 2010)

So I did all this, but when I click Run Fix, it says Windows Terminated the Program and your system is shutting down in :59, 58 ..etc.) And when it shut down and rebooted I got the Black screen ... Then I restarted the computer and it re booted properly. Tried it once more and then this all happened again.


----------



## CatByte (Feb 24, 2009)

Please try running the fix in safe mode

reboot > tap F8 repeatedly on startup until an options menu appears > arrow up to safe mode.


----------



## Chelsea-Buns (Oct 28, 2010)

I'm sure this is just as frustrating for me as it is for you but unfortunately running in safe mode still shows the same error...


----------



## Chelsea-Buns (Oct 28, 2010)

actually i tried to delete that inherit program and it did delete. Then I saved the inherit program renaming it to explorer.exe like you said. I then dragged the combofix program into it and ran it but nothing happens...should I run the explorer.exe in safe mode?


----------



## CatByte (Feb 24, 2009)

Hi, it was combofix that I wanted you to rename, but there are a couple of bad processes running that are stopping our tools from running, so I'm working on a manual fix, so bear with me,

I'll have something for you as soon as I can


----------



## CatByte (Feb 24, 2009)

Please do the following:

1. Please *download* *The Avenger2* by Swandog46 to your *Desktop*.
Right click on the Avenger.zip folder and select "Extract All..."
 Follow the prompts and extract the *avenger* folder to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (*Ctrl+C*):

```
Begin copying here:

Files to delete:
C:\Documents and Settings\chysa strickland\Application Data\Microsoft\svchost.exe
C:\Documents and Settings\chysa strickland\Local Settings\Temp\dwm.exe
C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe
C:\Documents and Settings\chysa strickland\Application Data\Bitrix Security\tuduewai.dll
C:\Documents and Settings\chysa strickland\Local Settings\Temp\Rdr.exe

Registry keys to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnonki

Programs to launch on reboot:
reg.exe DELETE "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v shell /f
reg.exe DELETE "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v load /f
reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /f /d Explorer.exe
```
_*
Note: the above code was created specifically for this user.**If you are not this user, do NOT follow these directions as they could damage the workings of your system.*_
3. Now, open the Avenger folder and *start The Avenger program* by clicking on its icon.

 Right click on the window under *Input script here:*, and select Paste.
 You can also *Paste* the text copied to the clipboard into this window by pressing (*Ctrl+V*), or click on the third button under the menu to paste it from the clipboard.
 Click on *Execute*
 Answer "*Yes*" twice when prompted.
4. *The Avenger will automatically do the following*:
It will *Restart your computer*. ( In cases where the code to execute contains "*Drivers to Delete*" or "*Drivers to Disable*", The Avenger will actually *restart your system twice.*)
On reboot, it will briefly *open a black command window* on your desktop, this is normal.
After the restart, it *creates a log file* that should open with the results of Avenger's actions.**This log file will be located at***C:\avenger.txt*
 The Avenger will also have *backed up all the files, etc., that you asked it to delete*, and will have zipped them and moved the zip archives to *C:\avenger\backup.zip*.
5. Please *copy/paste* the content of *c:\avenger.txt* into your reply


----------



## Chelsea-Buns (Oct 28, 2010)

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Thu Nov 04 05:45:55 2010

05:45:41: Error: Could not execute registry backup. (error 5: access is denied.)

//////////////////////////////////////////

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Error: file "C:\Documents and Settings\chysa strickland\Application Data\Microsoft\svchost.exe" not found!
Deletion of file "C:\Documents and Settings\chysa strickland\Application Data\Microsoft\svchost.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Error: file "C:\Documents and Settings\chysa strickland\Local Settings\Temp\dwm.exe" not found!
Deletion of file "C:\Documents and Settings\chysa strickland\Local Settings\Temp\dwm.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Error: file "C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe" not found!
Deletion of file "C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Windows\shell.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Error: file "C:\Documents and Settings\chysa strickland\Application Data\Bitrix Security\tuduewai.dll" not found!
Deletion of file "C:\Documents and Settings\chysa strickland\Application Data\Bitrix Security\tuduewai.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Error: file "C:\Documents and Settings\chysa strickland\Local Settings\Temp\Rdr.exe" not found!
Deletion of file "C:\Documents and Settings\chysa strickland\Local Settings\Temp\Rdr.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnonki" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnonki" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Program "reg.exe DELETE "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v shell /f" successfully queued to run on reboot.
Program "reg.exe DELETE "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v load /f" successfully queued to run on reboot.
Program "reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /f /d Explorer.exe" successfully queued to run on reboot.

Completed script processing.

*******************

Finished! Terminate.


----------



## CatByte (Feb 24, 2009)

OK,

Well OTL must have done something, as those files were no longer there (did you reboot the machine? - if not, please do so)

see if you can delete the copy of ComboFix from your desktop and download a fresh copy - rename it to SVCHOST.exe before saving it,

see if it will now run....

try it in safe mode if it wont run in normal mode


----------



## Chelsea-Buns (Oct 28, 2010)

I did all that you asked and it will not let me.


----------



## CatByte (Feb 24, 2009)

OK

we'll keep trying to find something that will run...

try an online scan

Go *here* to run an online scanner from *ESET.*

*Note:* You will need to use *Internet explorer* for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to *YES, I accept the Terms of Use.*
Click *Start*
When asked, allow the activeX control to install
Click *Start*
Make sure that the option *Remove found threats* is unticked and the *Scan Archives* option is ticked.
Click on Advanced Settings, ensure the options *Scan for potentially unwanted applications*, *Scan for potentially unsafe applications*, and *Enable Anti-Stealth Technology* are ticked.
Click *Scan*
Wait for the scan to finish
Use *notepad* to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic and also let me know how things are now.


----------



## Chelsea-Buns (Oct 28, 2010)

Ok so I clicked the link through IE, and it shows page cannot be displayed. But somehow now when I open IE google home page shows which wasn't showing since the 26 of Oct. So something happened with one of these scans. Anyways, I went on Firefox and found the page copied the link and pasted it into the IE search bar and it opened the site... BUT it will not allow me to run the scan I can click ESET Online Scannerand accept the terms of use, another window opens and the window just stays on a blue screen and doesn't do anything else.
I tried to run it through Mozilla but when I click on run online scan, it opens another window saying:

Firefox can't establish a connection to the server at download.eset.com.








* The site could be temporarily unavailable or too busy. Try again in a few
moments.

* If you are unable to load any pages, check your computer's network
connection.

* If your computer or network is protected by a firewall or proxy, make sure
that Firefox is permitted to access the Web.


----------



## CatByte (Feb 24, 2009)

OK,

well we are chipping away slowly

try the following program

Please download * Dr.Web CureIt *.****Save it to your *desktop:*

Doubleclick the *drweb-cureit.exe* file and click *Scan* to run express scan. Click *OK* in the**pop-up window to allow the scan.
This will scan the files currently running in memory and if something is found, click the *Yes* button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, select *Complete scan*.
Click the green arrow







at the right, and the scan will start.
Click *YES to all* if it asks if you want to cure/move the file.
When the scan has finished, in the *menu*, click *File* and choose *Save report list*
Save the report to your *desktop*. The report will be called *DrWeb.csv*
*Note:*this report may need to be renamed to *Dr.Web.txt* in order to post it on the forum.
Please post the *Dr.Web.txt* report in your next reply
Close Dr.Web Cureit.
*Important!* Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
*NOTE*. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on the *X* in the upper right corner.


----------



## Chelsea-Buns (Oct 28, 2010)

Ok so we first ran a "Express Scan" and failed to log the report when it was done. So we Then ran a "Complete Scan" and the results are uploaded. Now I am having issues with Mozilla Firefox here is the error:

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.





* This problem can sometimes be caused by disabling or refusing to accept
cookies.



Never mind about Mozilla, I got it to work, the Cookies settings were changed had to go on Mozilla Help Page and follow the Prompts and it works now.


----------



## CatByte (Feb 24, 2009)

OK, that cleared up a fair bit.

Let's see where we are at

please re-run OTL and post the log,

let's see what we have left to clean up


----------



## Chelsea-Buns (Oct 28, 2010)

I still cannot run OTL, it just shuts the computer off. When I re booted the computer it said rundll32.exe and some random message. Also when I start Mozilla it is still saying a message about :

C:\Program Files\Java\jre6\lib\deploy\jqs\ff\..\..\..\..\bin\jqsnotify.exe


----------



## CatByte (Feb 24, 2009)

Please run the following programs

Please download TDSSKiller.zip
Extract it to your desktop
Double click *TDSSKiller.exe*
Press *Start Scan*
Only if *Malicious* objects are found then ensure *Cure* is selected
Then click *Continue* > *Reboot now*

Copy and paste the log in your next reply
_A copy of the log will be saved automatically to the root of the drive (typically C:\)_

*

NEXT*

Please download *Malwarebytes' Anti-Malware * 

Double Click *mbam-setup.exe* to install the application.
Make sure a *checkmark* is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click *Finish.*
If an update is found, it will download and install the latest version.
Once the program has loaded, select* "Perform Quick Scan"*, then click* Scan.*
The scan may take some time to finish, so please be patient.
When the scan is complete, click *OK*, then *Show Results* to view the results.
Make sure that everything is checked, and click *Remove Selected*. <-- very important
When disinfection is completed, a *log* will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


----------



## Chelsea-Buns (Oct 28, 2010)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

06/11/2010 9:39:47 PM
mbam-log-2010-11-06 (21-39-47).txt

Scan type: Quick scan
Objects scanned: 127733
Time elapsed: 9 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 29
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 6
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\wrx.luna (Trojan.Dialer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wrx.luna.1 (Trojan.Dialer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{006c2f9b-122d-438f-bac0-de3c620d2ec6} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{010653e4-75ec-4d9b-ae49-f64fc810770d} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bf0a1ff4-bbaf-487f-bc85-a24ef8f443a8} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7aa32fc7-133b-4ae7-998e-ced0d9829b12} (Trojan.Dialer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{01417316-4620-43c7-b635-f4f381596978} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{971d5b7b-f7df-43ee-b771-6b7fa09975c3} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{971d5b7b-f7df-43ee-b771-6b7fa09975c3} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7aa32fc7-133b-4ae7-998e-ced0d9829b12} (Trojan.Dialer) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdrom (Trojan.Patched) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\TrafficEngine (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DbgMgr (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_RUNTIME (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_RUNTIME2 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\restore (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\USB2_04 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ctl_w32 (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rlist (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\music system (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{10884c46-3c20-43b4-bcd4-0e583d67e771}\NameServer (Trojan.DNSChanger) -> Data: 93.188.164.124,93.188.160.204 -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\All Users\Application Data\86034324 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\chysa strickland\Application Data\WinTouch (Adware.WinPop) -> Quarantined and deleted successfully.
C:\Program Files\Insider (Adware.DnsInsider) -> Quarantined and deleted successfully.
C:\Program Files\Temporary (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\WinAble (Trojan.Adloader) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\WinAble\winable.exe.lzma (Trojan.Adloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\cdrom.sys (Trojan.Patched) -> Quarantined and deleted successfully.
C:\Documents and Settings\chysa strickland\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\60a2u50V.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ClickToFindandFixErrors_Intl.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\chysa strickland\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Public\Favorites\csrss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\csrss.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\chysa strickland\Desktop\explorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\ctl_w32.sys (Rootkit.Agent) -> Quarantined and deleted successfully.


----------



## Chelsea-Buns (Oct 28, 2010)

TDSSkiller.zip found nothing


----------



## CatByte (Feb 24, 2009)

Hi

Please delete the copy of ComboFix that you have on your desktop

download a fresh copy and rename it to combo.exe

disable your security programs and run combofix

pot the resulting log


----------



## Chelsea-Buns (Oct 28, 2010)

32788R22FWJFW\iexplore.exe

Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item. 

It will not let me run it.


----------



## CatByte (Feb 24, 2009)

OK

delete that copy that you have on the desk top

Now download a fresh copy

this time save it directly to the C:\ drive, rename it to *firefox.exe*

now run it from the *c:\ drive*

If you still get the same message, download inherit Save it diectly to your c:\drive as well. Now drag the combofix icon into inherit, wait for it to say OK, then try running it again.


----------



## Chelsea-Buns (Oct 28, 2010)

It still won't work. I tried downloading it to c:\ drive and then opening it, then downloading inherit to c:\ drive and it gave me the same error message.


----------



## CatByte (Feb 24, 2009)

did you drag the combofix .exe into inherit?

Please run this program then give it another try

Please download *exeHelper* to your desktop.

Double-click on *exeHelper.com* to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of *log.txt* (Will be created in the directory where you ran exeHelper.com)
*Note  If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).*


----------



## Chelsea-Buns (Oct 28, 2010)

exeHelper by Raktor
Build 20100414
Run at 11:16:02 on 11/07/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--


----------



## CatByte (Feb 24, 2009)

Hi

Please retry combo fix now

make sure you drag the combofix.exe into inherit - wait for it to say OK, then try it


----------



## Chelsea-Buns (Oct 28, 2010)

And again it wouldn't let me open it. Is there something blocking it?


----------



## CatByte (Feb 24, 2009)

Hi

Yes there is, but I'm not sure what it is, we've been chipping away at the infections bit by bit, but there are still infections present,

let's get another diagnostic log

Please run the following:

Please download *DDS* from *LINK 1* or *LINK 2*
and save it to your *desktop.*

Disable any script blocking protection
 Double click *dds.pif* to run the tool. 
When done, two *DDS.txt's* will open. 
Save both reports to your *desktop.*
---------------------------------------------------
Please include the contents of the following in your next reply:

*DDS.txt*
*Attach.txt*.


----------



## Chelsea-Buns (Oct 28, 2010)

Ok here they are


----------



## CatByte (Feb 24, 2009)

Hi

Please do the following

Please delete the copy of combofix that you have on your C:\drive

download a fresh copy but rename it to *iexplore.exe*

save it to your *desktop*

Now boot back into safe mode

reboot > tap F8 repeatedly on startup until an options menu appears > arrow up to safe mode with networking

now double click the rename combofix

Note: it must be renamed *iexplore.exe* and it must be run in safe mode


----------



## Chelsea-Buns (Oct 28, 2010)

ComboFix 10-11-03.04 - chysa strickland 07/11/2010 16:46:07.1.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.337 [GMT -5:00]
Running from: c:\documents and settings\chysa strickland\Desktop\ComboFix.exe
AV: *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
AV: avast! Antivirus *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Application Data\alot
c:\documents and settings\chysa strickland\Application Data\alot
c:\documents and settings\chysa strickland\Application Data\alot\Button_0\Button_0.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_0\Button_0.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Button_1\Button_1.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_1\Button_1.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Button_2\Button_2.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_2\Button_2.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Button_3\Button_3.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_3\Button_3.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Button_4\Button_4.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_4\Button_4.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Button_5\Button_5.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_5\Button_5.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Button_6\Button_6.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_6\Button_6.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Button_7\Button_7.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_7\Button_7.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Button_8\Button_8.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_8\Button_8.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Button_9\Button_9.xml
c:\documents and settings\chysa strickland\Application Data\alot\Button_9\Button_9.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\configurator\configurator.xml
c:\documents and settings\chysa strickland\Application Data\alot\configurator\configurator.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\contextMenu\contextMenu.xml
c:\documents and settings\chysa strickland\Application Data\alot\contextMenu\contextMenu.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\postInstallLayout\postInstallLayout.xml
c:\documents and settings\chysa strickland\Application Data\alot\postInstallLayout\postInstallLayout.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\products\products.xml
c:\documents and settings\chysa strickland\Application Data\alot\products\products.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\Resources\BrowserSearch\alot_search_defend.html
c:\documents and settings\chysa strickland\Application Data\alot\Resources\BrowserSearch\images\favicon.ico
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_0\images\alot_logo_button.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_0\images\alot_logo_button.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_image_search.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_image_search.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_news_search.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_news_search.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_search_button.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_search_button.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_shop_search.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_shop_search.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_videos_search.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_videos_search.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_web_search.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_1\images\alot_web_search.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_2\images\alot_configure.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_2\images\alot_configure.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_3\images\4678_icon.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_3\images\4678_icon.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_4\images\default_2304_default_1379_alot_cas_playgames.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_4\images\default_2304_default_1379_alot_cas_playgames.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_5\images\default_2303_default_1379_alot_cas_playgames.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_5\images\default_2303_default_1379_alot_cas_playgames.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_6\images\default_2305_default_1613_alot_online_games_tetriz.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_6\images\default_2305_default_1613_alot_online_games_tetriz.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_7\images\default_2306_default_2080_frogger_button.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_7\images\default_2306_default_2080_frogger_button.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_8\images\4675_icon.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_8\images\4675_icon.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_9\images\4680_icon.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Button_9\images\4680_icon.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\contextMenu\images\alot_icon.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\contextMenu\images\alot_icon.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\contextMenu\images\alot_logo_button.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\contextMenu\images\alot_logo_button.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\domains.dat
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\alot_brand.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\alot_splitter.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\discover.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\intro_popup.png
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\spinner.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\widget_bottom.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\widget_btnclose0.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\widget_btnclose1.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\widget_caption.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\widget_error_bg.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\widget_error_close.bmp
c:\documents and settings\chysa strickland\Application Data\alot\Resources\Shared\images\widget_error_icon.bmp
c:\documents and settings\chysa strickland\Application Data\alot\TimerManager\TimerManager.xml
c:\documents and settings\chysa strickland\Application Data\alot\TimerManager\TimerManager.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\toolbar.xml
c:\documents and settings\chysa strickland\Application Data\alot\toolbar.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\toolbarContextMenu\toolbarContextMenu.xml
c:\documents and settings\chysa strickland\Application Data\alot\toolbarContextMenu\toolbarContextMenu.xml.backup
c:\documents and settings\chysa strickland\Application Data\alot\ToolbarSearch\ToolbarSearch.xml
c:\documents and settings\chysa strickland\Application Data\alot\Updater\Updater.xml
c:\documents and settings\chysa strickland\Application Data\alot\Updater\Updater.xml.backup
c:\documents and settings\chysa strickland\Application Data\AntiVirus 2010
c:\documents and settings\chysa strickland\Application Data\Bitrix Security
c:\documents and settings\chysa strickland\Application Data\Bitrix Security\23102010_133801_553926296_skey_23-10-2010__13-39-23.zip
c:\documents and settings\chysa strickland\Application Data\Bitrix Security\ffcd
c:\documents and settings\chysa strickland\Application Data\Bitrix Security\fg.txt
c:\documents and settings\chysa strickland\Application Data\Bitrix Security\kezpay
c:\documents and settings\chysa strickland\Application Data\Bitrix Security\mxd1.txt
c:\documents and settings\chysa strickland\Application Data\Bitrix Security\plk.txt
c:\documents and settings\chysa strickland\Application Data\Bitrix Security\qnf.txt
c:\documents and settings\chysa strickland\Application Data\Bitrix Security\tuduewai_shrd
c:\documents and settings\chysa strickland\Application Data\Microsoft\stor.cfg
c:\documents and settings\chysa strickland\Application Data\Wobym
c:\documents and settings\chysa strickland\Application Data\Wobym\obave.ocu
c:\documents and settings\chysa strickland\Application Data\Zaga
c:\documents and settings\chysa strickland\Application Data\Zaga\epek.exe
c:\documents and settings\chysa strickland\g2mdlhlpx.exe
c:\documents and settings\chysa strickland\Local Settings\Temporary Internet Files\2whN43--T
c:\documents and settings\chysa strickland\Local Settings\Temporary Internet Files\5-Jl6i_Z1EP47-
c:\documents and settings\chysa strickland\Local Settings\Temporary Internet Files\OMPgj-V
c:\documents and settings\chysa strickland\System
c:\documents and settings\chysa strickland\System\win_qs8.jqx
c:\program files\Common Files\crosof~1
c:\program files\Common Files\crosof~1.net
c:\program files\Common Files\dobe~1
c:\program files\Common Files\stem32~1
c:\program files\fnts~1
c:\program files\icroso~1.net
c:\program files\mantec~1
c:\program files\ppatch~1
c:\program files\pppatc~1
c:\program files\pppatc~2
c:\program files\smante~1
c:\program files\WinPCap
c:\program files\WinPCap\rpcapd.exe
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\fnts~1
c:\windows\racle~1
c:\windows\system32\crosof~1
c:\windows\system32\crosof~1.net
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
c:\windows\wnsxs~1

c:\windows\system32\drivers\cdrom.sys was missing 
Restored copy from - c:\system volume information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP20\A0015760.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CORE
-------\Legacy_CTL_W32
-------\Legacy_LDRSVC
-------\Legacy_NPF
-------\Legacy_TCPSR
-------\Legacy_TNIDRIVER
-------\Service_ldrsvc
-------\Service_npf

((((((((((((((((((((((((( Files Created from 2010-10-07 to 2010-11-07 )))))))))))))))))))))))))))))))
.

2010-11-07 21:55 . 2009-11-13 22:57 62592 ----a-w- c:\windows\system32\drivers\cdrom.sys
2010-11-07 20:58 . 2010-11-07 20:58 630272 ----a-w- C:\dds.pif.com
2010-11-07 12:45 . 2010-11-07 12:45 85504 ----a-w- C:\Inherit.exe
2010-11-07 01:18 . 2010-11-07 01:18 -------- d-----w- c:\documents and settings\chysa strickland\Application Data\Malwarebytes
2010-11-07 01:17 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-07 01:17 . 2010-11-07 01:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-07 01:17 . 2010-11-07 01:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-07 01:17 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-05 19:55 . 2010-11-05 19:55 -------- d-----w- c:\documents and settings\chysa strickland\DoctorWeb
2010-11-04 09:45 . 2010-11-04 09:55 285 ----a-w- C:\avexport.bat
2010-11-04 00:52 . 2010-11-04 00:52 -------- d-----w- c:\documents and settings\chysa strickland\Application Data\AVG8
2010-11-03 21:11 . 2010-11-03 21:11 -------- d-----w- C:\_OTL
2010-10-28 11:50 . 2010-11-02 11:21 -------- d-----w- c:\program files\Emsisoft Anti-Malware
2010-10-28 11:33 . 2010-10-28 11:33 -------- d-----w- c:\program files\Panda Security
2010-10-24 20:09 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-10-24 20:09 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-10-24 20:09 . 2010-09-07 14:53 340048 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2010-10-24 20:09 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-10-24 20:09 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-10-24 20:09 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-10-24 20:09 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-10-24 20:09 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-10-24 20:08 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-10-24 20:08 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-10-24 20:08 . 2010-10-24 20:08 -------- d-----w- c:\program files\Alwil Software
2010-10-24 20:08 . 2010-10-24 20:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-10-24 19:40 . 2010-10-24 19:40 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2010-10-24 13:20 . 2010-10-24 13:20 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar
2010-10-24 13:19 . 2010-10-24 13:19 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-10-23 22:46 . 2010-10-23 22:46 54784 --sha-r- c:\windows\system32\nddeapir0.dll
2010-10-18 00:53 . 2010-10-18 00:53 -------- d-----w- c:\documents and settings\chysa strickland\Application Data\OpenOffice.org
2010-10-18 00:12 . 2010-10-18 00:12 -------- d-----w- c:\program files\JRE
2010-10-18 00:10 . 2010-10-18 00:11 -------- d-----w- c:\program files\OpenOffice.org 3
2010-10-13 21:22 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2010-10-13 21:21 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-15 22:30 . 2010-09-14 22:25 2516 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-10-15 22:30 . 2010-09-14 22:25 88 --sh--r- c:\documents and settings\All Users\Application Data\7C708295CE.sys
2010-09-18 16:23 . 2004-08-10 18:51 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-10 18:51 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-10 18:51 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-10 18:51 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58 . 2004-08-10 18:51 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2004-08-10 18:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2004-08-10 18:51 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 2004-08-10 18:50 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2004-08-10 18:51 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2004-08-10 18:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-08-10 18:51 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2004-08-10 18:51 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-04-17 04:24 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2004-08-10 18:50 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-10 18:51 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-10 18:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
.

------- Sigcheck -------

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\asyncmac.sys
[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\asyncmac.sys

[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kbdclass.sys
[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
[-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\kbdclass.sys

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntfs.sys
[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
[-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\$NtServicePackUninstall$\ntfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB930916$\ntfs.sys

[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB917953$\tcpip.sys

[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\browser.dll
[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\system32\browser.dll
[-] 2004-08-04 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\browser.dll

[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lsass.exe
[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lsass.exe

[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll
[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[-] 2005-08-22 . 36739B39267914BA69AD0610A0299732 . 197632 . . [5.1.2600.2743] . . c:\windows\$NtServicePackUninstall$\netman.dll
[-] 2005-08-22 . 3516D8A18B36784B1005B950B84232E1 . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll
[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB905414$\netman.dll

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\ServicePackFiles\i386\qmgr.dll
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\bits\qmgr.dll
[-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\$NtServicePackUninstall$\qmgr.dll

[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll
[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rpcss.dll
[-] 2005-07-26 . CE94A2BD25E3E9F4D46A7373FF455C6D . 397824 . . [5.1.2600.2726] . . c:\windows\$NtServicePackUninstall$\rpcss.dll
[-] 2005-07-26 . C369DF215D352B6F3A0B8C3469AA34F8 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2005-04-28 . DA383FB39A6F1C445F3AFC94B3EB1248 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-04-28 . C8061F289E000703E7672916B7FE1571 . 395776 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\rpcss.dll
[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\rpcss.dll

[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe
[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\services.exe
[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\services.exe

[-] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[-] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[-] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2006-08-25 . B0124CB21D28B1C9F678B566B6B57D92 . 617472 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll
[-] 2006-08-25 . C4E80875C1CF1222FC5EFD0314AE5C01 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\$NtUninstallKB923191$\comctl32.dll
[-] 2004-08-04 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[-] 2004-08-04 . 5AF68A5E44734A082442668E9C787743 . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\cryptsvc.dll
[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
[-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\cryptsvc.dll

[-] 2008-07-07 20:32 . 60D1A6342238378BFB7545C81EE3606C . 253952 . . [2001.12.4414.320] . . c:\windows\$NtServicePackUninstall$\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
[-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
[-] 2008-07-07 20:06 . A4AB3DCA4A383F0DF4988ABDEB84F9A4 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll
[-] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\$NtUninstallKB950974$\es.dll
[-] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\ServicePackFiles\i386\es.dll
[-] 2005-07-26 04:39 . 34BBD9ACC1538818F2C878898C64E793 . 243200 . . [2001.12.4414.308] . . c:\windows\$NtUninstallKB950974_0$\es.dll
[-] 2005-07-26 04:20 . 95F5FEA4C6DE2C3F28784D0DCC8F0DD3 . 243200 . . [2001.12.4414.308] . . c:\windows\$hf_mig$\KB902400\SP2QFE\es.dll
[-] 2004-08-04 11:00 . ACD36A2DD7D1E9D8A060AA651DC07E63 . 243200 . . [2001.12.4414.258] . . c:\windows\$NtUninstallKB902400$\es.dll

[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\imm32.dll
[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\imm32.dll

[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll
[-] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kernel32.dll
[-] 2007-04-16 . 09F7CB3687F86EDAA4CA081F7AB66C03 . 986112 . . [5.1.2600.3119] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2007-04-16 . A01F9CA902A88F7CED06884174D6419D . 984576 . . [5.1.2600.3119] . . c:\windows\$NtServicePackUninstall$\kernel32.dll
[-] 2004-08-04 . 888190E31455FAD793312F8D087146EB . 983552 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB935839$\kernel32.dll

[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll
[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[-] 2005-09-01 . 648BF0B4DDE4F7A1156DAE7174D36EFA . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2005-09-01 . A1A688EE56CF3BBD24EDEB815D48E9BA . 19968 . . [5.1.2600.2751] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll
[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB900725$\linkinfo.dll

[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lpk.dll
[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lpk.dll
[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lpk.dll

[-] 2010-09-10 . DE41132DA8E5A3CD57201C6F2175EC05 . 5957120 . . [8.00.6001.18975] . . c:\windows\system32\mshtml.dll
[-] 2010-09-10 . DE41132DA8E5A3CD57201C6F2175EC05 . 5957120 . . [8.00.6001.18975] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2010-09-10 . 8A03CC037E6B7D1796192815231B0C3F . 5958656 . . [8.00.6001.23067] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll
[-] 2010-06-24 . 94DC7E938C57F3C3D1BC4A0F68FC5830 . 5954560 . . [8.00.6001.23037] . . c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\mshtml.dll
[-] 2010-06-24 . 4D7EF94795384CD2BBAAB078B7929FEA . 5951488 . . [8.00.6001.18939] . . c:\windows\ie8updates\KB2360131-IE8\mshtml.dll
[-] 2010-05-06 . C7B7A88CC7D7ABA5C395145BF92F46F7 . 5950976 . . [8.00.6001.18928] . . c:\windows\ie8updates\KB2183461-IE8\mshtml.dll
[-] 2010-05-06 . 9BE28F749A7FE7F8F177C6AA2E9DA609 . 5953024 . . [8.00.6001.23019] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\mshtml.dll
[-] 2010-02-25 . 7054F6ADC9B670887659F1561603B0D0 . 5944832 . . [8.00.6001.18904] . . c:\windows\ie8updates\KB982381-IE8\mshtml.dll
[-] 2010-02-25 . 974772C74DA7C7A8E7C813A9908A845F . 5946880 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
[-] 2009-12-21 . BE6EEBEF636773A8E7A82214E81C563A . 5942784 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\mshtml.dll
[-] 2009-12-21 . E6B64C6C729BBC38AB7CC92CE33F97A5 . 5945856 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll
[-] 2009-10-29 . C0F9AC6FAB2C788FFEE3E69585A0E93F . 5944320 . . [8.00.6001.22945] . . c:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll
[-] 2009-10-29 . CBB1EF54B86EDB78649909DD1699E5CA . 5940736 . . [8.00.6001.18854] . . c:\windows\ie8updates\KB978207-IE8\mshtml.dll
[-] 2009-10-22 . CDA69BC1C23B0EA033B989F67CB722FF . 5939712 . . [8.00.6001.18852] . . c:\windows\ie8updates\KB976325-IE8\mshtml.dll
[-] 2009-10-22 . A6CF28C6E0B6D10098AB601D85EE55E8 . 5943296 . . [8.00.6001.22942] . . c:\windows\$hf_mig$\KB976749-IE8\SP3QFE\mshtml.dll
[-] 2009-08-29 . 0E49677EE57A928765FC47FFBACD5326 . 5940224 . . [8.00.6001.18828] . . c:\windows\ie8updates\KB976749-IE8\mshtml.dll
[-] 2009-08-29 . B68F6E6C66D17D9EDABF3D5DA71046DA . 5942272 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\mshtml.dll
[-] 2009-07-19 . 5A32B43A48D6DCA339BF24105D9A028F . 5937152 . . [8.00.6001.18812] . . c:\windows\ie8updates\KB974455-IE8\mshtml.dll
[-] 2009-07-19 . F25D866DD486AD30E05E5596CB363C3E . 5938176 . . [8.00.6001.22902] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll
[-] 2009-05-13 . EEAADAA744B20E68CF5EB4FBB4F8AFA9 . 5936128 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\mshtml.dll
[-] 2009-05-13 . 1290E417BF806185CC7B2845E78A104E . 5936128 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll
[-] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\mshtml.dll
[-] 2009-02-21 . 1BB754AB47B327DE8DBF2FA18C36357C . 3596800 . . [7.00.6000.21015] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\mshtml.dll
[-] 2009-02-20 . C7C3E41CC2F6EB4A629FE2184136C098 . 3595264 . . [7.00.6000.16825] . . c:\windows\ie8\mshtml.dll
[-] 2009-01-17 . 3B413267DA8AE71C20E5EF3E54F74728 . 3594752 . . [7.00.6000.16809] . . c:\windows\ie7updates\KB963027-IE7\mshtml.dll
[-] 2009-01-16 . CC9D001B7370B292C35B366CA05B12B4 . 3596288 . . [7.00.6000.20996] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll
[-] 2008-12-13 . 121EC39A64D64205A88C2C45B034B455 . 3593216 . . [7.00.6000.16788] . . c:\windows\ie7updates\KB961260-IE7\mshtml.dll
[-] 2008-12-13 . C79FAD61CD4A26ED5AA8C16D991C6FBD . 3594752 . . [7.00.6000.20973] . . c:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll
[-] 2008-10-17 . EACAEDEF6FA2A969DE5B36190D45396F . 3593216 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB960714-IE7\mshtml.dll
[-] 2008-10-16 . B74F31A4BD83797D7A083F922169287D . 3595264 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll
[-] 2008-08-27 . 1AD035E04A7068EC2820B055A3131ED8 . 3593216 . . [7.00.6000.16735] . . c:\windows\ie7updates\KB958215-IE7\mshtml.dll
[-] 2008-08-26 . 25CC085720EE3617FD1F8AB9E2F7CAB2 . 3594752 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\mshtml.dll
[-] 2008-06-24 . EC936148284F557F19C333178768109B . 3592192 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB956390-IE7\mshtml.dll
[-] 2008-06-23 . 28B8231CA8D55FC85E027A57C90F5C88 . 3594240 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\mshtml.dll
[-] 2008-04-24 . 8976CAB317105F7431B08EA32AB73C65 . 3591680 . . [7.00.6000.16674] . . c:\windows\ie7updates\KB953838-IE7\mshtml.dll
[-] 2008-04-23 . 4D612FF5D3B7EEF200595AE6F95D5E68 . 3593728 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\mshtml.dll
[-] 2008-04-14 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\mshtml.dll
[-] 2008-03-01 . AB2C88167D78D71D93558ACECB24CC7A . 3591680 . . [7.00.6000.16640] . . c:\windows\ie7updates\KB950759-IE7\mshtml.dll
[-] 2008-03-01 . 4EE273E2B09317C1217EF0DB91F93534 . 3593216 . . [7.00.6000.20772] . . c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\mshtml.dll
[-] 2007-12-08 . A097C36412455F0C7E42377FAF8809B7 . 3592192 . . [7.00.6000.16608] . . c:\windows\ie7updates\KB947864-IE7\mshtml.dll
[-] 2007-12-07 . 976C46ED4A75FC66D9C596778898CE1E . 3593216 . . [7.00.6000.20733] . . c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\mshtml.dll
[-] 2007-10-30 . 54D8B404F17AA74C666F7F3AEF2AE459 . 3593216 . . [7.00.6000.20710] . . c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\mshtml.dll
[-] 2007-10-30 . 8AB7ECF59D6EBBE986277B65ED4A40A1 . 3590656 . . [7.00.6000.16587] . . c:\windows\ie7updates\KB944533-IE7\mshtml.dll
[-] 2007-08-20 . E267EE248CDA7667C19001C069DE867B . 3584512 . . [7.00.6000.16544] . . c:\windows\ie7updates\KB942615-IE7\mshtml.dll
[-] 2007-08-20 . AA8A4BD78D24FCDB96DDAEE3756AA372 . 3592192 . . [7.00.6000.20661] . . c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\mshtml.dll
[-] 2007-07-19 . BD609A26B683332A0E0E1445C5724851 . 3583488 . . [7.00.6000.16525] . . c:\windows\ie7updates\KB939653-IE7\mshtml.dll
[-] 2007-07-18 . 7CE243CFD47AD0DC431586CB8C542A11 . 3584000 . . [7.00.6000.20641] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\mshtml.dll
[-] 2007-05-08 . 1D4E3B86C601A2497C99790CC4D7DF26 . 3584000 . . [7.00.6000.20591] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\mshtml.dll
[-] 2007-05-08 . 5D90A7200F72DACE663EE78DE234FCC7 . 3583488 . . [7.00.6000.16481] . . c:\windows\ie7updates\KB937143-IE7\mshtml.dll
[-] 2007-05-04 . 00ADCB32832A10ED9419493BCEA97526 . 3064320 . . [6.00.2900.3132] . . c:\windows\ie7\mshtml.dll
[-] 2006-11-08 . CBF04597F9CF7739E572276A2698FDD3 . 3577856 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\mshtml.dll
[-] 2006-05-19 . 8687E029BE63C77D4919485068C54D77 . 3055104 . . [6.00.2900.2912] . . c:\windows\$hf_mig$\KB916281\SP2QFE\mshtml.dll
[-] 2006-05-19 . 8687E029BE63C77D4919485068C54D77 . 3055104 . . [6.00.2900.2912] . . c:\windows\$NtUninstallKB933566$\mshtml.dll
[-] 2006-05-19 . 284CE76B71DD5260B42A3CCF0135AF67 . 3052544 . . [6.00.2900.2912] . . c:\windows\$NtUninstallKB916281$\mshtml.dll
[-] 2006-02-01 . 51C91AC189321A320FC4BC90B56255A3 . 3073024 . . [6.00.2900.2838] . . c:\windows\$hf_mig$\KB912945\SP2QFE\mshtml.dll

[-] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\ServicePackFiles\i386\msvcrt.dll
[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\$NtServicePackUninstall$\msvcrt.dll
[-] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[-] 2004-08-04 . 98EC447E00229AFD88D5161A25D065DA . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll

[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-06-20 . 097722F235A1FB698BF9234E01B52637 . 245248 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\mswsock.dll
[-] 2008-06-20 . 1DFCA7713EA5A70D5D93B436AEA0317A . 245248 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\mswsock.dll
[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748_0$\mswsock.dll

[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netlogon.dll
[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
[-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\netlogon.dll

[-] 2010-04-28 . 472059774023F80EB7227EAF9A7ACDA1 . 2189952 . . [5.1.2600.5973] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2010-04-28 . 472059774023F80EB7227EAF9A7ACDA1 . 2189952 . . [5.1.2600.5973] . . c:\windows\system32\ntoskrnl.exe
[-] 2010-04-28 . 472059774023F80EB7227EAF9A7ACDA1 . 2189952 . . [5.1.2600.5973] . . c:\windows\system32\dllcache\ntoskrnl.exe
[-] 2010-04-27 . A2ABBEC40CDB57454645D06B7EBD22F5 . 2190080 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
[-] 2010-02-17 . D41C3CBAD0E1C0728D1CDFD541F60CFA . 2189952 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntoskrnl.exe
[-] 2010-02-16 . E1F653A542449D54FA2D27463D99B6B6 . 2190080 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[-] 2009-12-09 . 05BE3D9A71972223AFF6A3C823BA51B1 . 2189312 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe
[-] 2009-12-08 . 78EC47F9B9A3A1D539262D8834C896CE . 2189184 . . [5.1.2600.5913] . . c:\windows\$NtUninstallKB979683$\ntoskrnl.exe
[-] 2009-08-05 . 8415D9C7C050E7022AED8ABF281BE4A6 . 2189184 . . [5.1.2600.5857] . . c:\windows\$NtUninstallKB977165$\ntoskrnl.exe
[-] 2009-08-04 . FDE779EA1A564EBFE16F4E0F82B61BAD . 2189312 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
[-] 2009-02-07 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[-] 2009-02-06 . 7A95B10A73737EBF24139AAA63F5212B . 2189056 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB971486$\ntoskrnl.exe
[-] 2008-08-14 . 31914172342BFF330063F343AC6958FE . 2189184 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[-] 2008-08-14 . EEAF32F8E15A24F62BECB1BD403BB5C5 . 2189184 . . [5.1.2600.5657] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[-] 2008-04-13 . 0C89243C7C3EE199B96FCC16990E0679 . 2188928 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[-] 2008-04-13 . 0C89243C7C3EE199B96FCC16990E0679 . 2188928 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[-] 2007-02-28 . 5A5C8DB4AA962C714C8371FBDF189FC9 . 2182144 . . [5.1.2600.3093] . . c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
[-] 2005-03-02 . 28187802B7C368C0D3AEF7D4C382AABB . 2179456 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2005-03-02 . 4D4CF2C14550A4B7718E94A6E581856E . 2179328 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[-] 2004-08-04 . CE218BC7088681FAA06633E218596CA7 . 2180992 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\ntoskrnl.exe

[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\powrprof.dll
[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\powrprof.dll

[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\scecli.dll
[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\scecli.dll

[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfc.dll
[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfc.dll

[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\svchost.exe
[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\svchost.exe

[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll
[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[-] 2005-07-08 . 1418A3A6E76E5A2E3F5E43866E793A8B . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[-] 2005-07-08 . FB78839B36025AA286A51289ED28B73E . 249344 . . [5.1.2600.2716] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll
[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll

[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll
[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2007-03-08 . 7AA4F6C00405DFC4B70ED4214E7D687B . 578048 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 . B409909F6E2E8A7067076ED748ABF1E7 . 577536 . . [5.1.2600.3099] . . c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2005-03-02 . 1800F293BCCC8EDE8A70E12B88D80036 . 577024 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 . DE2DB164BBB35DB061AF0997E4499054 . 577024 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll

[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\userinit.exe

[-] 2010-09-10 . 36FE8ABC59AAFBE20CBE54BC372F9429 . 916480 . . [8.00.6001.18968] . . c:\windows\system32\wininet.dll
[-] 2010-09-10 . 36FE8ABC59AAFBE20CBE54BC372F9429 . 916480 . . [8.00.6001.18968] . . c:\windows\system32\dllcache\wininet.dll
[-] 2010-09-10 . 0555E190DCD06B8998E6DDCA42DAEB82 . 919552 . . [8.00.6001.23060] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll
[-] 2010-06-24 . 60237E50D575FBA9BEC9BC043F157149 . 919040 . . [8.00.6001.23037] . . c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\wininet.dll
[-] 2010-06-24 . D3DEB6B2B424AC93DE3801EAEB21A9A5 . 916480 . . [8.00.6001.18939] . . c:\windows\ie8updates\KB2360131-IE8\wininet.dll
[-] 2010-05-06 . 2D9C7B010409372C34F725DA5CCED083 . 916480 . . [8.00.6001.18923] . . c:\windows\ie8updates\KB2183461-IE8\wininet.dll
[-] 2010-05-06 . C1490F68B44AF8B781F52F12F564625D . 919040 . . [8.00.6001.23014] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll
[-] 2010-02-25 . 7A42CFED96CDA7F2FB1A26D1F9F65775 . 916480 . . [8.00.6001.18904] . . c:\windows\ie8updates\KB982381-IE8\wininet.dll
[-] 2010-02-25 . 4458D59F2B0369F4D3B137541D284041 . 919040 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
[-] 2009-12-21 . FF4241C74E0C0A5AFFFE05F584213ECB . 916480 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\wininet.dll
[-] 2009-12-21 . 5E1F666B8955FD77E65D65C4C4D882A3 . 916480 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll
[-] 2009-10-29 . 6AF52998B90F72FF2325D84D90EDA1CC . 916480 . . [8.00.6001.22945] . . c:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll
[-] 2009-10-29 . 75240F6EDBCE7B85DF66874407D38A4F . 916480 . . [8.00.6001.18854] . . c:\windows\ie8updates\KB978207-IE8\wininet.dll
[-] 2009-08-29 . CF0A5FE05BF614C24950D8FAEC1BC309 . 916480 . . [8.00.6001.18828] . . c:\windows\ie8updates\KB976325-IE8\wininet.dll
[-] 2009-08-29 . 972B226BDAD71C55F3CC9A72BBF8F1C1 . 916480 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
[-] 2009-07-03 . 7E8A47A2E6561274B83E257CE74803FD . 915456 . . [8.00.6001.18806] . . c:\windows\ie8updates\KB974455-IE8\wininet.dll
[-] 2009-07-03 . 38114DAB42FB2EB84D1726C42B8D80C5 . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
[-] 2009-05-13 . 366C72AF6970DB7BB39AB0142BF09DB5 . 915456 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\wininet.dll
[-] 2009-05-13 . C0EB6850C8A02A154281749DC61FAF22 . 915456 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[-] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\wininet.dll
[-] 2009-03-03 . 28775945CCD53DEE280EF58DEA1A94C4 . 826368 . . [7.00.6000.16827] . . c:\windows\ie8\wininet.dll
[-] 2009-03-03 . C8667854873938CA13C986F16B0CD183 . 828416 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll
[-] 2008-12-20 . 044E0A4E9FE97C0FB9AFE9C89E2A82E6 . 827904 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[-] 2008-12-20 . A82935D32D0672E8FF4E91AE398E901C . 826368 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\wininet.dll
[-] 2008-10-16 . 6741EAF7B7F110E803A6E38F6E5FA6B0 . 826368 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB961260-IE7\wininet.dll
[-] 2008-10-16 . 0D5B75171FF51775B630A431B6C667E8 . 827904 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[-] 2008-08-26 . 77C192FE56A70D7FA0247BA0A6201C32 . 827904 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
[-] 2008-08-26 . EF8EBA98145BFA44E80D17A3B3453300 . 826368 . . [7.00.6000.16735] . . c:\windows\ie7updates\KB958215-IE7\wininet.dll
[-] 2008-06-23 . 8C13D4A7479FA0A026EDA8ABCE82C0ED . 826368 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB956390-IE7\wininet.dll
[-] 2008-06-23 . C66402A06B83B036C195242C0C8CF83C . 827904 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
[-] 2008-04-23 . F6589BE784647CFDBC22EA51CCB1A57A . 826368 . . [7.00.6000.16674] . . c:\windows\ie7updates\KB953838-IE7\wininet.dll
[-] 2008-04-23 . 41546B396A526918DA7995A02EA04E51 . 827392 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[-] 2008-04-14 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\wininet.dll
[-] 2008-03-01 . AD21461AEF8244EDEC2EF18E55E1DCF3 . 826368 . . [7.00.6000.16640] . . c:\windows\ie7updates\KB950759-IE7\wininet.dll
[-] 2008-03-01 . 6316C2F0C61271C8ABDFF7429174879E . 827392 . . [7.00.6000.20772] . . c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[-] 2007-12-07 . 806D274C9A6C3AAEA5EAE8E4AF841E04 . 824832 . . [7.00.6000.16608] . . c:\windows\ie7updates\KB947864-IE7\wininet.dll
[-] 2007-12-07 . B5B411BB229AE6EAD7652A32ED47BFB9 . 825344 . . [7.00.6000.20733] . . c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[-] 2007-10-10 . 30C1E0F34AD2972C72A01DB5C74AB065 . 824832 . . [7.00.6000.16574] . . c:\windows\ie7updates\KB944533-IE7\wininet.dll
[-] 2007-10-10 . 0E5D918F87EFA7D2424D66B499C7EB04 . 825344 . . [7.00.6000.20696] . . c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2007-08-20 . 774435E499D8E9643EC961A6103C361F . 824832 . . [7.00.6000.16544] . . c:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2007-08-20 . 357D54BF94FE9D6D8505A96B5C2A3BCA . 825344 . . [7.00.6000.20661] . . c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
[-] 2007-06-27 . D6ED5E042C5207553E7F5E842918137F . 824320 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
[-] 2007-06-27 . 8068CBB58FE60CC95AEB2CFF70178208 . 823808 . . [7.00.6000.16512] . . c:\windows\ie7updates\KB939653-IE7\wininet.dll
[-] 2007-04-25 . 431DEFBB4A3D7B0DC062C1B064623A2F . 823808 . . [7.00.6000.20583] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll
[-] 2007-04-25 . 0586A7F0B2FDB94D624F399D4728E7C8 . 822784 . . [7.00.6000.16473] . . c:\windows\ie7updates\KB937143-IE7\wininet.dll
[-] 2007-04-18 . 4261BA03AFD659DE04F0A17DFBDD454D . 665600 . . [6.00.2900.3121] . . c:\windows\ie7\wininet.dll
[-] 2006-11-08 . 92995334F993E6E49C25C6D02EC04401 . 818688 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\wininet.dll
[-] 2006-05-10 . D94CFFDB53E7AC867438E2DFD50E7CBC . 663552 . . [6.00.2900.2904] . . c:\windows\$hf_mig$\KB916281\SP2QFE\wininet.dll
[-] 2006-05-10 . D94CFFDB53E7AC867438E2DFD50E7CBC . 663552 . . [6.00.2900.2904] . . c:\windows\$NtUninstallKB933566$\wininet.dll
[-] 2006-05-10 . 38AB7A56F566D9AAAD31812494944824 . 658432 . . [6.00.2900.2904] . . c:\windows\$NtUninstallKB916281$\wininet.dll
[-] 2006-01-09 . DDE9597A3311748C1519444E2BC147BD . 662016 . . [6.00.2900.2823] . . c:\windows\$hf_mig$\KB912945\SP2QFE\wininet.dll

[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2_32.dll
[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2_32.dll

[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2help.dll
[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll
[-] 2004-08-04 . 9BEACB911CA61E5881102188AB7FB431 . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2help.dll

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

[-] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\ole32.dll
[-] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\dllcache\ole32.dll
[-] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB979687$\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ole32.dll
[-] 2005-07-26 . AB8231D13692AC5088EB9C226B0C0576 . 1285120 . . [5.1.2600.2726] . . c:\windows\$NtServicePackUninstall$\ole32.dll
[-] 2005-07-26 . A2F755E237FA2CDD748A80BFBE6657F3 . 1285632 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll
[-] 2005-04-28 . 7440D29F257B7E44329343F944F2142C . 1286144 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll
[-] 2005-04-28 . 5950E4F28FDA9D147576BF6798937397 . 1285120 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\ole32.dll
[-] 2004-08-04 . 4FE9D9FA62D020E35E0AC6D1AEEB96F0 . 1281536 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\ole32.dll

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll
[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll

[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe
[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe

[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\xmlprov.dll
[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\xmlprov.dll

[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll
[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfcfiles.dll
[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfcfiles.dll

[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe

[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\system32\shsvcs.dll
[-] 2006-12-19 . 6815DEF9B810AEFAC107EEAF72DA6F82 . 134656 . . [6.00.2900.3051] . . c:\windows\$NtServicePackUninstall$\shsvcs.dll
[-] 2006-12-19 . 53D9184A21C5CBF600D918E51EF3A7E5 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll

[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll
[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regsvc.dll
[-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regsvc.dll

[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\schedsvc.dll
[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\schedsvc.dll

[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ssdpsrv.dll
[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
[-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ssdpsrv.dll

[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\termsrv.dll
[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
[-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\termsrv.dll

[-] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys
[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
[-] 2006-02-15 00:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$NtServicePackUninstall$\aec.sys
[-] 2004-08-04 04:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\$NtUninstallKB900485$\aec.sys

[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\agp440.sys
[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\agp440.sys
[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\agp440.sys
[-] 2004-08-04 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\agp440.sys

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ip6fw.sys
[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ip6fw.sys

[-] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
[-] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll
[-] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ServicePackFiles\i386\mfc40u.dll
[-] 2006-11-01 19:17 . 925F8B61ED301A317BA850EBEECBDAA0 . 927504 . . [4.1.0.61] . . c:\windows\$NtServicePackUninstall$\mfc40u.dll
[-] 2004-08-04 11:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\$NtUninstallKB924667$\mfc40u.dll

[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msgsvc.dll
[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
[-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msgsvc.dll

[-] 2006-10-19 01:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2006-10-19 01:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2005-01-28 17:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll

[-] 2010-04-28 . 756362706DE8BC92F11E197C98A73844 . 2066944 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe
[-] 2010-04-27 . DC57ABED7BDE1487E658968B4423BED7 . 2066816 . . [5.1.2600.5973] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2010-04-27 . DC57ABED7BDE1487E658968B4423BED7 . 2066816 . . [5.1.2600.5973] . . c:\windows\system32\ntkrnlpa.exe
[-] 2010-04-27 . DC57ABED7BDE1487E658968B4423BED7 . 2066816 . . [5.1.2600.5973] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[-] 2010-02-16 . A046C627EC20456E2959B7BD628E1FD0 . 2066816 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntkrnlpa.exe
[-] 2010-02-16 . DED8B5A89B085284634502E9D75AC78C . 2066944 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
[-] 2009-12-09 . FFDCE1EEA79C678C40237D4E031E5B51 . 2066176 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe
[-] 2009-12-08 . A6683E23468776F75EB2D8C6A02AAD3B . 2066048 . . [5.1.2600.5913] . . c:\windows\$NtUninstallKB979683$\ntkrnlpa.exe
[-] 2009-08-04 . 363B2BBEE0AEDC9E5433616D0AD0236A . 2066176 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
[-] 2009-08-04 . 7437BA6F538E89381A2E3643AED296C7 . 2066048 . . [5.1.2600.5857] . . c:\windows\$NtUninstallKB977165$\ntkrnlpa.exe
[-] 2009-02-07 . 5BA7F2141BC6DB06100D0E5A732C617A . 2066048 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB971486$\ntkrnlpa.exe
[-] 2009-02-06 . 607352B9CB3D708C67F6039097801B5A . 2066176 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2008-08-14 . A25E9B86EFFB2AF33BF51E676B68BFB0 . 2066048 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[-] 2008-08-14 . 4AC58F03EB94A72809949D757FC39D80 . 2066048 . . [5.1.2600.5657] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[-] 2008-04-13 . 109F8E3E3C82E337BB71B6BC9B895D61 . 2065792 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[-] 2008-04-13 . 109F8E3E3C82E337BB71B6BC9B895D61 . 2065792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[-] 2007-02-28 . 4D3DBDCCBF97F5BA1E74F322B155C3BA . 2059392 . . [5.1.2600.3093] . . c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
[-] 2005-03-02 . D8ABA3EAB509627E707A3B14F00FBB6B . 2056832 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2005-03-02 . 81013F36B21C7F72CF784CC6731E0002 . 2056832 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[-] 2004-08-04 . 947FB1D86D14AFCFFDB54BF837EC25D0 . 2056832 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe

[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\ServicePackFiles\i386\ntmssvc.dll
[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
[-] 2004-08-04 11:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\$NtServicePackUninstall$\ntmssvc.dll

[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\upnphost.dll
[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
[-] 2007-02-05 . 36ACA6CDC19C95FF468A1426EB7F32F0 . 185344 . . [5.1.2600.3077] . . c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll
[-] 2007-02-05 . ACA5D98663D879C6BAAFCEA7E2F1B710 . 185344 . . [5.1.2600.3077] . . c:\windows\$NtServicePackUninstall$\upnphost.dll
[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB931261$\upnphost.dll

[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\dsound.dll
[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
[-] 2004-08-04 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\dsound.dll

[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\d3d9.dll
[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
[-] 2004-08-04 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\d3d9.dll

[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\ddraw.dll
[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
[-] 2004-08-04 . 7ED462F353B3D915A418A689FA881F96 . 266240 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\ddraw.dll

[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\olepro32.dll
[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
[-] 2004-08-04 11:00 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\olepro32.dll

[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\perfctrs.dll
[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\perfctrs.dll
[-] 2004-08-04 . 96492C721C6EA517E2BFD5381FEF55E3 . 39936 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\perfctrs.dll

[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\version.dll
[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
[-] 2004-08-04 . D38408967BE738D0C1B47005BCE8CEEB . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\version.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 15:14 152160 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2006-06-29 269104]
"VX1000"="c:\windows\vVX1000.exe" [2006-06-29 707376]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 190696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati7rwxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Flq27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gms85.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hns27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hnt17.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Kqv27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Kqw41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nty51.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Oua16.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Pvb05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Pvc28.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Pvc74.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Qwd28.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Sag41.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Tag30.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ubg84.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vch62.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vci30.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdi27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdi40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Xej62.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Xek85.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\chysa strickland\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^Music System.exe]
path=c:\documents and settings\chysa strickland\Start Menu\Programs\Startup\Music System.exe
backup=c:\windows\pss\Music System.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk]
path=c:\documents and settings\chysa strickland\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
backup=c:\windows\pss\OpenOffice.org 3.1.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ohe]
c:\documents and settings\chysa strickland\My Documents\S?mantec\r?gsvr32.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sacbyo]
c:\program files\?ppPatch\?hkntfs.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smeuy]
c:\documents and settings\chysa strickland\My Documents\?ssembly\m?iexec.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-08-29 03:57 395776 ----a-w- c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2006-07-21 22:50 86016 -c--a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2006-07-06 13:15 151552 -c--a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2006-07-21 22:48 98304 -c--a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 22:50 221184 -c--a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 22:50 81920 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-04-02 20:11  342312 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2006-06-29 23:54 269104 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
2005-07-13 01:05 1117184 -c--a-w- c:\program files\McAfee\SpamKiller\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2006-07-21 22:47 81920 -c--a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2006-07-24 16:20 282624 -c--a-w- c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 08:00 132496 -c--a-w- c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
2006-06-29 23:42 707376 -c--a-w- c:\windows\vVX1000.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\chysa strickland\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Java\\jre1.6.0_02\\launch4j-tmp\\wowd.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1044:TCP"= 1044:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [24/10/2010 3:09 PM 340048]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [24/10/2010 3:09 PM 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [24/10/2010 3:09 PM 17744]
S0 ati7rwxx;ati7rwxx;c:\windows\system32\Drivers\ati7rwxx.sys --> c:\windows\system32\Drivers\ati7rwxx.sys [?]
S3 Cin05;Cin05;\??\c:\windows\System32\drivers\Cin05.sys --> c:\windows\System32\drivers\Cin05.sys [?]
S3 Flq27;Flq27;\??\c:\windows\System32\drivers\Flq27.sys --> c:\windows\System32\drivers\Flq27.sys [?]
S3 Gms85;Gms85;\??\c:\windows\System32\drivers\Gms85.sys --> c:\windows\System32\drivers\Gms85.sys [?]
S3 Hns27;Hns27;\??\c:\windows\System32\drivers\Hns27.sys --> c:\windows\System32\drivers\Hns27.sys [?]
S3 Hnt17;Hnt17;\??\c:\windows\System32\drivers\Hnt17.sys --> c:\windows\System32\drivers\Hnt17.sys [?]
S3 Kqv27;Kqv27;\??\c:\windows\System32\drivers\Kqv27.sys --> c:\windows\System32\drivers\Kqv27.sys [?]
S3 Kqw41;Kqw41;\??\c:\windows\System32\drivers\Kqw41.sys --> c:\windows\System32\drivers\Kqw41.sys [?]
S3 Nty51;Nty51;\??\c:\windows\System32\drivers\Nty51.sys --> c:\windows\System32\drivers\Nty51.sys [?]
S3 Oua16;Oua16;\??\c:\windows\System32\drivers\Oua16.sys --> c:\windows\System32\drivers\Oua16.sys [?]
S3 Pvb05;Pvb05;\??\c:\windows\System32\drivers\Pvb05.sys --> c:\windows\System32\drivers\Pvb05.sys [?]
S3 Pvc28;Pvc28;\??\c:\windows\System32\drivers\Pvc28.sys --> c:\windows\System32\drivers\Pvc28.sys [?]
S3 Pvc74;Pvc74;\??\c:\windows\System32\drivers\Pvc74.sys --> c:\windows\System32\drivers\Pvc74.sys [?]
S3 Qwd28;Qwd28;\??\c:\windows\System32\drivers\Qwd28.sys --> c:\windows\System32\drivers\Qwd28.sys [?]
S3 Sag41;Sag41;\??\c:\windows\System32\drivers\Sag41.sys --> c:\windows\System32\drivers\Sag41.sys [?]
S3 Tag30;Tag30;\??\c:\windows\System32\drivers\Tag30.sys --> c:\windows\System32\drivers\Tag30.sys [?]
S3 Tag74;Tag74;\??\c:\windows\System32\drivers\Tag74.sys --> c:\windows\System32\drivers\Tag74.sys [?]
S3 Ubg84;Ubg84;\??\c:\windows\System32\drivers\Ubg84.sys --> c:\windows\System32\drivers\Ubg84.sys [?]
S3 Vch62;Vch62;\??\c:\windows\System32\drivers\Vch62.sys --> c:\windows\System32\drivers\Vch62.sys [?]
S3 Vci30;Vci30;\??\c:\windows\System32\drivers\Vci30.sys --> c:\windows\System32\drivers\Vci30.sys [?]
S3 Wdi27;Wdi27;\??\c:\windows\System32\drivers\Wdi27.sys --> c:\windows\System32\drivers\Wdi27.sys [?]
S3 Wdi40;Wdi40;\??\c:\windows\System32\drivers\Wdi40.sys --> c:\windows\System32\drivers\Wdi40.sys [?]
S3 Xej62;Xej62;\??\c:\windows\System32\drivers\Xej62.sys --> c:\windows\System32\drivers\Xej62.sys [?]
S3 Xek85;Xek85;\??\c:\windows\System32\drivers\Xek85.sys --> c:\windows\System32\drivers\Xek85.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-11-07 c:\windows\Tasks\User_Feed_Synchronization-{A4CD5A22-7976-457E-987E-FE09DCEF65B6}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\chysa strickland\Start Menu\Programs\IMVU\Run IMVU.lnk
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - 
FF - ProfilePath - c:\documents and settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - plugin: c:\documents and settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: XULRunner: {684EEE60-404C-40D2-8E90-DF22A568A0AB} - c:\documents and settings\chysa strickland\Local Settings\Application Data\{684EEE60-404C-40D2-8E90-DF22A568A0AB}
FF - HiddenExtension: XULRunner: {B263A98A-C290-460A-B8F1-1C3405E865F1} - c:\documents and settings\Administrator\Local Settings\Application Data\{B263A98A-C290-460A-B8F1-1C3405E865F1}\
FF - HiddenExtension: XULRunner: {9C82F334-8236-4180-B136-8A10B8571B6A} - c:\documents and settings\chysa strickland\Local Settings\Application Data\{9C82F334-8236-4180-B136-8A10B8571B6A}
FF - HiddenExtension: XULRunner: {9B52B5AA-6616-42CD-9208-25F6E1C3B4C6} - c:\documents and settings\Administrator\Local Settings\Application Data\{9B52B5AA-6616-42CD-9208-25F6E1C3B4C6}\
FF - HiddenExtension: XULRunner: {16DD6999-7DE2-4C5C-AA72-900FC0246FC9} - c:\documents and settings\chysa strickland\Local Settings\Application Data\{16DD6999-7DE2-4C5C-AA72-900FC0246FC9}
FF - HiddenExtension: XULRunner: {CD312C35-B986-409F-8443-95827FAEB5A1} - c:\documents and settings\Administrator\Local Settings\Application Data\{CD312C35-B986-409F-8443-95827FAEB5A1}\
FF - HiddenExtension: XULRunner: {C253B108-8C8B-48BB-971C-D62A33EA1A12} - c:\documents and settings\chysa strickland\Local Settings\Application Data\{C253B108-8C8B-48BB-971C-D62A33EA1A12}
FF - HiddenExtension: XULRunner: {F70BED0B-AE4E-493E-A935-C0EADCA623ED} - c:\documents and settings\Administrator\Local Settings\Application Data\{F70BED0B-AE4E-493E-A935-C0EADCA623ED}\
.
- - - - ORPHANS REMOVED - - - -

BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
BHO-{da127091-7c9b-a25d-76b0-e0ace143d5e7} - c:\windows\system32\FOPYs--Ns_2_w.dll
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-Internet Connection Wizard Setup Tool - c:\program files\Internet Explorer\Connection Wizard\icwsetup.exe
SafeBoot-ati1otxx.sys
SafeBoot-ati2fkxx.sys
MSConfigStartUp-AVG7_CC - c:\progra~1\Grisoft\AVG7\avgcc.exe
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
MSConfigStartUp-WinPop - c:\program files\WinPop\winpop.exe
ActiveSetup-{BCA4BCBE-EB6E-406B-B990-3BEBF3024B3B} - c:\documents and settings\chysa strickland\Application Data\Bitrix Security\tuduewai.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-07 17:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2588715536-2586016954-2968683179-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1308)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft LifeCam\MSCamSvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-11-07 17:26:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-07 22:26

Pre-Run: 33,314,639,872 bytes free
Post-Run: 33,059,373,056 bytes free

- - End Of File - - E54C97B4F0B875C0D890F84D23B80409


----------



## CatByte (Feb 24, 2009)

Hi

Please do the following:


Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. 
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

*Copy/paste the text inside the Codebox below into notepad:*

Here's how to do that:
Click* Start > Run* type *Notepad* click *OK.*
This will open an empty notepad file:

*Copy* all the text *inside of the code box* - *Press Ctrl+C* (or right click on the highlighted section and choose 'copy')


```
http://forums.techguy.org/7674237-post54.html

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati7rwxx.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Flq27.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Gms85.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hns27.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hnt17.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Kqv27.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Kqw41.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nty51.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Oua16.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Pvb05.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Pvc28.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Pvc74.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Qwd28.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Sag41.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Tag30.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ubg84.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vch62.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Vci30.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdi27.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdi40.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Xej62.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Xek85.sys]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ohe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sacbyo]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smeuy]


Driver::
ati7rwxx
Cin05
Flq27
Gms85
Hns27
Hnt17
Kqv27
Kqw41
Nty51
Oua16
Pvb05
Pvc28
Pvc74
Qwd28
Sag41
Tag30
Tag74
Ubg84
Vch62
Vci30
Wdi27
Wdi40
Xej62
Xek85

FireFox::
FF - ProfilePath - c:\documents and settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\
FF - HiddenExtension: XULRunner: {684EEE60-404C-40D2-8E90-DF22A568A0AB} - c:\documents and settings\chysa strickland\Local Settings\Application Data\{684EEE60-404C-40D2-8E90-DF22A568A0AB}
FF - HiddenExtension: XULRunner: {B263A98A-C290-460A-B8F1-1C3405E865F1} - c:\documents and settings\Administrator\Local Settings\Application Data\{B263A98A-C290-460A-B8F1-1C3405E865F1}\
FF - HiddenExtension: XULRunner: {9C82F334-8236-4180-B136-8A10B8571B6A} - c:\documents and settings\chysa strickland\Local Settings\Application Data\{9C82F334-8236-4180-B136-8A10B8571B6A}
FF - HiddenExtension: XULRunner: {9B52B5AA-6616-42CD-9208-25F6E1C3B4C6} - c:\documents and settings\Administrator\Local Settings\Application Data\{9B52B5AA-6616-42CD-9208-25F6E1C3B4C6}\
FF - HiddenExtension: XULRunner: {16DD6999-7DE2-4C5C-AA72-900FC0246FC9} - c:\documents and settings\chysa strickland\Local Settings\Application Data\{16DD6999-7DE2-4C5C-AA72-900FC0246FC9}
FF - HiddenExtension: XULRunner: {CD312C35-B986-409F-8443-95827FAEB5A1} - c:\documents and settings\Administrator\Local Settings\Application Data\{CD312C35-B986-409F-8443-95827FAEB5A1}\
FF - HiddenExtension: XULRunner: {C253B108-8C8B-48BB-971C-D62A33EA1A12} - c:\documents and settings\chysa strickland\Local Settings\Application Data\{C253B108-8C8B-48BB-971C-D62A33EA1A12}
FF - HiddenExtension: XULRunner: {F70BED0B-AE4E-493E-A935-C0EADCA623ED} - c:\documents and settings\Administrator\Local Settings\Application Data\{F70BED0B-AE4E-493E-A935-C0EADCA623ED}\

Collect::
c:\documents and settings\chysa strickland\application data\bitrix security\tuduewai.dll
c:\documents and settings\chysa strickland\My Documents\S?mantec\r?gsvr32.exe
c:\program files\?ppPatch\?hkntfs.exe 
c:\documents and settings\chysa strickland\My Documents\?ssembly\m?iexec.exe 

Folder::
c:\docume~1\chysas~1\applic~1\AntiVirus 2010

File::
C:\avexport.bat
```
Now *paste* the copied text into the open notepad - press *CTRL+V* (or right click and choose 'paste')
*
Save this file to your desktop, Save this as "CFScript"*

Here's how to do that:

1.Click *File*;
2.Click *Save As*... Change the directory to your *desktop*;
3.Change the* Save as type* to *"All Files";*
4.Type in the file name: *CFScript*
5.Click *Save ...*










Referring to the *screenshot* above, *drag CFScript.txt* into *ComboFix.exe.*
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. 
*Copy and paste the contents of the log in your next reply.*

CAUTION: *Do not* mouse-click ComboFix's window while it is running. That may cause it to stall.


----------



## Chelsea-Buns (Oct 28, 2010)

k doing the scan now k


----------



## Chelsea-Buns (Oct 28, 2010)

It won't let me run the scan, the error is coming up again. I tried it in safe mode with networking and then again without networking.


----------



## Chelsea-Buns (Oct 28, 2010)

ComboFix 10-11-03.04 - chysa strickland 07/11/2010 20:15:23.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.243 [GMT -5:00]
Running from: c:\documents and settings\chysa strickland\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\chysa strickland\Desktop\CFScript.txt
AV: *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
AV: avast! Antivirus *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

FILE ::
"C:\avexport.bat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\avexport.bat
c:\documents and settings\Administrator\Local Settings\Application Data\{9B52B5AA-6616-42CD-9208-25F6E1C3B4C6}\
c:\documents and settings\Administrator\Local Settings\Application Data\{9B52B5AA-6616-42CD-9208-25F6E1C3B4C6}\\chrome.manifest
c:\documents and settings\Administrator\Local Settings\Application Data\{9B52B5AA-6616-42CD-9208-25F6E1C3B4C6}\\chrome\content\_cfg.js
c:\documents and settings\Administrator\Local Settings\Application Data\{9B52B5AA-6616-42CD-9208-25F6E1C3B4C6}\\install.rdf
c:\documents and settings\Administrator\Local Settings\Application Data\{B263A98A-C290-460A-B8F1-1C3405E865F1}\
c:\documents and settings\Administrator\Local Settings\Application Data\{B263A98A-C290-460A-B8F1-1C3405E865F1}\\chrome.manifest
c:\documents and settings\Administrator\Local Settings\Application Data\{B263A98A-C290-460A-B8F1-1C3405E865F1}\\chrome\content\_cfg.js
c:\documents and settings\Administrator\Local Settings\Application Data\{B263A98A-C290-460A-B8F1-1C3405E865F1}\\install.rdf
c:\documents and settings\Administrator\Local Settings\Application Data\{CD312C35-B986-409F-8443-95827FAEB5A1}\
c:\documents and settings\Administrator\Local Settings\Application Data\{CD312C35-B986-409F-8443-95827FAEB5A1}\\chrome.manifest
c:\documents and settings\Administrator\Local Settings\Application Data\{CD312C35-B986-409F-8443-95827FAEB5A1}\\chrome\content\_cfg.js
c:\documents and settings\Administrator\Local Settings\Application Data\{CD312C35-B986-409F-8443-95827FAEB5A1}\\install.rdf
c:\documents and settings\Administrator\Local Settings\Application Data\{F70BED0B-AE4E-493E-A935-C0EADCA623ED}\
c:\documents and settings\Administrator\Local Settings\Application Data\{F70BED0B-AE4E-493E-A935-C0EADCA623ED}\\chrome.manifest
c:\documents and settings\Administrator\Local Settings\Application Data\{F70BED0B-AE4E-493E-A935-C0EADCA623ED}\\chrome\content\_cfg.js
c:\documents and settings\Administrator\Local Settings\Application Data\{F70BED0B-AE4E-493E-A935-C0EADCA623ED}\\install.rdf
c:\documents and settings\chysa strickland\Local Settings\Application Data\{16DD6999-7DE2-4C5C-AA72-900FC0246FC9}
c:\documents and settings\chysa strickland\Local Settings\Application Data\{16DD6999-7DE2-4C5C-AA72-900FC0246FC9}\chrome.manifest
c:\documents and settings\chysa strickland\Local Settings\Application Data\{16DD6999-7DE2-4C5C-AA72-900FC0246FC9}\chrome\content\_cfg.js
c:\documents and settings\chysa strickland\Local Settings\Application Data\{16DD6999-7DE2-4C5C-AA72-900FC0246FC9}\install.rdf
c:\documents and settings\chysa strickland\Local Settings\Application Data\{684EEE60-404C-40D2-8E90-DF22A568A0AB}
c:\documents and settings\chysa strickland\Local Settings\Application Data\{684EEE60-404C-40D2-8E90-DF22A568A0AB}\chrome.manifest
c:\documents and settings\chysa strickland\Local Settings\Application Data\{684EEE60-404C-40D2-8E90-DF22A568A0AB}\chrome\content\_cfg.js
c:\documents and settings\chysa strickland\Local Settings\Application Data\{684EEE60-404C-40D2-8E90-DF22A568A0AB}\install.rdf
c:\documents and settings\chysa strickland\Local Settings\Application Data\{9C82F334-8236-4180-B136-8A10B8571B6A}
c:\documents and settings\chysa strickland\Local Settings\Application Data\{9C82F334-8236-4180-B136-8A10B8571B6A}\chrome.manifest
c:\documents and settings\chysa strickland\Local Settings\Application Data\{9C82F334-8236-4180-B136-8A10B8571B6A}\chrome\content\_cfg.js
c:\documents and settings\chysa strickland\Local Settings\Application Data\{9C82F334-8236-4180-B136-8A10B8571B6A}\install.rdf
c:\documents and settings\chysa strickland\Local Settings\Application Data\{C253B108-8C8B-48BB-971C-D62A33EA1A12}
c:\documents and settings\chysa strickland\Local Settings\Application Data\{C253B108-8C8B-48BB-971C-D62A33EA1A12}\chrome.manifest
c:\documents and settings\chysa strickland\Local Settings\Application Data\{C253B108-8C8B-48BB-971C-D62A33EA1A12}\chrome\content\_cfg.js
c:\documents and settings\chysa strickland\Local Settings\Application Data\{C253B108-8C8B-48BB-971C-D62A33EA1A12}\install.rdf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ATI7RWXX
-------\Legacy_TAG74
-------\Service_ati7rwxx
-------\Service_Cin05
-------\Service_Flq27
-------\Service_Gms85
-------\Service_Hns27
-------\Service_Hnt17
-------\Service_Kqv27
-------\Service_Kqw41
-------\Service_Nty51
-------\Service_Oua16
-------\Service_Pvb05
-------\Service_Pvc28
-------\Service_Pvc74
-------\Service_Qwd28
-------\Service_Sag41
-------\Service_Tag30
-------\Service_Tag74
-------\Service_Ubg84
-------\Service_Vch62
-------\Service_Vci30
-------\Service_Wdi27
-------\Service_Wdi40
-------\Service_Xej62
-------\Service_Xek85

((((((((((((((((((((((((( Files Created from 2010-10-08 to 2010-11-08 )))))))))))))))))))))))))))))))
.

2010-11-07 21:55 . 2009-11-13 22:57 62592 ----a-w- c:\windows\system32\drivers\cdrom.sys
2010-11-07 20:58 . 2010-11-07 20:58 630272 ----a-w- C:\dds.pif.com
2010-11-07 12:45 . 2010-11-07 12:45 85504 ----a-w- C:\Inherit.exe
2010-11-07 01:18 . 2010-11-07 01:18 -------- d-----w- c:\documents and settings\chysa strickland\Application Data\Malwarebytes
2010-11-07 01:17 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-07 01:17 . 2010-11-07 01:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-07 01:17 . 2010-11-07 01:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-07 01:17 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-05 19:55 . 2010-11-05 19:55 -------- d-----w- c:\documents and settings\chysa strickland\DoctorWeb
2010-11-04 00:52 . 2010-11-04 00:52 -------- d-----w- c:\documents and settings\chysa strickland\Application Data\AVG8
2010-11-03 21:11 . 2010-11-03 21:11 -------- d-----w- C:\_OTL
2010-10-28 11:50 . 2010-11-02 11:21 -------- d-----w- c:\program files\Emsisoft Anti-Malware
2010-10-28 11:33 . 2010-10-28 11:33 -------- d-----w- c:\program files\Panda Security
2010-10-24 20:09 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-10-24 20:09 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-10-24 20:09 . 2010-09-07 14:53 340048 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2010-10-24 20:09 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-10-24 20:09 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-10-24 20:09 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-10-24 20:09 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-10-24 20:09 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-10-24 20:08 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-10-24 20:08 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-10-24 20:08 . 2010-10-24 20:08 -------- d-----w- c:\program files\Alwil Software
2010-10-24 20:08 . 2010-10-24 20:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-10-24 19:40 . 2010-10-24 19:40 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2010-10-24 13:20 . 2010-10-24 13:20 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar
2010-10-24 13:19 . 2010-10-24 13:19 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-10-23 22:46 . 2010-10-23 22:46 54784 --sha-r- c:\windows\system32\nddeapir0.dll
2010-10-18 00:53 . 2010-10-18 00:53 -------- d-----w- c:\documents and settings\chysa strickland\Application Data\OpenOffice.org
2010-10-18 00:12 . 2010-10-18 00:12 -------- d-----w- c:\program files\JRE
2010-10-18 00:10 . 2010-10-18 00:11 -------- d-----w- c:\program files\OpenOffice.org 3
2010-10-13 21:22 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2010-10-13 21:21 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-15 22:30 . 2010-09-14 22:25 2516 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-10-15 22:30 . 2010-09-14 22:25 88 --sh--r- c:\documents and settings\All Users\Application Data\7C708295CE.sys
2010-09-18 16:23 . 2004-08-10 18:51 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-10 18:51 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-10 18:51 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-10 18:51 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58 . 2004-08-10 18:51 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2004-08-10 18:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2004-08-10 18:51 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 2004-08-10 18:50 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2004-08-10 18:51 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2004-08-10 18:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-08-10 18:51 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2004-08-10 18:51 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-04-17 04:24 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2004-08-10 18:50 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-10 18:51 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-10 18:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
.

------- Sigcheck -------

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\asyncmac.sys
[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\asyncmac.sys

[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kbdclass.sys
[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
[-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\kbdclass.sys

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntfs.sys
[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
[-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\$NtServicePackUninstall$\ntfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB930916$\ntfs.sys

[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB917953$\tcpip.sys

[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\browser.dll
[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\system32\browser.dll
[-] 2004-08-04 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\browser.dll

[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lsass.exe
[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lsass.exe

[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll
[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[-] 2005-08-22 . 36739B39267914BA69AD0610A0299732 . 197632 . . [5.1.2600.2743] . . c:\windows\$NtServicePackUninstall$\netman.dll
[-] 2005-08-22 . 3516D8A18B36784B1005B950B84232E1 . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll
[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB905414$\netman.dll

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\ServicePackFiles\i386\qmgr.dll
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\bits\qmgr.dll
[-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\$NtServicePackUninstall$\qmgr.dll

[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll
[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rpcss.dll
[-] 2005-07-26 . CE94A2BD25E3E9F4D46A7373FF455C6D . 397824 . . [5.1.2600.2726] . . c:\windows\$NtServicePackUninstall$\rpcss.dll
[-] 2005-07-26 . C369DF215D352B6F3A0B8C3469AA34F8 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2005-04-28 . DA383FB39A6F1C445F3AFC94B3EB1248 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-04-28 . C8061F289E000703E7672916B7FE1571 . 395776 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\rpcss.dll
[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\rpcss.dll

[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe
[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\services.exe
[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\services.exe

[-] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[-] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[-] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2006-08-25 . B0124CB21D28B1C9F678B566B6B57D92 . 617472 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll
[-] 2006-08-25 . C4E80875C1CF1222FC5EFD0314AE5C01 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\$NtUninstallKB923191$\comctl32.dll
[-] 2004-08-04 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[-] 2004-08-04 . 5AF68A5E44734A082442668E9C787743 . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\cryptsvc.dll
[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
[-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\cryptsvc.dll

[-] 2008-07-07 20:32 . 60D1A6342238378BFB7545C81EE3606C . 253952 . . [2001.12.4414.320] . . c:\windows\$NtServicePackUninstall$\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
[-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
[-] 2008-07-07 20:06 . A4AB3DCA4A383F0DF4988ABDEB84F9A4 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll
[-] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\$NtUninstallKB950974$\es.dll
[-] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\ServicePackFiles\i386\es.dll
[-] 2005-07-26 04:39 . 34BBD9ACC1538818F2C878898C64E793 . 243200 . . [2001.12.4414.308] . . c:\windows\$NtUninstallKB950974_0$\es.dll
[-] 2005-07-26 04:20 . 95F5FEA4C6DE2C3F28784D0DCC8F0DD3 . 243200 . . [2001.12.4414.308] . . c:\windows\$hf_mig$\KB902400\SP2QFE\es.dll
[-] 2004-08-04 11:00 . ACD36A2DD7D1E9D8A060AA651DC07E63 . 243200 . . [2001.12.4414.258] . . c:\windows\$NtUninstallKB902400$\es.dll

[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\imm32.dll
[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\imm32.dll

[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll
[-] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kernel32.dll
[-] 2007-04-16 . 09F7CB3687F86EDAA4CA081F7AB66C03 . 986112 . . [5.1.2600.3119] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2007-04-16 . A01F9CA902A88F7CED06884174D6419D . 984576 . . [5.1.2600.3119] . . c:\windows\$NtServicePackUninstall$\kernel32.dll
[-] 2004-08-04 . 888190E31455FAD793312F8D087146EB . 983552 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB935839$\kernel32.dll

[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll
[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[-] 2005-09-01 . 648BF0B4DDE4F7A1156DAE7174D36EFA . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2005-09-01 . A1A688EE56CF3BBD24EDEB815D48E9BA . 19968 . . [5.1.2600.2751] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll
[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB900725$\linkinfo.dll

[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lpk.dll
[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lpk.dll
[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lpk.dll

[-] 2010-09-10 . DE41132DA8E5A3CD57201C6F2175EC05 . 5957120 . . [8.00.6001.18975] . . c:\windows\system32\mshtml.dll
[-] 2010-09-10 . DE41132DA8E5A3CD57201C6F2175EC05 . 5957120 . . [8.00.6001.18975] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2010-09-10 . 8A03CC037E6B7D1796192815231B0C3F . 5958656 . . [8.00.6001.23067] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll
[-] 2010-06-24 . 94DC7E938C57F3C3D1BC4A0F68FC5830 . 5954560 . . [8.00.6001.23037] . . c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\mshtml.dll
[-] 2010-06-24 . 4D7EF94795384CD2BBAAB078B7929FEA . 5951488 . . [8.00.6001.18939] . . c:\windows\ie8updates\KB2360131-IE8\mshtml.dll
[-] 2010-05-06 . C7B7A88CC7D7ABA5C395145BF92F46F7 . 5950976 . . [8.00.6001.18928] . . c:\windows\ie8updates\KB2183461-IE8\mshtml.dll
[-] 2010-05-06 . 9BE28F749A7FE7F8F177C6AA2E9DA609 . 5953024 . . [8.00.6001.23019] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\mshtml.dll
[-] 2010-02-25 . 7054F6ADC9B670887659F1561603B0D0 . 5944832 . . [8.00.6001.18904] . . c:\windows\ie8updates\KB982381-IE8\mshtml.dll
[-] 2010-02-25 . 974772C74DA7C7A8E7C813A9908A845F . 5946880 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
[-] 2009-12-21 . BE6EEBEF636773A8E7A82214E81C563A . 5942784 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\mshtml.dll
[-] 2009-12-21 . E6B64C6C729BBC38AB7CC92CE33F97A5 . 5945856 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll
[-] 2009-10-29 . C0F9AC6FAB2C788FFEE3E69585A0E93F . 5944320 . . [8.00.6001.22945] . . c:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll
[-] 2009-10-29 . CBB1EF54B86EDB78649909DD1699E5CA . 5940736 . . [8.00.6001.18854] . . c:\windows\ie8updates\KB978207-IE8\mshtml.dll
[-] 2009-10-22 . CDA69BC1C23B0EA033B989F67CB722FF . 5939712 . . [8.00.6001.18852] . . c:\windows\ie8updates\KB976325-IE8\mshtml.dll
[-] 2009-10-22 . A6CF28C6E0B6D10098AB601D85EE55E8 . 5943296 . . [8.00.6001.22942] . . c:\windows\$hf_mig$\KB976749-IE8\SP3QFE\mshtml.dll
[-] 2009-08-29 . 0E49677EE57A928765FC47FFBACD5326 . 5940224 . . [8.00.6001.18828] . . c:\windows\ie8updates\KB976749-IE8\mshtml.dll
[-] 2009-08-29 . B68F6E6C66D17D9EDABF3D5DA71046DA . 5942272 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\mshtml.dll
[-] 2009-07-19 . 5A32B43A48D6DCA339BF24105D9A028F . 5937152 . . [8.00.6001.18812] . . c:\windows\ie8updates\KB974455-IE8\mshtml.dll
[-] 2009-07-19 . F25D866DD486AD30E05E5596CB363C3E . 5938176 . . [8.00.6001.22902] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll
[-] 2009-05-13 . EEAADAA744B20E68CF5EB4FBB4F8AFA9 . 5936128 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\mshtml.dll
[-] 2009-05-13 . 1290E417BF806185CC7B2845E78A104E . 5936128 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll
[-] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\mshtml.dll
[-] 2009-02-21 . 1BB754AB47B327DE8DBF2FA18C36357C . 3596800 . . [7.00.6000.21015] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\mshtml.dll
[-] 2009-02-20 . C7C3E41CC2F6EB4A629FE2184136C098 . 3595264 . . [7.00.6000.16825] . . c:\windows\ie8\mshtml.dll
[-] 2009-01-17 . 3B413267DA8AE71C20E5EF3E54F74728 . 3594752 . . [7.00.6000.16809] . . c:\windows\ie7updates\KB963027-IE7\mshtml.dll
[-] 2009-01-16 . CC9D001B7370B292C35B366CA05B12B4 . 3596288 . . [7.00.6000.20996] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll
[-] 2008-12-13 . 121EC39A64D64205A88C2C45B034B455 . 3593216 . . [7.00.6000.16788] . . c:\windows\ie7updates\KB961260-IE7\mshtml.dll
[-] 2008-12-13 . C79FAD61CD4A26ED5AA8C16D991C6FBD . 3594752 . . [7.00.6000.20973] . . c:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll
[-] 2008-10-17 . EACAEDEF6FA2A969DE5B36190D45396F . 3593216 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB960714-IE7\mshtml.dll
[-] 2008-10-16 . B74F31A4BD83797D7A083F922169287D . 3595264 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll
[-] 2008-08-27 . 1AD035E04A7068EC2820B055A3131ED8 . 3593216 . . [7.00.6000.16735] . . c:\windows\ie7updates\KB958215-IE7\mshtml.dll
[-] 2008-08-26 . 25CC085720EE3617FD1F8AB9E2F7CAB2 . 3594752 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\mshtml.dll
[-] 2008-06-24 . EC936148284F557F19C333178768109B . 3592192 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB956390-IE7\mshtml.dll
[-] 2008-06-23 . 28B8231CA8D55FC85E027A57C90F5C88 . 3594240 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\mshtml.dll
[-] 2008-04-24 . 8976CAB317105F7431B08EA32AB73C65 . 3591680 . . [7.00.6000.16674] . . c:\windows\ie7updates\KB953838-IE7\mshtml.dll
[-] 2008-04-23 . 4D612FF5D3B7EEF200595AE6F95D5E68 . 3593728 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\mshtml.dll
[-] 2008-04-14 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\mshtml.dll
[-] 2008-03-01 . AB2C88167D78D71D93558ACECB24CC7A . 3591680 . . [7.00.6000.16640] . . c:\windows\ie7updates\KB950759-IE7\mshtml.dll
[-] 2008-03-01 . 4EE273E2B09317C1217EF0DB91F93534 . 3593216 . . [7.00.6000.20772] . . c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\mshtml.dll
[-] 2007-12-08 . A097C36412455F0C7E42377FAF8809B7 . 3592192 . . [7.00.6000.16608] . . c:\windows\ie7updates\KB947864-IE7\mshtml.dll
[-] 2007-12-07 . 976C46ED4A75FC66D9C596778898CE1E . 3593216 . . [7.00.6000.20733] . . c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\mshtml.dll
[-] 2007-10-30 . 54D8B404F17AA74C666F7F3AEF2AE459 . 3593216 . . [7.00.6000.20710] . . c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\mshtml.dll
[-] 2007-10-30 . 8AB7ECF59D6EBBE986277B65ED4A40A1 . 3590656 . . [7.00.6000.16587] . . c:\windows\ie7updates\KB944533-IE7\mshtml.dll
[-] 2007-08-20 . E267EE248CDA7667C19001C069DE867B . 3584512 . . [7.00.6000.16544] . . c:\windows\ie7updates\KB942615-IE7\mshtml.dll
[-] 2007-08-20 . AA8A4BD78D24FCDB96DDAEE3756AA372 . 3592192 . . [7.00.6000.20661] . . c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\mshtml.dll
[-] 2007-07-19 . BD609A26B683332A0E0E1445C5724851 . 3583488 . . [7.00.6000.16525] . . c:\windows\ie7updates\KB939653-IE7\mshtml.dll
[-] 2007-07-18 . 7CE243CFD47AD0DC431586CB8C542A11 . 3584000 . . [7.00.6000.20641] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\mshtml.dll
[-] 2007-05-08 . 1D4E3B86C601A2497C99790CC4D7DF26 . 3584000 . . [7.00.6000.20591] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\mshtml.dll
[-] 2007-05-08 . 5D90A7200F72DACE663EE78DE234FCC7 . 3583488 . . [7.00.6000.16481] . . c:\windows\ie7updates\KB937143-IE7\mshtml.dll
[-] 2007-05-04 . 00ADCB32832A10ED9419493BCEA97526 . 3064320 . . [6.00.2900.3132] . . c:\windows\ie7\mshtml.dll
[-] 2006-11-08 . CBF04597F9CF7739E572276A2698FDD3 . 3577856 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\mshtml.dll
[-] 2006-05-19 . 8687E029BE63C77D4919485068C54D77 . 3055104 . . [6.00.2900.2912] . . c:\windows\$hf_mig$\KB916281\SP2QFE\mshtml.dll
[-] 2006-05-19 . 8687E029BE63C77D4919485068C54D77 . 3055104 . . [6.00.2900.2912] . . c:\windows\$NtUninstallKB933566$\mshtml.dll
[-] 2006-05-19 . 284CE76B71DD5260B42A3CCF0135AF67 . 3052544 . . [6.00.2900.2912] . . c:\windows\$NtUninstallKB916281$\mshtml.dll
[-] 2006-02-01 . 51C91AC189321A320FC4BC90B56255A3 . 3073024 . . [6.00.2900.2838] . . c:\windows\$hf_mig$\KB912945\SP2QFE\mshtml.dll

[-] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\ServicePackFiles\i386\msvcrt.dll
[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\$NtServicePackUninstall$\msvcrt.dll
[-] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[-] 2004-08-04 . 98EC447E00229AFD88D5161A25D065DA . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll

[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-06-20 . 097722F235A1FB698BF9234E01B52637 . 245248 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\mswsock.dll
[-] 2008-06-20 . 1DFCA7713EA5A70D5D93B436AEA0317A . 245248 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\mswsock.dll
[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748_0$\mswsock.dll

[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netlogon.dll
[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
[-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\netlogon.dll

[-] 2010-04-28 . 472059774023F80EB7227EAF9A7ACDA1 . 2189952 . . [5.1.2600.5973] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2010-04-28 . 472059774023F80EB7227EAF9A7ACDA1 . 2189952 . . [5.1.2600.5973] . . c:\windows\system32\ntoskrnl.exe
[-] 2010-04-28 . 472059774023F80EB7227EAF9A7ACDA1 . 2189952 . . [5.1.2600.5973] . . c:\windows\system32\dllcache\ntoskrnl.exe
[-] 2010-04-27 . A2ABBEC40CDB57454645D06B7EBD22F5 . 2190080 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
[-] 2010-02-17 . D41C3CBAD0E1C0728D1CDFD541F60CFA . 2189952 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntoskrnl.exe
[-] 2010-02-16 . E1F653A542449D54FA2D27463D99B6B6 . 2190080 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[-] 2009-12-09 . 05BE3D9A71972223AFF6A3C823BA51B1 . 2189312 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe
[-] 2009-12-08 . 78EC47F9B9A3A1D539262D8834C896CE . 2189184 . . [5.1.2600.5913] . . c:\windows\$NtUninstallKB979683$\ntoskrnl.exe
[-] 2009-08-05 . 8415D9C7C050E7022AED8ABF281BE4A6 . 2189184 . . [5.1.2600.5857] . . c:\windows\$NtUninstallKB977165$\ntoskrnl.exe
[-] 2009-08-04 . FDE779EA1A564EBFE16F4E0F82B61BAD . 2189312 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
[-] 2009-02-07 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[-] 2009-02-06 . 7A95B10A73737EBF24139AAA63F5212B . 2189056 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB971486$\ntoskrnl.exe
[-] 2008-08-14 . 31914172342BFF330063F343AC6958FE . 2189184 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[-] 2008-08-14 . EEAF32F8E15A24F62BECB1BD403BB5C5 . 2189184 . . [5.1.2600.5657] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[-] 2008-04-13 . 0C89243C7C3EE199B96FCC16990E0679 . 2188928 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[-] 2008-04-13 . 0C89243C7C3EE199B96FCC16990E0679 . 2188928 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[-] 2007-02-28 . 5A5C8DB4AA962C714C8371FBDF189FC9 . 2182144 . . [5.1.2600.3093] . . c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
[-] 2005-03-02 . 28187802B7C368C0D3AEF7D4C382AABB . 2179456 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2005-03-02 . 4D4CF2C14550A4B7718E94A6E581856E . 2179328 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[-] 2004-08-04 . CE218BC7088681FAA06633E218596CA7 . 2180992 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\ntoskrnl.exe

[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\powrprof.dll
[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\powrprof.dll

[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\scecli.dll
[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\scecli.dll

[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfc.dll
[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfc.dll

[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\svchost.exe
[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\svchost.exe

[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll
[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[-] 2005-07-08 . 1418A3A6E76E5A2E3F5E43866E793A8B . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[-] 2005-07-08 . FB78839B36025AA286A51289ED28B73E . 249344 . . [5.1.2600.2716] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll
[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll

[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll
[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2007-03-08 . 7AA4F6C00405DFC4B70ED4214E7D687B . 578048 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 . B409909F6E2E8A7067076ED748ABF1E7 . 577536 . . [5.1.2600.3099] . . c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2005-03-02 . 1800F293BCCC8EDE8A70E12B88D80036 . 577024 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 . DE2DB164BBB35DB061AF0997E4499054 . 577024 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll

[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\userinit.exe

[-] 2010-09-10 . 36FE8ABC59AAFBE20CBE54BC372F9429 . 916480 . . [8.00.6001.18968] . . c:\windows\system32\wininet.dll
[-] 2010-09-10 . 36FE8ABC59AAFBE20CBE54BC372F9429 . 916480 . . [8.00.6001.18968] . . c:\windows\system32\dllcache\wininet.dll
[-] 2010-09-10 . 0555E190DCD06B8998E6DDCA42DAEB82 . 919552 . . [8.00.6001.23060] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll
[-] 2010-06-24 . 60237E50D575FBA9BEC9BC043F157149 . 919040 . . [8.00.6001.23037] . . c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\wininet.dll
[-] 2010-06-24 . D3DEB6B2B424AC93DE3801EAEB21A9A5 . 916480 . . [8.00.6001.18939] . . c:\windows\ie8updates\KB2360131-IE8\wininet.dll
[-] 2010-05-06 . 2D9C7B010409372C34F725DA5CCED083 . 916480 . . [8.00.6001.18923] . . c:\windows\ie8updates\KB2183461-IE8\wininet.dll
[-] 2010-05-06 . C1490F68B44AF8B781F52F12F564625D . 919040 . . [8.00.6001.23014] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll
[-] 2010-02-25 . 7A42CFED96CDA7F2FB1A26D1F9F65775 . 916480 . . [8.00.6001.18904] . . c:\windows\ie8updates\KB982381-IE8\wininet.dll
[-] 2010-02-25 . 4458D59F2B0369F4D3B137541D284041 . 919040 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
[-] 2009-12-21 . FF4241C74E0C0A5AFFFE05F584213ECB . 916480 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\wininet.dll
[-] 2009-12-21 . 5E1F666B8955FD77E65D65C4C4D882A3 . 916480 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll
[-] 2009-10-29 . 6AF52998B90F72FF2325D84D90EDA1CC . 916480 . . [8.00.6001.22945] . . c:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll
[-] 2009-10-29 . 75240F6EDBCE7B85DF66874407D38A4F . 916480 . . [8.00.6001.18854] . . c:\windows\ie8updates\KB978207-IE8\wininet.dll
[-] 2009-08-29 . CF0A5FE05BF614C24950D8FAEC1BC309 . 916480 . . [8.00.6001.18828] . . c:\windows\ie8updates\KB976325-IE8\wininet.dll
[-] 2009-08-29 . 972B226BDAD71C55F3CC9A72BBF8F1C1 . 916480 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
[-] 2009-07-03 . 7E8A47A2E6561274B83E257CE74803FD . 915456 . . [8.00.6001.18806] . . c:\windows\ie8updates\KB974455-IE8\wininet.dll
[-] 2009-07-03 . 38114DAB42FB2EB84D1726C42B8D80C5 . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
[-] 2009-05-13 . 366C72AF6970DB7BB39AB0142BF09DB5 . 915456 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\wininet.dll
[-] 2009-05-13 . C0EB6850C8A02A154281749DC61FAF22 . 915456 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[-] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\wininet.dll
[-] 2009-03-03 . 28775945CCD53DEE280EF58DEA1A94C4 . 826368 . . [7.00.6000.16827] . . c:\windows\ie8\wininet.dll
[-] 2009-03-03 . C8667854873938CA13C986F16B0CD183 . 828416 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll
[-] 2008-12-20 . 044E0A4E9FE97C0FB9AFE9C89E2A82E6 . 827904 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[-] 2008-12-20 . A82935D32D0672E8FF4E91AE398E901C . 826368 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\wininet.dll
[-] 2008-10-16 . 6741EAF7B7F110E803A6E38F6E5FA6B0 . 826368 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB961260-IE7\wininet.dll
[-] 2008-10-16 . 0D5B75171FF51775B630A431B6C667E8 . 827904 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[-] 2008-08-26 . 77C192FE56A70D7FA0247BA0A6201C32 . 827904 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
[-] 2008-08-26 . EF8EBA98145BFA44E80D17A3B3453300 . 826368 . . [7.00.6000.16735] . . c:\windows\ie7updates\KB958215-IE7\wininet.dll
[-] 2008-06-23 . 8C13D4A7479FA0A026EDA8ABCE82C0ED . 826368 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB956390-IE7\wininet.dll
[-] 2008-06-23 . C66402A06B83B036C195242C0C8CF83C . 827904 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
[-] 2008-04-23 . F6589BE784647CFDBC22EA51CCB1A57A . 826368 . . [7.00.6000.16674] . . c:\windows\ie7updates\KB953838-IE7\wininet.dll
[-] 2008-04-23 . 41546B396A526918DA7995A02EA04E51 . 827392 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[-] 2008-04-14 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\wininet.dll
[-] 2008-03-01 . AD21461AEF8244EDEC2EF18E55E1DCF3 . 826368 . . [7.00.6000.16640] . . c:\windows\ie7updates\KB950759-IE7\wininet.dll
[-] 2008-03-01 . 6316C2F0C61271C8ABDFF7429174879E . 827392 . . [7.00.6000.20772] . . c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[-] 2007-12-07 . 806D274C9A6C3AAEA5EAE8E4AF841E04 . 824832 . . [7.00.6000.16608] . . c:\windows\ie7updates\KB947864-IE7\wininet.dll
[-] 2007-12-07 . B5B411BB229AE6EAD7652A32ED47BFB9 . 825344 . . [7.00.6000.20733] . . c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[-] 2007-10-10 . 30C1E0F34AD2972C72A01DB5C74AB065 . 824832 . . [7.00.6000.16574] . . c:\windows\ie7updates\KB944533-IE7\wininet.dll
[-] 2007-10-10 . 0E5D918F87EFA7D2424D66B499C7EB04 . 825344 . . [7.00.6000.20696] . . c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2007-08-20 . 774435E499D8E9643EC961A6103C361F . 824832 . . [7.00.6000.16544] . . c:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2007-08-20 . 357D54BF94FE9D6D8505A96B5C2A3BCA . 825344 . . [7.00.6000.20661] . . c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
[-] 2007-06-27 . D6ED5E042C5207553E7F5E842918137F . 824320 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
[-] 2007-06-27 . 8068CBB58FE60CC95AEB2CFF70178208 . 823808 . . [7.00.6000.16512] . . c:\windows\ie7updates\KB939653-IE7\wininet.dll
[-] 2007-04-25 . 431DEFBB4A3D7B0DC062C1B064623A2F . 823808 . . [7.00.6000.20583] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll
[-] 2007-04-25 . 0586A7F0B2FDB94D624F399D4728E7C8 . 822784 . . [7.00.6000.16473] . . c:\windows\ie7updates\KB937143-IE7\wininet.dll
[-] 2007-04-18 . 4261BA03AFD659DE04F0A17DFBDD454D . 665600 . . [6.00.2900.3121] . . c:\windows\ie7\wininet.dll
[-] 2006-11-08 . 92995334F993E6E49C25C6D02EC04401 . 818688 . . [7.00.5730.11] . . c:\windows\ie7updates\KB933566-IE7\wininet.dll
[-] 2006-05-10 . D94CFFDB53E7AC867438E2DFD50E7CBC . 663552 . . [6.00.2900.2904] . . c:\windows\$hf_mig$\KB916281\SP2QFE\wininet.dll
[-] 2006-05-10 . D94CFFDB53E7AC867438E2DFD50E7CBC . 663552 . . [6.00.2900.2904] . . c:\windows\$NtUninstallKB933566$\wininet.dll
[-] 2006-05-10 . 38AB7A56F566D9AAAD31812494944824 . 658432 . . [6.00.2900.2904] . . c:\windows\$NtUninstallKB916281$\wininet.dll
[-] 2006-01-09 . DDE9597A3311748C1519444E2BC147BD . 662016 . . [6.00.2900.2823] . . c:\windows\$hf_mig$\KB912945\SP2QFE\wininet.dll

[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2_32.dll
[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2_32.dll

[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2help.dll
[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll
[-] 2004-08-04 . 9BEACB911CA61E5881102188AB7FB431 . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2help.dll

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

[-] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\ole32.dll
[-] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\dllcache\ole32.dll
[-] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB979687$\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ole32.dll
[-] 2005-07-26 . AB8231D13692AC5088EB9C226B0C0576 . 1285120 . . [5.1.2600.2726] . . c:\windows\$NtServicePackUninstall$\ole32.dll
[-] 2005-07-26 . A2F755E237FA2CDD748A80BFBE6657F3 . 1285632 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll
[-] 2005-04-28 . 7440D29F257B7E44329343F944F2142C . 1286144 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll
[-] 2005-04-28 . 5950E4F28FDA9D147576BF6798937397 . 1285120 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\ole32.dll
[-] 2004-08-04 . 4FE9D9FA62D020E35E0AC6D1AEEB96F0 . 1281536 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\ole32.dll

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll
[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll

[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe
[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe

[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\xmlprov.dll
[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\xmlprov.dll

[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll
[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfcfiles.dll
[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfcfiles.dll

[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe

[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\system32\shsvcs.dll
[-] 2006-12-19 . 6815DEF9B810AEFAC107EEAF72DA6F82 . 134656 . . [6.00.2900.3051] . . c:\windows\$NtServicePackUninstall$\shsvcs.dll
[-] 2006-12-19 . 53D9184A21C5CBF600D918E51EF3A7E5 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll

[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll
[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regsvc.dll
[-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regsvc.dll

[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\schedsvc.dll
[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\schedsvc.dll

[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ssdpsrv.dll
[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
[-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ssdpsrv.dll

[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\termsrv.dll
[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
[-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\termsrv.dll

[-] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys
[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
[-] 2006-02-15 00:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$NtServicePackUninstall$\aec.sys
[-] 2004-08-04 04:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\$NtUninstallKB900485$\aec.sys

[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\agp440.sys
[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\agp440.sys
[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\agp440.sys
[-] 2004-08-04 . 2C428FA0C3E3A01ED93C9B2A27D8D4BB . 42368 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\agp440.sys

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ip6fw.sys
[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ip6fw.sys

[-] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
[-] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll
[-] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ServicePackFiles\i386\mfc40u.dll
[-] 2006-11-01 19:17 . 925F8B61ED301A317BA850EBEECBDAA0 . 927504 . . [4.1.0.61] . . c:\windows\$NtServicePackUninstall$\mfc40u.dll
[-] 2004-08-04 11:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\$NtUninstallKB924667$\mfc40u.dll

[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msgsvc.dll
[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
[-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msgsvc.dll

[-] 2006-10-19 01:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2006-10-19 01:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2005-01-28 17:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll

[-] 2010-04-28 . 756362706DE8BC92F11E197C98A73844 . 2066944 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe
[-] 2010-04-27 . DC57ABED7BDE1487E658968B4423BED7 . 2066816 . . [5.1.2600.5973] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2010-04-27 . DC57ABED7BDE1487E658968B4423BED7 . 2066816 . . [5.1.2600.5973] . . c:\windows\system32\ntkrnlpa.exe
[-] 2010-04-27 . DC57ABED7BDE1487E658968B4423BED7 . 2066816 . . [5.1.2600.5973] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[-] 2010-02-16 . A046C627EC20456E2959B7BD628E1FD0 . 2066816 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntkrnlpa.exe
[-] 2010-02-16 . DED8B5A89B085284634502E9D75AC78C . 2066944 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
[-] 2009-12-09 . FFDCE1EEA79C678C40237D4E031E5B51 . 2066176 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe
[-] 2009-12-08 . A6683E23468776F75EB2D8C6A02AAD3B . 2066048 . . [5.1.2600.5913] . . c:\windows\$NtUninstallKB979683$\ntkrnlpa.exe
[-] 2009-08-04 . 363B2BBEE0AEDC9E5433616D0AD0236A . 2066176 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
[-] 2009-08-04 . 7437BA6F538E89381A2E3643AED296C7 . 2066048 . . [5.1.2600.5857] . . c:\windows\$NtUninstallKB977165$\ntkrnlpa.exe
[-] 2009-02-07 . 5BA7F2141BC6DB06100D0E5A732C617A . 2066048 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB971486$\ntkrnlpa.exe
[-] 2009-02-06 . 607352B9CB3D708C67F6039097801B5A . 2066176 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2008-08-14 . A25E9B86EFFB2AF33BF51E676B68BFB0 . 2066048 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[-] 2008-08-14 . 4AC58F03EB94A72809949D757FC39D80 . 2066048 . . [5.1.2600.5657] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[-] 2008-04-13 . 109F8E3E3C82E337BB71B6BC9B895D61 . 2065792 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[-] 2008-04-13 . 109F8E3E3C82E337BB71B6BC9B895D61 . 2065792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[-] 2007-02-28 . 4D3DBDCCBF97F5BA1E74F322B155C3BA . 2059392 . . [5.1.2600.3093] . . c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
[-] 2005-03-02 . D8ABA3EAB509627E707A3B14F00FBB6B . 2056832 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2005-03-02 . 81013F36B21C7F72CF784CC6731E0002 . 2056832 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[-] 2004-08-04 . 947FB1D86D14AFCFFDB54BF837EC25D0 . 2056832 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe

[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\ServicePackFiles\i386\ntmssvc.dll
[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
[-] 2004-08-04 11:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\$NtServicePackUninstall$\ntmssvc.dll

[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\upnphost.dll
[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
[-] 2007-02-05 . 36ACA6CDC19C95FF468A1426EB7F32F0 . 185344 . . [5.1.2600.3077] . . c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll
[-] 2007-02-05 . ACA5D98663D879C6BAAFCEA7E2F1B710 . 185344 . . [5.1.2600.3077] . . c:\windows\$NtServicePackUninstall$\upnphost.dll
[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB931261$\upnphost.dll

[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\dsound.dll
[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
[-] 2004-08-04 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\dsound.dll

[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\d3d9.dll
[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
[-] 2004-08-04 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\d3d9.dll

[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\ddraw.dll
[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
[-] 2004-08-04 . 7ED462F353B3D915A418A689FA881F96 . 266240 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\ddraw.dll

[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\olepro32.dll
[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
[-] 2004-08-04 11:00 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\olepro32.dll

[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\perfctrs.dll
[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\perfctrs.dll
[-] 2004-08-04 . 96492C721C6EA517E2BFD5381FEF55E3 . 39936 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\perfctrs.dll

[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\version.dll
[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
[-] 2004-08-04 . D38408967BE738D0C1B47005BCE8CEEB . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\version.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 15:14 152160 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2006-06-29 269104]
"VX1000"="c:\windows\vVX1000.exe" [2006-06-29 707376]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 190696]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\chysa strickland\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^Music System.exe]
path=c:\documents and settings\chysa strickland\Start Menu\Programs\Startup\Music System.exe
backup=c:\windows\pss\Music System.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk]
path=c:\documents and settings\chysa strickland\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
backup=c:\windows\pss\OpenOffice.org 3.1.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-08-29 03:57 395776 ----a-w- c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2006-07-21 22:50 86016 -c--a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2006-07-06 13:15 151552 -c--a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2006-07-21 22:48 98304 -c--a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 22:50 221184 -c--a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 22:50 81920 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-04-02 20:11 342312 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2006-06-29 23:54 269104 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
2005-07-13 01:05 1117184 -c--a-w- c:\program files\McAfee\SpamKiller\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2006-07-21 22:47 81920 -c--a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2006-07-24 16:20 282624 -c--a-w- c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 08:00 132496 -c--a-w- c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
2006-06-29 23:42 707376 -c--a-w- c:\windows\vVX1000.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\chysa strickland\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Java\\jre1.6.0_02\\launch4j-tmp\\wowd.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1044:TCP"= 1044:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [24/10/2010 3:09 PM 340048]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [24/10/2010 3:09 PM 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [24/10/2010 3:09 PM 17744]
.
Contents of the 'Scheduled Tasks' folder

2010-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-11-08 c:\windows\Tasks\User_Feed_Synchronization-{A4CD5A22-7976-457E-987E-FE09DCEF65B6}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\chysa strickland\Start Menu\Programs\IMVU\Run IMVU.lnk
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - 
FF - ProfilePath - c:\documents and settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - plugin: c:\documents and settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-07 20:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2588715536-2586016954-2968683179-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1104)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft LifeCam\MSCamSvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-11-07 20:39:02 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-08 01:38
ComboFix2.txt 2010-11-07 22:26

Pre-Run: 33,035,579,392 bytes free
Post-Run: 33,013,448,704 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 325C603834B5FC2DED38EBBF8730344E


----------



## CatByte (Feb 24, 2009)

Hi

Please do the following:


Please open your *MalwareBytes AntiMalware* Program
Click the *Update Tab* and *search for updates*
If an update is found, it will download and install the latest version.
Once the program has loaded, select* "Perform Quick Scan"*, then click* Scan.*
The scan may take some time to finish, so please be patient.
When the scan is complete, click *OK*, then *Show Results* to view the results.
Make sure that everything is checked, and click *Remove Selected*. <-- very important
When disinfection is completed, a *log* will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
*Copy&Paste the entire report in your next reply.*

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. 


*NEXT*

*Run an on-line scan with Kaspersky*

Using Internet Explorer or Firefox, visit *Kaspersky On-line Scanner*

*1.* Click *Accept*, when prompted to download and install the program files and database of malware definitions. 
*2.* To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan
*3.* Click *Run* at the Security prompt. 
The program will then begin downloading and installing and will also update the database. 
Please be patient as this can take several minutes. 

Once the update is complete, click on *My Computer* under the green *Scan* bar to the left to start the scan. 
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. 
Do *NOT* be alarmed by what you see in the report. Many of the finds have likely been quarantined. 
Click *View scan report* at the bottom.










 Click the *Save as Text* button to save the file to your desktop so that you may post it in your next reply


----------



## Chelsea-Buns (Oct 28, 2010)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5072

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

08/11/2010 6:22:26 AM
mbam-log-2010-11-08 (06-22-26).txt

Scan type: Quick scan
Objects scanned: 149535
Time elapsed: 10 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{bca4bcbe-eb6e-406b-b990-3bebf3024b3b} (Password.Stealer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\__h-bifazr8 (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\IJKUK66HMN (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SMH2B46TDP (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\__h-BIFaZR8.exe (Adware.AdRotator) -> Quarantined and deleted successfully.


----------



## Chelsea-Buns (Oct 28, 2010)

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, November 8, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, November 07, 2010 17:02:48
Records in database: 4231704
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
E:\

Scan statistics:
Objects scanned: 87904
Threats found: 6
Infected objects found: 7
Suspicious objects found: 2
Scan duration: 03:34:32


File name / Threat / Threats count
C:\Documents and Settings\chysa strickland\DoctorWeb\Quarantine\A0010279.dll Infected: Trojan-PSW.Win32.Agent.uon 1
C:\Documents and Settings\chysa strickland\DoctorWeb\Quarantine\Rdv.exe Infected: Packed.Win32.Katusha.n 1
C:\Documents and Settings\chysa strickland\DoctorWeb\Quarantine\Rdw.exe Infected: Packed.Win32.Katusha.n 1
C:\Documents and Settings\chysa strickland\DoctorWeb\Quarantine\svchost.exe Infected: Trojan-Downloader.Win32.FraudLoad.xycl 1
C:\Documents and Settings\chysa strickland\DoctorWeb\Quarantine\w2 Infected: Trojan-Downloader.Win32.FraudLoad.hde 1
C:\Documents and Settings\chysa strickland\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ch 29\Sent items\341265C0-000000A6.eml Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\chysa strickland\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ch 29\Sent items\65CF7FF4-000000A0.eml Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP15\A0010273.exe Infected: not-a-virus:Monitor.MSIL.Keylogger.e 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP19\A0015701.exe Infected: Trojan-Downloader.Win32.FraudLoad.xycl 1

Selected area has been scanned.


----------



## CatByte (Feb 24, 2009)

you had some very nasty infections on your computer:

These type of infections can allow hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge.
If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Please read this: *How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?*

*
NEXT*

Most of the items found by Kaspersky are already in quarantine or old system restore points:

It also identifies suspicious emails in your sent items folder, so make sure you delete all the items there then empty your trash bin.

Now please post a fresh DDS and Attach.txt and advise how your computer is running now and if there are any outstanding issues:

I'll give you the instructions, save you from scrolling back pages:

Please download *DDS* from either of these links

*LINK 1* 
*LINK 2*

and save it to your *desktop.*

Disable any script blocking protection
 Double click *dds* to run the tool. 
When done, two *DDS.txt's* will open. 
Save both reports to your *desktop.*
---------------------------------------------------
*Please include the contents of the following in your next reply:*

*DDS.txt*
*Attach.txt*.


----------



## Chelsea-Buns (Oct 28, 2010)

Ok here they are


----------



## Chelsea-Buns (Oct 28, 2010)

One issue is when I open Mozilla it says I do not have the permissions and then when I click ok, it opens. As well, I want to thank you so very much for taking the time to help me with this, I am very appreciative. 
I was also wondering what Anti-Virus program you recommend so this does not happen again. And, is there a possibility that infections are still on my computer? When you were referring to email, my boyfriends hotmail account seems to be sending out spam, and it is sending it to mine as well. What should be done about that? He has a lot of accounts tied to that hotmail account such as his cell phone account, banking, credit card reciepts are in there too.
As for going to another computer and changing account passwords and such, will this be the only time this has to be done? Or on a regular? Thanks,


----------



## CatByte (Feb 24, 2009)

Reset you passwords on a regular basis, it's good practice.

Your boyfriend needs to change all his online passwords from a clean computer also as it sounds as though his email accounts have been compromised.

send an email to all his contacts not to open emails that appear to be from him unless there is a certain word in the title (pick a word) until it stops...changing his passwords should be enough.

as for Mozilla, if you still have inherit on your computer, drag the firefox.exe into it > wait for it to say OK, if that doesn't help, remove it completely, then download a fresh version and install it:

Your logs appear to be clean:

I use Microsoft Security Essential, Malwarebytes antimalware Pro and Web of Trust, I'm also behind a secured router.

The best thing you can do is just be careful, watch what you download, don't use P2P or torrents and don't open emails from anyone you don't know or click on links that you are not aware of in facebook etc.

we just have some house keeping to do now:

Please do the following:









*Your Java is out of date.* Older versions have vulnerabilities that malware can use to infect your system. *Please follow these steps to remove older version Java components and update.*

Download the latest version of *Java Runtime Environment (JRE) 22* and save it to your desktop.
Scroll down to where it says *JDK 6 Update 22 (JDK or JRE)*
Click the *Download JRE* button to the right
Select the *Windows* platform from the dropdown menu.
Read the License Agreement and then check the box that says: "_I agree to the Java SE Runtime Environment 6u22 with JavaFX 1 License Agreement_". Click on *Continue.* The page will refresh.
Click on the link to download *Windows Offline Installation* and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on *Add or Remove Programs* and remove all older versions of Java.
Check (_highlight_) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name.
Click the *Remove* or *Change/Remove* button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on * jre-6u22-windows-i586.exe* to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
On the General tab, under Temporary Internet Files, click the *Settings* button.
Next, click on the Delete Files button
There are two options in the window to clear the cache - *Leave BOTH Checked*

*Applications and Applets
Trace and Log Files*

Click OK on Delete Temporary Files Window
*Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.*
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.


*
NEXT*

*Follow these steps to uninstall Combofix *


Make sure your security programs are totally disabled.
Click *START* then *RUN*
Now copy/paste *Combofix /uninstall* into the *runbox* and click *OK.* Note the *space* between the *..X* and the */U*, it needs to be there.










*
NEXT*

Clean up with *OTL:*

Double-click *OTL.exe* to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the *CLEANUP* button
Say *Yes* to the prompt and then allow the program to reboot your computer.

*
If there are any logs/tools remaining > right click and delete them.*

*NEXT*

Below I have included a number of recommendations for how to protect your computer against malware infections.


It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article *
Strong passwords: How to create and use them* Then consider a *password keeper,* to keep all your passwords safe.

Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

*Make Internet Explorer more secure*
Click *Start* > *Run*
Type *Inetcpl.cpl* & click *OK*
Click on the *Security* tab
Click *Reset all zones to default level*
Make sure the *Internet Zone* is selected & Click *Custom level*
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click *OK*, then *Apply* button and then *OK* to exit the Internet Properties page.

*Download* *TFC* *to your desktop*
Close any open windows.
Double click the *TFC* icon to run the program
TFC *will close all open programs itself* in order to run, 
Click the *Start* button to begin the process. 
Allow *TFC* to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically *reboot your machine,*
if it doesn't, manually reboot to ensure a complete clean
*It's normal after running TFC cleaner that the PC will be slower to boot the first time. *

*WOT*, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
*Green* to go 
*Yellow* for caution 
*Red* to stop
 WOT has an addon available for both Firefox and IE

*Keep a backup of your important files* - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

*ERUNT* (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
*PC Safety and Security--What Do I Need?.*

***Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. *

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.


----------



## Chelsea-Buns (Oct 28, 2010)

When I try and open set program access and defaults it says:
rundll32.exe and that permissions error, I dragged mozilla into inherit and it didn't work. So I was going to go and remove and re download it. And I ran into this


----------



## CatByte (Feb 24, 2009)

Hi

Try the following:

Download *System Repair Engineer* and save it to your desktop.


Extract *all* files to the same folder on your desktop then double click on the *SREngLdR.exe* icon to run the program
Select *"Smart Scan"*
uncheck the *"Verify the digital signature of process modules"* box 
Click on the *[Scan]* button (this scan can take some time to complete)
When finished, click on the *[Save Reports]* button & save the log to *Desktop*
*Attach the log in your next reply* 
You may have to rename *SREngLOG.log* to *SREngLOG.txt* to upload it.


----------



## Chelsea-Buns (Oct 28, 2010)

ok, I tried to update Internet Explorer with the microsoft website you gave me, It downloaded but it won't open.
I am running the System Repair Engineer now as well.


----------



## Chelsea-Buns (Oct 28, 2010)

Oh and I also wanted to say that when I go into add/remove programs, there is a google toolbar that will not allow me to remove it. I click remove then it just refreshes and does nothing. As well do I need all the Windows Media Player Updates? I have like 100, and there is alot of other krap on there that seems repetitive.


----------



## Chelsea-Buns (Oct 28, 2010)

Here's the log, it seems like there is still something blocking my permissions to certain things. Like just now when I clicked on Manage Attachments it gives me this error again:
C:\Program Files\Java\jre6\lib\deploy\jqs\ff\..\..\..\..\bin\jqsnotify.exe


----------



## CatByte (Feb 24, 2009)

Please delete the OTL that you have on your desktop

download a fresh copy from this link and run it:

http://oldtimer.geekstogo.com/OTL.com


Double click on the







icon to run it.
Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath *Output* at the top, make sure *Standard output* is selected.
Under the *Extra Registry* section, check *Use SafeList*
Download the following file *scan.txt* to your *Desktop*. *Click here to download it*. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying *"Click Ok to load a custom scan from a file or Cancel to cancel"*
Click the Ok button and navigate to the file *scan.txt* which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (*Edit->Select All, Edit->Copy*) the contents of these files, one at a time and post them in your topic


----------



## Chelsea-Buns (Oct 28, 2010)

*OTL logfile created on: 09/11/2010 8:21:43 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\chysa strickland\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

502.00 Mb Total Physical Memory | 237.00 Mb Available Physical Memory | 47.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 32.16 Gb Free Space | 45.01% Space Free | Partition Type: NTFS

Computer Name: DCWDN4C1 | User Name: chysa strickland | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/09 20:13:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\OTL.com
PRC - [2010/09/07 10:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/01/15 22:09:37 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/09/28 09:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/05/19 10:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009/04/23 05:29:18 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
PRC - [2009/04/23 05:29:14 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/07/06 08:14:30 | 000,090,112 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2006/06/29 18:54:23 | 000,187,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
PRC - [2006/06/29 18:42:59 | 000,707,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\vVX1000.exe

========== Modules (SafeList) ==========

MOD - [2010/11/09 20:13:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\OTL.com
MOD - [2010/09/07 10:14:19 | 000,152,160 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxPlugins.dll
MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2010/04/06 03:52:46 | 002,462,720 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WMVCore.dll
MOD - [2009/08/13 08:55:04 | 001,748,992 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
MOD - [2009/07/11 23:02:02 | 000,653,120 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
MOD - [2009/04/16 13:17:38 | 000,371,712 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
MOD - [2009/04/16 11:57:36 | 000,597,504 | ---- | M] (STLport Consulting, Inc.) -- C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\stlport_vc7145.dll
MOD - [2008/04/13 19:12:09 | 000,053,760 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\winsta.dll
MOD - [2008/04/13 19:12:07 | 000,068,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\sti.dll
MOD - [2008/04/13 19:12:05 | 000,068,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\shgina.dll
MOD - [2008/04/13 19:12:02 | 000,249,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\odbc32.dll
MOD - [2008/04/13 19:12:02 | 000,245,760 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\netui1.dll
MOD - [2008/04/13 19:12:02 | 000,080,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\netui0.dll
MOD - [2008/04/13 19:12:02 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ntlanman.dll
MOD - [2008/04/13 19:12:01 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\netrap.dll
MOD - [2008/04/13 19:11:59 | 000,997,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msgina.dll
MOD - [2008/04/13 19:11:52 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drprov.dll
MOD - [2008/04/13 19:11:51 | 000,025,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\davclnt.dll
MOD - [2008/04/13 19:09:05 | 000,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cfgmgr32.dll
MOD - [2008/04/13 12:26:05 | 000,094,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\odbcint.dll
MOD - [2007/10/27 17:40:30 | 000,222,720 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wmasf.dll
MOD - [2006/10/18 20:47:18 | 000,284,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\PortableDeviceApi.dll
MOD - [2004/08/04 06:00:00 | 000,014,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\serwvdrv.dll
MOD - [2004/08/04 06:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\umdmxfrm.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/09/07 10:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/07 10:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/07 10:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009/09/28 09:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/05/19 10:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2006/12/14 02:21:20 | 000,045,056 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV)
SRV - [2006/12/14 02:02:08 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)
SRV - [2006/12/14 01:46:16 | 000,057,344 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR)
SRV - [2006/07/06 08:14:30 | 000,090,112 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2006/06/29 18:54:23 | 000,187,184 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamSvc.exe -- (MSCamSvc)

========== Driver Services (SafeList) ==========

DRV - [2010/09/07 09:53:58 | 000,340,048 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2010/09/07 09:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/07 09:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/07 09:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/07 09:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/09/07 09:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/09/07 09:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008/04/13 13:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 13:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 13:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2006/07/24 11:20:00 | 001,156,648 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2006/07/21 20:12:16 | 001,095,968 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2006/07/19 16:42:16 | 000,230,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1e5132.sys -- (e1express) Intel(R)
DRV - [2006/07/06 07:59:42 | 000,246,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\iaStor.sys -- (iaStor)
DRV - [2006/06/29 18:42:59 | 001,965,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VX1000.sys -- (VX1000)
DRV - [2006/01/10 12:07:58 | 000,004,864 | ---- | M] (GTek Technologies Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2004/08/03 23:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2003/11/17 15:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 15:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 15:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2002/07/17 07:53:02 | 000,016,877 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\Aspi32.sys -- (ASPI32)
DRV - [2001/08/17 15:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 15:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 15:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 15:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 15:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 14:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 14:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 14:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 14:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 14:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 14:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 14:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 14:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 14:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 14:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.ca/"
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..network.proxy.no_proxies_on: ""

FF - HKLM\software\mozilla\Firefox\Extensions\\{191d3f14-ff4c-4895-bdea-db54526cb49a}: C:\Program Files\Adobe\Flash [2010/10/28 15:31:49 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/16 15:09:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/08 21:27:42 | 000,000,000 | ---D | M]

[2010/06/09 06:11:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Extensions
[2010/06/09 06:11:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Extensions\[email protected]
[2010/03/19 10:20:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Extensions\[email protected]
[2010/11/08 22:23:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions
[2010/02/19 06:24:34 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2009/09/01 22:00:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/10 10:21:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\extensions\[email protected]
[2010/03/19 10:28:25 | 000,002,425 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\searchplugins\askcom.xml
[2007/11/12 17:48:12 | 000,002,031 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\searchplugins\facebook.xml
[2010/05/18 10:17:19 | 000,000,266 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\searchplugins\Search.xml
[2009/11/26 10:07:48 | 000,001,109 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Mozilla\Firefox\Profiles\e36lj4k3.default\searchplugins\wowd-search.xml
[2010/11/08 22:23:24 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/11/08 21:27:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/11/08 21:27:26 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2008/09/11 18:44:05 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll

O1 HOSTS File: ([2010/11/07 20:26:42 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll File not found
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O4 - HKLM..\Run: [HotKeysCmds] File not found
O4 - HKLM..\Run: [IAAnotif] File not found
O4 - HKLM..\Run: [IgfxTray] File not found
O4 - HKLM..\Run: [ISUSPM Startup] File not found
O4 - HKLM..\Run: [ISUSScheduler] File not found
O4 - HKLM..\Run: [iTunesHelper] File not found
O4 - HKLM..\Run: [LifeCam] File not found
O4 - HKLM..\Run: [MSKDetectorExe] File not found
O4 - HKLM..\Run: [Persistence] File not found
O4 - HKLM..\Run: [SigmatelSysTrayApp] File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] File not found
O4 - HKLM..\Run: [VX1000] File not found
O4 - HKCU..\Run: [ctfmon.exe] File not found
O4 - HKCU..\Run: [DellSupport] File not found
O4 - HKCU..\Run: [MSMSGS] File not found
O4 - HKCU..\Run: [msnmsgr] File not found
O4 - Startup: C:\Documents and Settings\chysa strickland\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\chysa strickland\Start Menu\Programs\IMVU\Run IMVU.lnk File not found
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.)
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} http://www.worldwinner.com/games/v50/tpir/tpir.cab (TPIR Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} http://www.worldwinner.com/games/v51/bejeweled/bejeweled.cab (Bejeweled Control)
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} http://zone.msn.com/bingame/dsh2/default/DinerDash2.1.0.0.68.cab (CPlayFirstDinerDash2Control Object)
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} http://sympatico.zone.msn.com/bingame/amad/default/atomaders.cab (AtlAtomadersCtlAttrib Class)
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} http://zone.msn.com/bingame/chnz/default/mjolauncher.cab (MJLauncherCtrl Class)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {95A311CD-EC8E-452A-BCEC-B844EB616D03} http://www.worldwinner.com/games/v51/bejeweledtwist/bejeweledtwist.cab (BejeweledTwist Control)
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} http://www.worldwinner.com/games/v57/wof/wof.cab (WoF Control)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} http://zone.msn.com/bingame/fotg/default/ddfotg.1.0.0.37.cab (CPlayFirstddfotgControl Object)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.100.2.1
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll File not found
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\chysa strickland\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\chysa strickland\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O29 - HKLM SecurityProviders - (msnsspc.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk - C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk - C:\PROGRA~1\DIGITA~1\DLG.exe - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^LimeWire On Startup.lnk - C:\PROGRA~1\LimeWire\LimeWire.exe - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^Music System.exe - C:\Documents and Settings\chysa strickland\Start Menu\Programs\Startup\Music System.exe - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^chysa strickland^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: Cin05.sys - Driver
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5CA109D3-A084-47E8-A9CB-D497322E3F50} - MSN Toolbar 3.0 & Silverlight 2.0
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{7843d7aa-576a-4136-9766-8325ddce8fb1} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
Unable to start service SrService!

========== Files/Folders - Created Within 30 Days ==========

[2010/11/09 20:13:09 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\OTL.com
[2010/11/08 22:21:08 | 000,000,000 | ---D | C] -- C:\sreng2
[2010/11/08 22:13:35 | 016,883,056 | ---- | C] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU(4).exe
[2010/11/08 22:11:03 | 016,883,056 | ---- | C] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU(3).exe
[2010/11/08 22:10:25 | 008,163,966 | ---- | C] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU(2).exe.part
[2010/11/08 22:09:22 | 005,538,508 | ---- | C] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU.exe.part
[2010/11/08 22:06:56 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/11/08 22:06:25 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\chysa strickland\Desktop\erunt-setup.exe
[2010/11/08 22:05:07 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\erunt-setup.exe
[2010/11/08 21:54:16 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\TFC.exe
[2010/11/08 21:29:14 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/11/08 21:28:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/11/08 21:27:55 | 000,000,000 | ---D | C] -- C:\Program Files\Sun
[2010/11/08 21:27:42 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/11/08 21:27:42 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/11/08 21:27:42 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/11/08 21:27:42 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/11/08 21:27:42 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/11/08 19:51:31 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/11/07 20:12:00 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/11/07 16:55:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/11/07 16:41:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/11/06 20:18:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\Application Data\Malwarebytes
[2010/11/06 20:17:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/06 20:17:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/11/06 20:17:48 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/06 20:17:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/05 14:55:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\DoctorWeb
[2010/11/03 19:52:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\Application Data\AVG8
[2010/10/28 06:50:44 | 000,000,000 | ---D | C] -- C:\Program Files\Emsisoft Anti-Malware
[2010/10/28 06:50:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\My Documents\Anti-Malware
[2010/10/28 06:33:37 | 000,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2010/10/24 15:09:15 | 000,165,584 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/10/24 15:09:15 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/10/24 15:09:14 | 000,340,048 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2010/10/24 15:09:14 | 000,046,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/10/24 15:09:14 | 000,023,376 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/10/24 15:09:13 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/10/24 15:09:13 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/10/24 15:09:13 | 000,028,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/10/24 15:08:28 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2010/10/24 15:08:25 | 000,167,592 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/10/24 15:08:07 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/10/24 15:08:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/10/24 14:40:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/10/17 19:53:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\Application Data\OpenOffice.org
[2010/10/17 19:12:10 | 000,000,000 | ---D | C] -- C:\Program Files\JRE
[2010/10/17 19:10:27 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2010/10/13 16:22:01 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/10/13 16:21:50 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comctl32.dll
[2010/10/11 16:26:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\chysa strickland\My Documents\HTML

========== Files - Modified Within 30 Days ==========

[2011/07/19 15:59:16 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/07/19 15:59:16 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/11/09 20:42:00 | 000,000,414 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{A4CD5A22-7976-457E-987E-FE09DCEF65B6}.job
[2010/11/09 20:13:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\OTL.com
[2010/11/09 07:52:35 | 000,281,403 | ---- | M] () -- C:\bday.pdf
[2010/11/08 22:20:53 | 000,684,619 | ---- | M] () -- C:\sreng2.zip
[2010/11/08 22:17:17 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/08 22:13:34 | 016,883,056 | ---- | M] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU(4).exe
[2010/11/08 22:12:03 | 016,883,056 | ---- | M] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU(3).exe
[2010/11/08 22:10:43 | 008,163,966 | ---- | M] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU(2).exe.part
[2010/11/08 22:10:26 | 000,000,000 | ---- | M] () -- C:\IE8-WindowsXP-x86-ENU(2).exe
[2010/11/08 22:10:02 | 005,538,508 | ---- | M] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU.exe.part
[2010/11/08 22:09:24 | 000,000,000 | ---- | M] () -- C:\IE8-WindowsXP-x86-ENU.exe
[2010/11/08 22:06:59 | 000,000,767 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/11/08 22:06:57 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Desktop\ERUNT.lnk
[2010/11/08 22:06:30 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\chysa strickland\Desktop\erunt-setup.exe
[2010/11/08 22:05:10 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\erunt-setup.exe
[2010/11/08 21:59:17 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/08 21:59:16 | 526,295,040 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/08 21:54:18 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\TFC.exe
[2010/11/08 21:49:15 | 000,309,192 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/08 21:27:26 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/11/08 21:27:26 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/11/08 21:27:26 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/11/08 21:27:26 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/11/08 21:27:26 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/11/08 21:14:36 | 079,578,904 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Desktop\jdk-6u22-windows-i586.exe
[2010/11/07 20:26:42 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/11/07 20:12:04 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/11/07 16:19:58 | 000,094,497 | ---- | M] () -- C:\kenchys.php
[2010/11/07 16:19:49 | 000,096,772 | ---- | M] () -- C:\kenney chy.php
[2010/11/07 14:53:22 | 000,442,466 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/07 14:53:22 | 000,071,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/11/07 07:45:18 | 000,085,504 | ---- | M] () -- C:\Inherit.exe
[2010/11/06 20:17:54 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/03 07:20:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/24 15:09:16 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Pro Antivirus.lnk
[2010/10/24 15:09:14 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/10/24 12:58:57 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/24 12:49:11 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/10/23 17:55:38 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Local Settings\Application Data\prvlcl.dat
[2010/10/23 17:46:10 | 000,054,784 | RHS- | M] () -- C:\WINDOWS\System32\nddeapir0.dll
[2010/10/23 12:37:35 | 000,001,908 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus 2010.lnk
[2010/10/21 20:55:04 | 000,098,304 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/18 08:48:47 | 000,014,022 | ---- | M] () -- C:\Documents and Settings\chysa strickland\My Documents\Module 1 Unit 3 Chemical Elements Assignment.ods
[2010/10/17 19:16:31 | 000,000,905 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\OpenOffice.org 3.1.lnk
[2010/10/17 02:12:43 | 000,000,593 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/10/17 02:08:22 | 000,000,705 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI
[2010/10/15 17:36:01 | 000,000,535 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2010/10/15 17:30:46 | 000,002,516 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2010/10/15 17:30:19 | 000,000,088 | RHS- | M] () -- C:\Documents and Settings\All Users\Application Data\7C708295CE.sys
[2010/10/11 16:47:41 | 002,949,215 | ---- | M] () -- C:\Documents and Settings\chysa strickland\My Documents\calista elephant project.wpd

========== Files Created - No Company Name ==========

[2010/11/09 07:52:37 | 000,281,403 | ---- | C] () -- C:\bday.pdf
[2010/11/08 22:20:47 | 000,684,619 | ---- | C] () -- C:\sreng2.zip
[2010/11/08 22:10:26 | 000,000,000 | ---- | C] () -- C:\IE8-WindowsXP-x86-ENU(2).exe
[2010/11/08 22:09:24 | 000,000,000 | ---- | C] () -- C:\IE8-WindowsXP-x86-ENU.exe
[2010/11/08 22:06:59 | 000,000,767 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/11/08 22:06:57 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Desktop\ERUNT.lnk
[2010/11/08 21:01:23 | 079,578,904 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Desktop\jdk-6u22-windows-i586.exe
[2010/11/07 20:12:04 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/11/07 20:12:01 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/11/07 18:42:03 | 526,295,040 | -HS- | C] () -- C:\hiberfil.sys
[2010/11/07 16:19:58 | 000,094,497 | ---- | C] () -- C:\kenchys.php
[2010/11/07 16:19:49 | 000,096,772 | ---- | C] () -- C:\kenney chy.php
[2010/11/07 07:45:18 | 000,085,504 | ---- | C] () -- C:\Inherit.exe
[2010/11/06 20:17:54 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/24 15:09:16 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Pro Antivirus.lnk
[2010/10/24 12:58:57 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/23 17:46:09 | 000,054,784 | RHS- | C] () -- C:\WINDOWS\System32\nddeapir0.dll
[2010/10/23 12:37:35 | 000,001,908 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus 2010.lnk
[2010/10/17 20:11:29 | 000,014,022 | ---- | C] () -- C:\Documents and Settings\chysa strickland\My Documents\Module 1 Unit 3 Chemical Elements Assignment.ods
[2010/10/17 19:16:31 | 000,000,905 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\OpenOffice.org 3.1.lnk
[2010/09/14 17:25:42 | 000,000,088 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\7C708295CE.sys
[2010/09/14 17:25:33 | 000,002,516 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2010/03/15 10:18:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\EEventManager.INI
[2010/02/06 19:29:10 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2010/02/06 19:22:33 | 000,000,079 | ---- | C] () -- C:\WINDOWS\EPNX510.ini
[2009/11/05 08:10:18 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Local Settings\Application Data\prvlcl.dat
[2008/06/03 13:21:21 | 000,000,022 | ---- | C] () -- C:\WINDOWS\iexplore.ini
[2008/02/21 13:01:36 | 000,000,014 | -H-- | C] () -- C:\WINDOWS\mmax_hren1.ini
[2008/02/15 02:17:50 | 000,000,705 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/01/17 14:56:29 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2007/11/24 12:50:47 | 000,532,480 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll
[2007/08/23 23:26:04 | 000,009,462 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Application Data\wklnhst.dat
[2007/07/13 00:10:40 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/07/10 23:10:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\AoADVDRipper.INI
[2007/07/09 23:51:24 | 000,002,516 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2007/07/09 23:51:24 | 000,000,088 | RHS- | C] () -- C:\WINDOWS\System32\5240E8750C.sys
[2007/07/06 07:39:20 | 000,098,304 | ---- | C] () -- C:\Documents and Settings\chysa strickland\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/07/04 18:03:31 | 000,015,498 | ---- | C] () -- C:\WINDOWS\VX1000.ini
[2006/11/21 14:58:19 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/11/21 14:53:53 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/11/21 14:49:50 | 000,001,448 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/11/21 14:25:13 | 000,348,880 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll
[2006/11/21 14:25:13 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4642.dll
[2006/11/21 14:23:32 | 000,000,493 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 14:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 14:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 13:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2004/08/10 14:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/11/09 07:52:35 | 000,281,403 | ---- | M] () -- C:\bday.pdf
[2010/10/24 12:49:11 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/11/07 20:12:04 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2004/08/10 14:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2006/11/21 14:28:38 | 000,005,941 | RH-- | M] () -- C:\dell.sdr
[2010/11/08 22:05:10 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\erunt-setup.exe
[2010/11/08 21:59:16 | 526,295,040 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/08 22:10:26 | 000,000,000 | ---- | M] () -- C:\IE8-WindowsXP-x86-ENU(2).exe
[2010/11/08 22:10:43 | 008,163,966 | ---- | M] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU(2).exe.part
[2010/11/08 22:12:03 | 016,883,056 | ---- | M] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU(3).exe
[2010/11/08 22:13:34 | 016,883,056 | ---- | M] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU(4).exe
[2010/11/08 22:09:24 | 000,000,000 | ---- | M] () -- C:\IE8-WindowsXP-x86-ENU.exe
[2010/11/08 22:10:02 | 005,538,508 | ---- | M] (Microsoft Corporation) -- C:\IE8-WindowsXP-x86-ENU.exe.part
[2010/07/22 13:44:29 | 000,152,088 | ---- | M] () -- C:\img2-001.raw
[2007/07/04 17:58:16 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2010/11/07 07:45:18 | 000,085,504 | ---- | M] () -- C:\Inherit.exe
[2004/08/10 14:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2010/11/07 16:19:58 | 000,094,497 | ---- | M] () -- C:\kenchys.php
[2010/11/07 16:19:49 | 000,096,772 | ---- | M] () -- C:\kenney chy.php
[2004/08/10 14:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/05 10:03:30 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/11/08 21:59:14 | 792,723,456 | -HS- | M] () -- C:\pagefile.sys
[2008/09/07 12:58:42 | 000,056,136 | ---- | M] () -- C:\playground.log
[2008/12/09 22:33:21 | 000,000,000 | ---- | M] () -- C:\plx_proxy.log
[2010/11/09 20:17:20 | 000,010,088 | ---- | M] () -- C:\scan.txt
[2010/10/17 18:47:24 | 000,009,594 | ---- | M] () -- C:\scramble.log
[2008/10/11 19:28:20 | 000,000,232 | -H-- | M] () -- C:\sqmdata00.sqm
[2008/11/03 00:51:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2008/12/01 14:52:58 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2009/01/03 11:28:48 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2009/03/02 22:29:13 | 000,000,232 | -H-- | M] () -- C:\sqmdata04.sqm
[2009/01/03 11:37:22 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2009/01/17 13:12:05 | 000,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
[2009/01/31 20:37:45 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
[2009/04/17 14:38:38 | 000,000,268 | -H-- | M] () -- C:\sqmdata08.sqm
[2009/05/02 14:19:00 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
[2008/09/07 11:45:45 | 000,000,268 | -H-- | M] () -- C:\sqmdata10.sqm
[2008/09/07 15:52:02 | 000,000,268 | -H-- | M] () -- C:\sqmdata11.sqm
[2008/09/07 15:52:09 | 000,000,232 | -H-- | M] () -- C:\sqmdata12.sqm
[2008/09/07 15:52:17 | 000,000,172 | -H-- | M] () -- C:\sqmdata13.sqm
[2008/09/07 15:52:34 | 000,000,268 | -H-- | M] () -- C:\sqmdata14.sqm
[2008/09/07 15:53:11 | 000,000,268 | -H-- | M] () -- C:\sqmdata15.sqm
[2008/09/07 15:53:18 | 000,000,208 | -H-- | M] () -- C:\sqmdata16.sqm
[2008/09/09 14:46:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata17.sqm
[2008/10/10 20:22:17 | 000,000,268 | -H-- | M] () -- C:\sqmdata18.sqm
[2008/10/11 19:20:05 | 000,000,232 | -H-- | M] () -- C:\sqmdata19.sqm
[2008/10/11 19:28:20 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2008/11/03 00:51:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2008/12/01 14:52:58 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2009/01/03 11:28:48 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2009/03/02 22:29:12 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2009/01/03 11:37:22 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2009/01/17 13:12:05 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2009/01/31 20:37:45 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2009/04/17 14:38:38 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2009/05/02 14:18:59 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2008/09/07 11:45:45 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2008/09/07 15:52:02 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2008/09/07 15:52:09 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2008/09/07 15:52:17 | 000,000,172 | -H-- | M] () -- C:\sqmnoopt13.sqm
[2008/09/07 15:52:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
[2008/09/07 15:53:11 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
[2008/09/07 15:53:18 | 000,000,172 | -H-- | M] () -- C:\sqmnoopt16.sqm
[2008/09/09 14:46:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
[2008/10/10 20:22:17 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2008/10/11 19:20:04 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
[2010/11/08 22:20:53 | 000,684,619 | ---- | M] () -- C:\sreng2.zip

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 14:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 12:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >
[2008/03/11 01:36:02 | 000,004,281 | -H-- | M] () -- C:\WINDOWS\mmhren22.jpg

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 10:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2009/07/10 12:15:46 | 000,306,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2009/10/22 17:45:04 | 000,001,666 | -H-- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\LastFlashConfig.WFC

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 13:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/10 13:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/10 13:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/09/05 10:09:01 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >
[2006/11/21 14:44:10 | 000,264,750 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\TRANSFORMS=1033.mst

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/07/04 17:51:52 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\chysa strickland\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2006/04/27 05:19:01 | 000,013,023 | ---- | M] () -- C:\WINDOWS\VX1000.src

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 06:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/07/04 17:51:50 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\chysa strickland\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2009/04/23 10:36:15 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\chysa strickland\Cookies\desktop.ini
[2010/11/09 20:14:29 | 000,262,144 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 21:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2008/04/13 19:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[2002/07/17 15:22:34 | 000,003,535 | ---- | M] () -- C:\WINDOWS\system\Wowpost.exe

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >
[7 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2004/08/10 11:11:00 | 000,022,486 | ---- | M] () -- C:\WINDOWS\system32\lrnxp.ico

< %systemroot%\system\*.exe >
[2002/07/17 15:22:34 | 000,003,535 | ---- | M] () -- C:\WINDOWS\system\Wowpost.exe

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/11/08 21:58:26 | 010,747,904 | ---- | M] () -- C:\Documents and Settings\chysa strickland\ntuser.dat

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2008/10/14 14:44:50 | 000,309,144 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_DUPA30.EXE
[2007/11/14 23:02:00 | 000,175,616 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FAMTFIA.EXE
[2008/10/27 00:05:00 | 000,171,008 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FARNFIA.EXE
[2008/11/20 00:00:00 | 000,199,680 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIFIA.EXE
[2007/12/16 19:03:00 | 000,177,152 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FBCSFIA.EXE
[2008/12/15 04:51:00 | 000,136,192 | ---- | M] (SEIKO EPSON Corporation) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FHUTFIA.EXE
[2008/10/22 02:05:00 | 000,804,784 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FINSFIA.EXE
[2008/09/07 23:00:00 | 000,204,800 | ---- | M] (SEIKO EPSON CORP.) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FPREFIA.EXE
[2007/01/10 22:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S40RP7.EXE
[2007/12/16 22:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S40ST7.EXE

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.rpv /x >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< %USERPROFILE%\System\*.* >

< %systemroot%\Source\*.* >

< %systemroot%\system32\ac\*.* >

< %ProgramFiles%\MSDN\*.* >

< %AppData%\AdobeUM\winvcldll54\*.* /s >

< %ProgramFiles%\Internet Explorer\*.ico >

< %systemroot%\system32\*.ojo >

< %systemroot%\system32\d323s\*.* >

< %systemroot%\system32\re\*.* >

< %UserProfile%\Microsoft\*.dll >

< %UserProfile%\Microsoft\*.log >

< %systemroot%\Bios\*.* >

< %ProgramFiles%\Spool\*.* >

< %ProgramFiles%\promp3\*.* >

< %SYSTEMDRIVE%\Driver\*.* /s >

< %SYSTEMDRIVE%\inetserver.exe\*.* >

< %systemroot%\java\trustlib\*.* >

< %ProgramFiles%\Common Files\designer\*.exe >

< %ProgramFiles%\*. >
[2010/09/26 09:36:17 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2007/10/14 11:49:01 | 000,000,000 | ---D | M] -- C:\Program Files\Ahead
[2010/10/24 15:08:07 | 000,000,000 | ---D | M] -- C:\Program Files\Alwil Software
[2009/04/28 09:54:42 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2010/02/06 19:35:46 | 000,000,000 | ---D | M] -- C:\Program Files\ArcSoft
[2010/07/21 06:28:06 | 000,000,000 | ---D | M] -- C:\Program Files\Ask.com
[2009/11/01 03:33:34 | 000,000,000 | ---D | M] -- C:\Program Files\AVG
[2007/10/09 14:12:26 | 000,000,000 | ---D | M] -- C:\Program Files\Azureus
[2006/11/21 14:50:08 | 000,000,000 | ---D | M] -- C:\Program Files\BAE
[2010/02/06 18:59:43 | 000,000,000 | ---D | M] -- C:\Program Files\Cheat Engine
[2009/10/30 22:22:40 | 000,000,000 | ---D | M] -- C:\Program Files\Citrix
[2010/11/08 21:29:14 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2004/08/10 14:02:08 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2009/10/31 06:56:11 | 000,000,000 | ---D | M] -- C:\Program Files\CONEXANT
[2007/07/04 18:44:24 | 000,000,000 | ---D | M] -- C:\Program Files\Dell
[2006/11/21 14:54:12 | 000,000,000 | ---D | M] -- C:\Program Files\Dell Support
[2010/07/21 06:34:29 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2010/10/28 15:31:48 | 000,000,000 | ---D | M] -- C:\Program Files\DRPU PC Data Manager
[2010/11/02 06:21:32 | 000,000,000 | ---D | M] -- C:\Program Files\Emsisoft Anti-Malware
[2010/02/06 19:40:28 | 000,000,000 | ---D | M] -- C:\Program Files\epson
[2010/02/06 19:27:02 | 000,000,000 | ---D | M] -- C:\Program Files\Epson Software
[2010/11/08 22:06:59 | 000,000,000 | ---D | M] -- C:\Program Files\ERUNT
[2008/12/21 01:05:31 | 000,000,000 | ---D | M] -- C:\Program Files\Garmin GPS Plugin
[2010/04/24 20:24:19 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2007/11/29 15:49:49 | 000,000,000 | ---D | M] -- C:\Program Files\Grisoft
[2010/02/25 14:11:45 | 000,000,000 | ---D | M] -- C:\Program Files\Incomplete
[2010/01/15 17:25:30 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallJammer Registry
[2010/02/06 19:40:50 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2006/11/21 14:44:10 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2006/11/21 14:44:30 | 000,000,000 | ---D | M] -- C:\Program Files\InterActual
[2010/11/06 20:39:44 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2009/04/28 09:56:37 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2009/04/28 09:56:53 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2010/11/08 21:27:22 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2010/10/17 19:12:14 | 000,000,000 | ---D | M] -- C:\Program Files\JRE
[2010/11/08 21:07:47 | 000,000,000 | ---D | M] -- C:\Program Files\LimeWire
[2010/03/09 12:33:42 | 000,000,000 | ---D | M] -- C:\Program Files\LTCM Client
[2010/11/06 20:17:56 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2006/11/21 14:49:25 | 000,000,000 | ---D | M] -- C:\Program Files\McAfee
[2008/09/07 02:08:19 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2010/10/24 12:19:06 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2004/08/10 14:04:18 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/05/28 17:46:16 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft LifeCam
[2010/10/24 12:05:18 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/11/10 08:43:22 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2009/06/26 13:23:32 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Sync Framework
[2006/11/21 14:52:43 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2009/10/18 02:03:53 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2010/08/15 02:02:46 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/11/04 18:44:42 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2009/08/09 02:08:48 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2010/02/11 15:48:08 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
[2010/02/06 19:03:21 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2009/01/30 18:35:06 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Games
[2007/11/29 15:45:29 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2009/06/25 19:15:45 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Messenger
[2006/11/21 14:46:45 | 000,000,000 | ---D | M] -- C:\Program Files\MUSICMATCH
[2007/09/18 00:41:23 | 000,000,000 | ---D | M] -- C:\Program Files\Nero
[2008/09/05 10:05:15 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2010/01/05 15:58:24 | 000,000,000 | ---D | M] -- C:\Program Files\NortonInstaller
[2007/11/29 15:44:46 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2010/10/17 19:11:45 | 000,000,000 | ---D | M] -- C:\Program Files\OpenOffice.org 3
[2010/05/16 02:01:37 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2010/10/28 06:33:38 | 000,000,000 | ---D | M] -- C:\Program Files\Panda Security
[2009/04/28 09:56:07 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2009/08/09 02:08:38 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2007/09/24 18:16:04 | 000,000,000 | ---D | M] -- C:\Program Files\Roxio
[2009/06/03 16:49:03 | 000,000,000 | ---D | M] -- C:\Program Files\Sabi
[2006/11/21 14:42:40 | 000,000,000 | ---D | M] -- C:\Program Files\Sigmatel
[2007/11/24 12:51:13 | 000,000,000 | ---D | M] -- C:\Program Files\Sony
[2010/10/26 19:58:57 | 000,000,000 | ---D | M] -- C:\Program Files\Spybot - Search & Destroy
[2010/11/08 21:27:55 | 000,000,000 | ---D | M] -- C:\Program Files\Sun
[2004/08/10 14:08:30 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2009/07/19 18:05:04 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2010/02/11 15:48:30 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2009/06/26 13:24:02 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live Toolbar
[2007/07/11 22:32:48 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2008/09/05 10:05:13 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2008/09/05 10:05:12 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2004/08/10 14:02:52 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2004/08/10 14:04:18 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2009/01/30 18:44:43 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!

< %systemroot%\system32\*.tso >

< %ALLUSERSPROFILE%\Documents\Server\*.* >

< %systemroot%\*.pif >
[2004/08/04 06:00:00 | 000,000,707 | ---- | M] () -- C:\WINDOWS\_default.pif

< %systemroot%\system32\n7533\*.* >

< %systemroot%\Us18336\*.* >

< %systemroot%\system32\*.zip >

< %systemroot%\system32\*.wgo >

< %systemroot%\system32\dllcache\*.com >

< %systemroot%\system32\dllchache\*.* >

< %systemroot%\system32\038840\*.* >

< %systemroot%\system32\13E92A\*.* >

< %systemroot%\system32\1CB5AD\*.* >

< %systemroot%\system32\52682A\*.* >

< %USERPROFILE%\My Documents\*.htm >

< %SYSTEMDRIVE%\Mr_CF\*.* >

< %USERPROFILE%\My Documents\*.dll >

< %USERPROFILE%\My Documents\*.ccc >

< %systemroot%\system32\Sis\*.* >

< %systemroot%\Microsft\*.* >

< %SYSTEMDRIVE%\driverwinx.exe\*.* >

< %systemroot%\BifroXx\*.* >

< %SYSTEMDRIVE%\TSTP\*.* >

< %systemroot%\winsn\*.* >

< %ProgramFiles%\windata\*.* >

< %SYSTEMDRIVE%\msixxxxxxx.exe\*.* >

< %systemroot%\system32\*.sao >

< %systemroot%\system32\*.iem >

< %systemroot%\system32\*.mdd >

< %systemroot%\system32\*.wlo >

< %systemroot%\system32\*.skn >

< %SYSTEMDRIVE%\Winup\*.* >

< %SYSTEMDRIVE%\test\*.* >

< %systemroot%\system32\med\*.* >

< %systemroot%\Bifrost\*.* >

< %systemroot%\system32\explorer.exe\*.* >

< %UserProfile%\UserData\*.dat /x >

< %SYSTEMDRIVE%\Arquivo de programas\*.* >

< %ProgramFiles%\tcpview\*.* >

< %systemroot%\system32\*.lyo >

< %ProgramFiles%\huanbang2\*.* >

< %systemroot%\winhuanbang\*.* >

< %systemroot%\minrsv.ini\*.* >

< %systemroot%\assembly\GAC\*.* >

< %AppData%\Adobe\crtmswin91\*.* >

< %ProgramFiles%\Windows NT\Accessories\*.exe >
[2010/07/12 07:55:03 | 000,218,112 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows NT\Accessories\wordpad.exe

< %systemroot%\system32\*.pdo >

< %SYSTEMDRIVE%\APPDATASH\*.* >

< %SYSTEMDRIVE%\sy\*.* >

< %systemroot%\*.cot >

< %systemroot%\system32\*.html >

< %systemroot%\system32\win32.exe\*.* >

< %systemroot%\System32\9283\*.* >

< %systemroot%\System32\hardpol\*.* /s >

< %systemroot%\Fonts\*.dat >

< %ProgramFiles%\WinNTsystem operation\*.* >

< %SYSTEMDRIVE%\moneyxmexx.exe\*.* >

< %USERPROFILE%\Templates\*.exe >

< %SYSTEMDRIVE%\MSOCache\*.* >

< %systemroot%\inf\win\*.* >

< %SYSTEMDRIVE%\users\*.ini /x >

< %systemroot%\Media\*.exe >

< %systemroot%\Media\*.dll >

< %USERPROFILE%\Desktop\*.exe >
[2010/11/08 22:06:30 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\chysa strickland\Desktop\erunt-setup.exe
[2010/11/08 21:14:36 | 079,578,904 | ---- | M] () -- C:\Documents and Settings\chysa strickland\Desktop\jdk-6u22-windows-i586.exe
[2010/11/08 21:54:18 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\chysa strickland\Desktop\TFC.exe

< %PROGRAMFILES%\*.* >

< %systemroot%\system\*.dat >

< %AppData%\AdobeUM\upldrvdrv2\*.* >

< %ProgramFiles%\wiselink\*.* >

< %systemroot%\*.wd >

< %systemroot%\boot\*.* >

< %systemroot%\ime\*.dll /x >

< %systemroot%\system32\GroupPolicy\User\Scripts\*.* /s >

< %systemroot%\system32\*.INS >

< %SYSTEMDRIVE%\Temporary\*.* >

< %AppData%\AdobeUM\vclvclupl66\*.* >

< %SYSTEMDRIVE%\KEY\*.* /s >

< %SYSTEMDRIVE%\INVRSO\*.* >

< %systemroot%\Config\Audit\*.* /s >

< %ProgramFiles%\facebook\*.* >

< %SystemRoot%\system32\___hptmp\*.* >

< %SystemRoot%\system32\Macromedia\*.* >

< %SystemRoot%\system32\Macrocmp\*.* >

< %systemroot%\ap0calypse_00CD1A40\*.* /s >

< %SYSTEMDRIVE%\bbotxxxxxx.exe\*.* >

< %systemroot%\cacher\*.* >

< %systemroot%\down\*.* >

< %systemroot%\up\*.* >

< %SYSTEMDRIVE%\bootstartx.exe\*.* >

< %systemroot%\system32\wbem\grpconv.exe >

< %SYSTEMDRIVE%\Zolander\*.* /s >

< %systemroot%\Media_\*.* >

< %systemroot%\SV1\*.* >

< %systemroot%\system32\Hotspot\*.* >

< %systemroot%\java\*.* >

< %systemroot%\system32\JAVA\*.* >

< %systemroot%\system32\syst\*.* >

< %systemroot%\msapps\*.* >

< %systemroot%\Fonts\*.html >

< %systemroot%\WinRecycleb\*.* >

< %systemroot%\system32\PassTools\*.* >

< %USERPROFILE%\Templates\*.txt >

< %SYSTEMDRIVE%\Drivers\*.* /s >
[2006/11/21 14:30:42 | 000,004,128 | ---- | M] () -- C:\drivers\INFCACHE.1
[2006/11/21 14:30:42 | 000,004,128 | ---- | M] () -- C:\drivers\audio\INFCACHE.1
[2006/07/24 11:20:00 | 000,002,548 | ---- | M] () -- C:\drivers\audio\R124105\92xxD.ini
[2006/07/24 11:20:00 | 000,002,464 | ---- | M] () -- C:\drivers\audio\R124105\92XXD2-1.INI
[2006/07/24 11:20:00 | 000,002,487 | ---- | M] () -- C:\drivers\audio\R124105\92XXD2-2.INI
[2006/07/24 11:20:00 | 000,002,043 | ---- | M] () -- C:\drivers\audio\R124105\92XXD2-3.INI
[2006/07/24 11:20:00 | 000,002,084 | ---- | M] () -- C:\drivers\audio\R124105\92XXD2-4.INI
[2006/07/24 11:20:00 | 000,003,098 | ---- | M] () -- C:\drivers\audio\R124105\92XXD8-1.INI
[2006/07/24 11:20:00 | 000,003,161 | ---- | M] () -- C:\drivers\audio\R124105\92XXD8-2.INI
[2006/07/24 11:20:00 | 000,003,651 | ---- | M] () -- C:\drivers\audio\R124105\92XXD8-3.INI
[2006/11/21 14:35:25 | 000,009,072 | ---- | M] () -- C:\drivers\audio\R124105\INFCACHE.1
[2006/07/24 11:20:00 | 000,159,825 | ---- | M] (SigmaTel, Inc.) -- C:\drivers\audio\R124105\stac97.cpl
[2006/07/24 11:20:00 | 000,208,896 | ---- | M] (SigmaTel, Inc.) -- C:\drivers\audio\R124105\stacapi.dll
[2006/07/24 11:20:00 | 000,112,128 | ---- | M] (SigmaTel, Inc.) -- C:\drivers\audio\R124105\staco.dll
[2006/07/24 11:20:00 | 000,194,048 | ---- | M] (SigmaTel, Inc.) -- C:\drivers\audio\R124105\staco64.dll
[2006/07/24 11:20:00 | 000,014,146 | ---- | M] () -- C:\drivers\audio\R124105\STHDA.cat
[2006/07/24 11:20:00 | 000,342,562 | ---- | M] () -- C:\drivers\audio\R124105\STHDA.INF
[2006/07/24 11:20:00 | 000,001,533 | ---- | M] () -- C:\drivers\audio\R124105\Sthda.ini
[2006/11/21 14:35:25 | 000,156,800 | ---- | M] () -- C:\drivers\audio\R124105\STHDA.PNF
[2006/07/24 11:20:00 | 001,156,648 | ---- | M] (SigmaTel, Inc.) -- C:\drivers\audio\R124105\sthda.sys
[2006/07/24 11:20:00 | 000,014,096 | ---- | M] () -- C:\drivers\audio\R124105\STHDA64.cat
[2006/07/24 11:20:00 | 000,342,856 | ---- | M] () -- C:\drivers\audio\R124105\STHDA64.INF
[2006/07/24 11:20:00 | 000,001,535 | ---- | M] () -- C:\drivers\audio\R124105\sthda64.ini
[2006/11/21 14:35:25 | 000,156,996 | ---- | M] () -- C:\drivers\audio\R124105\STHDA64.PNF
[2006/07/24 11:20:00 | 001,048,064 | ---- | M] (SigmaTel, Inc.) -- C:\drivers\audio\R124105\sthda64.sys
[2006/07/24 11:20:00 | 001,052,672 | ---- | M] (SigmaTel, Inc.) -- C:\drivers\audio\R124105\stlang.dll
[2006/07/24 11:20:00 | 000,282,624 | ---- | M] (SigmaTel, Inc.) -- C:\drivers\audio\R124105\stsystra.exe
[2006/11/21 14:30:44 | 000,004,128 | ---- | M] () -- C:\drivers\MODEM\INFCACHE.1
[2003/11/19 02:15:00 | 000,128,398 | ---- | M] () -- C:\drivers\MODEM\Addon\del200f.cty
[2004/01/19 11:13:08 | 000,011,075 | ---- | M] () -- C:\drivers\MODEM\Addon\del200fk.cat
[2004/01/07 11:16:18 | 000,037,128 | ---- | M] () -- C:\drivers\MODEM\Addon\del200fk.inf
[2009/10/31 06:55:56 | 000,062,708 | ---- | M] () -- C:\drivers\MODEM\Addon\del200fk.PNF
[2003/09/03 14:31:16 | 000,001,736 | ---- | M] () -- C:\drivers\MODEM\Addon\DEVTYPE.INI
[2002/02/04 15:39:20 | 000,000,023 | ---- | M] () -- C:\drivers\MODEM\Addon\disk1
[2003/10/23 14:01:36 | 000,032,218 | ---- | M] (Conexant Systems, Inc.) -- C:\drivers\MODEM\Addon\HSFCI008.dll
[2003/11/17 15:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) -- C:\drivers\MODEM\Addon\HSFHWBS2.sys
[2003/11/17 15:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) -- C:\drivers\MODEM\Addon\HSF_CNXT.sys
[2003/11/17 15:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) -- C:\drivers\MODEM\Addon\HSF_DP.sys
[2003/10/30 15:25:38 | 000,532,480 | ---- | M] (Conexant Systems, Inc.) -- C:\drivers\MODEM\Addon\HXFSetup.exe
[2006/11/21 14:35:26 | 000,004,616 | ---- | M] () -- C:\drivers\MODEM\Addon\INFCACHE.1
[2003/04/09 13:01:32 | 000,090,112 | ---- | M] (Conexant) -- C:\drivers\MODEM\Addon\MdmXSdk.dll
[2003/04/09 12:48:08 | 000,011,043 | ---- | M] (Conexant) -- C:\drivers\MODEM\Addon\MDMXSDK.sys
[2006/11/21 14:30:44 | 000,004,128 | ---- | M] () -- C:\drivers\network\INFCACHE.1
[2006/10/08 14:57:14 | 000,020,480 | ---- | M] () -- C:\drivers\network\R135588\E1000325.CAT
[2006/10/08 14:57:14 | 000,002,844 | ---- | M] () -- C:\drivers\network\R135588\e1000325.din
[2006/10/08 14:57:14 | 000,350,293 | ---- | M] () -- C:\drivers\network\R135588\e1000325.inf
[2006/11/21 14:35:26 | 000,293,300 | ---- | M] () -- C:\drivers\network\R135588\e1000325.PNF
[2006/10/08 14:57:14 | 000,164,352 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\E1000325.sys
[2006/10/08 14:57:14 | 000,253,952 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\e1000msg.dll
[2006/10/08 14:57:14 | 000,002,844 | ---- | M] () -- C:\drivers\network\R135588\e1000nt5.din
[2006/10/08 14:57:14 | 000,158,208 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\E1000NT5.SYS
[2006/10/08 14:57:14 | 000,002,877 | ---- | M] () -- C:\drivers\network\R135588\e1e5032.din
[2006/10/08 14:57:14 | 000,204,800 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\E1e5032.SYS
[2006/10/08 14:57:14 | 000,016,124 | ---- | M] () -- C:\drivers\network\R135588\E1E5132.CAT
[2006/10/08 14:57:14 | 000,002,877 | ---- | M] () -- C:\drivers\network\R135588\e1e5132.din
[2006/10/08 14:57:14 | 000,228,456 | ---- | M] () -- C:\drivers\network\R135588\e1e5132.inf
[2008/07/27 17:26:07 | 000,231,116 | ---- | M] () -- C:\drivers\network\R135588\e1e5132.PNF
[2006/10/08 14:57:14 | 000,230,400 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\e1e5132.sys
[2006/11/21 14:35:26 | 000,017,744 | ---- | M] () -- C:\drivers\network\R135588\INFCACHE.1
[2006/10/08 14:57:14 | 000,021,504 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\NicCo.dll
[2006/10/08 14:57:14 | 000,056,832 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\NicEtCo.dll
[2006/10/08 14:57:14 | 000,056,832 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\NicEtCoE.dll
[2006/10/08 14:57:14 | 000,020,992 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\NicInst.dll
[2006/10/08 14:57:16 | 000,020,480 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\NicInstE.dll
[2006/10/08 14:57:16 | 000,126,976 | ---- | M] (Intel Corporation) -- C:\drivers\network\R135588\PROUnstl.exe
[2006/11/21 14:30:42 | 000,004,128 | ---- | M] () -- C:\drivers\storage\INFCACHE.1
[2006/10/10 14:03:48 | 000,008,376 | ---- | M] () -- C:\drivers\storage\R130118\iaahci.cat
[2006/10/10 14:03:48 | 000,005,856 | ---- | M] () -- C:\drivers\storage\R130118\iaahci.inf
[2006/11/21 14:35:26 | 000,011,876 | ---- | M] () -- C:\drivers\storage\R130118\iaahci.PNF
[2006/10/10 14:03:48 | 000,008,278 | ---- | M] () -- C:\drivers\storage\R130118\iastor.cat
[2006/10/10 14:03:48 | 000,005,742 | ---- | M] () -- C:\drivers\storage\R130118\iastor.inf
[2006/11/21 14:35:26 | 000,011,516 | ---- | M] () -- C:\drivers\storage\R130118\iastor.PNF
[2006/10/10 14:03:48 | 000,246,784 | ---- | M] (Intel Corporation) -- C:\drivers\storage\R130118\iastor.sys
[2006/11/21 14:35:26 | 000,005,424 | ---- | M] () -- C:\drivers\storage\R130118\INFCACHE.1
[2006/10/10 14:03:50 | 000,003,981 | ---- | M] () -- C:\drivers\storage\R130118\TXTAHCI.OEM
[2006/10/10 14:03:50 | 000,003,980 | ---- | M] () -- C:\drivers\storage\R130118\TXTRAID.OEM
[2006/10/10 14:03:48 | 000,003,981 | ---- | M] () -- C:\drivers\storage\R130118\txtsetup.oem
[2006/07/24 11:47:24 | 000,010,531 | ---- | M] () -- C:\drivers\storage\R130160\5000xzvp.cat
[2006/07/24 11:47:24 | 000,015,528 | ---- | M] () -- C:\drivers\storage\R130160\5000XZVP.inf
[2006/11/21 14:35:25 | 000,025,888 | ---- | M] () -- C:\drivers\storage\R130160\5000XZVP.PNF
[2006/07/24 11:47:24 | 000,007,761 | ---- | M] () -- C:\drivers\storage\R130160\852.cat
[2006/07/24 11:47:24 | 000,003,954 | ---- | M] () -- C:\drivers\storage\R130160\852.inf
[2006/11/21 14:35:25 | 000,006,804 | ---- | M] () -- C:\drivers\storage\R130160\852.PNF
[2006/07/24 11:47:24 | 000,006,843 | ---- | M] () -- C:\drivers\storage\R130160\855.cat
[2006/07/24 11:47:24 | 000,003,553 | ---- | M] () -- C:\drivers\storage\R130160\855.inf
[2006/11/21 14:35:25 | 000,005,628 | ---- | M] () -- C:\drivers\storage\R130160\855.PNF
[2006/07/24 11:47:24 | 000,009,757 | ---- | M] () -- C:\drivers\storage\R130160\865.cat
[2006/07/24 11:47:24 | 000,004,787 | ---- | M] () -- C:\drivers\storage\R130160\865.inf
[2006/11/21 14:35:25 | 000,008,996 | ---- | M] () -- C:\drivers\storage\R130160\865.PNF
[2006/07/24 11:47:24 | 000,011,565 | ---- | M] () -- C:\drivers\storage\R130160\915.cat
[2006/07/24 11:47:24 | 000,003,912 | ---- | M] () -- C:\drivers\storage\R130160\915.inf
[2006/11/21 14:35:25 | 000,006,472 | ---- | M] () -- C:\drivers\storage\R130160\915.PNF
[2006/07/24 11:47:24 | 000,007,505 | ---- | M] () -- C:\drivers\storage\R130160\915M.cat
[2006/07/24 11:47:24 | 000,003,374 | ---- | M] () -- C:\drivers\storage\R130160\915M.inf
[2006/11/21 14:35:25 | 000,005,588 | ---- | M] () -- C:\drivers\storage\R130160\915M.PNF
[2006/07/24 11:47:24 | 000,007,921 | ---- | M] () -- C:\drivers\storage\R130160\945.cat
[2006/07/24 11:47:24 | 000,004,621 | ---- | M] () -- C:\drivers\storage\R130160\945.inf
[2006/11/21 14:35:25 | 000,007,796 | ---- | M] () -- C:\drivers\storage\R130160\945.PNF
[2006/07/24 11:47:24 | 000,007,515 | ---- | M] () -- C:\drivers\storage\R130160\945gm.cat
[2006/07/24 11:47:24 | 000,003,616 | ---- | M] () -- C:\drivers\storage\R130160\945GM.inf
[2006/11/21 14:35:25 | 000,005,904 | ---- | M] () -- C:\drivers\storage\R130160\945GM.PNF
[2006/07/24 11:47:24 | 000,009,263 | ---- | M] () -- C:\drivers\storage\R130160\965g.cat
[2006/07/24 11:47:24 | 000,004,410 | ---- | M] () -- C:\drivers\storage\R130160\965g.inf
[2006/11/21 14:35:25 | 000,007,448 | ---- | M] () -- C:\drivers\storage\R130160\965g.PNF
[2006/07/24 11:47:24 | 000,009,065 | ---- | M] () -- C:\drivers\storage\R130160\dmi_pci.cat
[2006/07/24 11:47:24 | 000,003,722 | ---- | M] () -- C:\drivers\storage\R130160\dmi_pci.inf
[2006/11/21 14:35:25 | 000,005,560 | ---- | M] () -- C:\drivers\storage\R130160\dmi_pci.PNF
[2006/07/24 11:47:24 | 000,010,433 | ---- | M] () -- C:\drivers\storage\R130160\E7220.cat
[2006/07/24 11:47:24 | 000,003,682 | ---- | M] () -- C:\drivers\storage\R130160\E7220.inf
[2006/11/21 14:35:25 | 000,005,908 | ---- | M] () -- C:\drivers\storage\R130160\E7220.PNF
[2006/07/24 11:47:24 | 000,007,507 | ---- | M] () -- C:\drivers\storage\R130160\e7230.cat
[2006/07/24 11:47:24 | 000,003,470 | ---- | M] () -- C:\drivers\storage\R130160\E7230.inf
[2006/11/21 14:35:25 | 000,005,408 | ---- | M] () -- C:\drivers\storage\R130160\E7230.PNF
[2006/07/24 11:47:24 | 000,009,601 | ---- | M] () -- C:\drivers\storage\R130160\E7520.cat
[2006/07/24 11:47:24 | 000,009,291 | ---- | M] () -- C:\drivers\storage\R130160\E7520.inf
[2006/11/21 14:35:25 | 000,017,744 | ---- | M] () -- C:\drivers\storage\R130160\E7520.PNF
[2006/07/24 11:47:24 | 000,010,525 | ---- | M] () -- C:\drivers\storage\R130160\E8500.cat
[2006/07/24 11:47:24 | 000,013,904 | ---- | M] () -- C:\drivers\storage\R130160\E8500.inf
[2006/11/21 14:35:25 | 000,022,200 | ---- | M] () -- C:\drivers\storage\R130160\E8500.PNF
[2006/07/24 11:47:24 | 000,010,697 | ---- | M] () -- C:\drivers\storage\R130160\esb2ide.cat
[2006/07/24 11:47:24 | 000,003,612 | ---- | M] () -- C:\drivers\storage\R130160\ESB2ide.inf
[2006/11/21 14:35:25 | 000,005,796 | ---- | M] () -- C:\drivers\storage\R130160\ESB2ide.PNF
[2006/07/24 11:47:24 | 000,007,765 | ---- | M] () -- C:\drivers\storage\R130160\esb2usb.cat
[2006/07/24 11:47:24 | 000,005,224 | ---- | M] () -- C:\drivers\storage\R130160\ESB2usb.inf
[2006/11/21 14:35:25 | 000,008,272 | ---- | M] () -- C:\drivers\storage\R130160\ESB2usb.PNF
[2006/07/24 11:47:24 | 000,007,657 | ---- | M] () -- C:\drivers\storage\R130160\ich4core.cat
[2006/07/24 11:47:24 | 000,004,155 | ---- | M] () -- C:\drivers\storage\R130160\ich4core.inf
[2006/11/21 14:35:25 | 000,006,616 | ---- | M] () -- C:\drivers\storage\R130160\ich4core.PNF
[2006/07/24 11:47:24 | 000,007,383 | ---- | M] () -- C:\drivers\storage\R130160\ich4ide.cat
[2006/07/24 11:47:24 | 000,003,780 | ---- | M] () -- C:\drivers\storage\R130160\ich4ide.inf
[2006/11/21 14:35:25 | 000,006,108 | ---- | M] () -- C:\drivers\storage\R130160\ich4ide.PNF
[2006/07/24 11:47:24 | 000,007,769 | ---- | M] () -- C:\drivers\storage\R130160\ich4usb.cat
[2006/07/24 11:47:24 | 000,003,760 | ---- | M] () -- C:\drivers\storage\R130160\ich4usb.inf
[2006/11/21 14:35:25 | 000,006,468 | ---- | M] () -- C:\drivers\storage\R130160\ich4usb.PNF
[2006/07/24 11:47:24 | 000,010,439 | ---- | M] () -- C:\drivers\storage\R130160\ich5core.cat
[2006/07/24 11:47:24 | 000,005,053 | ---- | M] () -- C:\drivers\storage\R130160\ich5core.inf
[2006/11/21 14:35:25 | 000,008,236 | ---- | M] () -- C:\drivers\storage\R130160\ich5core.PNF
[2006/07/24 11:47:24 | 000,010,437 | ---- | M] () -- C:\drivers\storage\R130160\ich5ide.cat
[2006/07/24 11:47:24 | 000,004,182 | ---- | M] () -- C:\drivers\storage\R130160\ich5ide.inf
[2006/11/21 14:35:25 | 000,006,556 | ---- | M] () -- C:\drivers\storage\R130160\ich5ide.PNF
[2006/07/24 11:47:24 | 000,008,849 | ---- | M] () -- C:\drivers\storage\R130160\ich5usb.cat
[2006/07/24 11:47:24 | 000,006,353 | ---- | M] () -- C:\drivers\storage\R130160\ich5usb.inf
[2006/11/21 14:35:25 | 000,009,872 | ---- | M] () -- C:\drivers\storage\R130160\ich5usb.PNF
[2006/07/24 11:47:24 | 000,011,575 | ---- | M] () -- C:\drivers\storage\R130160\ich6core.cat
[2006/07/24 11:47:24 | 000,005,019 | ---- | M] () -- C:\drivers\storage\R130160\ich6core.inf
[2006/11/21 14:35:25 | 000,008,188 | ---- | M] () -- C:\drivers\storage\R130160\ich6core.PNF
[2006/07/24 11:47:24 | 000,011,573 | ---- | M] () -- C:\drivers\storage\R130160\ich6ide.cat
[2006/07/24 11:47:24 | 000,004,064 | ---- | M] () -- C:\drivers\storage\R130160\ich6ide.inf
[2006/11/21 14:35:25 | 000,006,668 | ---- | M] () -- C:\drivers\storage\R130160\ich6ide.PNF
[2006/07/24 11:47:24 | 000,008,177 | ---- | M] () -- C:\drivers\storage\R130160\ich6usb.cat
[2006/07/24 11:47:24 | 000,004,926 | ---- | M] () -- C:\drivers\storage\R130160\ich6usb.inf
[2006/11/21 14:35:25 | 000,007,764 | ---- | M] () -- C:\drivers\storage\R130160\ich6usb.PNF
[2006/07/24 11:47:24 | 000,008,757 | ---- | M] () -- C:\drivers\storage\R130160\ich7core.cat
[2006/07/24 11:47:24 | 000,005,864 | ---- | M] () -- C:\drivers\storage\R130160\ich7core.inf
[2006/11/21 14:35:25 | 000,010,216 | ---- | M] () -- C:\drivers\storage\R130160\ich7core.PNF
[2006/07/24 11:47:24 | 000,008,755 | ---- | M] () -- C:\drivers\storage\R130160\ich7ide.cat
[2006/07/24 11:47:24 | 000,003,874 | ---- | M] () -- C:\drivers\storage\R130160\ich7ide.inf
[2006/11/21 14:35:25 | 000,006,440 | ---- | M] () -- C:\drivers\storage\R130160\ich7ide.PNF
[2006/07/24 11:47:24 | 000,008,177 | ---- | M] () -- C:\drivers\storage\R130160\ich7usb.cat
[2006/07/24 11:47:24 | 000,004,972 | ---- | M] () -- C:\drivers\storage\R130160\ich7usb.inf
[2006/11/21 14:35:25 | 000,007,964 | ---- | M] () -- C:\drivers\storage\R130160\ich7usb.PNF
[2006/07/24 11:47:24 | 000,009,271 | ---- | M] () -- C:\drivers\storage\R130160\ich8core.cat
[2006/07/24 11:47:24 | 000,006,004 | ---- | M] () -- C:\drivers\storage\R130160\ich8core.inf
[2006/11/21 14:35:25 | 000,010,260 | ---- | M] () -- C:\drivers\storage\R130160\ich8core.PNF
[2006/07/24 11:47:24 | 000,009,269 | ---- | M] () -- C:\drivers\storage\R130160\ich8ide.cat
[2006/07/24 11:47:24 | 000,004,064 | ---- | M] () -- C:\drivers\storage\R130160\ich8ide.inf
[2006/11/21 14:35:25 | 000,006,748 | ---- | M] () -- C:\drivers\storage\R130160\ich8ide.PNF
[2006/07/24 11:47:24 | 000,009,269 | ---- | M] () -- C:\drivers\storage\R130160\ich8smb.cat
[2006/07/24 11:47:24 | 000,003,430 | ---- | M] () -- C:\drivers\storage\R130160\ich8smb.inf
[2006/11/21 14:35:25 | 000,005,008 | ---- | M] () -- C:\drivers\storage\R130160\ich8smb.PNF
[2006/07/24 11:47:24 | 000,007,929 | ---- | M] () -- C:\drivers\storage\R130160\ich8usb.cat
[2006/07/24 11:47:24 | 000,005,531 | ---- | M] () -- C:\drivers\storage\R130160\ich8usb.inf
[2006/11/21 14:35:25 | 000,008,812 | ---- | M] () -- C:\drivers\storage\R130160\ich8usb.PNF
[2006/07/24 11:47:24 | 000,008,755 | ---- | M] () -- C:\drivers\storage\R130160\ichxdev.cat
[2006/07/24 11:47:24 | 000,003,198 | ---- | M] () -- C:\drivers\storage\R130160\ichXdev.inf
[2006/11/21 14:35:25 | 000,004,768 | ---- | M] () -- C:\drivers\storage\R130160\ichXdev.PNF
[2006/11/21 14:35:25 | 000,023,288 | ---- | M] () -- C:\drivers\storage\R130160\INFCACHE.1
[2006/07/24 11:47:24 | 000,010,697 | ---- | M] () -- C:\drivers\storage\R130160\SP\esb2id2.cat
[2006/07/24 11:47:24 | 000,003,613 | ---- | M] () -- C:\drivers\storage\R130160\SP\ESB2id2.inf
[2006/11/21 14:35:25 | 000,005,804 | ---- | M] () -- C:\drivers\storage\R130160\SP\ESB2id2.PNF
[2006/07/24 11:47:24 | 000,010,437 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich5id2.cat
[2006/07/24 11:47:24 | 000,004,185 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich5id2.inf
[2006/11/21 14:35:25 | 000,006,564 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich5id2.PNF
[2006/07/24 11:47:24 | 000,011,573 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich6id2.cat
[2006/07/24 11:47:24 | 000,004,072 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich6id2.inf
[2006/11/21 14:35:25 | 000,006,676 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich6id2.PNF
[2006/07/24 11:47:24 | 000,008,755 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich7id2.cat
[2006/07/24 11:47:24 | 000,003,875 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich7id2.inf
[2006/11/21 14:35:25 | 000,006,448 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich7id2.PNF
[2006/07/24 11:47:24 | 000,009,269 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich8id2.cat
[2006/07/24 11:47:24 | 000,004,073 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich8id2.inf
[2006/11/21 14:35:26 | 000,006,756 | ---- | M] () -- C:\drivers\storage\R130160\SP\ich8id2.PNF
[2006/11/21 14:35:26 | 000,005,808 | ---- | M] () -- C:\drivers\storage\R130160\SP\INFCACHE.1
[2006/11/21 14:30:44 | 000,004,128 | ---- | M] () -- C:\drivers\video\INFCACHE.1
[2006/04/21 16:13:40 | 000,309,760 | ---- | M] (Microsoft Corporation) -- C:\drivers\video\onboard\difx32.dll
[2006/07/21 17:45:58 | 000,081,920 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\hccutils.dll
[2006/07/21 17:50:10 | 000,086,016 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\hkcmd.exe
[2006/07/21 18:21:38 | 001,204,224 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\ig4dev32.dll
[2006/07/21 18:18:16 | 002,416,640 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\ig4icd32.dll
[2006/07/21 17:49:58 | 000,450,560 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxcfg.exe
[2006/07/21 17:48:16 | 000,094,208 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxcpl.cpl
[2006/07/21 17:45:52 | 000,147,456 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxdev.dll
[2006/07/21 17:46:52 | 000,098,304 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxdo.dll
[2006/07/21 17:50:20 | 000,023,552 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxexps.dll
[2006/07/21 17:50:18 | 000,118,784 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxext.exe
[2006/08/02 14:46:46 | 000,028,564 | ---- | M] () -- C:\drivers\video\onboard\igfxnt5.cat
[2006/07/21 17:47:00 | 000,081,920 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxpers.exe
[2006/07/21 17:46:42 | 000,155,648 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxpph.dll
[2006/07/21 17:50:26 | 000,098,304 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxrchs.lrc
[2006/07/21 17:50:26 | 000,094,208 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxrcht.lrc
[2006/07/21 17:50:28 | 000,176,128 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxrdeu.lrc
[2006/07/21 17:46:04 | 000,155,648 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxrenu.lrc
[2006/07/21 17:50:30 | 000,172,032 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxresp.lrc
[2006/07/21 17:47:06 | 003,276,800 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxress.dll
[2006/07/21 17:50:32 | 000,167,936 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxrfra.lrc
[2006/07/21 17:50:34 | 000,172,032 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxrita.lrc
[2006/07/21 17:50:34 | 000,114,688 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxrjpn.lrc
[2006/07/21 17:50:34 | 000,114,688 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxrkor.lrc
[2006/07/21 17:50:36 | 000,163,840 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxrptb.lrc
[2006/07/21 17:46:24 | 000,041,984 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxsrvc.dll
[2006/07/21 17:46:22 | 000,188,416 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxsrvc.exe
[2006/07/21 17:48:02 | 000,098,304 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxtray.exe
[2006/07/21 17:47:48 | 000,106,496 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igfxzoom.exe
[2006/07/21 18:37:44 | 000,450,560 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igldev32.dll
[2006/07/21 18:35:04 | 002,363,392 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\iglicd32.dll
[2006/07/21 20:12:18 | 000,348,880 | ---- | M] () -- C:\drivers\video\onboard\igmedkrn.dll
[2006/07/28 17:25:00 | 000,099,947 | ---- | M] () -- C:\drivers\video\onboard\igxp32.inf
[2006/11/21 14:35:26 | 000,089,148 | ---- | M] () -- C:\drivers\video\onboard\igxp32.PNF
[2006/07/21 21:16:34 | 000,192,512 | ---- | M] () -- C:\drivers\video\onboard\igxpco32.dll
[2006/07/21 20:11:10 | 001,294,784 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igxpdv32.dll
[2006/07/21 20:12:58 | 002,053,120 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igxpdx32.dll
[2006/07/21 20:11:36 | 000,140,800 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igxpgd32.dll
[2006/07/21 20:12:16 | 001,095,968 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igxpmp32.sys
[2006/07/21 20:11:46 | 000,048,128 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\igxprd32.dll
[2006/07/21 21:16:02 | 000,397,312 | ---- | M] (Intel(R) Corporation) -- C:\drivers\video\onboard\igxpun.exe
[2006/07/21 17:35:22 | 000,524,850 | ---- | M] () -- C:\drivers\video\onboard\igxpxa32.cpa
[2006/07/21 17:35:22 | 000,000,929 | ---- | M] () -- C:\drivers\video\onboard\igxpxa32.vp
[2006/07/21 17:35:22 | 000,058,704 | ---- | M] () -- C:\drivers\video\onboard\igxpxk32.vp
[2006/07/21 21:38:06 | 000,022,160 | ---- | M] () -- C:\drivers\video\onboard\igxpxs32.vp
[2006/11/21 14:35:26 | 000,008,312 | ---- | M] () -- C:\drivers\video\onboard\INFCACHE.1
[2006/01/23 18:29:44 | 000,121,232 | ---- | M] () -- C:\drivers\video\onboard\IScrNB.bmp
[2006/01/23 18:29:54 | 000,121,232 | ---- | M] () -- C:\drivers\video\onboard\IScrNBR.bmp
[2006/07/21 17:48:06 | 000,057,344 | ---- | M] (Intel Corporation) -- C:\drivers\video\onboard\oemdspif.dll

< %systemroot%\system32\****\*.* >

< %systemroot%\system32\xmldm\*.* >

< %systemroot%\system32\ui\*.* /s >

< HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download >
"CheckExeSignatures" = yes
"RunInvalidSignatures" = 0

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony\Providers|ProviderFileName6 /rs >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-17 07:12:55

========== Files - Unicode (All) ==========
[2010/11/01 16:40:41 | 000,000,000 | ---D | M](C:\Documents and Settings\chysa strickland\Favorites\??sorted Bookmarks) -- C:\Documents and Settings\chysa strickland\Favorites\韐ĳsorted Bookmarks
[2007/09/25 05:57:12 | 000,000,000 | ---D | M](C:\Documents and Settings\chysa strickland\My Documents\??crosoft) -- C:\Documents and Settings\chysa strickland\My Documents\Μіcrosoft
[2007/09/25 05:57:12 | 000,000,000 | ---D | C](C:\Documents and Settings\chysa strickland\My Documents\??crosoft) -- C:\Documents and Settings\chysa strickland\My Documents\Μіcrosoft

========== Alternate Data Streams ==========

@Alternate Data Stream - 166 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:82591FF7
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8C8F2D60
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:327F192C
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30FD0CBD

< End of report >

*


----------



## Chelsea-Buns (Oct 28, 2010)

OTL Extras logfile created on: 09/11/2010 8:21:43 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\chysa strickland\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

502.00 Mb Total Physical Memory | 237.00 Mb Available Physical Memory | 47.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 32.16 Gb Free Space | 45.01% Space Free | Partition Type: NTFS

Computer Name: DCWDN4C1 | User Name: chysa strickland | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNetisabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNetisabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNetisabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNetisabledxpsp2res.dll,-22002
"1044:TCP" = 1044:TCP:*:Enabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\Microsoft LifeCam\LifeCam.exe" = C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe -- (Microsoft Corporation)
"C:\Program Files\Microsoft LifeCam\LifeExp.exe" = C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe -- (Microsoft Corporation)
"C:\Documents and Settings\chysa strickland\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe" = C:\Documents and Settings\chysa strickland\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe:*:Enabled:Octoshape add-in for Adobe Flash Player -- File not found
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)
"C:\Program Files\Java\jre1.6.0_02\launch4j-tmp\wowd.exe" = C:\Program Files\Java\jre1.6.0_02\launch4j-tmp\wowd.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\Epson Software\Event Manager\EEventManager.exe" = C:\Program Files\Epson Software\Event Manager\EEventManager.exe:*:Enabled:EEventManager.exe -- (SEIKO EPSON CORPORATION)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- File not found

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
"{07453869-D17D-4159-A23D-0A956CE96448}" = ArcSoft Print Creations
"{0A0873E1-D9BA-4994-B85D-A0A331EF1F0C}" = Intel(R) PRO Network Connections
"{117CD9C0-0F15-4633-93D7-F957B50535A5}" = Popup Blocker (Windows Live Toolbar)
"{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{32A3A4F4-B792-11D6-A78A-00B0D0160220}" = Java(TM) SE Development Kit 6 Update 22
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = Epson Event Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{4DEE75B1-B201-4DA3-A50F-007CDB00DA23}" = Microsoft LifeCam
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module
"{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}" = iTunes
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AFA20D47-69C3-4030-8DF8-D37466E70F13}" = Apple Mobile Device Support
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CA9ED5E4-1548-485B-A293-417840060158}" = ArcSoft Print Creations - Photo Calendar
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEE2252C-4035-4B27-8EC6-0B085DD3A413}" = Dell Support 3.2.1
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{E6C82F8F-2031-4825-8CC3-98C5960875C1}" = Epson CreativeZone
"{F04F9557-81A9-4293-BC49-2C216FA325A7}" = ArcSoft Print Creations - Greeting Card
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6970FBD-809A-4C51-BAB3-D94A04C6C8E7}" = Garmin Communicator Plugin
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast5" = avast! Pro Antivirus
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 56K V.9x DFVc Modem
"EPSON NX510 Series" = EPSON NX510 Series Printer Uninstall
"EPSON Scanner" = EPSON Scan
"ERUNT_is1" = ERUNT 1.1j
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-14-05-01
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 03/11/2010 7:15:26 PM | Computer Name = DCWDN4C1 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 03/11/2010 7:15:26 PM | Computer Name = DCWDN4C1 | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 06/11/2010 7:47:43 AM | Computer Name = DCWDN4C1 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 06/11/2010 7:47:43 AM | Computer Name = DCWDN4C1 | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 07/11/2010 5:46:39 PM | Computer Name = DCWDN4C1 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 08/11/2010 11:22:20 PM | Computer Name = DCWDN4C1 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 08/11/2010 11:22:34 PM | Computer Name = DCWDN4C1 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 08/11/2010 11:22:47 PM | Computer Name = DCWDN4C1 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 08/11/2010 11:23:01 PM | Computer Name = DCWDN4C1 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 08/11/2010 11:23:12 PM | Computer Name = DCWDN4C1 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

[ System Events ]
Error - 08/11/2010 10:08:33 PM | Computer Name = DCWDN4C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 08/11/2010 10:54:41 PM | Computer Name = DCWDN4C1 | Source = Service Control Manager | ID = 7034
Description = The ArcSoft Connect Daemon service terminated unexpectedly. It has
done this 1 time(s).

Error - 08/11/2010 10:54:41 PM | Computer Name = DCWDN4C1 | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 08/11/2010 10:54:41 PM | Computer Name = DCWDN4C1 | Source = Service Control Manager | ID = 7031
Description = The avast! Antivirus service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 5000 milliseconds:
Restart the service.

Error - 08/11/2010 10:54:41 PM | Computer Name = DCWDN4C1 | Source = Service Control Manager | ID = 7034
Description = The Intel(R) Matrix Storage Event Monitor service terminated unexpectedly.
It has done this 1 time(s).

Error - 08/11/2010 10:54:41 PM | Computer Name = DCWDN4C1 | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 08/11/2010 10:54:41 PM | Computer Name = DCWDN4C1 | Source = Service Control Manager | ID = 7034
Description = The MSCamSvc service terminated unexpectedly. It has done this 1 
time(s).

Error - 08/11/2010 10:54:41 PM | Computer Name = DCWDN4C1 | Source = Service Control Manager | ID = 7034
Description = The SeaPort service terminated unexpectedly. It has done this 1 time(s).

Error - 09/11/2010 9:40:13 PM | Computer Name = DCWDN4C1 | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 09/11/2010 9:40:14 PM | Computer Name = DCWDN4C1 | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

< End of report >


----------



## CatByte (Feb 24, 2009)

Please do the following:

This procedure is documented on the Microsoft.com website for resetting registry and system file permissions, as well as default security descriptors.

While it might not fix the problem, it should do no harm either.

First, log on with an Administrative User account .

Now, download and install *SubInACL* from Microsoft.

*Close out all other programs and open windows.*

Highlight and copy the *contents* of the code box below.


```
cd /d "%ProgramFiles%\Windows Resource Kits\Tools"
subinacl /subkeyreg HKEY_LOCAL_MACHINE /owner=administrators /grant=administrators=f /grant=system=f /grant=RESTRICTED=r
subinacl /subkeyreg HKEY_CURRENT_USER /owner=administrators /grant=administrators=f /grant=system=f /grant=RESTRICTED=r
subinacl /subkeyreg HKEY_CLASSES_ROOT /owner=administrators /grant=administrators=f /grant=system=f /grant=RESTRICTED=r
subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose 
exit
cls
```
Click the *WinKey + R* to open a run box and type *cmd* then hit enter to open a command window. (Vista and Win7 users need to right click *cmd* once it populates and click on "Run as an Administrator")

Right click in the command window and select *paste.*

It will take a while for the commands to process, so please be patient.

The command window should close on it's own when finished.

Reboot for the changes to take effect.


----------



## Chelsea-Buns (Oct 28, 2010)

Ok I did that. When I click on my Windows Security Shield it says Rundll32.exe. It won't let me open it. I have to go into control panel then to Security Center to open it.


----------



## CatByte (Feb 24, 2009)

Is that the only remaining issue or are there other issues besides this one?


----------



## Chelsea-Buns (Oct 28, 2010)

As well when downloading things to my documents it won't open it. And as well Mozilla is acting up, saying an error msg when opened. When I click ok, it goes away and it opens


----------



## CatByte (Feb 24, 2009)

Please delete the copy of ComboFix that you have on your desltop > download a fresh copy from the link below and run it

post the resulting log:

Make certain your security programs are disabled:

*Link 1*


----------

