# Very slow computer and comboFIX said it had a root kit



## sarahmuriel (Feb 1, 2004)

Long story short, I got really sick and was unable to pursue the posting of the issue. Big issues with FIrefox, wont let me download the programs and was unable to post them in desktop. Was able to do all this with IE. BTW when the Microsoft music plays at the beginning and end of use it sound like a broken record. The system is very slow, freezes and many times just turns itself off.

Attach programs log
HJT
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:00:27 PM, on 5/31/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
C:\Program Files\FileOpen\Services\FileOpenBroker32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\Documents and Settings\all\Local Settings\Temporary Internet Files\Content.IE5\8H8U98XU\9dgxc9k2[1].exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Winamp Toolbar Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Reader Library Launcher] C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe /startup
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [FUFAXSTM] "C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe"
O4 - HKLM\..\Run: [FileOpenBroker] C:\Program Files\FileOpen\Services\FileOpenBroker32.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\program files\real\realplayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [EPSON NX410 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE /FU "C:\DOCUME~1\all\LOCALS~1\Temp\E_SAA.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [JavaInstallRetry] "C:\Documents and Settings\all\Application Data\Sun\Java\JRERunOnce.exe" RUNONCE=1 SPONSORS=0
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282722117312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1342019053406
O16 - DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} (DASWebDownload Class) - http://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://mozysupport.webex.com/client/T27LB/support/ieatgpc.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: FileOpen Manager Service (FileOpenManagerSvc) - FileOpen Systems Inc. - C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 11807 bytes

DDS logs

DDS (Ver_2012-11-20.01) - NTFS_x86 
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.13.2
Run by all at 15:24:09 on 2013-05-31
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.212 [GMT -4:00]
.
AV: ESET Smart Security 6.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *Enabled* 
FW: AVG Firewall *Disabled* 
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
C:\Program Files\FileOpen\Services\FileOpenBroker32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
uURLSearchHooks: Winamp Toolbar Search Class: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - c:\program files\winamp toolbar\winamptb.dll
mURLSearchHooks: Winamp Toolbar Search Class: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - c:\program files\winamp toolbar\winamptb.dll
BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Winamp Toolbar Loader: {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - c:\program files\winamp toolbar\winamptb.dll
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users.windows\application data\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - c:\program files\epson software\easy photo print\EPTBL.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn2\YTSingleInstance.dll
TB: Winamp Toolbar: {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - c:\program files\winamp toolbar\winamptb.dll
TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
TB: Winamp Toolbar: {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - c:\program files\winamp toolbar\winamptb.dll
TB: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - c:\program files\epson software\easy photo print\EPTBL.dll
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe"
uRun: [EPSON NX410 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatifca.exe /fu "c:\docume~1\all\locals~1\temp\E_SAA.tmp" /EF "HKCU"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [JavaInstallRetry] "c:\documents and settings\all\application data\sun\java\JRERunOnce.exe" RUNONCE=1 SPONSORS=0
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [Reader Library Launcher] c:\program files\sony\reader\data\bin\launcher\Reader Library Launcher.exe
mRun: [EEventManager] "c:\program files\epson software\event manager\EEventManager.exe"
mRun: [ddoctorv2] "c:\program files\comcast\desktop doctor\bin\sprtcmd.exe" /P ddoctorv2
mRun: [LTCM Client] c:\program files\ltcm client\ltcmClient.exe /startup
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [FUFAXSTM] "c:\program files\epson software\fax utility\FUFAXSTM.exe"
mRun: [FileOpenBroker] c:\program files\fileopen\services\FileOpenBroker32.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\ymetray.lnk - c:\program files\yahoo!\yahoo! music jukebox\ymetray.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282722117312
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1342019053406
DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} - hxxp://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://mozysupport.webex.com/client/T27LB/support/ieatgpc.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F} : DHCPNameServer = 65.32.5.111 65.32.5.112
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\all\application data\mozilla\firefox\profiles\4zkw72so.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\all users.windows\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users.windows\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll
FF - plugin: c:\documents and settings\all users.windows\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlpepperflashvideoshim.dll
FF - plugin: c:\documents and settings\all users.windows\application data\realnetworks\realdownloader\browserplugins\npdlplugin.dll
FF - plugin: c:\documents and settings\all\application data\mozilla\plugins\npatgpc.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\motive\npMotive.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\program files\sony\reader\data\bin\npebldetectmoz.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_202.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - ExtSQL: !HIDDEN! 2010-08-28 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01
.
============= SERVICES / DRIVERS ===============
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2011-8-4 122240]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\common files\abbyy\finereadersprint\9.00\licensing\NetworkLicenseServer.exe [2009-5-14 759048]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\adobe\photoshop elements 7.0\PhotoshopElementsFileAgent.exe [2008-9-16 169312]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2013-3-21 1341664]
R2 FileOpenManagerSvc;FileOpen Manager Service;c:\program files\fileopen\services\FileOpenManagerSvc32.exe [2012-4-30 213888]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\realnetworks\realdownloader\rndlresolversvc.exe [2012-11-29 38608]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [2012-9-24 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [2012-9-24 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [2012-9-24 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [2012-9-24 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [2012-9-24 25704]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2012-10-7 1691480]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [2003-4-23 16896]
S3 eBook;eBook;c:\windows\system32\drivers\eBook.sys [2005-6-25 22072]
S3 fdrawcmd;Low-level Floppy Driver;c:\windows\system32\drivers\fdrawcmd.sys [2008-9-27 27544]
S3 wdpnp;WinDriver USB Client;c:\windows\system32\drivers\wdpnp.sys [2010-8-29 22748]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;"c:\program files\roxio creator 2009\digital home 11\roxioupnprenderer11.exe" --> c:\program files\roxio creator 2009\digital home 11\RoxioUPnPRenderer11.exe [?]
.
=============== File Associations ===============
.
ShellExec: ymp.exe: open="c:\program files\yahoo!\yahoo! music jukebox\YahooMusicEngine.exe" -play "%1"
ShellExec: ymp.exe: play="c:\program files\yahoo!\yahoo! music jukebox\YahooMusicEngine.exe" -play "%1"
.
=============== Created Last 30 ================
.
2013-05-24 06:05:08	262552	----a-w-	c:\program files\mozilla firefox\browser\components\browsercomps.dll
2013-05-24 06:03:57	104344	----a-w-	c:\program files\mozilla firefox\nssutil3.dll
2013-05-12 03:16:39	--------	d-----w-	c:\documents and settings\all users.windows\application data\Licenses
.
==================== Find3M ====================
.
2013-05-22 12:18:32	252288	----a-r-	c:\windows\system32\cpnprt2.cid
2013-05-15 04:59:47	692104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-05-15 04:59:46	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-16 22:17:15	920064	----a-w-	c:\windows\system32\wininet.dll
2013-04-16 22:17:14	43520	------w-	c:\windows\system32\licmgr10.dll
2013-04-16 22:17:14	1469440	------w-	c:\windows\system32\inetcpl.cpl
2013-04-12 23:28:55	385024	------w-	c:\windows\system32\html.iec
2013-04-10 01:31:19	1876352	----a-w-	c:\windows\system32\win32k.sys
2013-03-08 08:36:22	293376	----a-w-	c:\windows\system32\winsrv.dll
2013-03-07 01:32:25	2149888	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50:30	2028544	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-04-10 17:21:49	1263344	----a-w-	c:\program files\eset_smart_security_live_installer.exe
2010-08-29 15:32:15	18862693	----a-w-	c:\program files\KoboSetup.exe
2010-08-29 15:23:15	3760464	----a-w-	c:\program files\CuteWriter.exe
2010-08-19 22:08:22	359656	----a-w-	c:\program files\msicuu2.exe
2010-01-24 19:09:12	289584	----a-w-	c:\program files\uTorrent.exe
2009-11-11 06:06:26	4787413	----a-w-	c:\program files\copistar_full.exe
2009-03-31 05:01:20	401720	----a-w-	c:\program files\HiJackThis.exe
2007-08-09 02:07:20	1578514	----a-w-	c:\program files\abcreb_setup.exe
2001-12-25 12:03:24	249856	----a-w-	c:\program files\pelite.exe
.
============= FINISH: 15:26:29.57 ===============

Attach log

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 8/25/2010 2:23:17 PM
System Uptime: 5/31/2013 3:00:41 PM (0 hours ago)
.
Motherboard: LENOVO | | LENOVO
Processor: Intel(R) Atom(TM) CPU 230 @ 1.60GHz | CPU 1 | 1596/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 149 GiB total, 103.251 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 1397 GiB total, 1198.26 GiB free.
G: is FIXED (NTFS) - 298 GiB total, 174.584 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP171: 3/2/2013 4:37:54 PM - System Checkpoint
RP172: 3/3/2013 5:37:22 PM - System Checkpoint
RP173: 3/4/2013 6:37:45 PM - System Checkpoint
RP174: 3/5/2013 7:37:55 PM - System Checkpoint
RP175: 3/6/2013 7:46:02 PM - System Checkpoint
RP176: 3/7/2013 8:37:33 PM - System Checkpoint
RP177: 3/8/2013 9:37:12 PM - System Checkpoint
RP178: 3/9/2013 11:37:19 PM - System Checkpoint
RP179: 3/11/2013 12:37:26 AM - System Checkpoint
RP180: 3/11/2013 11:29:20 AM - Installed calibre
RP181: 3/12/2013 11:37:22 AM - System Checkpoint
RP182: 3/13/2013 1:38:47 PM - System Checkpoint
RP183: 3/14/2013 2:33:33 PM - System Checkpoint
RP184: 3/15/2013 4:23:16 PM - System Checkpoint
RP185: 3/16/2013 8:53:15 AM - Software Distribution Service 3.0
RP186: 3/17/2013 9:00:38 AM - System Checkpoint
RP187: 3/18/2013 9:09:39 AM - System Checkpoint
RP188: 3/19/2013 10:09:56 AM - System Checkpoint
RP189: 3/20/2013 11:10:14 AM - System Checkpoint
RP190: 3/21/2013 1:01:32 PM - System Checkpoint
RP191: 3/22/2013 1:33:52 PM - System Checkpoint
RP192: 3/23/2013 2:09:46 PM - System Checkpoint
RP193: 3/24/2013 10:45:07 AM - Software Distribution Service 3.0
RP194: 3/25/2013 11:09:49 AM - System Checkpoint
RP195: 3/26/2013 12:08:32 PM - System Checkpoint
RP196: 3/27/2013 1:09:49 PM - System Checkpoint
RP197: 3/28/2013 2:08:32 PM - System Checkpoint
RP198: 3/29/2013 3:08:55 PM - System Checkpoint
RP199: 3/30/2013 4:09:01 PM - System Checkpoint
RP200: 3/31/2013 5:08:57 PM - System Checkpoint
RP201: 4/1/2013 1:27:30 PM - SlimDrivers Installing Drivers
RP202: 4/1/2013 1:44:04 PM - Installed Realtek High Definition Audio Driver
RP203: 4/1/2013 1:49:16 PM - SlimDrivers Installing Drivers
RP204: 4/2/2013 2:06:53 PM - System Checkpoint
RP205: 4/3/2013 2:19:24 PM - System Checkpoint
RP206: 4/4/2013 3:19:21 PM - System Checkpoint
RP207: 4/5/2013 3:33:47 PM - System Checkpoint
RP208: 4/6/2013 4:33:41 PM - System Checkpoint
RP209: 4/7/2013 5:33:42 PM - System Checkpoint
RP210: 4/8/2013 6:33:44 PM - System Checkpoint
RP211: 4/9/2013 7:33:34 PM - System Checkpoint
RP212: 4/10/2013 8:33:39 PM - System Checkpoint
RP213: 4/11/2013 9:33:38 PM - System Checkpoint
RP214: 4/12/2013 10:33:51 PM - System Checkpoint
RP215: 4/13/2013 11:33:42 PM - System Checkpoint
RP216: 4/14/2013 11:19:04 AM - Software Distribution Service 3.0
RP217: 4/15/2013 11:51:18 AM - System Checkpoint
RP218: 4/16/2013 11:58:53 AM - System Checkpoint
RP219: 4/17/2013 12:58:35 PM - System Checkpoint
RP220: 4/18/2013 1:56:16 PM - System Checkpoint
RP221: 4/19/2013 1:59:06 PM - System Checkpoint
RP222: 4/20/2013 2:58:56 PM - System Checkpoint
RP223: 4/21/2013 3:08:08 PM - System Checkpoint
RP224: 4/22/2013 4:00:21 PM - System Checkpoint
RP225: 4/23/2013 4:58:29 PM - System Checkpoint
RP226: 4/24/2013 6:21:11 PM - System Checkpoint
RP227: 4/25/2013 7:02:35 PM - System Checkpoint
RP228: 4/26/2013 7:36:34 PM - System Checkpoint
RP229: 4/27/2013 8:36:36 PM - System Checkpoint
RP230: 4/28/2013 8:53:34 PM - System Checkpoint
RP231: 4/29/2013 9:36:42 PM - System Checkpoint
RP232: 4/30/2013 10:36:35 PM - System Checkpoint
RP233: 5/1/2013 11:36:32 PM - System Checkpoint
RP234: 5/2/2013 2:36:44 PM - Removed ESET Smart Security
RP235: 5/2/2013 2:38:23 PM - Installed ESET Smart Security
RP236: 5/3/2013 3:10:52 PM - System Checkpoint
RP237: 5/4/2013 4:11:05 PM - System Checkpoint
RP238: 5/5/2013 5:11:09 PM - System Checkpoint
RP239: 5/6/2013 6:11:09 PM - System Checkpoint
RP240: 5/7/2013 7:10:39 PM - System Checkpoint
RP241: 5/8/2013 8:10:38 PM - System Checkpoint
RP242: 5/9/2013 8:58:13 PM - System Checkpoint
RP243: 5/10/2013 9:10:54 PM - System Checkpoint
RP244: 5/11/2013 7:29:09 PM - Restore Operation
RP245: 5/11/2013 7:36:30 PM - Restore Operation
RP246: 5/11/2013 7:44:16 PM - Restore Operation
RP247: 5/25/2013 5:38:55 PM - Software Distribution Service 3.0
RP248: 5/28/2013 11:19:16 AM - System Checkpoint
RP249: 5/29/2013 11:45:42 AM - System Checkpoint
RP250: 5/30/2013 12:04:30 PM - System Checkpoint
RP251: 5/31/2013 12:06:45 PM - System Checkpoint
RP252: 5/31/2013 2:58:19 PM - Installed Windows Internet Explorer 8.
.
==== Installed Programs ======================
.
µTorrent
ABBYY FineReader 9.0 Sprint
ABC Amber LIT Converter
ABC Amber Text Converter
[email protected] ISO Burner
Adobe AIR
Adobe Digital Editions
Adobe Flash Player 11 Plugin
Adobe Photoshop Elements 7.0
Adobe Reader X (10.1.6)
Aimersoft Music Converter(Build 1.4.3.0)
AnyTV Free 2.63
Ashampoo Burning Studio 6 FREE v.6.81
AudibleManager
Auto Updater
Borders Desktop
Buzz Tools
calibre
CCleaner
ConvertXtoDVD 4.1.2.336
Coupon Printer for Windows
Creative MediaSource 5
Creative Removable Disk Manager
Creative System Information
Creative ZEN V Series (R2)
CutePDF Writer 2.8
Dear Jane
Desktop Doctor
Download Updater (AOL LLC)
Epson CreativeZone
Epson Easy Photo Print 2
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
Epson Easy Photo Print Plug-in for Windows Live Photo Gallery
Epson Easy Photo Print Plug-in for Windows Live Photo Gallery Setup
Epson Event Manager
Epson FAX Utility
EPSON NX410 Series Printer Uninstall
Epson PC-FAX Driver
EPSON Scan
EPSON WorkForce 520 Series Printer Uninstall
EpsonNet Print
EpsonNet Setup 3.2
EQ5
ESET Online Scanner v3
ESET Smart Security
Family Tree Maker 2006
Family Tree Maker 2010
Fdrawcmd.sys 1.0.1.10
FileOpen Client
Foundation Factory Quilt Mag Blocks For Quilt-Pro
Free M4a to MP3 Converter 7.1
G7 Video Player Driver
Garmin POI Loader
Garmin USB Drivers
Garmin WebUpdater
GoToMeeting 4.5.0.457
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB2779562)
iCare by Wild Ginger Software, Inc.
Intel(R) Graphics Media Accelerator Driver
Intel(R) IPP Run-Time Installer 5.2 for Windows* on IA-32
Japanese Fonts Support For Adobe Reader 8
Java 7 Update 13
Java Auto Updater
Knitting Math Wizard
LTCM Client
Magna-Hoop
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2742597)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft ActiveSync
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Money Plus
Microsoft Money Shared Libraries
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Plus 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Primary Interoperability Assemblies 2005
Microsoft Reader
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server Compact 3.5 ENU
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft WSE 3.0
Mozilla Firefox 21.0 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
OverDrive Media Console
Pattern Master 5 Help and Movies
PatternMaster Boutique 4
PatternMaster Boutique 5
PatternMaster Boutique 5 Update
PatternMaster Boutique x5
PCStitch Pattern Viewer
PE-DESIGN Ver.6
PE-DESIGN Ver.7
PED-Basic
Pick-A-Stitch
PL-2303 USB-to-Serial
PowerISO
Print-A-Grid
PRS-500 USB driver
Pulse Ambassador
Quilt-Pro Version 5
Quilt-Pro Version 6
RCA Opal (Model M4001, M4002, MC4001 and MC4002) Firmware Update Utility
Reader Library by Sony
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealNetworks - Microsoft Visual C++ 2010 Runtime
RealPlayer
REALTEK GbE & FE Ethernet PCI and PCIE Windows NIC Driver
Realtek High Definition Audio Driver
RealUpgrade 1.1
RegScrubXP 3.25
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition 
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition 
Security Update for Microsoft Office InfoPath 2007 (KB2510061)
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition 
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition 
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB2761465)
Security Update for Windows Internet Explorer 8 (KB2792100)
Security Update for Windows Internet Explorer 8 (KB2797052)
Security Update for Windows Internet Explorer 8 (KB2799329)
Security Update for Windows Internet Explorer 8 (KB2809289)
Security Update for Windows Internet Explorer 8 (KB2817183)
Security Update for Windows Internet Explorer 8 (KB2829530)
Security Update for Windows Internet Explorer 8 (KB2847204)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Encoder (KB2447961)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB2753842-v2)
Security Update for Windows XP (KB2753842)
Security Update for Windows XP (KB2757638)
Security Update for Windows XP (KB2758857)
Security Update for Windows XP (KB2761226)
Security Update for Windows XP (KB2770660)
Security Update for Windows XP (KB2778344)
Security Update for Windows XP (KB2779030)
Security Update for Windows XP (KB2780091)
Security Update for Windows XP (KB2799494)
Security Update for Windows XP (KB2802968)
Security Update for Windows XP (KB2807986)
Security Update for Windows XP (KB2808735)
Security Update for Windows XP (KB2813170)
Security Update for Windows XP (KB2813345)
Security Update for Windows XP (KB2820197)
Security Update for Windows XP (KB2820917)
Security Update for Windows XP (KB2829361)
Security Update for Windows XP (KB923789)
Sew Precise
Sew Precise 4
Shirley Liby Designs for Sew Precise!
SlimDrivers
SmartSound Quicktracks Plugin
SMPlayer 0.6.9
Sock Wizard V2
Spybot - Search & Destroy
SpywareBlaster 5.0
Sweater Wizard V3
The Complete Genealogy Reporter
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817359) 32-Bit Edition
Update for Windows Internet Explorer 8 (KB2598845)
Update for Windows Internet Explorer 8 (KB2632503)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2492386)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB971029)
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebEx
WebFldrs XP
Wild Things! by Wild Ginger Software, Inc.
Winamp
Winamp Toolbar
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
Windows Driver Package - Sony Corporation (PRSUSB) USB (08/08/2006 1.0.03.08080)
Windows Imaging Component
Windows Installer Clean Up
Windows Internet Explorer 8
Windows Management Framework Core
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB895316
Windows Media Player 11
Windows XP Service Pack 3
WinPatrol
WinRAR archiver
Yahoo! Music Jukebox
Yahoo! Software Update
Yahoo! Toolbar
ZEN V Series Media Explorer
ZENcast Organizer
.
==== End Of File ===========================

ATK log

GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-05-31 17:50:47
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-6 Hitachi_HDP725016GLA380 rev.GMBOA5NA 149.05GB
Running: 9dgxc9k2[1].exe; Driver: C:\DOCUME~1\all\LOCALS~1\Temp\pxtdapod.sys

---- System - GMER 2.1 ----

SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwAssignProcessToJobObject [0x9F5F04B0]
SSDT spxt.sys ZwCreateKey [0xF72D50E0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwCreateThread [0x9F5F07F0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwDebugActiveProcess [0x9F5F0AB0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwDuplicateObject [0x9F5F05D0]
SSDT spxt.sys ZwEnumerateKey [0xF72EDDA4]
SSDT spxt.sys ZwEnumerateValueKey [0xF72EE132]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwLoadDriver [0x9F5F08B0]
SSDT spxt.sys ZwOpenKey [0xF72D50C0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwOpenProcess [0x9F5F0350]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwOpenThread [0x9F5F0410]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwProtectVirtualMemory [0x9F5F0570]
SSDT spxt.sys ZwQueryKey [0xF72EE20A]
SSDT spxt.sys ZwQueryValueKey [0xF72EE08A]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwQueueApcThread [0x9F5F0630]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSetContextThread [0x9F5F0530]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSetInformationThread [0x9F5F04F0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSetSecurityObject [0x9F5F0670]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSetSystemInformation [0x9F5F0870]
SSDT spxt.sys ZwSetValueKey [0xF72EE29C]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSuspendProcess [0x9F5F03B0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSuspendThread [0x9F5F0430]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSystemDebugControl [0x9F5F0830]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwTerminateProcess [0x9F5F0370]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwTerminateThread [0x9F5F0470]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwWriteVirtualMemory [0x9F5F05F0]

INT 0x62 ? 86D68BF8
INT 0x63 ? 86C02F00
INT 0x73 ? 86D68BF8
INT 0x73 ? 86D68BF8
INT 0x73 ? 86C02F00
INT 0x73 ? 86D68BF8
INT 0x82 ? 86D68BF8
INT 0x83 ? 86C02F00
INT 0xB4 ? 86C02F00

---- Kernel code sections - GMER 2.1 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2FD0 805048B8 12 Bytes [B0, 03, 5F, 9F, 30, 04, 5F, ...] {MOV AL, 0x3; POP EDI; LAHF ; XOR [EDI+EBX*2], AL; LAHF ; XOR [EAX], CL; POP EDI; LAHF }
? spxt.sys The system cannot find the file specified. !
? C:\DOCUME~1\all\LOCALS~1\Temp\mbr.sys The filename, directory name, or volume label syntax is incorrect. !

---- User code sections - GMER 2.1 ----

.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[504] kernel32.dll!SetUnhandledExceptionFilter 7C8449CD 4 Bytes [C2, 04, 00, 00]
.text C:\Program Files\Internet Explorer\iexplore.exe[1544] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215545 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1544] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDC14 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1544] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E799F C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1544] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E78D1 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1544] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E793C C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1544] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E77A2 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1544] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E7804 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1544] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E7A02 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1544] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E7866 C:\WINDOWS\system32\IEFRAME.dll
.text C:\WINDOWS\system32\SearchIndexer.exe[2388] kernel32.dll!WriteFile 7C8112FF 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL
.text C:\program files\real\realplayer\update\realsched.exe[2788] kernel32.dll!SetUnhandledExceptionFilter 7C8449CD 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215545 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9B89 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD1C5 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDC14 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E2546A6 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E799F C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E78D1 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E793C C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E77A2 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E7804 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E7A02 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E7866 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] ole32.dll!CoCreateInstance 774FF1BC 5 Bytes JMP 3E2EDC70 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3120] ole32.dll!OleLoadFromStream 7752983B 5 Bytes JMP 3E3E7D07 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe[3544] kernel32.dll!SetUnhandledExceptionFilter 7C8449CD 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- Devices - GMER 2.1 ----

Device \FileSystem\Ntfs \Ntfs 86D671F8

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys

Device \Driver\NetBT \Device\NetBT_Tcpip_{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F} 861C3500

AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys

Device \Driver\usbehci \Device\USBPDO-0 86BFF500
Device \Driver\usbuhci \Device\USBPDO-1 86C08500
Device \Driver\usbuhci \Device\USBPDO-2 86C08500
Device \Driver\usbuhci \Device\USBPDO-3 86C08500
Device \Driver\usbuhci \Device\USBPDO-4 86C08500

AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys

Device \Driver\Ftdisk \Device\HarddiskVolume1 86DD81F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 86DD81F8
Device \Driver\Cdrom \Device\CdRom0 86C05500
Device \Driver\atapi \Device\Ide\IdePort0 [F724FB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [F724FB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-6 [F724FB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort2 [F724FB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-e [F724FB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort3 [F724FB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\Ftdisk \Device\HarddiskVolume3 86DD81F8
Device \Driver\usbstor \Device\00000080 861C8500
Device \Driver\usbstor \Device\00000081 861C8500
Device \Driver\usbstor \Device\00000083 861C8500
Device \Driver\NetBT \Device\NetBt_Wins_Export 861C3500
Device \Driver\NetBT \Device\NetbiosSmb 861C3500
Device \Driver\FileOpenWebPublisherScreenHookDriver \Device\FileOpenWebPublisherScreenHookDriver fowp32.sys

AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys

Device \Driver\usbuhci \Device\USBFDO-0 86C08500
Device \Driver\usbuhci \Device\USBFDO-1 86C08500
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 861C9500
Device \Driver\usbuhci \Device\USBFDO-2 86C08500
Device \FileSystem\MRxSmb \Device\LanmanRedirector 861C9500
Device \Driver\usbuhci \Device\USBFDO-3 86C08500
Device \Driver\usbehci \Device\USBFDO-4 86BFF500
Device \Driver\Ftdisk \Device\FtControl 86DD81F8
Device \Driver\usbstor \Device\0000007e 861C8500
Device \FileSystem\Cdfs \Cdfs 861C2500

---- Trace I/O - GMER 2.1 ----

Trace ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spxt.sys >>UNKNOWN [0x86d88938]<< 86d88938
Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86d23ab8] 86d23ab8
Trace 3 CLASSPNP.SYS[f7508fd7] -> nt!IofCallDriver -> \Device\00000070[0x86d18f18] 86d18f18
Trace 5 ACPI.sys[f7294620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-6[0x86d48940] 86d48940

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\[email protected] 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\[email protected] 285507792
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\[email protected] 340
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\[email protected] 109

---- EOF - GMER 2.1 ----

Please help, I really need my computer and it definitely has some bug bugging it!!!!

THanks in advance Sarah


----------



## sarahmuriel (Feb 1, 2004)

Still would love to hear from you!!!!


----------



## sarahmuriel (Feb 1, 2004)

Please, please , please help, it's sooooo slow I just want to slam my computer. It raises my BLOOD PRESSURE!


----------



## Cookiegal (Aug 27, 2003)

Please download aswMBR.exe and save it to your desktop.

Double click aswMBR.exe to start the tool (Vista/Windows 7 users - right click to run as administrator) and allow it to download the Avast database.

Click *Scan*.

Upon completion of the scan, click *Save log* then save it to your desktop and post that log in your next reply for review. 
*Note - do NOT attempt any Fix yet. *

You will also notice another file created on the desktop named *MBR.dat*. This is just a back up of the MBR so please leave it on the desktop for now in case it may be needed.


----------



## sarahmuriel (Feb 1, 2004)

Here is a copy of the log. As you will notice it shows that I saved a log before it finished, I discarded that one (I thought it had ended and then saw it was continuing) am posting the finished one. 
Sarah

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-06-06 10:16:16
-----------------------------
10:16:16.759 OS Version: Windows 5.1.2600 Service Pack 3
10:16:16.759 Number of processors: 2 586 0x1C02
10:16:16.759 ComputerName: LENOVO UserName: all
10:16:19.900 Initialize success
10:20:44.916 AVAST engine defs: 13060600
10:24:06.728 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-6
10:24:06.728 Disk 0 Vendor: Hitachi_HDP725016GLA380 GMBOA5NA Size: 152627MB BusType: 3
10:24:07.072 Disk 0 MBR read successfully
10:24:07.072 Disk 0 MBR scan
10:24:07.212 Disk 0 Windows XP default MBR code
10:24:07.228 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 152617 MB offset 63
10:24:07.244 Disk 0 scanning sectors +312560640
10:24:07.666 Disk 0 scanning C:\WINDOWS\system32\drivers
10:24:59.056 Service scanning
10:25:56.775 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
10:26:11.978 Modules scanning
10:26:43.541 Disk 0 trace - called modules:
10:26:43.587 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spve.sys >>UNKNOWN [0x86d88938]<<
10:26:43.978 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86d02ab8]
10:26:43.978 3 CLASSPNP.SYS[f7508fd7] -> nt!IofCallDriver -> \Device\00000070[0x86d06f18]
10:26:43.994 5 ACPI.sys[f7294620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-6[0x86d05940]
10:26:46.728 AVAST engine scan C:\WINDOWS
10:27:25.634 AVAST engine scan C:\WINDOWS\system32
10:44:26.556 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\all\Desktop\MBR.dat"
10:44:26.603 The log file has been saved successfully to "C:\Documents and Settings\all\Desktop\aswMBR.txt"
10:44:35.587 AVAST engine scan C:\WINDOWS\system32\drivers
10:45:34.416 AVAST engine scan C:\Documents and Settings\all
11:12:55.478 AVAST engine scan C:\Documents and Settings\All Users.WINDOWS
11:24:43.212 Scan finished successfully
11:26:46.541 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\all\Desktop\MBR.dat"
11:26:46.556 The log file has been saved successfully to "C:\Documents and Settings\all\Desktop\aswMBR.txt"

Thanks for your Help


----------



## Cookiegal (Aug 27, 2003)

First of all, you shouldn't run ComboFix on your own but In the title of your thread you mentioned that ComboFix said it had a rootkit. What exactly do you mean? Did ComboFix give you an alert and if so please provide what it said exactly. Were you able to run it and do you have a log to post?


----------



## sarahmuriel (Feb 1, 2004)

Done with the tropical storm, lost power for a little while only. Yes I did run ComboFIx and no I don't remember the name of the RootKit that the program named.

Posting the entries on the ComboFix quarantine files, the date was 05/12

2013-01-31 17:11:53 . 2013-05-12 18:49:23 6,292 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2013-01-31 16:33:34 . 2013-05-12 18:32:32 408 ----a-w- C:\Qoobox\Quarantine\catchme.log
2012-07-22 14:46:52 . 2012-07-22 14:46:53 16,883,056 ----a-w- C:\Qoobox\Quarantine\C\IE8-WI~1.EXE.vir
2012-01-17 03:01:31 . 2012-01-17 03:04:52 941 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\all\Application Data\a3a47e80.vir
2012-01-17 03:01:31 . 2012-01-17 03:04:52 987 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\ffb54aa1.vir
2010-09-09 16:43:43 . 2010-09-13 19:45:02 787 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\wininit.ini.vir
2004-08-03 22:59:02 . 2012-04-11 12:35:51 2,026,496 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_000012_.tmp.dll.vir
2004-08-03 22:59:02 . 2011-10-25 12:52:02 2,027,008 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_000013_.tmp.dll.vir
2003-02-21 09:16:08 . 2003-02-21 09:16:08 49,152 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\URTTemp\regtlib.exe.vir

Copy of the log for that day

ComboFix 13-02-07.01 - all 05/12/2013 14:34:53.10.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.583 [GMT -4:00]
Running from: c:\documents and settings\all\Desktop\ComboFix.exe
AV: ESET Smart Security 6.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ESET Personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
.
.
((((((((((((((((((((((((( Files Created from 2013-04-12 to 2013-05-12 )))))))))))))))))))))))))))))))
.
.
2013-05-12 03:16 . 2013-05-12 03:16	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\Licenses
2013-05-02 18:38 . 2013-05-02 18:38	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-09 23:04 . 2012-03-31 09:15	691592	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-05-09 23:04 . 2011-05-14 05:23	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-08 08:36 . 2004-08-04 20:00	293376	----a-w-	c:\windows\system32\winsrv.dll
2013-03-07 01:32 . 2004-08-04 20:00	2149888	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50 . 2004-08-03 22:59	2028544	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-03-02 02:06 . 2004-08-04 20:00	916480	----a-w-	c:\windows\system32\wininet.dll
2013-03-02 02:06 . 2004-08-04 20:00	43520	------w-	c:\windows\system32\licmgr10.dll
2013-03-02 02:06 . 2004-08-04 20:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2013-03-02 01:25 . 2004-08-04 20:00	1867264	----a-w-	c:\windows\system32\win32k.sys
2013-03-02 01:08 . 2004-08-04 20:00	385024	------w-	c:\windows\system32\html.iec
2013-02-27 07:56 . 2010-08-25 18:09	2067456	------w-	c:\windows\system32\mstscax.dll
2013-02-20 15:07 . 2011-08-04 13:20	62512	----a-w-	c:\windows\system32\drivers\epfwtdi.sys
2013-02-12 00:32 . 2010-09-04 21:23	12928	----a-w-	c:\windows\system32\drivers\usb8023x.sys
2013-02-12 00:32 . 2004-08-04 20:00	12928	----a-w-	c:\windows\system32\drivers\usb8023.sys
2012-04-10 17:21 . 2012-04-10 17:21	1263344	----a-w-	c:\program files\eset_smart_security_live_installer.exe
2010-08-29 15:32 . 2010-08-29 15:31	18862693	----a-w-	c:\program files\KoboSetup.exe
2010-08-29 15:23 . 2010-08-29 15:23	3760464	----a-w-	c:\program files\CuteWriter.exe
2010-08-19 22:08 . 2010-11-05 21:25	359656	----a-w-	c:\program files\msicuu2.exe
2010-01-24 19:09 . 2010-01-24 19:09	289584	----a-w-	c:\program files\uTorrent.exe
2009-11-11 06:06 . 2010-02-14 22:07	4787413	----a-w-	c:\program files\copistar_full.exe
2009-03-31 05:01 . 2010-05-30 23:13	401720	----a-w-	c:\program files\HiJackThis.exe
2007-08-09 02:07 . 2010-07-07 18:38	1578514	----a-w-	c:\program files\abcreb_setup.exe
2001-12-25 12:03 . 2010-08-29 16:48	249856	----a-w-	c:\program files\pelite.exe
2013-04-12 05:09 . 2013-04-12 05:07	263064	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2011-09-28 1937736]
.
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LTCM Client"="c:\program files\LTCM Client\ltcmClient.exe" [2009-08-05 1596096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-01-30 400480]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-03 847872]
"FileOpenBroker"="c:\program files\FileOpen\Services\FileOpenBroker32.exe" [2012-04-30 836480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2000-01-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2000-01-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2000-01-01 137752]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-01-31 295072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"RTHDCPL"="RTHDCPL.EXE" [2000-01-01 20117136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-03-21 5078504]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2006-8-14 49152]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pulse Ambassador Update Setup for All Users]
2009-05-13 18:48	2768848	-c--a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\EpsonNet\\EpsonNet Setup\\tool10\\ENEasyApp.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5985:TCP"= 5985:TCP:*isabled:Windows Remote Management 
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/5/2010 6:20 AM 691696]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8/4/2011 9:20 AM 122240]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [5/14/2009 6:07 PM 759048]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 12:03 PM 169312]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [3/21/2013 3:19 PM 1341664]
R2 FileOpenManagerSvc;FileOpen Manager Service;c:\program files\FileOpen\Services\FileOpenManagerSvc32.exe [4/30/2012 7:56 PM 213888]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [11/29/2012 9:31 PM 38608]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [9/24/2012 3:55 PM 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [9/24/2012 3:58 PM 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [9/24/2012 3:59 PM 25704]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [10/7/2012 7:42 PM 1691480]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [4/23/2003 9:45 AM 16896]
S3 eBook;eBook;c:\windows\system32\drivers\eBook.sys [6/25/2005 11:35 AM 22072]
S3 fdrawcmd;Low-level Floppy Driver;c:\windows\system32\drivers\fdrawcmd.sys [9/27/2008 11:09 PM 27544]
S3 wdpnp;WinDriver USB Client;c:\windows\system32\drivers\wdpnp.sys [8/29/2010 1:14 PM 22748]
S4 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;"c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe" --> c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [?]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - FileOpenWebPublisherScreenHookDriver
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32	128512	------w-	c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 23:04]
.
2013-05-12 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 00:12]
.
2013-05-12 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-05-12 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-05-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-05-12 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchAssistant = 
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2010-08-28 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-12 14:58
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2013-05-12 15:16:38
ComboFix-quarantined-files.txt 2013-05-12 19:16
ComboFix2.txt 2013-05-12 01:07
ComboFix3.txt 2013-02-07 22:11
ComboFix4.txt 2013-01-31 17:39
ComboFix5.txt 2013-05-12 16:31
.
Pre-Run: 111,364,616,192 bytes free
Post-Run: 111,443,431,424 bytes free
.
- - End Of File - - EB39DD7DAC8684941DAC3545D8A8BF89


----------



## Cookiegal (Aug 27, 2003)

Please go to the following link and download and run TDSSKiller:

http://support.kaspersky.com/viruses/utility

Allow it cure anything if prompted.

Please post the log back here.


----------



## sarahmuriel (Feb 1, 2004)

I just finished running that program, only one object found, threat medium, quarantine in the LOCKED file, no cure option. Unfortunately there is no way to post a report log, of itself it does not create a log text. When I go into their report and I highlight the report , there is no right click to copy. So if you have further instructions I would appreciate them so that I can copy that Report for you.
Thanks 
Sarah


----------



## Cookiegal (Aug 27, 2003)

There should be a log that looks like this:

C:\TDSSKiller.<version_date_time>log.txt

Please oen it in Notepad and copy and paste the contents here.


----------



## sarahmuriel (Feb 1, 2004)

16:01:59.0353 8376 TDSS rootkit removing tool 2.8.17.0 Apr 11 2013 11:56:34
16:02:00.0884 8376 ============================================================
16:02:00.0884 8376 Current date / time: 2013/06/07 16:02:00.0884
16:02:00.0884 8376 SystemInfo:
16:02:00.0884 8376 
16:02:00.0884 8376 OS Version: 5.1.2600 ServicePack: 3.0
16:02:00.0884 8376 Product type: Workstation
16:02:00.0884 8376 ComputerName: LENOVO
16:02:00.0884 8376 UserName: all
16:02:00.0884 8376 Windows directory: C:\WINDOWS
16:02:00.0884 8376 System windows directory: C:\WINDOWS
16:02:00.0884 8376 Processor architecture: Intel x86
16:02:00.0884 8376 Number of processors: 2
16:02:00.0884 8376 Page size: 0x1000
16:02:00.0884 8376 Boot type: Normal boot
16:02:00.0884 8376 ============================================================
16:02:24.0900 8376 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
16:02:24.0931 8376 Drive \Device\Harddisk1\DR2 - Size: 0x15D50D00000 (1397.26 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
16:02:24.0947 8376 Drive \Device\Harddisk2\DR3 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
16:02:24.0962 8376 ============================================================
16:02:24.0962 8376 \Device\Harddisk0\DR0:
16:02:24.0994 8376 MBR partitions:
16:02:24.0994 8376 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A14BC1
16:02:24.0994 8376 \Device\Harddisk1\DR2:
16:02:24.0994 8376 MBR partitions:
16:02:24.0994 8376 \Device\Harddisk1\DR2\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAEA86000
16:02:24.0994 8376 \Device\Harddisk2\DR3:
16:02:25.0009 8376 MBR partitions:
16:02:25.0009 8376 \Device\Harddisk2\DR3\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542D682
16:02:25.0009 8376 ============================================================
16:02:25.0259 8376 C: <-> \Device\Harddisk0\DR0\Partition1
16:02:25.0400 8376 G: <-> \Device\Harddisk2\DR3\Partition1
16:02:25.0962 8376 F: <-> \Device\Harddisk1\DR2\Partition1
16:02:25.0962 8376 ============================================================
16:02:25.0962 8376 Initialize success
16:02:25.0962 8376 ============================================================
16:04:03.0931 7788 ============================================================
16:04:03.0931 7788 Scan started
16:04:03.0931 7788 Mode: Manual; 
16:04:03.0931 7788 ============================================================
16:04:06.0587 7788 ================ Scan system memory ========================
16:04:06.0587 7788 System memory - ok
16:04:06.0587 7788 ================ Scan services =============================
16:04:07.0025 7788 [ C07D5197410AAB28D0D93F943F59656D ] 6to4 C:\WINDOWS\System32\6to4svc.dll
16:04:07.0041 7788 6to4 - ok
16:04:07.0416 7788 [ B33CF4DE909A5B30F526D82053A63C8E ] ABBYY.Licensing.FineReader.Sprint.9.0 C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
16:04:07.0650 7788 ABBYY.Licensing.FineReader.Sprint.9.0 - ok
16:04:07.0728 7788 Abiosdsk - ok
16:04:07.0744 7788 abp480n5 - ok
16:04:07.0853 7788 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:04:07.0916 7788 ACPI - ok
16:04:07.0962 7788 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
16:04:07.0994 7788 ACPIEC - ok
16:04:08.0134 7788 [ 3FD8DC2C9735C2AA70155102CFB93EDA ] AdobeActiveFileMonitor7.0 C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
16:04:08.0181 7788 AdobeActiveFileMonitor7.0 - ok
16:04:08.0369 7788 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
16:04:08.0431 7788 AdobeFlashPlayerUpdateSvc - ok
16:04:08.0431 7788 adpu160m - ok
16:04:08.0525 7788 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
16:04:08.0572 7788 aec - ok
16:04:08.0666 7788 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
16:04:08.0712 7788 AFD - ok
16:04:08.0728 7788 Aha154x - ok
16:04:08.0744 7788 aic78u2 - ok
16:04:08.0759 7788 aic78xx - ok
16:04:08.0806 7788 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
16:04:08.0806 7788 Alerter - ok
16:04:08.0853 7788 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
16:04:08.0853 7788 ALG - ok
16:04:08.0869 7788 AliIde - ok
16:04:09.0494 7788 [ 267FC636801EDC5AB28E14036349E3BE ] Ambfilt C:\WINDOWS\system32\drivers\Ambfilt.sys
16:04:10.0103 7788 Ambfilt - ok
16:04:10.0119 7788 amsint - ok
16:04:10.0150 7788 AppMgmt - ok
16:04:10.0150 7788 asc - ok
16:04:10.0166 7788 asc3350p - ok
16:04:10.0181 7788 asc3550 - ok
16:04:10.0400 7788 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
16:04:10.0416 7788 aspnet_state - ok
16:04:10.0462 7788 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:04:10.0478 7788 AsyncMac - ok
16:04:10.0556 7788 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
16:04:10.0556 7788 atapi - ok
16:04:10.0572 7788 Atdisk - ok
16:04:10.0603 7788 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:04:10.0634 7788 Atmarpc - ok
16:04:10.0697 7788 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
16:04:10.0697 7788 AudioSrv - ok
16:04:10.0744 7788 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
16:04:10.0744 7788 audstub - ok
16:04:10.0806 7788 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
16:04:10.0822 7788 Beep - ok
16:04:10.0994 7788 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll
16:04:11.0134 7788 BITS - ok
16:04:11.0197 7788 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll
16:04:11.0212 7788 Browser - ok
16:04:11.0259 7788 [ 32F39B678B5CD3BDAA2CFF481BCEA695 ] busbcrw C:\WINDOWS\system32\Drivers\busbcrw.sys
16:04:11.0259 7788 busbcrw - ok
16:04:11.0462 7788 catchme - ok
16:04:11.0494 7788 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
16:04:11.0509 7788 cbidf2k - ok
16:04:11.0525 7788 cd20xrnt - ok
16:04:11.0556 7788 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
16:04:11.0572 7788 Cdaudio - ok
16:04:11.0634 7788 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
16:04:11.0681 7788 Cdfs - ok
16:04:11.0744 7788 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:04:11.0759 7788 Cdrom - ok
16:04:11.0775 7788 Changer - ok
16:04:11.0822 7788 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
16:04:11.0822 7788 CiSvc - ok
16:04:11.0853 7788 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
16:04:11.0853 7788 ClipSrv - ok
16:04:11.0931 7788 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:04:12.0009 7788 clr_optimization_v2.0.50727_32 - ok
16:04:12.0416 7788 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:04:12.0541 7788 clr_optimization_v4.0.30319_32 - ok
16:04:12.0556 7788 CmdIde - ok
16:04:12.0572 7788 COMSysApp - ok
16:04:12.0587 7788 Cpqarray - ok
16:04:12.0650 7788 [ 3C8B6609712F4FF78E521F6DCFC4032B ] Creative Service for CDROM Access C:\WINDOWS\system32\CTsvcCDA.exe
16:04:12.0666 7788 Creative Service for CDROM Access - ok
16:04:12.0728 7788 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
16:04:12.0728 7788 CryptSvc - ok
16:04:12.0744 7788 dac2w2k - ok
16:04:12.0759 7788 dac960nt - ok
16:04:12.0931 7788 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
16:04:13.0056 7788 DcomLaunch - ok
16:04:13.0150 7788 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
16:04:13.0166 7788 Dhcp - ok
16:04:13.0244 7788 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
16:04:13.0259 7788 Disk - ok
16:04:13.0259 7788 dmadmin - ok
16:04:13.0572 7788 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
16:04:13.0837 7788 dmboot - ok
16:04:13.0916 7788 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
16:04:13.0978 7788 dmio - ok
16:04:14.0025 7788 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
16:04:14.0025 7788 dmload - ok
16:04:14.0087 7788 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
16:04:14.0087 7788 dmserver - ok
16:04:14.0134 7788 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
16:04:14.0150 7788 DMusic - ok
16:04:14.0212 7788 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
16:04:14.0212 7788 Dnscache - ok
16:04:14.0306 7788 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
16:04:14.0337 7788 Dot3svc - ok
16:04:14.0353 7788 dpti2o - ok
16:04:14.0400 7788 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
16:04:14.0400 7788 drmkaud - ok
16:04:14.0494 7788 [ 14EA0C26137744636EB25B3FF1F2B02E ] eamon C:\WINDOWS\system32\DRIVERS\eamon.sys
16:04:14.0572 7788 eamon - ok
16:04:14.0603 7788 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
16:04:14.0603 7788 EapHost - ok
16:04:14.0650 7788 [ DC2D33EFCA7FEE0806A5606906BB2D48 ] eBook C:\WINDOWS\system32\Drivers\eBook.sys
16:04:14.0666 7788 eBook - ok
16:04:14.0728 7788 [ 366369746D1818FDD8589D1F2C8A6D03 ] ehdrv C:\WINDOWS\system32\DRIVERS\ehdrv.sys
16:04:14.0775 7788 ehdrv - ok
16:04:15.0697 7788 [ 7FE34FD5652C54BDA8D2DF8AC92E833A ] ekrn  C:\Program Files\ESET\ESET Smart Security\ekrn.exe
16:04:16.0134 7788 ekrn - ok
16:04:16.0212 7788 [ 5F08103444A1B5B2A38EAB729DE0A1A3 ] epfw C:\WINDOWS\system32\DRIVERS\epfw.sys
16:04:16.0259 7788 epfw - ok
16:04:16.0306 7788 [ 03C6C226BC364D23682A8A5AE136F038 ] Epfwndis C:\WINDOWS\system32\DRIVERS\Epfwndis.sys
16:04:16.0322 7788 Epfwndis - ok
16:04:16.0369 7788 [ FEDBE43C34EF0D4CB249C22964B0E17D ] epfwtdi C:\WINDOWS\system32\DRIVERS\epfwtdi.sys
16:04:16.0400 7788 epfwtdi - ok
16:04:16.0541 7788 [ ABDD5AD016AFFD34AD40E944CE94BF59 ] EpsonBidirectionalService C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
16:04:16.0556 7788 EpsonBidirectionalService - ok
16:04:16.0603 7788 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
16:04:16.0619 7788 ERSvc - ok
16:04:16.0681 7788 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
16:04:16.0712 7788 Eventlog - ok
16:04:16.0822 7788 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
16:04:16.0884 7788 EventSystem - ok
16:04:16.0947 7788 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
16:04:16.0994 7788 Fastfat - ok
16:04:17.0087 7788 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
16:04:17.0119 7788 FastUserSwitchingCompatibility - ok
16:04:17.0150 7788 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
16:04:17.0166 7788 Fdc - ok
16:04:17.0212 7788 [ 75C1E92F6AC3DA41728731EA2E20FBCE ] fdrawcmd C:\WINDOWS\system32\drivers\fdrawcmd.sys
16:04:17.0228 7788 fdrawcmd - ok
16:04:17.0400 7788 [ B94390912EEC86DCD3DD79B9693A8F9C ] FileOpenManagerSvc C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
16:04:17.0447 7788 FileOpenManagerSvc - ok
16:04:17.0525 7788 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
16:04:17.0556 7788 Fips - ok
16:04:17.0806 7788 [ F76D04F7413B07DAA029F6520B64B4E8 ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
16:04:17.0994 7788 FLEXnet Licensing Service - ok
16:04:18.0025 7788 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
16:04:18.0041 7788 Flpydisk - ok
16:04:18.0119 7788 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
16:04:18.0166 7788 FltMgr - ok
16:04:18.0259 7788 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:04:18.0259 7788 FontCache3.0.0.0 - ok
16:04:18.0275 7788 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:04:18.0291 7788 Fs_Rec - ok
16:04:18.0353 7788 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:04:18.0400 7788 Ftdisk - ok
16:04:18.0447 7788 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:04:18.0462 7788 Gpc - ok
16:04:18.0494 7788 [ 6003BC70F1A8307262BD3C941BDA0B7E ] grmnusb C:\WINDOWS\system32\drivers\grmnusb.sys
16:04:18.0525 7788 grmnusb - ok
16:04:18.0587 7788 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
16:04:18.0634 7788 HDAudBus - ok
16:04:18.0712 7788 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:04:18.0712 7788 helpsvc - ok
16:04:18.0759 7788 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll
16:04:18.0759 7788 HidServ - ok
16:04:18.0806 7788 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:04:18.0806 7788 hidusb - ok
16:04:18.0884 7788 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
16:04:18.0900 7788 hkmsvc - ok
16:04:18.0900 7788 hpn - ok
16:04:19.0056 7788 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
16:04:19.0166 7788 HTTP - ok
16:04:19.0197 7788 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
16:04:19.0197 7788 HTTPFilter - ok
16:04:19.0212 7788 i2omgmt - ok
16:04:19.0228 7788 i2omp - ok
16:04:19.0275 7788 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:04:19.0291 7788 i8042prt - ok
16:04:21.0228 7788 [ 48846B31BE5A4FA662CCFDE7A1BA86B9 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
16:04:23.0150 7788 ialm - ok
16:04:23.0275 7788 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
16:04:23.0291 7788 IDriverT - ok
16:04:23.0634 7788 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:04:23.0884 7788 idsvc - ok
16:04:23.0931 7788 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
16:04:23.0947 7788 Imapi - ok
16:04:24.0056 7788 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
16:04:24.0087 7788 ImapiService - ok
16:04:24.0103 7788 ini910u - ok
16:04:26.0181 7788 [ 71318705126975C9F09E2D03614AC53C ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys
16:04:28.0228 7788 IntcAzAudAddService - ok
16:04:28.0259 7788 IntelIde - ok
16:04:28.0322 7788 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:04:28.0337 7788 intelppm - ok
16:04:28.0384 7788 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
16:04:28.0384 7788 Ip6Fw - ok
16:04:28.0462 7788 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:04:28.0478 7788 IpFilterDriver - ok
16:04:28.0525 7788 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:04:28.0525 7788 IpInIp - ok
16:04:28.0619 7788 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:04:28.0666 7788 IpNat - ok
16:04:28.0712 7788 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:04:28.0728 7788 IPSec - ok
16:04:28.0759 7788 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
16:04:28.0775 7788 IRENUM - ok
16:04:28.0822 7788 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:04:28.0837 7788 isapnp - ok
16:04:29.0009 7788 [ 5739F2821D49975CEDE6BF0153D0CF01 ] JavaQuickStarterService C:\Program Files\Java\jre7\bin\jqs.exe
16:04:29.0041 7788 JavaQuickStarterService - ok
16:04:29.0087 7788 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:04:29.0103 7788 Kbdclass - ok
16:04:29.0181 7788 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
16:04:29.0228 7788 kmixer - ok
16:04:29.0306 7788 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
16:04:29.0337 7788 KSecDD - ok
16:04:29.0416 7788 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
16:04:29.0447 7788 lanmanserver - ok
16:04:29.0525 7788 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
16:04:29.0556 7788 lanmanworkstation - ok
16:04:29.0572 7788 lbrtfdc - ok
16:04:29.0634 7788 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
16:04:29.0634 7788 LmHosts - ok
16:04:29.0837 7788 [ E6CB119EF2E148EAA1A247343550756E ] McciCMService C:\Program Files\Common Files\Motive\McciCMService.exe
16:04:29.0931 7788 McciCMService - ok
16:04:29.0962 7788 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
16:04:29.0962 7788 Messenger - ok
16:04:30.0009 7788 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
16:04:30.0009 7788 mnmdd - ok
16:04:30.0072 7788 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
16:04:30.0072 7788 mnmsrvc - ok
16:04:30.0134 7788 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
16:04:30.0134 7788 Modem - ok
16:04:30.0619 7788 [ C7D9F9717916B34C1B00DD4834AF485C ] Monfilt C:\WINDOWS\system32\drivers\Monfilt.sys
16:04:31.0087 7788 Monfilt - ok
16:04:31.0134 7788 [ FE80C18BA448DDD76B7BEAD9EB203D37 ] motmodem C:\WINDOWS\system32\DRIVERS\motmodem.sys
16:04:31.0166 7788 motmodem - ok
16:04:31.0228 7788 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:04:31.0244 7788 Mouclass - ok
16:04:31.0291 7788 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:04:31.0322 7788 mouhid - ok
16:04:31.0353 7788 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
16:04:31.0369 7788 MountMgr - ok
16:04:31.0462 7788 [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
16:04:31.0478 7788 MozillaMaintenance - ok
16:04:31.0494 7788 mraid35x - ok
16:04:31.0525 7788 [ 9BD4DCB5412921864A7AACDEDFBD1923 ] MREMP50 C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS
16:04:31.0541 7788 MREMP50 - ok
16:04:31.0556 7788 [ 07C02C892E8E1A72D6BF35004F0E9C5E ] MRESP50 C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS
16:04:31.0572 7788 MRESP50 - ok
16:04:31.0634 7788 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:04:31.0697 7788 MRxDAV - ok
16:04:31.0884 7788 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:04:32.0041 7788 MRxSmb - ok
16:04:32.0087 7788 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
16:04:32.0087 7788 MSDTC - ok
16:04:32.0119 7788 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
16:04:32.0119 7788 Msfs - ok
16:04:32.0134 7788 MSIServer - ok
16:04:32.0166 7788 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:04:32.0181 7788 MSKSSRV - ok
16:04:32.0197 7788 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:04:32.0197 7788 MSPCLOCK - ok
16:04:32.0228 7788 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
16:04:32.0244 7788 MSPQM - ok
16:04:32.0291 7788 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:04:32.0306 7788 mssmbios - ok
16:04:32.0384 7788 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
16:04:32.0431 7788 Mup - ok
16:04:32.0572 7788 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
16:04:32.0634 7788 napagent - ok
16:04:32.0728 7788 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
16:04:32.0822 7788 NDIS - ok
16:04:32.0884 7788 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:04:32.0916 7788 NdisTapi - ok
16:04:32.0994 7788 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:04:33.0009 7788 Ndisuio - ok
16:04:33.0072 7788 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:04:33.0134 7788 NdisWan - ok
16:04:33.0197 7788 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
16:04:33.0228 7788 NDProxy - ok
16:04:33.0259 7788 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
16:04:33.0275 7788 NetBIOS - ok
16:04:33.0369 7788 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
16:04:33.0431 7788 NetBT - ok
16:04:33.0509 7788 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
16:04:33.0525 7788 NetDDE - ok
16:04:33.0572 7788 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
16:04:33.0572 7788 NetDDEdsdm - ok
16:04:33.0603 7788 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
16:04:33.0619 7788 Netlogon - ok
16:04:33.0697 7788 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
16:04:33.0759 7788 Netman - ok
16:04:33.0837 7788 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:04:33.0869 7788 NetTcpPortSharing - ok
16:04:33.0994 7788 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
16:04:34.0056 7788 Nla - ok
16:04:34.0087 7788 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
16:04:34.0103 7788 Npfs - ok
16:04:34.0337 7788 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
16:04:34.0556 7788 Ntfs - ok
16:04:34.0587 7788 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
16:04:34.0603 7788 NtLmSsp - ok
16:04:34.0791 7788 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
16:04:34.0931 7788 NtmsSvc - ok
16:04:34.0962 7788 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
16:04:34.0962 7788 Null - ok
16:04:35.0025 7788 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:04:35.0025 7788 NwlnkFlt - ok
16:04:35.0072 7788 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:04:35.0072 7788 NwlnkFwd - ok
16:04:35.0134 7788 [ 8B8B1BE2DBA4025DA6786C645F77F123 ] NwlnkIpx C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
16:04:35.0166 7788 NwlnkIpx - ok
16:04:35.0212 7788 [ 56D34A67C05E94E16377C60609741FF8 ] NwlnkNb C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
16:04:35.0228 7788 NwlnkNb - ok
16:04:35.0275 7788 [ C0BB7D1615E1ACBDC99757F6CEAF8CF0 ] NwlnkSpx C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
16:04:35.0306 7788 NwlnkSpx - ok
16:04:35.0572 7788 [ 1F0E05DFF4F5A833168E49BE1256F002 ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
16:04:35.0697 7788 odserv - ok
16:04:35.0775 7788 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:04:35.0806 7788 ose - ok
16:04:35.0869 7788 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys
16:04:35.0900 7788 Parport - ok
16:04:35.0947 7788 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
16:04:35.0962 7788 PartMgr - ok
16:04:36.0009 7788 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
16:04:36.0009 7788 ParVdm - ok
16:04:36.0072 7788 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
16:04:36.0087 7788 PCI - ok
16:04:36.0103 7788 PCIDump - ok
16:04:36.0150 7788 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
16:04:36.0150 7788 PCIIde - ok
16:04:36.0212 7788 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
16:04:36.0275 7788 Pcmcia - ok
16:04:36.0291 7788 PDCOMP - ok
16:04:36.0306 7788 PDFRAME - ok
16:04:36.0322 7788 PDRELI - ok
16:04:36.0322 7788 PDRFRAME - ok
16:04:36.0337 7788 perc2 - ok
16:04:36.0353 7788 perc2hib - ok
16:04:36.0447 7788 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
16:04:36.0462 7788 PlugPlay - ok
16:04:36.0478 7788 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
16:04:36.0478 7788 PolicyAgent - ok
16:04:36.0541 7788 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
16:04:36.0556 7788 PptpMiniport - ok
16:04:36.0572 7788 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
16:04:36.0587 7788 ProtectedStorage - ok
16:04:36.0619 7788 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
16:04:36.0650 7788 PSched - ok
16:04:36.0681 7788 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:04:36.0697 7788 Ptilink - ok
16:04:36.0744 7788 [ E42E3433DBB4CFFE8FDD91EAB29AEA8E ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
16:04:36.0759 7788 PxHelp20 - ok
16:04:36.0775 7788 ql1080 - ok
16:04:36.0791 7788 Ql10wnt - ok
16:04:36.0806 7788 ql12160 - ok
16:04:36.0822 7788 ql1240 - ok
16:04:36.0822 7788 ql1280 - ok
16:04:36.0853 7788 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
16:04:36.0853 7788 RasAcd - ok
16:04:36.0931 7788 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
16:04:36.0947 7788 RasAuto - ok
16:04:36.0994 7788 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:04:37.0009 7788 Rasl2tp - ok
16:04:37.0119 7788 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
16:04:37.0166 7788 RasMan - ok
16:04:37.0197 7788 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:04:37.0212 7788 RasPppoe - ok
16:04:37.0228 7788 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
16:04:37.0228 7788 Raspti - ok
16:04:37.0306 7788 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
16:04:37.0369 7788 Rdbss - ok
16:04:37.0384 7788 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:04:37.0384 7788 RDPCDD - ok
16:04:37.0478 7788 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
16:04:37.0556 7788 RDPWD - ok
16:04:37.0634 7788 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
16:04:37.0681 7788 RDSessMgr - ok
16:04:37.0775 7788 [ A0FF419B61AE47E26ADF3BB15DB4F2FE ] RealNetworks Downloader Resolver Service C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
16:04:37.0775 7788 RealNetworks Downloader Resolver Service - ok
16:04:37.0837 7788 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
16:04:37.0853 7788 redbook - ok
16:04:37.0916 7788 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
16:04:37.0931 7788 RemoteAccess - ok
16:04:37.0931 7788 Roxio UPnP Renderer 11 - ok
16:04:37.0978 7788 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
16:04:37.0978 7788 RpcLocator - ok
16:04:38.0134 7788 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll
16:04:38.0150 7788 RpcSs - ok
16:04:38.0228 7788 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
16:04:38.0259 7788 RSVP - ok
16:04:38.0353 7788 [ 839141088AD7EE90F5B441B2D1AFD22C ] RTLE8023xp C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
16:04:38.0384 7788 RTLE8023xp - ok
16:04:38.0431 7788 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
16:04:38.0431 7788 SamSs - ok
16:04:38.0494 7788 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
16:04:38.0509 7788 SCardSvr - ok
16:04:38.0556 7788 [ 20B2751CD4C8F3FD989739CA661B9F30 ] SCDEmu C:\WINDOWS\system32\drivers\SCDEmu.sys
16:04:38.0603 7788 SCDEmu - ok
16:04:38.0712 7788 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
16:04:38.0759 7788 Schedule - ok
16:04:38.0806 7788 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:04:38.0837 7788 Secdrv - ok
16:04:38.0869 7788 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
16:04:38.0869 7788 seclogon - ok
16:04:38.0900 7788 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
16:04:38.0916 7788 SENS - ok
16:04:38.0978 7788 [ 2EC41A96D0DC98BD119BF325E0B9F392 ] Ser2pl C:\WINDOWS\system32\DRIVERS\ser2pl.sys
16:04:39.0009 7788 Ser2pl - ok
16:04:39.0041 7788 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
16:04:39.0041 7788 serenum - ok
16:04:39.0072 7788 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
16:04:39.0103 7788 Serial - ok
16:04:39.0150 7788 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
16:04:39.0150 7788 Sfloppy - ok
16:04:39.0306 7788 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
16:04:39.0400 7788 SharedAccess - ok
16:04:39.0478 7788 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
16:04:39.0478 7788 ShellHWDetection - ok
16:04:39.0494 7788 Simbad - ok
16:04:39.0587 7788 [ 3BB48F7E33C2B76184DDF233000C09CD ] Sony SCSI Helper Service C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
16:04:39.0603 7788 Sony SCSI Helper Service - ok
16:04:39.0603 7788 Sparrow - ok
16:04:39.0650 7788 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
16:04:39.0650 7788 splitter - ok
16:04:39.0712 7788 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
16:04:39.0728 7788 Spooler - ok
16:04:39.0884 7788 [ C3716EC0D36AD924B6888D794563E647 ] sprtsvc_ddoctorv2 C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
16:04:39.0962 7788 sprtsvc_ddoctorv2 - ok
16:04:40.0212 7788 [ CDDDEC541BC3C96F91ECB48759673505 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys
16:04:40.0212 7788 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: CDDDEC541BC3C96F91ECB48759673505
16:04:40.0228 7788 sptd ( LockedFile.Multi.Generic ) - warning
16:04:40.0228 7788 sptd - detected LockedFile.Multi.Generic (1)
16:04:40.0275 7788 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
16:04:40.0306 7788 sr - ok
16:04:40.0400 7788 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
16:04:40.0431 7788 srservice - ok
16:04:40.0572 7788 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
16:04:40.0697 7788 Srv - ok
16:04:40.0744 7788 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
16:04:40.0759 7788 SSDPSRV - ok
16:04:40.0916 7788 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
16:04:41.0009 7788 stisvc - ok
16:04:41.0072 7788 [ 833AC40F6E7BE17951D6D9A956829547 ] StMp3Rec C:\WINDOWS\system32\Drivers\StMp3Rec.sys
16:04:41.0087 7788 StMp3Rec - ok
16:04:41.0150 7788 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
16:04:41.0150 7788 swenum - ok
16:04:41.0181 7788 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
16:04:41.0212 7788 swmidi - ok
16:04:41.0228 7788 SwPrv - ok
16:04:41.0244 7788 symc810 - ok
16:04:41.0259 7788 symc8xx - ok
16:04:41.0275 7788 sym_hi - ok
16:04:41.0291 7788 sym_u3 - ok
16:04:41.0337 7788 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
16:04:41.0353 7788 sysaudio - ok
16:04:41.0431 7788 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
16:04:41.0447 7788 SysmonLog - ok
16:04:41.0556 7788 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
16:04:41.0619 7788 TapiSrv - ok
16:04:41.0791 7788 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
16:04:41.0931 7788 Tcpip - ok
16:04:42.0041 7788 [ 4E53BBCC4BE37D7A4BD6EF1098C89FF7 ] Tcpip6 C:\WINDOWS\system32\DRIVERS\tcpip6.sys
16:04:42.0119 7788 Tcpip6 - ok
16:04:42.0166 7788 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
16:04:42.0166 7788 TDPIPE - ok
16:04:42.0197 7788 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
16:04:42.0212 7788 TDTCP - ok
16:04:42.0259 7788 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
16:04:42.0275 7788 TermDD - ok
16:04:42.0416 7788 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
16:04:42.0494 7788 TermService - ok
16:04:42.0572 7788 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
16:04:42.0572 7788 Themes - ok
16:04:42.0587 7788 TosIde - ok
16:04:42.0634 7788 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
16:04:42.0650 7788 TrkWks - ok
16:04:42.0681 7788 [ 8F861EDA21C05857EB8197300A92501C ] tunmp C:\WINDOWS\system32\DRIVERS\tunmp.sys
16:04:42.0681 7788 tunmp - ok
16:04:42.0744 7788 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
16:04:42.0791 7788 Udfs - ok
16:04:42.0806 7788 ultra - ok
16:04:42.0947 7788 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
16:04:43.0087 7788 Update - ok
16:04:43.0197 7788 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
16:04:43.0244 7788 upnphost - ok
16:04:43.0291 7788 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
16:04:43.0291 7788 UPS - ok
16:04:43.0337 7788 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:04:43.0353 7788 usbccgp - ok
16:04:43.0384 7788 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:04:43.0431 7788 usbehci - ok
16:04:43.0478 7788 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:04:43.0509 7788 usbhub - ok
16:04:43.0525 7788 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
16:04:43.0541 7788 usbprint - ok
16:04:43.0556 7788 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:04:43.0572 7788 usbscan - ok
16:04:43.0603 7788 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:04:43.0619 7788 usbstor - ok
16:04:43.0681 7788 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:04:43.0681 7788 usbuhci - ok
16:04:43.0728 7788 [ B4D7B7AD8A9F7C063C5CC3E2C1A0724E ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
16:04:43.0775 7788 usb_rndisx - ok
16:04:43.0806 7788 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
16:04:43.0822 7788 VgaSave - ok
16:04:43.0837 7788 ViaIde - ok
16:04:43.0884 7788 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
16:04:43.0900 7788 VolSnap - ok
16:04:44.0056 7788 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
16:04:44.0134 7788 VSS - ok
16:04:44.0197 7788 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
16:04:44.0244 7788 W32Time - ok
16:04:44.0275 7788 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:04:44.0291 7788 Wanarp - ok
16:04:44.0322 7788 [ 46A247F6617526AFE38B6F12F5512120 ] wceusbsh C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
16:04:44.0337 7788 wceusbsh - ok
16:04:44.0525 7788 [ FD47474BD21794508AF449D9D91AF6E6 ] Wdf01000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
16:04:44.0697 7788 Wdf01000 - ok
16:04:44.0697 7788 WDICA - ok
16:04:44.0759 7788 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
16:04:44.0775 7788 wdmaud - ok
16:04:44.0837 7788 [ D3D0906ECD655C30E72A3198454881DB ] wdpnp C:\WINDOWS\system32\Drivers\wdpnp.sys
16:04:44.0869 7788 wdpnp - ok
16:04:44.0931 7788 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
16:04:44.0947 7788 WebClient - ok
16:04:45.0119 7788 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
16:04:45.0150 7788 winmgmt - ok
16:04:45.0556 7788 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll
16:04:45.0900 7788 WinRM - ok
16:04:45.0978 7788 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
16:04:45.0978 7788 WmdmPmSN - ok
16:04:46.0056 7788 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
16:04:46.0072 7788 WmiApSrv - ok
16:04:46.0431 7788 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
16:04:46.0697 7788 WMPNetworkSvc - ok
16:04:46.0744 7788 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
16:04:46.0759 7788 WpdUsb - ok
16:04:47.0134 7788 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
16:04:47.0431 7788 WPFFontCache_v0400 - ok
16:04:47.0462 7788 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
16:04:47.0462 7788 WS2IFSL - ok
16:04:47.0509 7788 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(1) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys
16:04:47.0525 7788 WsAudio_DeviceS(1) - ok
16:04:47.0541 7788 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(2) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys
16:04:47.0556 7788 WsAudio_DeviceS(2) - ok
16:04:47.0603 7788 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(3) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys
16:04:47.0619 7788 WsAudio_DeviceS(3) - ok
16:04:47.0650 7788 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(4) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys
16:04:47.0650 7788 WsAudio_DeviceS(4) - ok
16:04:47.0681 7788 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(5) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys
16:04:47.0697 7788 WsAudio_DeviceS(5) - ok
16:04:47.0759 7788 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
16:04:47.0775 7788 wscsvc - ok
16:04:47.0791 7788 WSearch - ok
16:04:47.0806 7788 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
16:04:47.0822 7788 wuauserv - ok
16:04:47.0884 7788 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:04:47.0916 7788 WudfPf - ok
16:04:47.0994 7788 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:04:48.0025 7788 WudfRd - ok
16:04:48.0072 7788 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
16:04:48.0087 7788 WudfSvc - ok
16:04:48.0291 7788 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
16:04:48.0431 7788 WZCSVC - ok
16:04:48.0525 7788 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
16:04:48.0556 7788 xmlprov - ok
16:04:48.0837 7788 [ DD0042F0C3B606A6A8B92D49AFB18AD6 ] YahooAUService C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
16:04:49.0009 7788 YahooAUService - ok
16:04:49.0041 7788 ================ Scan global ===============================
16:04:49.0103 7788 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
16:04:49.0244 7788 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll
16:04:49.0447 7788 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll
16:04:49.0525 7788 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
16:04:49.0525 7788 [Global] - ok
16:04:49.0525 7788 ================ Scan MBR ==================================
16:04:49.0556 7788 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
16:04:49.0837 7788 \Device\Harddisk0\DR0 - ok
16:04:50.0259 7788 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR2
16:04:50.0275 7788 \Device\Harddisk1\DR2 - ok
16:04:50.0291 7788 [ A4A15D6782E6FE1DCE41A606CB3AFFE3 ] \Device\Harddisk2\DR3
16:04:50.0931 7788 \Device\Harddisk2\DR3 - ok
16:04:50.0931 7788 ================ Scan VBR ==================================
16:04:50.0931 7788 [ 6272409E6484D7A9B39BBEAB5CBC2D02 ] \Device\Harddisk0\DR0\Partition1
16:04:50.0947 7788 \Device\Harddisk0\DR0\Partition1 - ok
16:04:50.0947 7788 [ ABA4ABBBBA63DEDAF4F2A967E1D5A9B0 ] \Device\Harddisk1\DR2\Partition1
16:04:50.0947 7788 \Device\Harddisk1\DR2\Partition1 - ok
16:04:50.0962 7788 [ E08F96B3546C1B3A6F980E54C9E46945 ] \Device\Harddisk2\DR3\Partition1
16:04:50.0978 7788 \Device\Harddisk2\DR3\Partition1 - ok
16:04:50.0978 7788 ============================================================
16:04:50.0978 7788 Scan finished
16:04:50.0978 7788 ============================================================
16:04:50.0994 4632 Detected object count: 1
16:04:50.0994 4632 Actual detected object count: 1
16:05:20.0666 4632 sptd ( LockedFile.Multi.Generic ) - skipped by user
16:05:20.0666 4632 sptd ( LockedFile.Multi.Generic ) - User select action: Skip 
16:06:04.0775 0820 ============================================================
16:06:04.0775 0820 Scan started
16:06:04.0775 0820 Mode: Manual; 
16:06:04.0775 0820 ============================================================
16:06:04.0947 0820 ================ Scan system memory ========================
16:06:04.0962 0820 System memory - ok
16:06:04.0962 0820 ================ Scan services =============================
16:06:05.0400 0820 [ C07D5197410AAB28D0D93F943F59656D ] 6to4 C:\WINDOWS\System32\6to4svc.dll
16:06:05.0400 0820 6to4 - ok
16:06:05.0775 0820 [ B33CF4DE909A5B30F526D82053A63C8E ] ABBYY.Licensing.FineReader.Sprint.9.0 C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
16:06:05.0791 0820 ABBYY.Licensing.FineReader.Sprint.9.0 - ok
16:06:05.0853 0820 Abiosdsk - ok
16:06:05.0869 0820 abp480n5 - ok
16:06:05.0978 0820 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:06:05.0978 0820 ACPI - ok
16:06:06.0025 0820 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
16:06:06.0041 0820 ACPIEC - ok
16:06:06.0197 0820 [ 3FD8DC2C9735C2AA70155102CFB93EDA ] AdobeActiveFileMonitor7.0 C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
16:06:06.0197 0820 AdobeActiveFileMonitor7.0 - ok
16:06:06.0369 0820 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
16:06:06.0369 0820 AdobeFlashPlayerUpdateSvc - ok
16:06:06.0384 0820 adpu160m - ok
16:06:06.0462 0820 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
16:06:06.0462 0820 aec - ok
16:06:06.0541 0820 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
16:06:06.0556 0820 AFD - ok
16:06:06.0556 0820 Aha154x - ok
16:06:06.0572 0820 aic78u2 - ok
16:06:06.0587 0820 aic78xx - ok
16:06:06.0650 0820 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
16:06:06.0650 0820 Alerter - ok
16:06:06.0697 0820 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
16:06:06.0697 0820 ALG - ok
16:06:06.0697 0820 AliIde - ok
16:06:07.0291 0820 [ 267FC636801EDC5AB28E14036349E3BE ] Ambfilt C:\WINDOWS\system32\drivers\Ambfilt.sys
16:06:07.0306 0820 Ambfilt - ok
16:06:07.0322 0820 amsint - ok
16:06:07.0337 0820 AppMgmt - ok
16:06:07.0337 0820 asc - ok
16:06:07.0353 0820 asc3350p - ok
16:06:07.0369 0820 asc3550 - ok
16:06:07.0603 0820 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
16:06:07.0603 0820 aspnet_state - ok
16:06:07.0650 0820 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:06:07.0650 0820 AsyncMac - ok
16:06:07.0728 0820 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
16:06:07.0728 0820 atapi - ok
16:06:07.0744 0820 Atdisk - ok
16:06:07.0775 0820 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:06:07.0775 0820 Atmarpc - ok
16:06:07.0837 0820 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
16:06:07.0837 0820 AudioSrv - ok
16:06:07.0900 0820 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
16:06:07.0900 0820 audstub - ok
16:06:07.0947 0820 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
16:06:07.0962 0820 Beep - ok
16:06:08.0134 0820 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll
16:06:08.0150 0820 BITS - ok
16:06:08.0212 0820 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll
16:06:08.0212 0820 Browser - ok
16:06:08.0275 0820 [ 32F39B678B5CD3BDAA2CFF481BCEA695 ] busbcrw C:\WINDOWS\system32\Drivers\busbcrw.sys
16:06:08.0275 0820 busbcrw - ok
16:06:08.0447 0820 catchme - ok
16:06:08.0478 0820 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
16:06:08.0478 0820 cbidf2k - ok
16:06:08.0494 0820 cd20xrnt - ok
16:06:08.0525 0820 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
16:06:08.0541 0820 Cdaudio - ok
16:06:08.0603 0820 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
16:06:08.0603 0820 Cdfs - ok
16:06:08.0650 0820 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:06:08.0650 0820 Cdrom - ok
16:06:08.0666 0820 Changer - ok
16:06:08.0712 0820 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
16:06:08.0712 0820 CiSvc - ok
16:06:08.0744 0820 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
16:06:08.0744 0820 ClipSrv - ok
16:06:08.0822 0820 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:06:08.0822 0820 clr_optimization_v2.0.50727_32 - ok
16:06:09.0103 0820 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:06:09.0103 0820 clr_optimization_v4.0.30319_32 - ok
16:06:09.0119 0820 CmdIde - ok
16:06:09.0134 0820 COMSysApp - ok
16:06:09.0150 0820 Cpqarray - ok
16:06:09.0212 0820 [ 3C8B6609712F4FF78E521F6DCFC4032B ] Creative Service for CDROM Access C:\WINDOWS\system32\CTsvcCDA.exe
16:06:09.0212 0820 Creative Service for CDROM Access - ok
16:06:09.0275 0820 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
16:06:09.0275 0820 CryptSvc - ok
16:06:09.0275 0820 dac2w2k - ok
16:06:09.0306 0820 dac960nt - ok
16:06:09.0494 0820 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
16:06:09.0509 0820 DcomLaunch - ok
16:06:09.0619 0820 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
16:06:09.0619 0820 Dhcp - ok
16:06:09.0681 0820 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
16:06:09.0681 0820 Disk - ok
16:06:09.0697 0820 dmadmin - ok
16:06:10.0025 0820 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
16:06:10.0041 0820 dmboot - ok
16:06:10.0119 0820 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
16:06:10.0119 0820 dmio - ok
16:06:10.0181 0820 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
16:06:10.0181 0820 dmload - ok
16:06:10.0228 0820 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
16:06:10.0228 0820 dmserver - ok
16:06:10.0275 0820 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
16:06:10.0275 0820 DMusic - ok
16:06:10.0337 0820 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
16:06:10.0337 0820 Dnscache - ok
16:06:10.0447 0820 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
16:06:10.0447 0820 Dot3svc - ok
16:06:10.0462 0820 dpti2o - ok
16:06:10.0509 0820 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
16:06:10.0509 0820 drmkaud - ok
16:06:10.0619 0820 [ 14EA0C26137744636EB25B3FF1F2B02E ] eamon C:\WINDOWS\system32\DRIVERS\eamon.sys
16:06:10.0619 0820 eamon - ok
16:06:10.0650 0820 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
16:06:10.0650 0820 EapHost - ok
16:06:10.0697 0820 [ DC2D33EFCA7FEE0806A5606906BB2D48 ] eBook C:\WINDOWS\system32\Drivers\eBook.sys
16:06:10.0697 0820 eBook - ok
16:06:10.0759 0820 [ 366369746D1818FDD8589D1F2C8A6D03 ] ehdrv C:\WINDOWS\system32\DRIVERS\ehdrv.sys
16:06:10.0759 0820 ehdrv - ok
16:06:11.0416 0820 [ 7FE34FD5652C54BDA8D2DF8AC92E833A ] ekrn C:\Program Files\ESET\ESET Smart Security\ekrn.exe
16:06:11.0431 0820 ekrn - ok
16:06:11.0525 0820 [ 5F08103444A1B5B2A38EAB729DE0A1A3 ] epfw C:\WINDOWS\system32\DRIVERS\epfw.sys
16:06:11.0525 0820 epfw - ok
16:06:11.0572 0820 [ 03C6C226BC364D23682A8A5AE136F038 ] Epfwndis C:\WINDOWS\system32\DRIVERS\Epfwndis.sys
16:06:11.0572 0820 Epfwndis - ok
16:06:11.0634 0820 [ FEDBE43C34EF0D4CB249C22964B0E17D ] epfwtdi C:\WINDOWS\system32\DRIVERS\epfwtdi.sys
16:06:11.0634 0820 epfwtdi - ok
16:06:11.0744 0820 [ ABDD5AD016AFFD34AD40E944CE94BF59 ] EpsonBidirectionalService C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
16:06:11.0744 0820 EpsonBidirectionalService - ok
16:06:11.0806 0820 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
16:06:11.0806 0820 ERSvc - ok
16:06:11.0900 0820 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
16:06:11.0900 0820 Eventlog - ok
16:06:12.0009 0820 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
16:06:12.0009 0820 EventSystem - ok
16:06:12.0087 0820 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
16:06:12.0087 0820 Fastfat - ok
16:06:12.0181 0820 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
16:06:12.0197 0820 FastUserSwitchingCompatibility - ok
16:06:12.0212 0820 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
16:06:12.0212 0820 Fdc - ok
16:06:12.0275 0820 [ 75C1E92F6AC3DA41728731EA2E20FBCE ] fdrawcmd C:\WINDOWS\system32\drivers\fdrawcmd.sys
16:06:12.0275 0820 fdrawcmd - ok
16:06:12.0431 0820 [ B94390912EEC86DCD3DD79B9693A8F9C ] FileOpenManagerSvc C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
16:06:12.0431 0820 FileOpenManagerSvc - ok
16:06:12.0509 0820 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
16:06:12.0509 0820 Fips - ok
16:06:12.0759 0820 [ F76D04F7413B07DAA029F6520B64B4E8 ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
16:06:12.0775 0820 FLEXnet Licensing Service - ok
16:06:12.0806 0820 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
16:06:12.0806 0820 Flpydisk - ok
16:06:12.0869 0820 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
16:06:12.0869 0820 FltMgr - ok
16:06:12.0962 0820 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:06:12.0962 0820 FontCache3.0.0.0 - ok
16:06:12.0978 0820 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:06:12.0978 0820 Fs_Rec - ok
16:06:13.0041 0820 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:06:13.0041 0820 Ftdisk - ok
16:06:13.0087 0820 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:06:13.0103 0820 Gpc - ok
16:06:13.0134 0820 [ 6003BC70F1A8307262BD3C941BDA0B7E ] grmnusb C:\WINDOWS\system32\drivers\grmnusb.sys
16:06:13.0134 0820 grmnusb - ok
16:06:13.0228 0820 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
16:06:13.0228 0820 HDAudBus - ok
16:06:13.0291 0820 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:06:13.0291 0820 helpsvc - ok
16:06:13.0337 0820 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll
16:06:13.0353 0820 HidServ - ok
16:06:13.0384 0820 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:06:13.0384 0820 hidusb - ok
16:06:13.0447 0820 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
16:06:13.0447 0820 hkmsvc - ok
16:06:13.0462 0820 hpn - ok
16:06:13.0603 0820 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
16:06:13.0603 0820 HTTP - ok
16:06:13.0650 0820 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
16:06:13.0650 0820 HTTPFilter - ok
16:06:13.0666 0820 i2omgmt - ok
16:06:13.0666 0820 i2omp - ok
16:06:13.0728 0820 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:06:13.0728 0820 i8042prt - ok
16:06:15.0837 0820 [ 48846B31BE5A4FA662CCFDE7A1BA86B9 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
16:06:15.0900 0820 ialm - ok
16:06:16.0041 0820 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
16:06:16.0041 0820 IDriverT - ok
16:06:16.0384 0820 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:06:16.0400 0820 idsvc - ok
16:06:16.0447 0820 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
16:06:16.0447 0820 Imapi - ok
16:06:16.0556 0820 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
16:06:16.0556 0820 ImapiService - ok
16:06:16.0572 0820 ini910u - ok
16:06:18.0603 0820 [ 71318705126975C9F09E2D03614AC53C ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys
16:06:18.0666 0820 IntcAzAudAddService - ok
16:06:18.0697 0820 IntelIde - ok
16:06:18.0759 0820 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:06:18.0759 0820 intelppm - ok
16:06:18.0791 0820 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
16:06:18.0791 0820 Ip6Fw - ok
16:06:18.0853 0820 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:06:18.0853 0820 IpFilterDriver - ok
16:06:18.0884 0820 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:06:18.0884 0820 IpInIp - ok
16:06:18.0978 0820 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:06:18.0978 0820 IpNat - ok
16:06:19.0009 0820 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:06:19.0025 0820 IPSec - ok
16:06:19.0056 0820 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
16:06:19.0056 0820 IRENUM - ok
16:06:19.0103 0820 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:06:19.0103 0820 isapnp - ok
16:06:19.0275 0820 [ 5739F2821D49975CEDE6BF0153D0CF01 ] JavaQuickStarterService C:\Program Files\Java\jre7\bin\jqs.exe
16:06:19.0291 0820 JavaQuickStarterService - ok
16:06:19.0337 0820 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:06:19.0337 0820 Kbdclass - ok
16:06:19.0416 0820 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
16:06:19.0416 0820 kmixer - ok
16:06:19.0494 0820 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
16:06:19.0494 0820 KSecDD - ok
16:06:19.0587 0820 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
16:06:19.0603 0820 lanmanserver - ok
16:06:19.0697 0820 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
16:06:19.0697 0820 lanmanworkstation - ok
16:06:19.0712 0820 lbrtfdc - ok
16:06:19.0791 0820 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
16:06:19.0791 0820 LmHosts - ok
16:06:19.0978 0820 [ E6CB119EF2E148EAA1A247343550756E ] McciCMService C:\Program Files\Common Files\Motive\McciCMService.exe
16:06:19.0978 0820 McciCMService - ok
16:06:20.0025 0820 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
16:06:20.0025 0820 Messenger - ok
16:06:20.0072 0820 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
16:06:20.0072 0820 mnmdd - ok
16:06:20.0134 0820 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
16:06:20.0150 0820 mnmsrvc - ok
16:06:20.0197 0820 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
16:06:20.0197 0820 Modem - ok
16:06:20.0681 0820 [ C7D9F9717916B34C1B00DD4834AF485C ] Monfilt C:\WINDOWS\system32\drivers\Monfilt.sys
16:06:20.0697 0820 Monfilt - ok
16:06:20.0759 0820 [ FE80C18BA448DDD76B7BEAD9EB203D37 ] motmodem C:\WINDOWS\system32\DRIVERS\motmodem.sys
16:06:20.0759 0820 motmodem - ok
16:06:20.0806 0820 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:06:20.0806 0820 Mouclass - ok
16:06:20.0853 0820 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:06:20.0869 0820 mouhid - ok
16:06:20.0884 0820 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
16:06:20.0884 0820 MountMgr - ok
16:06:20.0978 0820 [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
16:06:20.0978 0820 MozillaMaintenance - ok
16:06:20.0994 0820 mraid35x - ok
16:06:21.0025 0820 [ 9BD4DCB5412921864A7AACDEDFBD1923 ] MREMP50 C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS
16:06:21.0025 0820 MREMP50 - ok
16:06:21.0041 0820 [ 07C02C892E8E1A72D6BF35004F0E9C5E ] MRESP50 C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS
16:06:21.0056 0820 MRESP50 - ok
16:06:21.0119 0820 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:06:21.0119 0820 MRxDAV - ok
16:06:21.0306 0820 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:06:21.0322 0820 MRxSmb - ok
16:06:21.0369 0820 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
16:06:21.0369 0820 MSDTC - ok
16:06:21.0400 0820 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
16:06:21.0400 0820 Msfs - ok
16:06:21.0416 0820 MSIServer - ok
16:06:21.0447 0820 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:06:21.0447 0820 MSKSSRV - ok
16:06:21.0494 0820 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:06:21.0494 0820 MSPCLOCK - ok
16:06:21.0525 0820 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
16:06:21.0525 0820 MSPQM - ok
16:06:21.0572 0820 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:06:21.0572 0820 mssmbios - ok
16:06:21.0634 0820 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
16:06:21.0634 0820 Mup - ok
16:06:21.0759 0820 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
16:06:21.0759 0820 napagent - ok
16:06:21.0853 0820 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
16:06:21.0853 0820 NDIS - ok
16:06:21.0916 0820 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:06:21.0916 0820 NdisTapi - ok
16:06:21.0978 0820 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:06:21.0978 0820 Ndisuio - ok
16:06:22.0009 0820 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:06:22.0009 0820 NdisWan - ok
16:06:22.0072 0820 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
16:06:22.0072 0820 NDProxy - ok
16:06:22.0103 0820 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
16:06:22.0103 0820 NetBIOS - ok
16:06:22.0181 0820 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
16:06:22.0181 0820 NetBT - ok
16:06:22.0259 0820 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
16:06:22.0259 0820 NetDDE - ok
16:06:22.0306 0820 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
16:06:22.0306 0820 NetDDEdsdm - ok
16:06:22.0337 0820 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
16:06:22.0353 0820 Netlogon - ok
16:06:22.0431 0820 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
16:06:22.0431 0820 Netman - ok
16:06:22.0525 0820 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:06:22.0525 0820 NetTcpPortSharing - ok
16:06:22.0650 0820 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
16:06:22.0650 0820 Nla - ok
16:06:22.0681 0820 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
16:06:22.0681 0820 Npfs - ok
16:06:22.0916 0820 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
16:06:22.0931 0820 Ntfs - ok
16:06:22.0947 0820 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
16:06:22.0947 0820 NtLmSsp - ok
16:06:23.0134 0820 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
16:06:23.0150 0820 NtmsSvc - ok
16:06:23.0181 0820 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
16:06:23.0181 0820 Null - ok
16:06:23.0228 0820 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:06:23.0228 0820 NwlnkFlt - ok
16:06:23.0259 0820 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:06:23.0275 0820 NwlnkFwd - ok
16:06:23.0322 0820 [ 8B8B1BE2DBA4025DA6786C645F77F123 ] NwlnkIpx C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
16:06:23.0322 0820 NwlnkIpx - ok
16:06:23.0369 0820 [ 56D34A67C05E94E16377C60609741FF8 ] NwlnkNb C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
16:06:23.0369 0820 NwlnkNb - ok
16:06:23.0416 0820 [ C0BB7D1615E1ACBDC99757F6CEAF8CF0 ] NwlnkSpx C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
16:06:23.0416 0820 NwlnkSpx - ok
16:06:23.0697 0820 [ 1F0E05DFF4F5A833168E49BE1256F002 ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
16:06:23.0697 0820 odserv - ok
16:06:23.0791 0820 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:06:23.0791 0820 ose - ok
16:06:23.0853 0820 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys
16:06:23.0853 0820 Parport - ok
16:06:23.0900 0820 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
16:06:23.0916 0820 PartMgr - ok
16:06:23.0962 0820 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
16:06:23.0962 0820 ParVdm - ok
16:06:24.0025 0820 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
16:06:24.0025 0820 PCI - ok
16:06:24.0025 0820 PCIDump - ok
16:06:24.0072 0820 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
16:06:24.0072 0820 PCIIde - ok
16:06:24.0134 0820 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
16:06:24.0134 0820 Pcmcia - ok
16:06:24.0150 0820 PDCOMP - ok
16:06:24.0166 0820 PDFRAME - ok
16:06:24.0166 0820 PDRELI - ok
16:06:24.0181 0820 PDRFRAME - ok
16:06:24.0197 0820 perc2 - ok
16:06:24.0212 0820 perc2hib - ok
16:06:24.0291 0820 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
16:06:24.0306 0820 PlugPlay - ok
16:06:24.0322 0820 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
16:06:24.0322 0820 PolicyAgent - ok
16:06:24.0384 0820 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
16:06:24.0384 0820 PptpMiniport - ok
16:06:24.0400 0820 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
16:06:24.0416 0820 ProtectedStorage - ok
16:06:24.0447 0820 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
16:06:24.0447 0820 PSched - ok
16:06:24.0509 0820 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:06:24.0509 0820 Ptilink - ok
16:06:24.0556 0820 [ E42E3433DBB4CFFE8FDD91EAB29AEA8E ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
16:06:24.0556 0820 PxHelp20 - ok
16:06:24.0572 0820 ql1080 - ok
16:06:24.0587 0820 Ql10wnt - ok
16:06:24.0603 0820 ql12160 - ok
16:06:24.0619 0820 ql1240 - ok
16:06:24.0619 0820 ql1280 - ok
16:06:24.0650 0820 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
16:06:24.0650 0820 RasAcd - ok
16:06:24.0728 0820 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
16:06:24.0728 0820 RasAuto - ok
16:06:24.0775 0820 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:06:24.0775 0820 Rasl2tp - ok
16:06:24.0884 0820 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
16:06:24.0900 0820 RasMan - ok
16:06:24.0916 0820 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:06:24.0916 0820 RasPppoe - ok
16:06:24.0947 0820 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
16:06:24.0947 0820 Raspti - ok
16:06:25.0025 0820 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
16:06:25.0025 0820 Rdbss - ok
16:06:25.0041 0820 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:06:25.0041 0820 RDPCDD - ok
16:06:25.0166 0820 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
16:06:25.0166 0820 RDPWD - ok
16:06:25.0244 0820 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
16:06:25.0259 0820 RDSessMgr - ok
16:06:25.0353 0820 [ A0FF419B61AE47E26ADF3BB15DB4F2FE ] RealNetworks Downloader Resolver Service C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
16:06:25.0353 0820 RealNetworks Downloader Resolver Service - ok
16:06:25.0416 0820 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
16:06:25.0416 0820 redbook - ok
16:06:25.0478 0820 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
16:06:25.0494 0820 RemoteAccess - ok
16:06:25.0494 0820 Roxio UPnP Renderer 11 - ok
16:06:25.0541 0820 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
16:06:25.0541 0820 RpcLocator - ok
16:06:25.0681 0820 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll
16:06:25.0697 0820 RpcSs - ok
16:06:25.0791 0820 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
16:06:25.0791 0820 RSVP - ok
16:06:25.0869 0820 [ 839141088AD7EE90F5B441B2D1AFD22C ] RTLE8023xp C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
16:06:25.0869 0820 RTLE8023xp - ok
16:06:25.0900 0820 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
16:06:25.0900 0820 SamSs - ok
16:06:25.0962 0820 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
16:06:25.0962 0820 SCardSvr - ok
16:06:26.0025 0820 [ 20B2751CD4C8F3FD989739CA661B9F30 ] SCDEmu C:\WINDOWS\system32\drivers\SCDEmu.sys
16:06:26.0041 0820 SCDEmu - ok
16:06:26.0134 0820 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
16:06:26.0150 0820 Schedule - ok
16:06:26.0197 0820 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:06:26.0197 0820 Secdrv - ok
16:06:26.0244 0820 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
16:06:26.0244 0820 seclogon - ok
16:06:26.0275 0820 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
16:06:26.0291 0820 SENS - ok
16:06:26.0353 0820 [ 2EC41A96D0DC98BD119BF325E0B9F392 ] Ser2pl C:\WINDOWS\system32\DRIVERS\ser2pl.sys
16:06:26.0353 0820 Ser2pl - ok
16:06:26.0384 0820 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
16:06:26.0384 0820 serenum - ok
16:06:26.0416 0820 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
16:06:26.0431 0820 Serial - ok
16:06:26.0494 0820 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
16:06:26.0494 0820 Sfloppy - ok
16:06:26.0650 0820 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
16:06:26.0650 0820 SharedAccess - ok
16:06:26.0712 0820 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
16:06:26.0728 0820 ShellHWDetection - ok
16:06:26.0728 0820 Simbad - ok
16:06:26.0837 0820 [ 3BB48F7E33C2B76184DDF233000C09CD ] Sony SCSI Helper Service C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
16:06:26.0837 0820 Sony SCSI Helper Service - ok
16:06:26.0853 0820 Sparrow - ok
16:06:26.0884 0820 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
16:06:26.0884 0820 splitter - ok
16:06:26.0947 0820 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
16:06:26.0947 0820 Spooler - ok
16:06:27.0103 0820 [ C3716EC0D36AD924B6888D794563E647 ] sprtsvc_ddoctorv2 C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
16:06:27.0103 0820 sprtsvc_ddoctorv2 - ok
16:06:27.0384 0820 [ CDDDEC541BC3C96F91ECB48759673505 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys
16:06:27.0384 0820 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: CDDDEC541BC3C96F91ECB48759673505
16:06:27.0384 0820 sptd ( LockedFile.Multi.Generic ) - warning
16:06:27.0384 0820 sptd - detected LockedFile.Multi.Generic (1)
16:06:27.0431 0820 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
16:06:27.0431 0820 sr - ok
16:06:27.0525 0820 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
16:06:27.0541 0820 srservice - ok
16:06:27.0681 0820 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
16:06:27.0697 0820 Srv - ok
16:06:27.0744 0820 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
16:06:27.0759 0820 SSDPSRV - ok
16:06:27.0916 0820 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
16:06:27.0931 0820 stisvc - ok
16:06:27.0994 0820 [ 833AC40F6E7BE17951D6D9A956829547 ] StMp3Rec C:\WINDOWS\system32\Drivers\StMp3Rec.sys
16:06:27.0994 0820 StMp3Rec - ok
16:06:28.0041 0820 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
16:06:28.0041 0820 swenum - ok
16:06:28.0072 0820 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
16:06:28.0072 0820 swmidi - ok
16:06:28.0087 0820 SwPrv - ok
16:06:28.0103 0820 symc810 - ok
16:06:28.0119 0820 symc8xx - ok
16:06:28.0134 0820 sym_hi - ok
16:06:28.0150 0820 sym_u3 - ok
16:06:28.0181 0820 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
16:06:28.0181 0820 sysaudio - ok
16:06:28.0244 0820 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
16:06:28.0244 0820 SysmonLog - ok
16:06:28.0353 0820 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
16:06:28.0353 0820 TapiSrv - ok
16:06:28.0541 0820 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
16:06:28.0541 0820 Tcpip - ok
16:06:28.0650 0820 [ 4E53BBCC4BE37D7A4BD6EF1098C89FF7 ] Tcpip6 C:\WINDOWS\system32\DRIVERS\tcpip6.sys
16:06:28.0650 0820 Tcpip6 - ok
16:06:28.0681 0820 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
16:06:28.0681 0820 TDPIPE - ok
16:06:28.0712 0820 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
16:06:28.0712 0820 TDTCP - ok
16:06:28.0759 0820 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
16:06:28.0759 0820 TermDD - ok
16:06:28.0916 0820 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
16:06:28.0916 0820 TermService - ok
16:06:28.0978 0820 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
16:06:28.0994 0820 Themes - ok
16:06:29.0009 0820 TosIde - ok
16:06:29.0056 0820 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
16:06:29.0056 0820 TrkWks - ok
16:06:29.0103 0820 [ 8F861EDA21C05857EB8197300A92501C ] tunmp C:\WINDOWS\system32\DRIVERS\tunmp.sys
16:06:29.0103 0820 tunmp - ok
16:06:29.0181 0820 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
16:06:29.0181 0820 Udfs - ok
16:06:29.0212 0820 ultra - ok
16:06:29.0337 0820 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
16:06:29.0353 0820 Update - ok
16:06:29.0478 0820 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
16:06:29.0478 0820 upnphost - ok
16:06:29.0525 0820 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
16:06:29.0525 0820 UPS - ok
16:06:29.0572 0820 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:06:29.0572 0820 usbccgp - ok
16:06:29.0603 0820 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:06:29.0603 0820 usbehci - ok
16:06:29.0650 0820 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:06:29.0650 0820 usbhub - ok
16:06:29.0681 0820 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
16:06:29.0697 0820 usbprint - ok
16:06:29.0712 0820 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:06:29.0712 0820 usbscan - ok
16:06:29.0744 0820 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:06:29.0744 0820 usbstor - ok
16:06:29.0806 0820 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:06:29.0806 0820 usbuhci - ok
16:06:29.0853 0820 [ B4D7B7AD8A9F7C063C5CC3E2C1A0724E ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
16:06:29.0869 0820 usb_rndisx - ok
16:06:29.0884 0820 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
16:06:29.0884 0820 VgaSave - ok
16:06:29.0900 0820 ViaIde - ok
16:06:29.0947 0820 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
16:06:29.0947 0820 VolSnap - ok
16:06:30.0087 0820 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
16:06:30.0103 0820 VSS - ok
16:06:30.0197 0820 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
16:06:30.0212 0820 W32Time - ok
16:06:30.0259 0820 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:06:30.0259 0820 Wanarp - ok
16:06:30.0306 0820 [ 46A247F6617526AFE38B6F12F5512120 ] wceusbsh C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
16:06:30.0306 0820 wceusbsh - ok
16:06:30.0494 0820 [ FD47474BD21794508AF449D9D91AF6E6 ] Wdf01000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
16:06:30.0509 0820 Wdf01000 - ok
16:06:30.0525 0820 WDICA - ok
16:06:30.0572 0820 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
16:06:30.0572 0820 wdmaud - ok
16:06:30.0619 0820 [ D3D0906ECD655C30E72A3198454881DB ] wdpnp C:\WINDOWS\system32\Drivers\wdpnp.sys
16:06:30.0634 0820 wdpnp - ok
16:06:30.0681 0820 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
16:06:30.0697 0820 WebClient - ok
16:06:30.0853 0820 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
16:06:30.0853 0820 winmgmt - ok
16:06:31.0259 0820 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll
16:06:31.0275 0820 WinRM - ok
16:06:31.0337 0820 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
16:06:31.0353 0820 WmdmPmSN - ok
16:06:31.0416 0820 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
16:06:31.0416 0820 WmiApSrv - ok
16:06:31.0791 0820 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
16:06:31.0806 0820 WMPNetworkSvc - ok
16:06:31.0853 0820 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
16:06:31.0853 0820 WpdUsb - ok
16:06:32.0244 0820 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
16:06:32.0244 0820 WPFFontCache_v0400 - ok
16:06:32.0291 0820 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
16:06:32.0291 0820 WS2IFSL - ok
16:06:32.0322 0820 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(1) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys
16:06:32.0322 0820 WsAudio_DeviceS(1) - ok
16:06:32.0353 0820 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(2) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys
16:06:32.0353 0820 WsAudio_DeviceS(2) - ok
16:06:32.0400 0820 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(3) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys
16:06:32.0400 0820 WsAudio_DeviceS(3) - ok
16:06:32.0431 0820 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(4) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys
16:06:32.0431 0820 WsAudio_DeviceS(4) - ok
16:06:32.0462 0820 [ 4160CBE59D9B5BE22E4C3897E8DB9D56 ] WsAudio_DeviceS(5) C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys
16:06:32.0462 0820 WsAudio_DeviceS(5) - ok
16:06:32.0556 0820 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
16:06:32.0556 0820 wscsvc - ok
16:06:32.0572 0820 WSearch - ok
16:06:32.0603 0820 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
16:06:32.0603 0820 wuauserv - ok
16:06:32.0681 0820 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:06:32.0681 0820 WudfPf - ok
16:06:32.0775 0820 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:06:32.0775 0820 WudfRd - ok
16:06:32.0822 0820 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
16:06:32.0822 0820 WudfSvc - ok
16:06:33.0025 0820 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
16:06:33.0041 0820 WZCSVC - ok
16:06:33.0134 0820 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
16:06:33.0150 0820 xmlprov - ok
16:06:33.0431 0820 [ DD0042F0C3B606A6A8B92D49AFB18AD6 ] YahooAUService C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
16:06:33.0431 0820 YahooAUService - ok
16:06:33.0447 0820 ================ Scan global ===============================
16:06:33.0525 0820 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
16:06:33.0666 0820 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll
16:06:33.0775 0820 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll
16:06:33.0837 0820 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
16:06:33.0853 0820 [Global] - ok
16:06:33.0853 0820 ================ Scan MBR ==================================
16:06:33.0884 0820 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
16:06:34.0150 0820 \Device\Harddisk0\DR0 - ok
16:06:34.0166 0820 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR2
16:06:34.0181 0820 \Device\Harddisk1\DR2 - ok
16:06:34.0181 0820 [ A4A15D6782E6FE1DCE41A606CB3AFFE3 ] \Device\Harddisk2\DR3
16:06:34.0837 0820 \Device\Harddisk2\DR3 - ok
16:06:34.0837 0820 ================ Scan VBR ==================================
16:06:34.0853 0820 [ 6272409E6484D7A9B39BBEAB5CBC2D02 ] \Device\Harddisk0\DR0\Partition1
16:06:34.0853 0820 \Device\Harddisk0\DR0\Partition1 - ok
16:06:34.0869 0820 [ ABA4ABBBBA63DEDAF4F2A967E1D5A9B0 ] \Device\Harddisk1\DR2\Partition1
16:06:34.0869 0820 \Device\Harddisk1\DR2\Partition1 - ok
16:06:34.0884 0820 [ E08F96B3546C1B3A6F980E54C9E46945 ] \Device\Harddisk2\DR3\Partition1
16:06:34.0884 0820 \Device\Harddisk2\DR3\Partition1 - ok
16:06:34.0884 0820 ============================================================
16:06:34.0884 0820 Scan finished
16:06:34.0884 0820 ============================================================
16:06:34.0900 9180 Detected object count: 1
16:06:34.0900 9180 Actual detected object count: 1
16:06:49.0244 9180 C:\WINDOWS\system32\Drivers\sptd.sys - copied to quarantine
16:06:50.0056 9180 sptd ( LockedFile.Multi.Generic ) - User select action: Quarantine


----------



## Cookiegal (Aug 27, 2003)

Download *OTS.exe * to your Desktop. 

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Double-click on *OTS.exe* to start the program.
At the top put a check mark in the box beside "Scan All Users".
Under the *Additional Scans *section put a check in the box next to Disabled MS Config Items, NetSvcs and EventViewer logs (Last 10 errors)
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## sarahmuriel (Feb 1, 2004)

OTS log

OTS logfile created on: 6/9/2013 11:11:07 AM - Run 3
OTS by OldTimer - Version 3.1.47.2 Folder = C:\Documents and Settings\all\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,015.00 Mb Total Physical Memory | 632.00 Mb Available Physical Memory | 62.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 103.20 Gb Free Space | 69.24% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 1397.26 Gb Total Space | 1198.26 Gb Free Space | 85.76% Space Free | Partition Type: NTFS
Drive G: | 298.09 Gb Total Space | 174.58 Gb Free Space | 58.57% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LENOVO
Current User Name: all
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days

[Processes - Safe List]
ots.exe -> C:\Documents and Settings\all\Desktop\OTS.exe -> [2013/06/09 11:01:26 | 000,646,656 | ---- | M] (OldTimer Tools)
jqs.exe -> C:\Program Files\Java\jre7\bin\jqs.exe -> [2013/06/04 20:43:13 | 000,181,664 | ---- | M] (Oracle Corporation)
ekrn.exe -> C:\Program Files\ESET\ESET Smart Security\ekrn.exe -> [2013/03/21 15:19:46 | 001,341,664 | ---- | M] (ESET)
egui.exe -> C:\Program Files\ESET\ESET Smart Security\egui.exe -> [2013/03/21 15:19:40 | 005,078,504 | ---- | M] (ESET)
realsched.exe -> C:\Program Files\Real\RealPlayer\Update\realsched.exe -> [2013/01/31 10:05:49 | 000,295,072 | ---- | M] (RealNetworks, Inc.)
recordingmanager.exe -> C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe -> [2012/11/29 21:33:06 | 000,232,608 | ---- | M] (RealNetworks, Inc.)
rndlresolversvc.exe -> C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe -> [2012/11/29 21:31:04 | 000,038,608 | ---- | M] ()
fileopenmanagersvc32.exe -> C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe -> [2012/04/30 19:56:52 | 000,213,888 | ---- | M] (FileOpen Systems Inc.)
fileopenbroker32.exe -> C:\Program Files\FileOpen\Services\FileOpenBroker32.exe -> [2012/04/30 19:56:50 | 000,836,480 | ---- | M] (FileOpen Systems Inc.)
winpatrol.exe -> C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe -> [2012/01/30 14:35:14 | 000,400,480 | ---- | M] (BillP Studios)
reader library launcher.exe -> C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe -> [2010/07/13 02:34:46 | 000,906,648 | ---- | M] (Sony Corporation)
pwrisovm.exe -> C:\Program Files\PowerISO\PWRISOVM.EXE -> [2010/04/12 04:40:16 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.)
eeventmanager.exe -> C:\Program Files\Epson Software\Event Manager\EEventManager.exe -> [2009/12/03 11:12:12 | 000,976,320 | ---- | M] (SEIKO EPSON CORPORATION)
fufaxstm.exe -> C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe -> [2009/12/03 00:00:00 | 000,847,872 | ---- | M] (SEIKO EPSON CORPORATION)
networklicenseserver.exe -> C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe -> [2009/05/14 18:07:14 | 000,759,048 | ---- | M] (ABBYY)
yahooauservice.exe -> C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -> [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.)
e_fatifca.exe -> C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIFCA.EXE -> [2008/10/01 06:00:00 | 000,199,680 | ---- | M] (SEIKO EPSON CORPORATION)
photoshopelementsfileagent.exe -> C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -> [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated)
sprtsvc.exe -> C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe -> [2008/04/24 13:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.)
sprtcmd.exe -> C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe -> [2008/04/24 13:25:22 | 000,202,560 | ---- | M] (SupportSoft, Inc.)
explorer.exe -> C:\WINDOWS\explorer.exe -> [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation)
ctsyncu.exe -> C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe -> [2007/07/17 11:03:38 | 000,868,352 | ---- | M] ()
eebsvc.exe -> C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe -> [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION)
ymetray.exe -> C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe -> [2006/08/14 13:12:46 | 000,049,152 | ---- | M] ()

[Modules - No Company Name]
rndlresolversvc.exe -> C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe -> [2012/11/29 21:31:04 | 000,038,608 | ---- | M] ()
sqlite3.dll -> C:\Program Files\BillP Studios\WinPatrol\sqlite3.dll -> [2011/04/14 21:01:33 | 000,548,854 | ---- | M] ()
connectiondetector.dll -> C:\Program Files\Sony\Reader\Data\bin\launcher\connectionDetector.dll -> [2010/07/13 02:29:42 | 000,143,360 | ---- | M] ()
fsk.dll -> C:\Program Files\Sony\Reader\Data\bin\launcher\fsk.dll -> [2010/07/13 02:28:42 | 000,856,064 | ---- | M] ()
fsknetinterface.dll -> C:\Program Files\Sony\Reader\Data\bin\launcher\FskNetInterface.dll -> [2010/07/13 02:26:12 | 000,018,432 | ---- | M] ()
fsktimehardware.dll -> C:\Program Files\Sony\Reader\Data\bin\launcher\FskTimeHardware.dll -> [2010/07/13 02:25:56 | 000,008,704 | ---- | M] ()
ticket.dll -> C:\Program Files\Sony\Reader\Data\bin\launcher\ticket.dll -> [2010/07/13 02:25:50 | 000,028,160 | ---- | M] ()
ebookdevicenotifier.dll -> C:\Program Files\Sony\Reader\Data\bin\launcher\ebookDeviceNotifier.dll -> [2010/07/13 02:25:42 | 000,011,776 | ---- | M] ()
fskinlocalize.dll -> C:\Program Files\Sony\Reader\Data\bin\FskinLocalize.dll -> [2010/07/13 02:22:36 | 000,020,480 | ---- | M] ()
fskpower.dll -> C:\Program Files\Sony\Reader\Data\bin\FskPower.dll -> [2010/07/13 02:22:02 | 000,009,728 | ---- | M] ()
fskdocumentviewer.dll -> C:\Program Files\Sony\Reader\Data\bin\FskDocumentViewer.dll -> [2010/07/13 02:16:16 | 000,118,784 | ---- | M] ()
fskmobilemediadevice.dll -> C:\Program Files\Sony\Reader\Data\bin\FskMobileMediaDevice.dll -> [2010/07/13 02:15:58 | 000,010,240 | ---- | M] ()
fskin.dll -> C:\Program Files\Sony\Reader\Data\bin\Fskin.dll -> [2010/07/13 02:15:52 | 000,233,472 | ---- | M] ()
fskmediaplayers.dll -> C:\Program Files\Sony\Reader\Data\bin\FskMediaPlayers.dll -> [2010/07/13 02:13:42 | 000,033,792 | ---- | M] ()
usbdetector.dll -> C:\Program Files\Sony\Reader\Data\bin\launcher\USBDetector.dll -> [2010/07/13 02:10:56 | 000,172,032 | ---- | M] ()
fsksecurity.dll -> C:\Program Files\Sony\Reader\Data\bin\FskSecurity.dll -> [2010/04/02 22:23:36 | 000,815,104 | ---- | M] ()
ebookusb.dll -> C:\Program Files\Sony\Reader\Data\bin\launcher\ebookUsb.dll -> [2010/04/02 21:44:16 | 000,086,016 | ---- | M] ()
rarext.dll -> C:\Program Files\WinRAR\RarExt.dll -> [2010/03/15 11:28:22 | 000,141,824 | ---- | M] ()
cpwmon2k.dll -> C:\WINDOWS\system32\cpwmon2k.dll -> [2009/11/05 08:39:40 | 000,087,552 | ---- | M] ()
ctsyncu.exe -> C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe -> [2007/07/17 11:03:38 | 000,868,352 | ---- | M] ()
msjetoledb40.dll -> C:\WINDOWS\system32\msjetoledb40.dll -> [2007/04/02 08:49:20 | 000,355,112 | ---- | M] ()
ctsyncrs.crl -> C:\Program Files\Creative\Sync Manager Unicode\CTSyncRs.crl -> [2007/02/07 16:51:20 | 000,188,416 | ---- | M] ()
ymetray.exe -> C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe -> [2006/08/14 13:12:46 | 000,049,152 | ---- | M] ()
tsd32.dll -> C:\WINDOWS\system32\tsd32.dll -> [2004/08/04 16:00:00 | 000,015,360 | ---- | M] ()

[Win32 Services - Safe List]
(Roxio UPnP Renderer 11) Roxio UPnP Renderer 11 [Disabled | Stopped] -> -> File not found
(AppMgmt) Application Management [On_Demand | Stopped] -> -> File not found
(JavaQuickStarterService) Java Quick Starter [Auto | Running] -> C:\Program Files\Java\jre7\bin\jqs.exe -> [2013/06/04 20:43:13 | 000,181,664 | ---- | M] (Oracle Corporation)
(MozillaMaintenance) Mozilla Maintenance Service [On_Demand | Stopped] -> C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -> [2013/05/24 02:05:01 | 000,117,144 | ---- | M] (Mozilla Foundation)
(AdobeFlashPlayerUpdateSvc) Adobe Flash Player Update Service [On_Demand | Stopped] -> C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -> [2013/05/15 00:59:57 | 000,256,904 | ---- | M] (Adobe Systems Incorporated)
(ekrn) ESET Service [Auto | Running] -> C:\Program Files\ESET\ESET Smart Security\ekrn.exe -> [2013/03/21 15:19:46 | 001,341,664 | ---- | M] (ESET)
(RealNetworks Downloader Resolver Service) RealNetworks Downloader Resolver Service [Auto | Running] -> C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe -> [2012/11/29 21:31:04 | 000,038,608 | ---- | M] ()
(FileOpenManagerSvc) FileOpen Manager Service [Auto | Running] -> C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe -> [2012/04/30 19:56:52 | 000,213,888 | ---- | M] (FileOpen Systems Inc.)
(FLEXnet Licensing Service) FLEXnet Licensing Service [On_Demand | Stopped] -> C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -> [2010/05/15 10:56:20 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.)
(Sony SCSI Helper Service) Sony SCSI Helper Service [On_Demand | Stopped] -> C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe -> [2010/04/02 22:34:12 | 000,073,728 | ---- | M] (Sony Corporation)
(ABBYY.Licensing.FineReader.Sprint.9.0) ABBYY FineReader 9.0 Sprint Licensing Service [Auto | Running] -> C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe -> [2009/05/14 18:07:14 | 000,759,048 | ---- | M] (ABBYY)
(YahooAUService) Yahoo! Updater [Auto | Running] -> C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -> [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.)
(AdobeActiveFileMonitor7.0) Adobe Active File Monitor V7 [Auto | Running] -> C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -> [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated)
(sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2) [Auto | Running] -> C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe -> [2008/04/24 13:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.)
(EpsonBidirectionalService) EpsonBidirectionalService [Auto | Running] -> C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe -> [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION)

[Driver Services - Safe List]
(epfwtdi) epfwtdi [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\epfwtdi.sys -> [2013/02/20 11:07:38 | 000,062,512 | ---- | M] (ESET)
(epfw) epfw [Kernel | Auto | Running] -> C:\WINDOWS\system32\drivers\epfw.sys -> [2013/01/10 15:08:16 | 000,150,080 | ---- | M] (ESET)
(Epfwndis) Eset Personal Firewall [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\epfwndis.sys -> [2013/01/10 15:08:16 | 000,040,376 | ---- | M] (ESET)
(eamon) eamon [File_System | System | Running] -> C:\WINDOWS\system32\drivers\eamon.sys -> [2013/01/10 15:08:14 | 000,161,368 | ---- | M] (ESET)
(ehdrv) ehdrv [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\ehdrv.sys -> [2013/01/10 15:08:14 | 000,122,240 | ---- | M] (ESET)
(WsAudio_DeviceS(5)) WsAudio_DeviceS(5) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys -> [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare)
(WsAudio_DeviceS(4)) WsAudio_DeviceS(4) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys -> [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare)
(WsAudio_DeviceS(3)) WsAudio_DeviceS(3) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys -> [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare)
(WsAudio_DeviceS(2)) WsAudio_DeviceS(2) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys -> [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare)
(WsAudio_DeviceS(1)) WsAudio_DeviceS(1) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys -> [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare)
(sptd) sptd [Kernel | Boot | Running] -> C:\WINDOWS\System32\Drivers\sptd.sys -> [2010/10/05 06:20:02 | 000,691,696 | ---- | M] ()
(MRESP50) MRESP50 NDIS Protocol Driver [Kernel | On_Demand | Stopped] -> C:\Program Files\Common Files\Motive\MRESP50.sys -> [2010/05/26 22:21:22 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA))
(MREMP50) MREMP50 NDIS Protocol Driver [Kernel | On_Demand | Stopped] -> C:\Program Files\Common Files\Motive\MREMP50.sys -> [2010/05/26 22:20:34 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA))
(SCDEmu) SCDEmu [Kernel | System | Running] -> C:\WINDOWS\System32\drivers\scdemu.sys -> [2010/04/12 04:44:34 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.)
(Tcpip6) Microsoft IPv6 Protocol Driver [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\tcpip6.sys -> [2010/02/11 08:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation)
(RTLE8023xp) Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\Rtenicxp.sys -> [2008/10/30 09:14:20 | 000,117,888 | ---- | M] (Realtek Semiconductor Corporation )
(fdrawcmd) Low-level Floppy Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\fdrawcmd.sys -> [2008/09/27 23:09:50 | 000,027,544 | ---- | M] (simonowen.com)
(NwlnkIpx) NWLink IPX/SPX/NetBIOS Compatible Transport Protocol [Kernel | Auto | Running] -> C:\WINDOWS\system32\drivers\nwlnkipx.sys -> [2008/04/13 14:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation)
(motmodem) Motorola USB CDC ACM Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\motmodem.sys -> [2007/06/18 21:18:26 | 000,023,680 | ---- | M] (Motorola)
(StMp3Rec) Player Recovery Device Control Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\StMp3Rec.sys -> [2007/06/15 10:49:30 | 000,019,840 | R--- | M] (Generic)
(Ser2pl) Prolific2 Serial port driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\ser2pl.sys -> [2005/07/25 10:04:08 | 000,048,640 | ---- | M] (Prolific Technology Inc.)
(eBook) eBook [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\eBook.sys -> [2005/06/25 11:35:22 | 000,022,072 | ---- | M] (eBook Technologies, Inc.)
(NwlnkNb) NWLink NetBIOS [Kernel | Auto | Running] -> C:\WINDOWS\system32\drivers\nwlnknb.sys -> [2004/08/04 16:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation)
(NwlnkSpx) NWLink SPX/SPXII Protocol [Kernel | Auto | Running] -> C:\WINDOWS\system32\drivers\nwlnkspx.sys -> [2004/08/04 16:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation)
(busbcrw) USB Card Reader Writer driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\busbcrw.sys -> [2003/04/23 09:45:00 | 000,016,896 | ---- | M] (Brother Industries, Ltd.)
(wdpnp) WinDriver USB Client [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\wdpnp.sys -> [2001/11/12 06:23:12 | 000,022,748 | ---- | M] ()
(IntcAzAudAddService) Service for Realtek HD Audio (WDM) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\RtkHDAud.sys -> [1999/12/31 20:00:00 | 006,168,208 | ---- | M] (Realtek Semiconductor Corp.)
(Ambfilt) Ambfilt [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\Ambfilt.sys -> [1999/12/31 20:00:00 | 001,691,480 | ---- | M] (Creative)
(Monfilt) Monfilt [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\Monfilt.sys -> [1999/12/31 20:00:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.)

[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Search\\"Default_Search_URL" -> -> 
HKEY_LOCAL_MACHINE\: URLSearchHooks\\"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}" [HKLM] -> C:\Program Files\Winamp Toolbar\winamptb.dll [Winamp Toolbar Search Class] -> [2011/09/28 14:05:46 | 001,937,736 | ---- | M] (AOL Inc.)
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> 
HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 1 -> 
HKEY_USERS\.DEFAULT\: "ProxyServer" -> http=127.0.0.1:61030 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> 
HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 1 -> 
HKEY_USERS\S-1-5-18\: "ProxyServer" -> http=127.0.0.1:61030 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> 
HKEY_USERS\S-1-5-19\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> 
HKEY_USERS\S-1-5-20\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\] > -> -> 
HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\: Main\\"SearchDefaultBranded" -> 1 -> 
HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\: Main\\"Start Page" -> http://www.yahoo.com/ -> 
HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\: Search\\"SearchAssistant" -> -> 
HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\: URLSearchHooks\\"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}" [HKLM] -> C:\Program Files\Winamp Toolbar\winamptb.dll [Winamp Toolbar Search Class] -> [2011/09/28 14:05:46 | 001,937,736 | ---- | M] (AOL Inc.)
HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\: "ProxyEnable" -> 0 -> 
< FireFox Settings [Prefs.js] > -> C:\Documents and Settings\all\Application Data\Mozilla\FireFox\Profiles\4zkw72so.default\prefs.js -> 
browser.search.defaultenginename -> "Yahoo" ->
browser.search.defaultthis.engineName -> "MyAshampoo Customized Web Search" ->
browser.search.defaulturl -> "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=" ->
browser.search.param.yahoo-fr -> "moz2-ytff-" ->
browser.search.param.yahoo-fr-cjkt -> "moz2-ytff-" ->
browser.search.selectedEngine -> "WOT Safe Search" ->
browser.search.useDBForOrder -> true ->
browser.startup.homepage -> "www.yahoo.com" ->
extensions.enabledItems -> {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100127023632 ->
extensions.enabledItems -> {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 ->
extensions.enabledItems -> [email protected]:1.0 ->
extensions.enabledItems -> {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 ->
extensions.enabledItems -> {7000b6ca-4388-4d95-893d-6659c2d4d1ce}:3.5 ->
extensions.enabledItems -> {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209 ->
network.proxy.type -> 0 ->
< FireFox Settings [User.js] > -> C:\Documents and Settings\all\Application Data\Mozilla\FireFox\Profiles\4zkw72so.default\user.js -> 
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\Extensions -> -> 
HKLM\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632} -> C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT\ [C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT\] -> [2013/01/31 10:08:11 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Firefox 21.0\extensions -> -> 
HKLM\software\mozilla\Mozilla Firefox 21.0\extensions\\Components -> C:\Program Files\Mozilla Firefox\components [C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2013/05/24 02:05:08 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins -> C:\Program Files\Mozilla Firefox\plugins [C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2013/05/24 02:04:04 | 000,000,000 | ---D | M]
HKLM\software\mozilla\Thunderbird\Extensions -> -> 
HKLM\software\mozilla\Thunderbird\Extensions\\[email protected] -> C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [C:\PROGRAM FILES\ESET\ESET SMART SECURITY\MOZILLA THUNDERBIRD] -> [2013/05/02 14:42:22 | 000,000,000 | ---D | M]
< FireFox Extensions [User Folders] > -> 
-> C:\Documents and Settings\all\Application Data\Mozilla\Extensions -> [2010/08/29 11:43:41 | 000,000,000 | ---D | M]
-> C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions -> [2013/05/25 14:29:57 | 000,000,000 | ---D | M]
Winamp Toolbar -> C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} -> [2013/04/03 11:07:31 | 000,000,000 | ---D | M]
Microsoft .NET Framework Assistant -> C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} -> [2010/09/09 13:07:53 | 000,000,000 | ---D | M]
ChatZilla -> C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2} -> [2013/02/09 13:55:46 | 000,000,000 | ---D | M]
Yahoo! Toolbar -> C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} -> [2013/04/26 09:56:01 | 000,000,000 | ---D | M]
Xfinity.com Toolbar -> C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce} -> [2011/06/21 14:01:52 | 000,000,000 | ---D | M]
WOT -> C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} -> [2013/05/16 14:49:02 | 000,000,000 | ---D | M]
< FireFox SearchPlugins [User Folders] > -> 
conduit.xml -> C:\Documents and Settings\all\Application Data\Mozilla\FireFox\Profiles\4zkw72so.default\searchplugins\conduit.xml -> [2010/12/15 17:12:32 | 000,000,923 | ---- | M] ()
wot-safe-search.xml -> C:\Documents and Settings\all\Application Data\Mozilla\FireFox\Profiles\4zkw72so.default\searchplugins\wot-safe-search.xml -> [2012/03/12 15:19:37 | 000,002,306 | ---- | M] ()
< FireFox Extensions [Program Folders] > -> 
-> C:\Program Files\Mozilla Firefox\extensions -> [2013/05/24 02:05:09 | 000,000,000 | ---D | M]
Java Console -> C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} -> [2013/05/24 02:03:44 | 000,000,000 | ---D | M]
-> C:\Program Files\Mozilla Firefox\browser\extensions -> [2013/05/24 02:05:07 | 000,000,000 | ---D | M]
Default -> C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} -> [2013/05/24 02:05:08 | 000,000,000 | ---D | M]
RealDownloader -> C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT -> [2013/01/31 10:08:11 | 000,000,000 | ---D | M]
< FireFox Components [Program Folders] > -> 
nprndlffbrowserrecordext.dll -> C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT\components\nprndlffbrowserrecordext.dll -> [2012/11/29 21:35:26 | 000,110,592 | ---- | M] (RealNetworks, Inc.)
nprndlffbrowserrecordlegacyext.dll -> C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT\components\nprndlffbrowserrecordlegacyext.dll -> [2012/11/29 21:35:06 | 000,108,032 | ---- | M] (RealNetworks, Inc.)
< HOSTS File > ([2013/05/11 20:47:35 | 000,000,027 | ---- | M] - 1 lines) -> C:\WINDOWS\system32\drivers\etc\hosts -> 
Reset Hosts
127.0.0.1 localhost
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{02478D38-C3F9-4efb-9B51-7695ECA05670} [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll [&Yahoo! Toolbar Helper] -> [2010/03/23 03:51:16 | 001,205,560 | ---- | M] (Yahoo! Inc.)
{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} [HKLM] -> C:\Program Files\Winamp Toolbar\winamptb.dll [Winamp Toolbar Loader] -> [2011/09/28 14:05:46 | 001,937,736 | ---- | M] (AOL Inc.)
{3049C3E9-B461-4BC5-8870-4C09146192CA} [HKLM] -> C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [RealNetworks Download and Record Plugin for Internet Explorer] -> [2012/11/29 21:33:04 | 000,539,888 | ---- | M] (RealDownloader)
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> [2009/01/26 15:31:02 | 001,879,896 | ---- | M] (Safer Networking Limited)
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> C:\Program Files\Java\jre7\bin\ssv.dll [Java(tm) Plug-In SSV Helper] -> [2013/06/04 20:43:18 | 000,462,752 | ---- | M] (Oracle Corporation)
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} [HKLM] -> C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [Easy Photo Print] -> [2008/03/29 18:42:00 | 000,266,240 | ---- | M] (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
{DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [Java(tm) Plug-In 2 SSV Helper] -> [2013/06/04 20:43:12 | 000,171,424 | ---- | M] (Oracle Corporation)
{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll [SingleInstance Class] -> [2010/03/23 03:51:16 | 000,158,520 | ---- | M] (Yahoo! Inc)
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 
"{9421DD08-935F-4701-A9CA-22DF90AC4EA6}" [HKLM] -> C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [Easy Photo Print] -> [2008/03/29 18:42:00 | 000,266,240 | ---- | M] (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
"{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}" [HKLM] -> C:\Program Files\Winamp Toolbar\winamptb.dll [Winamp Toolbar] -> [2011/09/28 14:05:46 | 001,937,736 | ---- | M] (AOL Inc.)
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll [Yahoo! Toolbar] -> [2010/03/23 03:51:16 | 001,205,560 | ---- | M] (Yahoo! Inc.)
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\] > -> HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\Software\Microsoft\Internet Explorer\Toolbar\ -> 
WebBrowser\\"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" [HKLM] -> C:\Program Files\Winamp Toolbar\winamptb.dll [Winamp Toolbar] -> [2011/09/28 14:05:46 | 001,937,736 | ---- | M] (AOL Inc.)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"ddoctorv2" -> C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe ["C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2] -> [2008/04/24 13:25:22 | 000,202,560 | ---- | M] (SupportSoft, Inc.)
"EEventManager" -> C:\Program Files\Epson Software\Event Manager\EEventManager.exe ["C:\Program Files\Epson Software\Event Manager\EEventManager.exe"] -> [2009/12/03 11:12:12 | 000,976,320 | ---- | M] (SEIKO EPSON CORPORATION)
"egui" -> C:\Program Files\ESET\ESET Smart Security\egui.exe ["C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice] -> [2013/03/21 15:19:40 | 005,078,504 | ---- | M] (ESET)
"FileOpenBroker" -> C:\Program Files\FileOpen\Services\FileOpenBroker32.exe [C:\Program Files\FileOpen\Services\FileOpenBroker32.exe] -> [2012/04/30 19:56:50 | 000,836,480 | ---- | M] (FileOpen Systems Inc.)
"FUFAXSTM" -> C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe ["C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe"] -> [2009/12/03 00:00:00 | 000,847,872 | ---- | M] (SEIKO EPSON CORPORATION)
"LTCM Client" -> C:\Program Files\LTCM Client\ltcmClient.exe [C:\Program Files\LTCM Client\ltcmClient.exe /startup] -> [2009/08/05 13:36:18 | 001,596,096 | ---- | M] (Leader Technologies Inc.)
"PWRISOVM.EXE" -> C:\Program Files\PowerISO\PWRISOVM.EXE [C:\Program Files\PowerISO\PWRISOVM.EXE] -> [2010/04/12 04:40:16 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.)
"Reader Library Launcher" -> C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe] -> [2010/07/13 02:34:46 | 000,906,648 | ---- | M] (Sony Corporation)
"TkBellExe" -> C:\program files\real\realplayer\update\realsched.exe ["C:\program files\real\realplayer\update\realsched.exe" -osboot] -> [2013/01/31 10:05:49 | 000,295,072 | ---- | M] (RealNetworks, Inc.)
"WinPatrol" -> C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot] -> [2012/01/30 14:35:14 | 000,400,480 | ---- | M] (BillP Studios)
< Run [HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\] > -> HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"CTSyncU.exe" -> C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe ["C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"] -> [2007/07/17 11:03:38 | 000,868,352 | ---- | M] ()
"EPSON NX410 Series" -> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE /FU "C:\DOCUME~1\all\LOCALS~1\Temp\E_SAA.tmp" /EF "HKCU"] -> [2008/10/01 06:00:00 | 000,199,680 | ---- | M] (SEIKO EPSON CORPORATION)
< all Startup Folder > -> C:\Documents and Settings\all\Start Menu\Programs\Startup -> 
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\eBook USB Driver.lnk -> C:\Program Files\eBook Technologies\eBook USB Driver\TrayEBU.exe -> [2005/06/25 11:35:16 | 000,042,552 | ---- | M] ()
< All Users.WINDOWS Startup Folder > -> C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup -> 
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ymetray.lnk -> C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe -> [2006/08/14 13:12:46 | 000,049,152 | ---- | M] ()
< Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup -> 
< Default User.WINDOWS Startup Folder > -> C:\Documents and Settings\Default User.WINDOWS\Start Menu\Programs\Startup -> 
< Owner Startup Folder > -> C:\Documents and Settings\Owner\Start Menu\Programs\Startup -> 
< Software Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer -> 
< Software Policy Settings [HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004] > -> HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\SOFTWARE\Policies\Microsoft\Internet Explorer -> 
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"HonorAutoRunSetting" -> [1] -> File not found
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
\\"NoDrives" -> [0] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004] > -> HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
\\"NoDrives" -> [0] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004] > -> HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Menu: Spybot - Search & Destroy Configuration] -> [2009/01/26 15:31:02 | 001,879,896 | ---- | M] (Safer Networking Limited)
< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\] > -> HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\Software\Microsoft\Internet Explorer\Extensions\ -> 
CmdMapping\\"{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}" [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2009/01/26 15:31:02 | 001,879,896 | ---- | M] (Safer Networking Limited)
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 7822 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 7822 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 7822 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\] > -> HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 11864 domain(s) found. -> 
//@[email protected]/ .[money] -> Local intranet -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\] > -> HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-21-1644491937-115176313-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{6414512B-B978-451D-A0D8-FCFDF33E833C} [HKLM] -> http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282722117312 [WUWebControl Class] -> 
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} [HKLM] -> http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1342019053406 [MUWebControl Class] -> 
{814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} [HKLM] -> http://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab [DASWebDownload Class] -> 
{E06E2E99-0AA1-11D4-ABA6-0060082AA75C} [HKLM] -> https://mozysupport.webex.com/client/T27LB/support/ieatgpc.cab [GpcContainer Class] -> 
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} [HKLM] -> http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab [Reg Error: Key error.] -> 
Garmin Communicator Plug-In [HKLM] -> https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB [Reg Error: Key error.] -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> 
DhcpNameServer -> 65.32.5.111 65.32.5.112 -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}\\DhcpNameServer -> 65.32.5.111 65.32.5.112 (Realtek RTL8102E/RTL8103E Family PCI-E Fast Ethernet NIC) -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
Explorer.exe -> C:\WINDOWS\explorer.exe -> [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
*UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit -> 
C:\WINDOWS\system32\userinit.exe -> C:\WINDOWS\system32\userinit.exe -> [2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< Winlogon settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> C:\WINDOWS\explorer.exe -> [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< Winlogon settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> C:\WINDOWS\explorer.exe -> [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> 
"{56F9679E-7826-4C84-81F3-532071A8BCC5}" [HKLM] -> C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll [] -> [2009/05/24 22:41:34 | 000,304,128 | ---- | M] (Microsoft Corporation)
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List -> 
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 
"C:\Program Files\Epson Software\Event Manager\EEventManager.exe" -> C:\Program Files\Epson Software\Event Manager\EEventManager.exe [C:\Program Files\Epson Software\Event Manager\EEventManager.exe:*:Enabled:EEventManager.exe] -> [2009/12/03 11:12:12 | 000,976,320 | ---- | M] (SEIKO EPSON CORPORATION)
"C:\Program Files\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe" -> C:\Program Files\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe [C:\Program Files\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe:*:Enabled:EpsonNet Setup] -> [2009/11/20 16:43:10 | 002,553,248 | ---- | M] (SEIKO EPSON CORPORATION)
"C:\Program Files\uTorrent\uTorrent.exe" -> C:\Program Files\uTorrent\uTorrent.exe [C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent] -> [2012/10/27 13:47:02 | 000,963,984 | ---- | M] (BitTorrent, Inc.)
"C:\Program Files\Winamp\winamp.exe" -> C:\Program Files\Winamp\winamp.exe [C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp] -> [2011/12/09 13:23:30 | 001,596,032 | ---- | M] (Nullsoft, Inc.)
"C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe" -> C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe [C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox] -> [2006/08/14 13:09:18 | 006,033,408 | ---- | M] (Yahoo!)
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> [system32\DRIVERS\cdrom.sys] -> File not found
< Drives with AutoRun files > -> -> 
C:\AUTOEXEC.BAT [] -> C:\AUTOEXEC.BAT [ NTFS ] -> [2010/01/25 00:58:00 | 000,000,000 | ---- | M] ()
F:\autorun [] -> F:\autorun [ NTFS ] -> [2012/02/19 01:34:27 | 000,000,000 | R--D | M]
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 
< Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command -> 
comfile [open] -> "%1" %* -> 
exefile [open] -> "%1" %* -> 
< File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>\ -> 
.com [@ = ComFile] -> "%1" %* -> 
.exe [@ = exefile] -> "%1" %* ->

[Registry - Additional Scans - Safe List]
< Disabled MSConfig Registry Items [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ -> 
Pulse Ambassador Update Setup for All Users hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe -> [2009/05/13 14:48:08 | 002,768,848 | ---- | M] (Pulse Microsystems Ltd. )
< Disabled MSConfig State [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state -> 
"bootini" -> 0 -> 
"services" -> 0 -> 
"startup" -> 0 -> 
"system.ini" -> 0 -> 
"win.ini" -> 0 -> 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost > -> ->
*netsvcs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs ->
AppMgmt -> -> File not found
Ias -> -> File not found
Iprip -> -> File not found
Irmon -> -> File not found
NWCWorkstation -> -> File not found
Nwsapagent -> -> File not found
WmdmPmSp -> -> File not found
*MultiFile Done* -> -> 
< EventViewer Logs - Last 10 Errors > -> Event Information -> Description
Application [ Error ] 5/9/2013 7:48:29 PM Computer Name = LENOVO | Source = Windows Search Service | ID = 3013 -> Description = The entry <C:\DOCUMENTS AND SETTINGS\ALL\MY DOCUMENTS\MY DIGITAL EDITIONS\BACKUP_MANIFEST.XML> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) 
Application [ Error ] 5/9/2013 7:50:22 PM Computer Name = LENOVO | Source = Windows Search Service | ID = 3013 -> Description = The entry <C:\DOCUMENTS AND SETTINGS\ALL\MY DOCUMENTS\MY DIGITAL EDITIONS\BACKUP_MANIFEST.XML> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) 
Application [ Error ] 5/9/2013 8:34:01 PM Computer Name = LENOVO | Source = crypt32 | ID = 131080 -> Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired. 
Application [ Error ] 5/28/2013 10:05:13 AM Computer Name = LENOVO | Source = Application Error | ID = 1000 -> Description = Faulting application rndlresolversvc.exe, version 0.0.0.0, faulting module rndlresolversvc.exe, version 0.0.0.0, fault address 0x00003035.
Application [ Error ] 5/28/2013 10:06:06 AM Computer Name = LENOVO | Source = .NET Runtime Optimization Service | ID = 1103 -> Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown 
Application [ Error ] 5/28/2013 10:06:53 AM Computer Name = LENOVO | Source = Application Error | ID = 1001 -> Description = Fault bucket -1173431414.
Application [ Error ] 5/31/2013 2:39:41 PM Computer Name = LENOVO | Source = Application Hang | ID = 1002 -> Description = Hanging application firefox.exe, version 21.0.0.4879, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 5/31/2013 2:39:54 PM Computer Name = LENOVO | Source = Application Hang | ID = 1001 -> Description = Fault bucket -710996888.
Application [ Error ] 5/31/2013 3:31:44 PM Computer Name = LENOVO | Source = crypt32 | ID = 131080 -> Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired. 
Application [ Error ] 6/7/2013 4:01:44 PM Computer Name = LENOVO | Source = crypt32 | ID = 131080 -> Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired. 
OSession [ Error ] 9/24/2010 7:51:05 PM Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 35 seconds with 0 seconds of active time. This session ended with a crash.
OSession [ Error ] 10/10/2010 7:52:13 PM Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 119771 seconds with 300 seconds of active time. This session ended with a crash.
OSession [ Error ] 12/13/2010 9:51:02 PM Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 29008 seconds with 240 seconds of active time. This session ended with a crash.
OSession [ Error ] 2/3/2011 2:45:28 PM Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 2723 seconds with 720 seconds of active time. This session ended with a crash.
OSession [ Error ] 2/25/2011 12:15:09 AM Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 356052 seconds with 900 seconds of active time. This session ended with a crash.
OSession [ Error ] 3/10/2011 5:26:17 PM Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 269041 seconds with 1800 seconds of active time. This session ended with a crash.
OSession [ Error ] 3/22/2011 2:31:11 PM Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001 -> Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 271695 seconds with 480 seconds of active time. This session ended with a crash.
System [ Error ] 5/31/2013 5:17:24 PM Computer Name = LENOVO | Source = atapi | ID = 262153 -> Description = The device, \Device\Ide\IdePort2, did not respond within the timeout period.
System [ Error ] 5/31/2013 5:17:26 PM Computer Name = LENOVO | Source = atapi | ID = 262153 -> Description = The device, \Device\Ide\IdePort2, did not respond within the timeout period.
System [ Error ] 5/31/2013 5:17:41 PM Computer Name = LENOVO | Source = atapi | ID = 262153 -> Description = The device, \Device\Ide\IdePort2, did not respond within the timeout period.
System [ Error ] 5/31/2013 5:19:18 PM Computer Name = LENOVO | Source = atapi | ID = 262153 -> Description = The device, \Device\Ide\IdePort2, did not respond within the timeout period.
System [ Error ] 5/31/2013 5:22:03 PM Computer Name = LENOVO | Source = atapi | ID = 262153 -> Description = The device, \Device\Ide\IdePort2, did not respond within the timeout period.
System [ Error ] 5/31/2013 5:22:22 PM Computer Name = LENOVO | Source = atapi | ID = 262153 -> Description = The device, \Device\Ide\IdePort2, did not respond within the timeout period.
System [ Error ] 5/31/2013 5:22:33 PM Computer Name = LENOVO | Source = atapi | ID = 262153 -> Description = The device, \Device\Ide\IdePort2, did not respond within the timeout period.
System [ Error ] 5/31/2013 5:22:37 PM Computer Name = LENOVO | Source = atapi | ID = 262153 -> Description = The device, \Device\Ide\IdePort2, did not respond within the timeout period.
System [ Error ] 6/4/2013 8:01:39 PM Computer Name = LENOVO | Source = Service Control Manager | ID = 7022 -> Description = The Yahoo! Updater service hung on starting.
System [ Error ] 6/4/2013 8:38:50 PM Computer Name = LENOVO | Source = Service Control Manager | ID = 7034 -> Description = The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

[Files/Folders - Created Within 30 Days]
OTS.exe -> C:\Documents and Settings\all\Desktop\OTS.exe -> [2013/06/09 11:00:27 | 000,646,656 | ---- | C] (OldTimer Tools)
aswMBR.exe -> C:\Documents and Settings\all\Desktop\aswMBR.exe -> [2013/06/06 10:14:52 | 004,745,728 | ---- | C] (AVAST Software)
javacpl.cpl -> C:\WINDOWS\System32\javacpl.cpl -> [2013/06/04 20:44:24 | 000,144,896 | ---- | C] (Oracle Corporation)
javaws.exe -> C:\WINDOWS\System32\javaws.exe -> [2013/06/04 20:44:21 | 000,263,584 | ---- | C] (Oracle Corporation)
WindowsAccessBridge.dll -> C:\WINDOWS\System32\WindowsAccessBridge.dll -> [2013/06/04 20:44:09 | 000,094,112 | ---- | C] (Oracle Corporation)
javaw.exe -> C:\WINDOWS\System32\javaw.exe -> [2013/06/04 20:44:08 | 000,174,496 | ---- | C] (Oracle Corporation)
java.exe -> C:\WINDOWS\System32\java.exe -> [2013/06/04 20:44:08 | 000,174,496 | ---- | C] (Oracle Corporation)
TEMP -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP -> [2013/06/04 20:39:31 | 000,000,000 | ---D | C]
RECYCLER -> C:\RECYCLER -> [2013/05/30 11:07:45 | 000,000,000 | -HSD | C]
Mozilla Firefox -> C:\Program Files\Mozilla Firefox -> [2013/05/24 02:03:40 | 000,000,000 | ---D | C]
Licenses -> C:\Documents and Settings\All Users.WINDOWS\Application Data\Licenses -> [2013/05/11 23:16:39 | 000,000,000 | ---D | C]
SpywareBlaster -> C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\SpywareBlaster -> [2013/05/11 23:16:24 | 000,000,000 | ---D | C]
eset_smart_security_live_installer.exe -> C:\Program Files\eset_smart_security_live_installer.exe -> [2012/04/10 13:21:44 | 001,263,344 | ---- | C] (ESET)

[Files/Folders - Modified Within 30 Days]
OTS.exe -> C:\Documents and Settings\all\Desktop\OTS.exe -> [2013/06/09 11:01:26 | 000,646,656 | ---- | M] (OldTimer Tools)
Adobe Flash Player Updater.job -> C:\WINDOWS\tasks\Adobe Flash Player Updater.job -> [2013/06/09 10:59:01 | 000,000,830 | ---- | M] ()
RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job -> C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job -> [2013/06/09 10:49:41 | 000,000,282 | ---- | M] ()
RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job -> C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job -> [2013/06/09 10:49:30 | 000,000,274 | ---- | M] ()
RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job -> C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job -> [2013/06/09 10:49:27 | 000,000,282 | ---- | M] ()
Disk Cleanup.job -> C:\WINDOWS\tasks\Disk Cleanup.job -> [2013/06/08 23:05:05 | 000,000,256 | ---- | M] ()
tdsskiller.exe -> C:\Documents and Settings\all\Desktop\tdsskiller.exe -> [2013/06/07 16:01:02 | 002,240,352 | ---- | M] (Kaspersky Lab ZAO)
MBR.dat -> C:\Documents and Settings\all\Desktop\MBR.dat -> [2013/06/06 11:26:46 | 000,000,512 | ---- | M] ()
aswMBR.exe -> C:\Documents and Settings\all\Desktop\aswMBR.exe -> [2013/06/06 10:16:02 | 004,745,728 | ---- | M] (AVAST Software)
tweaking.com_windows_repair_aio_setup.exe -> C:\Documents and Settings\all\Desktop\tweaking.com_windows_repair_aio_setup.exe -> [2013/06/05 11:55:07 | 005,555,190 | ---- | M] ()
WindowsAccessBridge.dll -> C:\WINDOWS\System32\WindowsAccessBridge.dll -> [2013/06/04 20:43:19 | 000,094,112 | ---- | M] (Oracle Corporation)
javaws.exe -> C:\WINDOWS\System32\javaws.exe -> [2013/06/04 20:42:58 | 000,263,584 | ---- | M] (Oracle Corporation)
javaw.exe -> C:\WINDOWS\System32\javaw.exe -> [2013/06/04 20:42:58 | 000,174,496 | ---- | M] (Oracle Corporation)
javacpl.cpl -> C:\WINDOWS\System32\javacpl.cpl -> [2013/06/04 20:42:58 | 000,144,896 | ---- | M] (Oracle Corporation)
java.exe -> C:\WINDOWS\System32\java.exe -> [2013/06/04 20:42:57 | 000,174,496 | ---- | M] (Oracle Corporation)
npdeployJava1.dll -> C:\WINDOWS\System32\npdeployJava1.dll -> [2013/06/04 20:42:54 | 000,866,720 | ---- | M] (Oracle Corporation)
deployJava1.dll -> C:\WINDOWS\System32\deployJava1.dll -> [2013/06/04 20:42:53 | 000,788,896 | ---- | M] (Oracle Corporation)
RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job -> C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job -> [2013/06/04 20:03:17 | 000,000,274 | ---- | M] ()
wpa.dbl -> C:\WINDOWS\System32\wpa.dbl -> [2013/06/04 19:58:54 | 000,013,646 | ---- | M] ()
bootstat.dat -> C:\WINDOWS\bootstat.dat -> [2013/06/04 19:58:50 | 000,002,048 | --S- | M] ()
HiJackThis.lnk -> C:\Documents and Settings\all\Desktop\HiJackThis.lnk -> [2013/05/31 17:58:28 | 000,002,443 | ---- | M] ()
Internet Explorer.lnk -> C:\Documents and Settings\all\Desktop\Internet Explorer.lnk -> [2013/05/31 17:52:02 | 000,000,803 | ---- | M] ()
hijackthis -> C:\Documents and Settings\all\Desktop\hijackthis -> [2013/05/31 11:00:15 | 000,011,524 | ---- | M] ()
sari june.JPG -> C:\Documents and Settings\all\Desktop\sari june.JPG -> [2013/05/30 11:06:46 | 000,604,966 | ---- | M] ()
FNTCACHE.DAT -> C:\WINDOWS\System32\FNTCACHE.DAT -> [2013/05/28 10:03:57 | 000,277,352 | ---- | M] ()
perfh009.dat -> C:\WINDOWS\System32\perfh009.dat -> [2013/05/25 18:14:45 | 000,505,306 | ---- | M] ()
perfc009.dat -> C:\WINDOWS\System32\perfc009.dat -> [2013/05/25 18:14:44 | 000,087,712 | ---- | M] ()
imsins.BAK -> C:\WINDOWS\imsins.BAK -> [2013/05/25 17:52:46 | 000,001,374 | ---- | M] ()
cpnprt2.cid -> C:\WINDOWS\System32\cpnprt2.cid -> [2013/05/22 08:18:32 | 000,252,288 | R--- | M] (Coupons, Inc.)
FlashPlayerApp.exe -> C:\WINDOWS\System32\FlashPlayerApp.exe -> [2013/05/15 00:59:47 | 000,692,104 | ---- | M] (Adobe Systems Incorporated)
FlashPlayerCPLApp.cpl -> C:\WINDOWS\System32\FlashPlayerCPLApp.cpl -> [2013/05/15 00:59:46 | 000,071,048 | ---- | M] (Adobe Systems Incorporated)
PMBx5.lnk -> C:\Documents and Settings\all\Desktop\PMBx5.lnk -> [2013/05/12 17:05:03 | 000,002,227 | ---- | M] ()
SpywareBlaster.lnk -> C:\Documents and Settings\All Users.WINDOWS\Desktop\SpywareBlaster.lnk -> [2013/05/11 23:16:24 | 000,000,754 | ---- | M] ()
hosts -> C:\WINDOWS\System32\drivers\etc\hosts -> [2013/05/11 20:47:35 | 000,000,027 | ---- | M] ()
6 C:\Documents and Settings\all\Local Settings\temp\*.tmp files -> C:\Documents and Settings\all\Local Settings\temp\*.tmp ->

[Files - No Company Name]
MBR.dat -> C:\Documents and Settings\all\Desktop\MBR.dat -> [2013/06/06 10:44:26 | 000,000,512 | ---- | C] ()
tweaking.com_windows_repair_aio_setup.exe -> C:\Documents and Settings\all\Desktop\tweaking.com_windows_repair_aio_setup.exe -> [2013/06/05 11:54:54 | 005,555,190 | ---- | C] ()
Internet Explorer.lnk -> C:\Documents and Settings\all\Desktop\Internet Explorer.lnk -> [2013/05/31 17:52:02 | 000,000,803 | ---- | C] ()
hijackthis -> C:\Documents and Settings\all\Desktop\hijackthis -> [2013/05/31 11:00:15 | 000,011,524 | ---- | C] ()
sari june.JPG -> C:\Documents and Settings\all\Desktop\sari june.JPG -> [2013/05/30 11:06:13 | 000,604,966 | ---- | C] ()
SpywareBlaster.lnk -> C:\Documents and Settings\All Users.WINDOWS\Desktop\SpywareBlaster.lnk -> [2013/05/11 23:16:24 | 000,000,754 | ---- | C] ()
PEV.exe -> C:\WINDOWS\PEV.exe -> [2013/01/31 12:33:43 | 000,256,000 | ---- | C] ()
MBR.exe -> C:\WINDOWS\MBR.exe -> [2013/01/31 12:33:43 | 000,208,896 | ---- | C] ()
sed.exe -> C:\WINDOWS\sed.exe -> [2013/01/31 12:33:43 | 000,098,816 | ---- | C] ()
grep.exe -> C:\WINDOWS\grep.exe -> [2013/01/31 12:33:43 | 000,080,412 | ---- | C] ()
zip.exe -> C:\WINDOWS\zip.exe -> [2013/01/31 12:33:43 | 000,068,096 | ---- | C] ()
RTAIODAT.DAT -> C:\WINDOWS\System32\drivers\RTAIODAT.DAT -> [2012/10/07 19:42:46 | 000,025,816 | ---- | C] ()
igfxCoIn_v4926.dll -> C:\WINDOWS\System32\igfxCoIn_v4926.dll -> [2012/10/07 19:23:45 | 000,147,456 | ---- | C] ()
WS_ATLMovie.dll -> C:\WINDOWS\System32\WS_ATLMovie.dll -> [2012/09/24 15:54:46 | 000,153,600 | ---- | C] ()
Sp03.ini -> C:\WINDOWS\Sp03.ini -> [2012/03/10 10:22:25 | 000,000,432 | ---- | C] ()
iacenc.dll -> C:\WINDOWS\System32\iacenc.dll -> [2012/02/18 17:52:11 | 000,003,072 | ---- | C] ()
d3d9caps.dat -> C:\WINDOWS\System32\d3d9caps.dat -> [2012/02/08 18:36:11 | 000,000,664 | ---- | C] ()
d1e682a2 -> C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2 -> [2012/01/16 23:01:31 | 000,001,015 | ---- | C] ()
commong7.dat -> C:\WINDOWS\System32\commong7.dat -> [2011/08/25 15:36:56 | 000,000,286 | ---- | C] ()
CD_Start.INI -> C:\WINDOWS\CD_Start.INI -> [2011/08/25 15:33:40 | 000,000,032 | ---- | C] ()
rp_stats.dat -> C:\WINDOWS\System32\rp_stats.dat -> [2011/06/27 14:46:49 | 000,000,064 | ---- | C] ()
rp_rules.dat -> C:\WINDOWS\System32\rp_rules.dat -> [2011/06/27 14:46:49 | 000,000,044 | ---- | C] ()

[Alternate Data Streams]
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C321E34
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\all\My Documents\Ladies Prefer rogues.pdf:DocumentSummaryInformation
@Alternate Data Stream - 196 bytes -> C:\Documents and Settings\all\My Documents\Ladies Prefer rogues.pdf:SummaryInformation
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\all\My Documents\untitled.bmp:Roxio EMC Stream
< End of report >
[/code]


----------



## Cookiegal (Aug 27, 2003)

Start *OTS*. Copy/Paste the information in the code box below into the pane where it says *"Paste fix here"* and then click the "Run Fix" button.

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the OK button and Notepad will open with a log of actions taken during the fix. Post that information back here please.


```
[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> 
YN -> HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 1
YN -> HKEY_USERS\.DEFAULT\: "ProxyServer" -> http=127.0.0.1:61030
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> 
YN -> HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 1
YN -> HKEY_USERS\S-1-5-18\: "ProxyServer" -> http=127.0.0.1:61030
< FireFox Settings [Prefs.js] > -> C:\Documents and Settings\all\Application Data\Mozilla\FireFox\Profiles\4zkw72so.default\prefs.js
YN -> extensions.enabledItems -> {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
YN -> extensions.enabledItems -> {7000b6ca-4388-4d95-893d-6659c2d4d1ce}:3.5
< FireFox Extensions [User Folders] > -> 
YY -> Xfinity.com Toolbar   -> C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}
< FireFox SearchPlugins [User Folders] > -> 
YY ->  conduit.xml -> C:\Documents and Settings\all\Application Data\Mozilla\FireFox\Profiles\4zkw72so.default\searchplugins\conduit.xml
[Files/Folders - Modified Within 30 Days]
NY ->  cpnprt2.cid -> C:\WINDOWS\System32\cpnprt2.cid
NY ->  6 C:\Documents and Settings\all\Local Settings\temp\*.tmp files -> C:\Documents and Settings\all\Local Settings\temp\*.tmp
[Alternate Data Streams]
NY -> @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C321E34
[Empty Temp Folders]
[EmptyFlash]
[EmptyJava]
[Start Explorer]
[Reboot]
```


----------



## Cookiegal (Aug 27, 2003)

Please download  *SystemLook* and save it to your Desktop.

Double-click *SystemLook.exe* to run it.
Copy the content of the following code box into the main text field:

```
:dir
C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*


----------



## sarahmuriel (Feb 1, 2004)

OTS fix Log

All Processes Killed
[Registry - Safe List]
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable deleted successfully.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer deleted successfully.
Unable to delete registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable .
Unable to delete registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer .
Prefs.js: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 removed from extensions.enabledItems
Prefs.js: {7000b6ca-4388-4d95-893d-6659c2d4d1ce}:3.5 removed from extensions.enabledItems
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\components folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\xfinity folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\panels\images folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\panels\css folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\panels folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\uwa folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels\images folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels\default folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels\css folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels\bubblewindow\template\Sample folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels\bubblewindow\template folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels\bubblewindow folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib\panels folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin\lib folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\skin folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\data\websiteinspector folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\data\search folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\data folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\content\newtab\images folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\content\newtab folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\content\modules folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\content\lib folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\content\coupon folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome\content folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce}\chrome folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{7000b6ca-4388-4d95-893d-6659c2d4d1ce} folder moved successfully.
C:\Documents and Settings\all\Application Data\Mozilla\FireFox\Profiles\4zkw72so.default\searchplugins\conduit.xml moved successfully.
[Files/Folders - Modified Within 30 Days]
C:\WINDOWS\System32\cpnprt2.cid moved successfully.
C:\Documents and Settings\all\Local Settings\temp\E_SAA.tmp deleted successfully.
C:\Documents and Settings\all\Local Settings\temp\JET4CBB.tmp deleted successfully.
C:\Documents and Settings\all\Local Settings\temp\JETFD58.tmp deleted successfully.
C:\Documents and Settings\all\Local Settings\temp\RD6F.tmp deleted successfully.
C:\Documents and Settings\all\Local Settings\temp\RD78.tmp deleted successfully.
[Alternate Data Streams]
ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C321E34 deleted successfully.
[Empty Temp Folders]

User: all
->Temp folder emptied: 412628130 bytes
->Temporary Internet Files folder emptied: 115979101 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 5853348 bytes
->Flash cache emptied: 506 bytes

User: All Users

User: All Users.WINDOWS

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Owner
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 49260 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 193229 bytes

Total Files Cleaned = 510.00 mb

[EMPTYFLASH]

User: all
->Flash cache emptied: 0 bytes

User: All Users

User: All Users.WINDOWS

User: Default User
->Flash cache emptied: 0 bytes

User: Default User.WINDOWS
->Flash cache emptied: 0 bytes

User: LocalService

User: LocalService.NT AUTHORITY
->Flash cache emptied: 0 bytes

User: NetworkService

User: NetworkService.NT AUTHORITY
->Flash cache emptied: 0 bytes

User: Owner
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: all
->Java cache emptied: 0 bytes

User: All Users

User: All Users.WINDOWS

User: Default User

User: Default User.WINDOWS

User: LocalService

User: LocalService.NT AUTHORITY
->Java cache emptied: 0 bytes

User: NetworkService

User: NetworkService.NT AUTHORITY
->Java cache emptied: 0 bytes

User: Owner
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb

< End of fix log >
OTS by OldTimer - Version 3.1.47.2 fix logfile created on 06092013_173757

Files\Folders moved on Reboot...
C:\Documents and Settings\all\Local Settings\Temp\WCESLog.log moved successfully.

Registry entries deleted on Reboot...

SystemLook log

SystemLook 04.09.10 by jpshortstuff
Log created at 17:53 on 09/06/2013 by all
Administrator - Elevation successful

========== dir ==========

C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2 - Unable to find folder.

-= EOF =-

Thanks for your help Sarah


----------



## Cookiegal (Aug 27, 2003)

Please run SystemLook again with the following script and post the resulting log.


```
:filefind
*d1e682a2*
```


----------



## sarahmuriel (Feb 1, 2004)

SystemLook Log

SystemLook 04.09.10 by jpshortstuff
Log created at 18:17 on 10/06/2013 by all
Administrator - Elevation successful

========== filefind ==========

Searching for "*d1e682a2*"
C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2	--a---- 1015 bytes	[03:01 17/01/2012]	[03:04 17/01/2012] 37C3A96218793BF2531EC06D75B9C770

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

Please go to *TheSpyKiller* and upload this (these) file(s):

*C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2*

Here are the directions for uploading the file:

Just register to create an account then click "New Topic", fill in the needed details and post a link to your thread here. Click the "Browse" button. Navigate to the file on your computer. When the file is listed in the window click "Post" to upload the file.

Note that you will have to unhide files/folders to see the Location Settings and Application Data folders:

Click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types". Now click "Apply to all folders". Click "Apply" then "OK".


----------



## sarahmuriel (Feb 1, 2004)

Posted to spykiller.
Sarah


----------



## Cookiegal (Aug 27, 2003)

Thanks. We just need to wait to hear back from them about that file.


----------



## dvk01 (Dec 14, 2002)

the file is either encrypted data or encrypted instructions for another file
on its own it is harmless but should be deleted


----------



## Cookiegal (Aug 27, 2003)

Thanks Derek.


----------



## Cookiegal (Aug 27, 2003)

Please remove the version of ComboFix that you have by dragging it to the Recycle Bin then grab the latest one.

Please visit *Combofix Guide & Instructions * for instructions for downloading and running ComboFix.

Once it's installed on the desktop, disable all security programs temporarily (remember to re-enable them after the scan) and do the following:

Open Notepad and copy and paste the text in the code box below into it:


```
File::
C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe (or the renamed puppy.exe if you were asked to rename it).










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.


----------



## sarahmuriel (Feb 1, 2004)

ComboFix is running on my desktop, I am on my tablet. At the start ComboFix advised the desktop has a Root kit named Zero Access inserted on TCP/IP stack. Just to let you know, I remember that this is the same name that appeared when I ran CF by myself, I guess it was not fixed at the time. sarah


----------



## Cookiegal (Aug 27, 2003)

OK, thanks. I'll wait for the ComboFix log.


----------



## sarahmuriel (Feb 1, 2004)

So I deleted and downloaded Combofix, when it downloaded and ran the program automatically this is the log that came after telling me I had the Zero Access rootkit.

1st log

ComboFix 13-06-08.02 - all 06/11/2013 16:41:36.11.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.577 [GMT -4:00]
Running from: c:\documents and settings\all\Desktop\ComboFix.exe
AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ESET Personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
.
.
((((((((((((((((((((((((( Files Created from 2013-05-11 to 2013-06-11 )))))))))))))))))))))))))))))))
.
.
2013-06-09 21:37 . 2013-06-09 21:37	--------	d-----w-	C:\_OTS
2013-06-05 00:44 . 2013-06-05 00:42	144896	----a-w-	c:\windows\system32\javacpl.cpl
2013-06-05 00:44 . 2013-06-05 00:43	94112	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-05 00:42 . 2012-06-26 12:59	866720	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-06-05 00:42 . 2010-11-05 20:05	788896	----a-w-	c:\windows\system32\deployJava1.dll
2013-05-15 04:59 . 2012-03-31 09:15	692104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-05-15 04:59 . 2011-05-14 05:23	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-16 22:17 . 2004-08-04 20:00	920064	----a-w-	c:\windows\system32\wininet.dll
2013-04-16 22:17 . 2004-08-04 20:00	43520	------w-	c:\windows\system32\licmgr10.dll
2013-04-16 22:17 . 2004-08-04 20:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2013-04-12 23:28 . 2004-08-04 20:00	385024	------w-	c:\windows\system32\html.iec
2013-04-10 01:31 . 2004-08-04 20:00	1876352	----a-w- c:\windows\system32\win32k.sys
2012-04-10 17:21 . 2012-04-10 17:21	1263344	----a-w-	c:\program files\eset_smart_security_live_installer.exe
2010-08-29 15:32 . 2010-08-29 15:31	18862693	----a-w-	c:\program files\KoboSetup.exe
2010-08-29 15:23 . 2010-08-29 15:23	3760464	----a-w-	c:\program files\CuteWriter.exe
2010-08-19 22:08 . 2010-11-05 21:25	359656	----a-w-	c:\program files\msicuu2.exe
2010-01-24 19:09 . 2010-01-24 19:09	289584	----a-w-	c:\program files\uTorrent.exe
2009-11-11 06:06 . 2010-02-14 22:07	4787413	----a-w-	c:\program files\copistar_full.exe
2009-03-31 05:01 . 2010-05-30 23:13	401720	----a-w-	c:\program files\HiJackThis.exe
2007-08-09 02:07 . 2010-07-07 18:38	1578514	----a-w-	c:\program files\abcreb_setup.exe
2001-12-25 12:03 . 2010-08-29 16:48	249856	----a-w-	c:\program files\pelite.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2011-09-28 1937736]
.
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LTCM Client"="c:\program files\LTCM Client\ltcmClient.exe" [2009-08-05 1596096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-01-30 400480]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-03 847872]
"FileOpenBroker"="c:\program files\FileOpen\Services\FileOpenBroker32.exe" [2012-04-30 836480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2000-01-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2000-01-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2000-01-01 137752]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-01-31 295072]
"RTHDCPL"="RTHDCPL.EXE" [2000-01-01 20117136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-03-21 5078504]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2006-8-14 49152]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pulse Ambassador Update Setup for All Users]
2009-05-13 18:48	2768848	-c--a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\EpsonNet\\EpsonNet Setup\\tool10\\ENEasyApp.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5985:TCP"= 5985:TCP:*isabled:Windows Remote Management 
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/5/2010 6:20 AM 691696]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8/4/2011 9:20 AM 122240]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [5/14/2009 6:07 PM 759048]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 12:03 PM 169312]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [3/21/2013 3:19 PM 1341664]
R2 FileOpenManagerSvc;FileOpen Manager Service;c:\program files\FileOpen\Services\FileOpenManagerSvc32.exe [4/30/2012 7:56 PM 213888]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [11/29/2012 9:31 PM 38608]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [9/24/2012 3:55 PM 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [9/24/2012 3:58 PM 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [9/24/2012 3:59 PM 25704]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [10/7/2012 7:42 PM 1691480]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [4/23/2003 9:45 AM 16896]
S3 eBook;eBook;c:\windows\system32\drivers\eBook.sys [6/25/2005 11:35 AM 22072]
S3 fdrawcmd;Low-level Floppy Driver;c:\windows\system32\drivers\fdrawcmd.sys [9/27/2008 11:09 PM 27544]
S3 wdpnp;WinDriver USB Client;c:\windows\system32\drivers\wdpnp.sys [8/29/2010 1:14 PM 22748]
S4 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;"c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe" --> c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [?]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - FileOpenWebPublisherScreenHookDriver
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32	128512	------w-	c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 04:59]
.
2013-06-11 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 00:12]
.
2013-06-11 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-11 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchAssistant = 
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2010-08-28 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-11 17:08
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1196)
c:\windows\system32\igfxdev.dll
.
Completion time: 2013-06-11 17:32:27
ComboFix-quarantined-files.txt 2013-06-11 21:32
ComboFix2.txt 2013-05-12 19:16
ComboFix3.txt 2013-05-12 01:07
ComboFix4.txt 2013-02-07 22:11
ComboFix5.txt 2013-06-11 20:17
.
Pre-Run: 111,376,244,736 bytes free
Post-Run: 111,383,465,984 bytes free
.
- - End Of File - - BAD2F700BCE86775BC2E6CADC01B9577
8F558EB6672622401DA993E1E865C861

The I dragged the CFscriipt to the CF icon and let the program run again, again it told me it had found that root kit, and also I believe there must be something in the sound system as the Microsoft logo music sounds like a wobbly record
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log 2 after the drag file

ComboFix 13-06-08.02 - all 06/11/2013 18:24:55.12.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.569 [GMT -4:00]
Running from: c:\documents and settings\all\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\all\Desktop\CFScript.txt.txt
AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ESET Personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
FILE ::
"c:\documents and settings\all\Local Settings\Application Data\d1e682a2"
.
.
((((((((((((((((((((((((( Files Created from 2013-05-11 to 2013-06-11 )))))))))))))))))))))))))))))))
.
.
2013-06-09 21:37 . 2013-06-09 21:37	--------	d-----w-	C:\_OTS
2013-06-05 00:44 . 2013-06-05 00:42	144896	----a-w-	c:\windows\system32\javacpl.cpl
2013-06-05 00:44 . 2013-06-05 00:43	94112	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-05 00:42 . 2012-06-26 12:59	866720	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-06-05 00:42 . 2010-11-05 20:05	788896	----a-w-	c:\windows\system32\deployJava1.dll
2013-05-15 04:59 . 2012-03-31 09:15	692104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-05-15 04:59 . 2011-05-14 05:23	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-16 22:17 . 2004-08-04 20:00	920064	----a-w-	c:\windows\system32\wininet.dll
2013-04-16 22:17 . 2004-08-04 20:00	43520	------w-	c:\windows\system32\licmgr10.dll
2013-04-16 22:17 . 2004-08-04 20:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2013-04-12 23:28 . 2004-08-04 20:00	385024	------w-	c:\windows\system32\html.iec
2013-04-10 01:31 . 2004-08-04 20:00	1876352	----a-w-	c:\windows\system32\win32k.sys
2012-04-10 17:21 . 2012-04-10 17:21	1263344	----a-w-	c:\program files\eset_smart_security_live_installer.exe
2010-08-29 15:32 . 2010-08-29 15:31	18862693	----a-w-	c:\program files\KoboSetup.exe
2010-08-29 15:23 . 2010-08-29 15:23	3760464	----a-w-	c:\program files\CuteWriter.exe
2010-08-19 22:08 . 2010-11-05 21:25	359656	----a-w-	c:\program files\msicuu2.exe
2010-01-24 19:09 . 2010-01-24 19:09	289584	----a-w-	c:\program files\uTorrent.exe
2009-11-11 06:06 . 2010-02-14 22:07	4787413	----a-w-	c:\program files\copistar_full.exe
2009-03-31 05:01 . 2010-05-30 23:13	401720	----a-w-	c:\program files\HiJackThis.exe
2007-08-09 02:07 . 2010-07-07 18:38	1578514	----a-w-	c:\program files\abcreb_setup.exe
2001-12-25 12:03 . 2010-08-29 16:48	249856	----a-w-	c:\program files\pelite.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2011-09-28 1937736]
.
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LTCM Client"="c:\program files\LTCM Client\ltcmClient.exe" [2009-08-05 1596096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-01-30 400480]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-03 847872]
"FileOpenBroker"="c:\program files\FileOpen\Services\FileOpenBroker32.exe" [2012-04-30 836480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2000-01-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2000-01-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2000-01-01 137752]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-01-31 295072]
"RTHDCPL"="RTHDCPL.EXE" [2000-01-01 20117136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-03-21 5078504]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pulse Ambassador Update Setup for All Users]
2009-05-13 18:48	2768848	-c--a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\EpsonNet\\EpsonNet Setup\\tool10\\ENEasyApp.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5985:TCP"= 5985:TCP:*isabled:Windows Remote Management 
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/5/2010 6:20 AM 691696]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8/4/2011 9:20 AM 122240]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [5/14/2009 6:07 PM 759048]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 12:03 PM 169312]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [3/21/2013 3:19 PM 1341664]
R2 FileOpenManagerSvc;FileOpen Manager Service;c:\program files\FileOpen\Services\FileOpenManagerSvc32.exe [4/30/2012 7:56 PM 213888]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [11/29/2012 9:31 PM 38608]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [9/24/2012 3:55 PM 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [9/24/2012 3:58 PM 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [9/24/2012 3:59 PM 25704]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [10/7/2012 7:42 PM 1691480]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [4/23/2003 9:45 AM 16896]
S3 eBook;eBook;c:\windows\system32\drivers\eBook.sys [6/25/2005 11:35 AM 22072]
S3 fdrawcmd;Low-level Floppy Driver;c:\windows\system32\drivers\fdrawcmd.sys [9/27/2008 11:09 PM 27544]
S3 wdpnp;WinDriver USB Client;c:\windows\system32\drivers\wdpnp.sys [8/29/2010 1:14 PM 22748]
S4 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;"c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe" --> c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [?]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - FileOpenWebPublisherScreenHookDriver
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32	128512	------w-	c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 04:59]
.
2013-06-11 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 00:12]
.
2013-06-11 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-11 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchAssistant = 
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2010-08-28 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-11 18:48
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2013-06-11 19:08:44
ComboFix-quarantined-files.txt 2013-06-11 23:08
ComboFix2.txt 2013-06-11 21:32
ComboFix3.txt 2013-05-12 19:16
ComboFix4.txt 2013-05-12 01:07
ComboFix5.txt 2013-06-11 21:53
.
Pre-Run: 111,354,183,680 bytes free
Post-Run: 111,368,368,128 bytes free
.
- - End Of File - - 7D068902902F5FA308E5E1EA99B49AC0
8F558EB6672622401DA993E1E865C861

Sarah


----------



## Cookiegal (Aug 27, 2003)

Open Notepad and copy and paste the text in the code box below into it:


```
Folder::
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
Registry
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pulse Ambassador Update Setup for All Users]
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe (or the renamed puppy.exe if you were asked to rename it).










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply. Also, let me know if you still get that message from ComboFix about the ZeroAccess Rootkit please.

Please go to *VirusTotal* and upload the following file for scanning.

Click *Choose File*
Navigate to the following file then click *Open* 

```
c:\program files\copistar_full.exe
```

Click *Scan It*
If you get a message saying the file has already been analyzed click *Reanalyse file now*
Wait for the scan to finish and then copy and paste the URL from your browser address bar in your next reply please.

Please do the same for these other files as well and post all three URLs.

c:\program files\abcreb_setup.exe
c:\program files\pelite.exe


----------



## sarahmuriel (Feb 1, 2004)

From my tablet, running CF. FYI copistar is a program I purchased to copy or print for PDF, Epub and kindle. Perlite from my Ped Basic embroidery program, Ambassador Pulse is another of my embroidery programs. ABCREB is a program I have to convert files from, lest say a Epub file to an RB file for use in my different book readers. Sarah


----------



## Cookiegal (Aug 27, 2003)

OK, thanks for the clarification. I'll wait to see the ComboFix log when it's finished.


----------



## sarahmuriel (Feb 1, 2004)

Got the same reboot message of the Zero Access rootkit located on TCP/ip stack. Let me know if you still want to run the virus total after you see this log.

CF Log

ComboFix 13-06-08.02 - all 06/12/2013 12:05:40.13.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.568 [GMT -4:00]
Running from: c:\documents and settings\all\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\all\Desktop\CFScript.txt
AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ESET Personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4}
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\instance.dat
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\mia.lib
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788\BZR.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F\Ltclr15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F\Lfxpm15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F\Lffax15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788\ATRC.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F\Lfmsp15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F\Lfpct15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788\JIOL10.csy
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F\Ltimgclr15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F\Lttwn15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D\Ambassador.exe
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220\PmlOutBar.cfg
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788\JIOL10.cht
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788\JIOL10.fra
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F\Lfeps15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788\GenWin.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788\pml5gre.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F\Lftga15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F\Ltimgcor15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan DST.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan Z.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Brother.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy DST.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Melco.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Pfaff.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Renaissance.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\SWF.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima Chenille.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TBF.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMCE-100 Chenille.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMLH.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Toyota.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK Transport.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788\CDBrowserDLL.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F\Ltimgutl15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F\Ltkrn15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788\SETNG.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788\SEH10.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788\GGems.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788\THRD.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F\Lfpng15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788\TRCNV.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788\pml5fra.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788\Draw.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788\SCLI.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F\Lfiff15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788\JIOL10.gre
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F\Lfgif15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668\_Normal.style
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788\pml5esp.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788\DRTD.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D\Ambassador.DAT
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788\JIOL10.ptb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F\Lfcal15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220\license.txt
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788\PWCT.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788\ABU.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788\pml5deu.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220\pmlstate.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788\JIOL10.jpn
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788\pml5ita.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788\MULTT.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Ambassador.chm
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Readme.pdf
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788\pml5csy.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F\Lfacs15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788\cndcnv.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788\JIOL10.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788\SPath.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F\Lfbmp15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F\Ltfil15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D\Register.exe
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788\GenC.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F\Lfabi15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F\Lfdxf15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788\GenSC.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2\pedfile.ico
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220\pmlhky.xml
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788\BOXF.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788\Saurer.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788\pml5cht.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F\Lfcut15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220\pmlstate.def
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F\Pcdlib32.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788\GenIO.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F\Lvkrn15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788\SGNS.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788\ADIG.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788\JIOL10.chi
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788\IMF.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788\GenCnv.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220\diagnostics.txt
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788\sto.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788\STC.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 12.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 28.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 40.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 50.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\AutoCAD.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Country.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Flesh.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Burmilana.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Colorful.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 30.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 40.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isafil.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isalon.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 12.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 28.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 40.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 50.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother - Brother Embroidery.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Country.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Flesh.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Alcazar.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko USA Polyester.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default DMC - Rayon.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Durak - Visco 40.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Embroidery Warehouse - Colorful.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold - Poly.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Cotty.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Sulky.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Burmilana 12.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Classic 40.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Polyneon 40.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Sticku 30.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Toledo 60.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Marathon - Rayon.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #122 SBP-7.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #304-4.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #40E 600.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #70C Super Luster.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - SSR-7.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Rapos - Polyester.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Royal - Linhasoft.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Metallic Nailheads.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Swarovski.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\DefaultThreads.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Gunold - Poly.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Isalon.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Janome Palette.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_1.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_10.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_11.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_12.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_13.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_14.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_15.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_16.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_17.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_18.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_19.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_2.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Thread_20.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_21.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_22.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_3.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_4.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_5.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_6.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_7.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_8.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_9.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Viking Palette.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Metallic Nailheads.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Swarovski.tdb
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F\Lfmac15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788\IMP.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F\Ltdis15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2\pxffile.ico
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F\Lfpcd15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F\Lfimg15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220\Config.ini
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788\GenApp.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788\JIOL10.ita
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F\Lfica15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788\GenPat.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788\Crypt.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788\GenD.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23\libxml2.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D\FREE3OF9.TXT
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F\Lfpcl15u.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788\JIOL10.esp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788\PLeg.dll
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Basket Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige and Grey Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Leather.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Thatch.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Rubber.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Wavey Fabric.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown and Yellow Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Corduroy.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Fabric.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Honeycomb Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Leather.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown ZigZag.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Burgandy Fabric.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Basket.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Linen.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Grey Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Rose Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Speckled.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Vertical Sweater.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Fabric.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Flowers on Vertical Stripe.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Gold Velvet.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Green Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey and Brown Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Blinds.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Herring Bone.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Leather.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Linen.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Horizontal.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Narrow Corduroy.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Thick Corduroy.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Medium Brown Big Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Multi-Color Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Orange Weave.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Red Towel.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Rose Fabric.bmp
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.dat
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.lan
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.msi
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.par
c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.res
c:\windows\EventSystem.log
.
.
((((((((((((((((((((((((( Files Created from 2013-05-12 to 2013-06-12 )))))))))))))))))))))))))))))))
.
.
2013-06-09 21:37 . 2013-06-09 21:37	--------	d-----w-	C:\_OTS
2013-06-05 00:44 . 2013-06-05 00:42	144896	----a-w-	c:\windows\system32\javacpl.cpl
2013-06-05 00:44 . 2013-06-05 00:43	94112	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 07:59 . 2012-03-31 09:15	692104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-06-12 07:59 . 2011-05-14 05:23	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-05 00:42 . 2012-06-26 12:59	866720	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-06-05 00:42 . 2010-11-05 20:05	788896	----a-w-	c:\windows\system32\deployJava1.dll
2013-04-16 22:17 . 2004-08-04 20:00	920064	----a-w-	c:\windows\system32\wininet.dll
2013-04-16 22:17 . 2004-08-04 20:00	43520	------w-	c:\windows\system32\licmgr10.dll
2013-04-16 22:17 . 2004-08-04 20:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2013-04-12 23:28 . 2004-08-04 20:00	385024	------w-	c:\windows\system32\html.iec
2013-04-10 01:31 . 2004-08-04 20:00	1876352	----a-w-	c:\windows\system32\win32k.sys
2012-04-10 17:21 . 2012-04-10 17:21	1263344	----a-w-	c:\program files\eset_smart_security_live_installer.exe
2010-08-29 15:32 . 2010-08-29 15:31	18862693	----a-w-	c:\program files\KoboSetup.exe
2010-08-29 15:23 . 2010-08-29 15:23	3760464	----a-w-	c:\program files\CuteWriter.exe
2010-08-19 22:08 . 2010-11-05 21:25	359656	----a-w-	c:\program files\msicuu2.exe
2010-01-24 19:09 . 2010-01-24 19:09	289584	----a-w-	c:\program files\uTorrent.exe
2009-11-11 06:06 . 2010-02-14 22:07	4787413	----a-w-	c:\program files\copistar_full.exe
2009-03-31 05:01 . 2010-05-30 23:13	401720	----a-w-	c:\program files\HiJackThis.exe
2007-08-09 02:07 . 2010-07-07 18:38	1578514	----a-w-	c:\program files\abcreb_setup.exe
2001-12-25 12:03 . 2010-08-29 16:48	249856	----a-w-	c:\program files\pelite.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2011-09-28 1937736]
.
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LTCM Client"="c:\program files\LTCM Client\ltcmClient.exe" [2009-08-05 1596096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-01-30 400480]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-03 847872]
"FileOpenBroker"="c:\program files\FileOpen\Services\FileOpenBroker32.exe" [2012-04-30 836480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2000-01-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2000-01-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2000-01-01 137752]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-01-31 295072]
"RTHDCPL"="RTHDCPL.EXE" [2000-01-01 20117136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-03-21 5078504]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2006-8-14 49152]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\EpsonNet\\EpsonNet Setup\\tool10\\ENEasyApp.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5985:TCP"= 5985:TCP:*isabled:Windows Remote Management 
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/5/2010 6:20 AM 691696]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8/4/2011 9:20 AM 122240]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [5/14/2009 6:07 PM 759048]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 12:03 PM 169312]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [3/21/2013 3:19 PM 1341664]
R2 FileOpenManagerSvc;FileOpen Manager Service;c:\program files\FileOpen\Services\FileOpenManagerSvc32.exe [4/30/2012 7:56 PM 213888]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [11/29/2012 9:31 PM 38608]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [9/24/2012 3:55 PM 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [9/24/2012 3:58 PM 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [9/24/2012 3:59 PM 25704]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [10/7/2012 7:42 PM 1691480]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [4/23/2003 9:45 AM 16896]
S3 eBook;eBook;c:\windows\system32\drivers\eBook.sys [6/25/2005 11:35 AM 22072]
S3 fdrawcmd;Low-level Floppy Driver;c:\windows\system32\drivers\fdrawcmd.sys [9/27/2008 11:09 PM 27544]
S3 wdpnp;WinDriver USB Client;c:\windows\system32\drivers\wdpnp.sys [8/29/2010 1:14 PM 22748]
S4 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;"c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe" --> c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [?]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - FileOpenWebPublisherScreenHookDriver
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32	128512	------w-	c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 07:59]
.
2013-06-12 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 00:12]
.
2013-06-12 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-12 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchAssistant = 
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2010-08-28 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Pulse Ambassador Update Setup for All Users - c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
AddRemove-Pulse Ambassador - c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
AddRemove-{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4} - c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-12 12:33
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1196)
c:\windows\system32\igfxdev.dll
.
Completion time: 2013-06-12 12:53:44
ComboFix-quarantined-files.txt 2013-06-12 16:53
ComboFix2.txt 2013-06-11 23:08
ComboFix3.txt 2013-06-11 21:32
ComboFix4.txt 2013-05-12 19:16
ComboFix5.txt 2013-06-12 15:44
.
Pre-Run: 111,325,233,152 bytes free
Post-Run: 111,281,950,720 bytes free
.
- - End Of File - - 56A4C2833814C474A7354154C3A08570
8F558EB6672622401DA993E1E865C861


----------



## Cookiegal (Aug 27, 2003)

Please navigate to the following file, open it in Notepad and copy/paste the contents here.

C:\Qoobox\*ComboFix-quarantined-files.txt*


----------



## sarahmuriel (Feb 1, 2004)

Sorry, but where do I paste the contents too?


----------



## Cookiegal (Aug 27, 2003)

Into a reply here.


----------



## sarahmuriel (Feb 1, 2004)

CF quarantined files 

2013-06-12 16:51:42 . 2013-06-12 16:51:42 1,858 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4}.reg.dat
2013-06-12 16:51:41 . 2013-06-12 16:51:41 1,692 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Pulse Ambassador.reg.dat
2013-06-12 16:36:36 . 2013-06-12 16:36:36 896 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Pulse Ambassador Update Setup for All Users.reg.dat
2013-06-11 22:24:44 . 2013-06-12 16:05:30 0 ----a-w- C:\Qoobox\Quarantine\catchme.txt
2013-06-11 20:26:19 . 2013-06-12 15:51:32 512 ----a-w- C:\Qoobox\Quarantine\MBR_HardDisk0.mbr
2013-04-01 17:58:00 . 2013-04-01 17:58:01 902 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\EventSystem.log.vir
2013-01-31 17:11:53 . 2013-06-12 16:19:43 6,292 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2013-01-31 16:33:34 . 2013-06-12 16:03:07 816 ----a-w- C:\Qoobox\Quarantine\catchme.log
2012-07-22 14:46:52 . 2012-07-22 14:46:53 16,883,056 ----a-w- C:\Qoobox\Quarantine\C\IE8-WI~1.EXE.vir
2012-01-17 03:01:31 . 2012-01-17 03:04:52 941 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\all\Application Data\a3a47e80.vir
2012-01-17 03:01:31 . 2012-01-17 03:04:52 987 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\ffb54aa1.vir
2010-09-09 16:43:43 . 2010-09-13 19:45:02 787 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\wininit.ini.vir
2010-08-29 01:25:36 . 2010-08-29 01:25:36 98 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\instance.dat.vir
2010-08-29 01:25:36 . 2009-05-13 18:48:06 579,156 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\mia.lib.vir
2010-08-29 01:25:36 . 2010-08-29 01:26:07 2,801 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.dat.vir
2010-08-29 01:25:36 . 2010-08-29 01:25:36 9 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.lan.vir
2010-08-29 01:25:36 . 2010-08-29 01:25:36 17,714 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.par.vir
2010-08-29 01:25:36 . 2009-05-13 18:48:05 364,544 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.msi.vir
2010-08-29 01:25:36 . 2009-05-13 18:48:12 7,964,683 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.res.vir
2010-08-29 01:25:36 . 2009-05-13 18:48:08 2,768,848 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe.vir
2010-08-29 01:25:36 . 2010-08-29 01:25:36 0 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4}.vir
2010-08-29 01:25:01 . 2010-08-29 01:25:01 0 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}.vir
2010-08-29 01:23:25 . 1998-09-01 11:50:00 0 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220\diagnostics.txt.vir
2010-08-29 01:23:25 . 2001-08-21 15:41:38 2,700 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_7.tdb.vir
2010-08-29 01:23:25 . 2003-06-13 18:49:46 21,460 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_8.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:46:42 17,896 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_9.tdb.vir
2010-08-29 01:23:25 . 2009-02-23 12:25:22 1,565 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Viking Palette.tdb.vir
2010-08-29 01:23:25 . 2006-11-09 21:51:00 1,391 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Metallic Nailheads.tdb.vir
2010-08-29 01:23:25 . 2006-11-09 21:40:44 2,840 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Swarovski.tdb.vir
2010-08-29 01:23:25 . 2003-06-13 18:26:54 22,105 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_21.tdb.vir
2010-08-29 01:23:25 . 2003-09-11 19:06:18 19,989 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_22.tdb.vir
2010-08-29 01:23:25 . 2002-08-01 19:25:02 17,809 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_3.tdb.vir
2010-08-29 01:23:25 . 2003-03-16 20:08:08 25,662 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_4.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:40:54 1,835 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_5.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:41:18 1,779 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_6.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:51:42 12,573 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_17.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:52:22 28,187 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_18.tdb.vir
2010-08-29 01:23:25 . 2002-10-21 12:35:00 16,548 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_19.tdb.vir
2010-08-29 01:23:25 . 2007-09-11 20:06:14 19,934 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_2.tdb.vir
2010-08-29 01:23:25 . 2002-08-01 16:26:06 15,008 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Thread_20.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:48:14 8,004 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_10.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:48:32 3,930 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_11.tdb.vir
2010-08-29 01:23:25 . 2008-04-23 20:32:50 18,584 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_12.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:49:40 11,453 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_13.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:49:58 5,780 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_14.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:50:50 4,827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_15.tdb.vir
2010-08-29 01:23:25 . 2004-02-12 23:09:46 20,414 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_16.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:45:42 717 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Rapos - Polyester.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:45:52 883 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Royal - Linhasoft.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:46:04 877 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Metallic Nailheads.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:46:14 910 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Swarovski.tdb.vir
2010-08-29 01:23:25 . 2003-09-12 15:36:36 812 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\DefaultThreads.tdb.vir
2010-08-29 01:23:25 . 2006-04-18 20:33:06 14,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Gunold - Poly.tdb.vir
2010-08-29 01:23:25 . 2004-09-30 16:17:14 17,662 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Isalon.tdb.vir
2010-08-29 01:23:25 . 2009-02-23 12:26:04 4,246 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Janome Palette.tdb.vir
2010-08-29 01:23:25 . 1998-09-01 12:50:00 571 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.tdb.vir
2010-08-29 01:23:25 . 2007-09-11 19:40:06 1,785 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_1.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:44:14 949 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Sticku 30.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:44:28 948 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Toledo 60.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:44:38 685 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Marathon - Rayon.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:45:08 873 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #122 SBP-7.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:45:20 785 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #304-4.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:44:48 792 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #40E 600.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:44:58 930 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #70C Super Luster.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:45:30 761 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - SSR-7.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:42:42 748 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default DMC - Rayon.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:42:52 888 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Durak - Visco 40.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:43:04 880 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Embroidery Warehouse - Colorful.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:43:22 979 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Cotty.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:43:32 988 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Sulky.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:43:12 748 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold - Poly.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:43:42 851 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Burmilana 12.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:43:52 816 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Classic 40.tdb.vir
2010-08-29 01:23:25 . 2008-04-23 19:21:42 829 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Polyneon 40.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:41:06 827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 28.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:41:16 827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 40.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:41:28 827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 50.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:41:38 735 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother - Brother Embroidery.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:41:50 865 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Country.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:42:00 661 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Flesh.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:42:12 891 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Alcazar.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:42:22 1,183 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko USA Polyester.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:42:32 836 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko.tdb.vir
2010-08-29 01:23:25 . 2006-09-27 20:42:18 11,645 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\AutoCAD.tdb.vir
2010-08-29 01:23:25 . 2005-09-14 14:38:18 3,435 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Country.tdb.vir
2010-08-29 01:23:25 . 2009-02-23 12:18:50 613 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Flesh.tdb.vir
2010-08-29 01:23:25 . 2009-04-29 11:26:37 3,146 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother.tdb.vir
2010-08-29 01:23:25 . 2007-09-11 18:39:10 6,681 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Burmilana.tdb.vir
2010-08-29 01:23:25 . 2004-09-15 21:35:36 11,937 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Colorful.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:40:14 988 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 30.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:40:24 980 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 40.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:40:38 813 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isafil.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:40:48 653 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isalon.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:40:56 827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 12.tdb.vir
2010-08-29 01:23:25 . 2007-04-30 14:13:24 650 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668\_Normal.style.vir
2010-08-29 01:23:25 . 2005-02-04 08:07:12 11,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 12.tdb.vir
2010-08-29 01:23:25 . 2005-02-04 08:07:10 11,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 28.tdb.vir
2010-08-29 01:23:25 . 2005-02-04 08:07:10 11,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 40.tdb.vir
2010-08-29 01:23:25 . 2005-02-04 08:07:10 11,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 50.tdb.vir
2010-08-29 01:23:24 . 2009-05-13 17:27:52 34,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788\JIOL10.ptb.vir
2010-08-29 01:23:24 . 2009-05-13 17:23:21 35,600 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788\JIOL10.fra.vir
2010-08-29 01:23:24 . 2009-05-13 17:25:09 34,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788\JIOL10.gre.vir
2010-08-29 01:23:24 . 2009-05-13 17:26:59 26,384 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788\JIOL10.jpn.vir
2010-08-29 01:23:24 . 2009-05-13 17:26:04 34,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788\JIOL10.ita.vir
2010-08-29 01:23:24 . 2009-05-13 16:24:29 44,608 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D\Ambassador.DAT.vir
2010-08-29 01:23:24 . 2009-05-13 17:29:45 35,088 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788\JIOL10.esp.vir
2010-08-29 01:23:24 . 2009-05-13 17:21:04 32,528 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788\JIOL10.csy.vir
2010-08-29 01:23:24 . 2005-01-15 19:44:44 1,852 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220\PmlOutBar.cfg.vir
2010-08-29 01:23:24 . 2009-05-13 17:20:03 25,360 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788\JIOL10.cht.vir
2010-08-29 01:23:24 . 2009-05-13 17:18:51 24,848 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788\JIOL10.chi.vir
2010-08-29 01:23:24 . 2009-04-06 21:40:18 96,528 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788\THRD.dll.vir
2010-08-29 01:23:24 . 2009-04-06 21:50:38 24,336 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788\TRCNV.dll.vir
2010-08-29 01:23:24 . 2009-05-13 15:48:24 228,624 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788\sto.dll.vir
2010-08-29 01:23:24 . 2009-04-06 21:41:39 170,256 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788\STC.dll.vir
2010-08-29 01:23:24 . 2009-04-28 00:56:34 630,032 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788\SPath.dll.vir
2010-08-29 01:23:24 . 2009-04-06 21:44:03 130,832 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788\SGNS.dll.vir
2010-08-29 01:23:23 . 2009-05-13 15:39:34 1,195,792 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788\SETNG.dll.vir
2010-08-29 01:23:23 . 2009-04-06 21:54:17 26,384 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788\SEH10.dll.vir
2010-08-29 01:23:23 . 2009-05-13 15:52:06 3,301,648 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788\SCLI.dll.vir
2010-08-29 01:23:23 . 2009-05-04 21:18:38 91,920 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788\Saurer.dll.vir
2010-08-29 01:23:23 . 2009-04-06 21:45:17 21,776 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788\PWCT.dll.vir
2010-08-29 01:23:22 . 2009-05-13 17:26:19 4,963,088 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788\pml5ita.dll.vir
2010-08-29 01:23:22 . 2009-05-13 17:25:24 4,960,528 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788\pml5gre.dll.vir
2010-08-29 01:23:20 . 2009-05-13 17:23:36 4,977,936 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788\pml5fra.dll.vir
2010-08-29 01:23:20 . 2009-05-13 17:30:07 4,977,424 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788\pml5esp.dll.vir
2010-08-29 01:23:20 . 2009-05-13 17:24:29 4,965,136 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788\pml5deu.dll.vir
2010-08-29 01:23:20 . 2009-05-13 17:21:32 4,935,952 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788\pml5csy.dll.vir
2010-08-29 01:23:19 . 2009-05-13 17:20:20 4,815,632 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788\pml5cht.dll.vir
2010-08-29 01:23:19 . 2009-05-13 15:47:33 231,696 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788\PLeg.dll.vir
2010-08-29 01:23:19 . 2008-06-12 20:00:36 217,864 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F\Pcdlib32.dll.vir
2010-08-29 01:23:19 . 2009-04-06 21:38:49 57,616 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788\MULTT.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:36 117,904 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F\Lttwn15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:38 248,976 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F\Lvkrn15u.dll.vir
2010-08-29 01:23:19 . 2007-01-11 22:27:50 482,448 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F\Ltkrn15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:32 117,904 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F\Ltimgutl15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:30 212,112 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F\Ltimgclr15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:30 302,224 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F\Ltimgcor15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:29:56 150,672 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F\Ltfil15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:29:56 261,264 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F\Ltdis15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:24 1,711,248 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F\Ltclr15u.dll.vir
2010-08-29 01:23:17 . 2008-03-14 16:40:57 512,264 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23\libxml2.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:24 27,792 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F\Lfxpm15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:20 18,064 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F\Lftga15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:14 64,656 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F\Lfpct15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:14 126,096 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F\Lfpng15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:12 13,968 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F\Lfmsp15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:12 13,456 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F\Lfmac15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:12 17,552 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F\Lfpcd15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:12 97,424 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F\Lfpcl15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:10 22,160 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F\Lfiff15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:10 14,992 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F\Lfimg15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:08 29,840 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F\Lfica15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:08 32,912 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F\Lfgif15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:29:52 97,424 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F\Lffax15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:06 25,232 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F\Lfeps15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:06 146,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F\Lfdxf15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:04 14,992 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F\Lfcut15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:02 24,720 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F\Lfcal15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:02 24,720 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F\Lfbmp15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:00 48,272 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F\Lfacs15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:00 21,648 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F\Lfabi15u.dll.vir
2010-08-29 01:23:17 . 2009-02-13 01:08:54 35,600 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788\JIOL10.dll.vir
2010-08-29 01:23:17 . 2009-04-06 21:49:14 36,624 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788\IMF.dll.vir
2010-08-29 01:23:17 . 2009-04-06 21:48:50 57,104 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788\IMP.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:39:31 28,432 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788\GGems.dll.vir
2010-08-29 01:23:16 . 2009-05-11 21:05:49 936,720 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788\GenWin.dll.vir
2010-08-29 01:23:16 . 2009-05-13 15:49:06 551,696 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788\GenSC.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:43:17 313,616 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788\GenPat.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:39:19 354,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788\GenIO.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:41:56 250,128 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788\GenD.dll.vir
2010-08-29 01:23:16 . 2009-05-13 15:38:18 369,936 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788\GenCnv.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:41:04 352,528 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788\GenC.dll.vir
2010-08-29 01:23:16 . 2009-05-11 21:03:38 297,744 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788\GenApp.dll.vir
2010-08-29 01:23:16 . 2009-05-13 15:40:24 86,800 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788\DRTD.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:44:08 162,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788\Draw.dll.vir
2010-08-29 01:23:16 . 2009-02-13 00:38:43 19,728 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788\Crypt.dll.vir
2010-08-29 01:23:16 . 2009-05-13 15:55:59 63,760 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788\cndcnv.dll.vir
2010-08-29 01:23:15 . 2009-04-06 22:12:35 483,088 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788\CDBrowserDLL.dll.vir
2010-08-29 01:23:15 . 2009-04-06 21:40:04 403,216 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788\BZR.dll.vir
2010-08-29 01:23:15 . 2009-04-06 21:48:57 146,192 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788\ATRC.dll.vir
2010-08-29 01:23:15 . 2009-04-06 21:41:22 81,680 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788\BOXF.dll.vir
2010-08-29 01:23:15 . 2009-05-13 15:48:56 157,456 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788\ADIG.dll.vir
2010-08-29 01:23:15 . 2009-04-06 21:48:23 676,624 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788\ABU.dll.vir
2010-08-29 01:23:15 . 2009-04-06 22:14:22 63,248 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D\Register.exe.vir
2010-08-29 01:23:12 . 2009-05-13 16:24:27 11,411,216 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D\Ambassador.exe.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,260 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,258 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Toyota.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,272 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK Transport.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,262 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK.ini.vir
2010-08-29 01:23:12 . 2009-04-13 16:57:54 70,339 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Readme.pdf.vir
2010-08-29 01:23:12 . 2007-05-08 19:34:38 1,983 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,255 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Pfaff.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,265 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Renaissance.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,258 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\SWF.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,268 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima Chenille.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,264 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TBF.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,276 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMCE-100 Chenille.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,265 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMLH.ini.vir
2010-08-29 01:23:12 . 2009-02-06 18:57:49 3,856 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220\pmlstate.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,261 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Brother.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,263 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy DST.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,259 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,257 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Melco.ini.vir
2010-08-29 01:23:12 . 2007-02-20 16:38:27 14 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220\Config.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,264 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan DST.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,259 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan Z.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,257 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan.ini.vir
2010-08-29 01:23:12 . 2008-10-10 20:44:14 45,091 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220\license.txt.vir
2010-08-29 01:23:12 . 2004-02-15 01:21:38 2,920 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D\FREE3OF9.TXT.vir
2010-08-29 01:23:12 . 2007-01-04 16:40:58 776 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220\pmlhky.xml.vir
2010-08-29 01:23:12 . 2009-02-06 18:58:23 3,856 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220\pmlstate.def.vir
2010-08-29 01:23:12 . 2008-09-18 20:45:20 285,478 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2\pxffile.ico.vir
2010-08-29 01:23:12 . 2008-07-15 22:05:24 1,078 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2\pedfile.ico.vir
2010-08-29 01:23:12 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Orange Weave.bmp.vir
2010-08-29 01:23:12 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Red Towel.bmp.vir
2010-08-29 01:23:12 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Rose Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Thick Corduroy.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 83,855 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Medium Brown Big Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Multi-Color Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Linen.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Horizontal.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Narrow Corduroy.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 9,363 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Herring Bone.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Leather.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Green Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey and Brown Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 352,106 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Blinds.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Flowers on Vertical Stripe.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Gold Velvet.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Speckled.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Vertical Sweater.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Basket.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Linen.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Grey Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Rose Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Leather.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown ZigZag.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Burgandy Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Corduroy.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Honeycomb Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Rubber.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Wavey Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown and Yellow Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Basket Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige and Grey Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 17,462 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Leather.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Thatch.bmp.vir
2010-08-29 01:23:11 . 2007-08-29 12:42:16 387,392 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Ambassador.chm.vir
2004-08-03 22:59:02 . 2012-04-11 12:35:51 2,026,496 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_000012_.tmp.dll.vir
2004-08-03 22:59:02 . 2011-10-25 12:52:02 2,027,008 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_000013_.tmp.dll.vir
2003-02-21 09:16:08 . 2003-02-21 09:16:08 49,152 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\URTTemp\regtlib.exe.vir


----------



## Cookiegal (Aug 27, 2003)

When doing my research I saw where the Pulse Ambassador program has been flagged as suspicious and there wasn't much information on it verifying that it was legitimate so I gave a command to remove a directory with ComboFix. I'm not sure if they're all needed though. Can you tell me if the program works?


----------



## sarahmuriel (Feb 1, 2004)

No, the program does not work but I can download it again, as it is a free program
http://www.hirschinternational.com/...olutions/Tajima-DGML-by-Pulse/Ambassador.aspx

If I download it again will the commands you have entered affect it if I download it again?

Sarah


----------



## Cookiegal (Aug 27, 2003)

I'm sorry about that. Let's try restoring it using ComboFix first and if that doesn't work then you can redownload it. The commands won't do anything as long as we don't run those ones again. 

This is a command to restore the directory all of the files were in. This time, ComboFix will not do a full scan, it will just restore the directory.

Open Notepad and copy and paste the text in the code box below into it:


```
DEQUARANTINE::
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
QUIT::
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe (or the renamed puppy.exe if you were asked to rename it).










This will start ComboFix again. It may ask to reboot. Post the contents of DeQuarantine.txt in your next reply.


----------



## sarahmuriel (Feb 1, 2004)

Well as CF found the Zero Access rootkit,it ran the whole program and created a De-quarantine log. The program still wont run a get a message saying that ADIG.dll is not found and to reinstall the program. Also when I tried to bring up Firefox-IE after running CF and the restart I was not able to connect to the internet. Turn the computer off and then started it and that took care of that problem. 

Dequarantine files 

C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\instance.dat -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\instance.dat
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\mia.lib -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\mia.lib
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.dat -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.dat
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.lan -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.lan
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.msi -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.msi
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.par -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.par
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.res -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.res
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4} -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4}
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\{A91C477B-655B-4FEA-8B8E-CC6820970F3A} -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788\BZR.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788\BZR.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F\Ltclr15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F\Ltclr15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F\Lfxpm15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F\Lfxpm15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F\Lffax15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F\Lffax15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788\ATRC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788\ATRC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F\Lfmsp15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F\Lfmsp15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F\Lfpct15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F\Lfpct15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788\JIOL10.csy -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788\JIOL10.csy
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F\Ltimgclr15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F\Ltimgclr15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F\Lttwn15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F\Lttwn15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D\Ambassador.exe -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D\Ambassador.exe
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220\PmlOutBar.cfg -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220\PmlOutBar.cfg
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788\JIOL10.cht -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788\JIOL10.cht
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788\JIOL10.fra -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788\JIOL10.fra
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F\Lfeps15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F\Lfeps15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788\GenWin.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788\GenWin.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788\pml5gre.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788\pml5gre.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F\Lftga15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F\Lftga15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F\Ltimgcor15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F\Ltimgcor15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan DST.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan DST.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan Z.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan Z.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Brother.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Brother.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy DST.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy DST.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Melco.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Melco.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Pfaff.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Pfaff.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Renaissance.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Renaissance.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\SWF.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\SWF.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima Chenille.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima Chenille.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TBF.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TBF.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMCE-100 Chenille.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMCE-100 Chenille.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMLH.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMLH.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Toyota.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Toyota.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK Transport.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK Transport.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788\CDBrowserDLL.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788\CDBrowserDLL.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F\Ltimgutl15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F\Ltimgutl15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F\Ltkrn15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F\Ltkrn15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788\SETNG.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788\SETNG.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788\SEH10.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788\SEH10.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788\GGems.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788\GGems.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788\THRD.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788\THRD.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F\Lfpng15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F\Lfpng15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788\TRCNV.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788\TRCNV.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788\pml5fra.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788\pml5fra.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788\Draw.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788\Draw.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788\SCLI.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788\SCLI.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F\Lfiff15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F\Lfiff15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788\JIOL10.gre -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788\JIOL10.gre
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F\Lfgif15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F\Lfgif15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668\_Normal.style -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668\_Normal.style
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788\pml5esp.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788\pml5esp.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788\DRTD.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788\DRTD.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D\Ambassador.DAT -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D\Ambassador.DAT
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788\JIOL10.ptb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788\JIOL10.ptb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F\Lfcal15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F\Lfcal15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220\license.txt -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220\license.txt
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788\PWCT.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788\PWCT.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788\ABU.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788\ABU.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788\pml5deu.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788\pml5deu.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220\pmlstate.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220\pmlstate.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788\JIOL10.jpn -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788\JIOL10.jpn
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788\pml5ita.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788\pml5ita.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788\MULTT.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788\MULTT.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Ambassador.chm -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Ambassador.chm
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Readme.pdf -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Readme.pdf
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788\pml5csy.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788\pml5csy.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F\Lfacs15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F\Lfacs15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788\cndcnv.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788\cndcnv.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788\JIOL10.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788\JIOL10.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788\SPath.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788\SPath.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F\Lfbmp15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F\Lfbmp15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F\Ltfil15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F\Ltfil15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D\Register.exe -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D\Register.exe
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788\GenC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788\GenC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F\Lfabi15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F\Lfabi15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F\Lfdxf15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F\Lfdxf15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788\GenSC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788\GenSC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2\pedfile.ico -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2\pedfile.ico
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220\pmlhky.xml -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220\pmlhky.xml
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788\BOXF.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788\BOXF.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788\Saurer.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788\Saurer.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788\pml5cht.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788\pml5cht.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F\Lfcut15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F\Lfcut15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220\pmlstate.def -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220\pmlstate.def
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F\Pcdlib32.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F\Pcdlib32.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788\GenIO.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788\GenIO.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F\Lvkrn15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F\Lvkrn15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788\SGNS.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788\SGNS.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788\ADIG.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788\ADIG.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788\JIOL10.chi -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788\JIOL10.chi
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788\IMF.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788\IMF.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788\GenCnv.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788\GenCnv.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220\diagnostics.txt -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220\diagnostics.txt
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788\sto.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788\sto.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788\STC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788\STC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 28.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 28.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 50.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 50.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\AutoCAD.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\AutoCAD.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Country.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Country.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Flesh.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Flesh.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Burmilana.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Burmilana.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Colorful.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Colorful.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 30.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 30.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isafil.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isafil.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isalon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isalon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 28.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 28.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 50.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 50.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother - Brother Embroidery.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother - Brother Embroidery.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Country.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Country.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Flesh.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Flesh.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Alcazar.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Alcazar.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko USA Polyester.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko USA Polyester.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default DMC - Rayon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default DMC - Rayon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Durak - Visco 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Durak - Visco 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Embroidery Warehouse - Colorful.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Embroidery Warehouse - Colorful.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Cotty.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Cotty.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Sulky.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Sulky.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold - Poly.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold - Poly.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Burmilana 12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Burmilana 12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Classic 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Classic 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Polyneon 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Polyneon 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Sticku 30.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Sticku 30.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Toledo 60.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Toledo 60.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Marathon - Rayon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Marathon - Rayon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #122 SBP-7.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #122 SBP-7.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #304-4.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #304-4.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #40E 600.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #40E 600.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #70C Super Luster.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #70C Super Luster.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - SSR-7.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - SSR-7.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Rapos - Polyester.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Rapos - Polyester.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Royal - Linhasoft.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Royal - Linhasoft.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Metallic Nailheads.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Metallic Nailheads.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Swarovski.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Swarovski.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\DefaultThreads.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\DefaultThreads.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Gunold - Poly.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Gunold - Poly.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Isalon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Isalon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Janome Palette.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Janome Palette.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_1.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_1.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_10.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_10.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_11.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_11.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_13.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_13.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_14.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_14.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_15.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_15.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_16.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_16.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_17.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_17.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_18.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_18.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_19.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_19.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_2.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_2.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Thread_20.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Thread_20.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_21.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_21.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_22.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_22.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_3.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_3.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_4.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_4.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_5.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_5.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_6.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_6.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_7.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_7.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_8.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_8.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_9.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_9.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Viking Palette.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Viking Palette.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Metallic Nailheads.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Metallic Nailheads.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Swarovski.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Swarovski.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F\Lfmac15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F\Lfmac15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788\IMP.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788\IMP.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F\Ltdis15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F\Ltdis15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2\pxffile.ico -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2\pxffile.ico
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F\Lfpcd15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F\Lfpcd15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F\Lfimg15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F\Lfimg15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220\Config.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220\Config.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788\GenApp.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788\GenApp.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788\JIOL10.ita -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788\JIOL10.ita
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F\Lfica15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F\Lfica15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788\GenPat.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788\GenPat.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788\Crypt.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788\Crypt.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788\GenD.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788\GenD.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23\libxml2.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23\libxml2.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D\FREE3OF9.TXT -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D\FREE3OF9.TXT
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F\Lfpcl15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F\Lfpcl15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788\JIOL10.esp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788\JIOL10.esp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788\PLeg.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788\PLeg.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Basket Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Basket Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige and Grey Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige and Grey Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Leather.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Leather.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Thatch.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Thatch.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Rubber.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Rubber.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Wavey Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Wavey Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown and Yellow Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown and Yellow Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Corduroy.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Corduroy.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Honeycomb Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Honeycomb Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Leather.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Leather.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown ZigZag.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown ZigZag.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Burgandy Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Burgandy Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Basket.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Basket.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Linen.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Linen.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Grey Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Grey Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Rose Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Rose Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Speckled.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Speckled.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Vertical Sweater.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Vertical Sweater.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Flowers on Vertical Stripe.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Flowers on Vertical Stripe.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Gold Velvet.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Gold Velvet.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Green Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Green Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey and Brown Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey and Brown Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Blinds.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Blinds.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Herring Bone.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Herring Bone.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Leather.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Leather.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Linen.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Linen.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Horizontal.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Horizontal.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Narrow Corduroy.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Narrow Corduroy.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Thick Corduroy.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Thick Corduroy.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Medium Brown Big Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Medium Brown Big Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Multi-Color Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Multi-Color Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Orange Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Orange Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Red Towel.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Red Towel.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Rose Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Rose Fabric.bmp
239 File(s) copied

Sarah


----------



## Cookiegal (Aug 27, 2003)

You have an emulator program that may be causing a false detection of a rootkit so we're going t run this program to disable its drivers temporarily.

Please download *DeFogger* to your *desktop*.

Double click *DeFogger* to run the tool.
The application window will appear
Click the *Disable* button to disable your CD Emulation drivers
Click *Yes* to continue
A *'Finished!'* message will appear
Click *OK*
DeFogger will now ask to reboot the machine - click *OK*
*IMPORTANT!* If you receive an error message while running DeFogger, please post the log *defogger_disable* which will appear on your desktop.

*Do not* re-enable these drivers until otherwise instructed.

Make sure a reboot was done after running Defogger then please run a regular scan with ComboFix (disable your security programs first) and let me know if you still get that message.

Also, please post the C:\Qoobox\ComboFix-quarantined-files.txt log again. The log was so lengthy I thought there may be some things that didn't get restored on the first try.

I'll be signing off for the night in a few minutes so we can continue this tomorrow.


----------



## sarahmuriel (Feb 1, 2004)

PS perhaps the Scotty programs held backthe reinstall. I had requested to turn the computer off to restart to solve the internet issue and then scotty was asking if to allow or not something other but the computer was already turning off. I have pulled up the scotty recent files, to see if I can identify the message. it said it is missing ADIG.dll but nothing like that is mentioned on the Scotty recent files. Just trying to help.....
Sarah


----------



## Cookiegal (Aug 27, 2003)

OK, please carry out the instructions and I'll see what else we can do in the morning.


----------



## sarahmuriel (Feb 1, 2004)

Ran Defogger

Log

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:53 on 12/06/2013 (all)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)

-=E.O.F=-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ran Combofix right after the Defogger restart and the same message about Zero Access came up and it ran the whole program to try to get rid of it

CF Log

ComboFix 13-06-08.02 - all 06/12/2013 22:29:12.14.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.567 [GMT -4:00]
Running from: c:\documents and settings\all\Desktop\ComboFix.exe
AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ESET Personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
.
((((((((((((((((((((((((( Files Created from 2013-05-13 to 2013-06-13 )))))))))))))))))))))))))))))))
.
.
2013-06-13 00:40 . 2013-06-13 00:41	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
2013-06-09 21:37 . 2013-06-09 21:37	--------	d-----w-	C:\_OTS
2013-06-05 00:44 . 2013-06-05 00:42	144896	----a-w-	c:\windows\system32\javacpl.cpl
2013-06-05 00:44 . 2013-06-05 00:43	94112	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 07:59 . 2012-03-31 09:15	692104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-06-12 07:59 . 2011-05-14 05:23	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-05 00:42 . 2012-06-26 12:59	866720	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-06-05 00:42 . 2010-11-05 20:05	788896	----a-w-	c:\windows\system32\deployJava1.dll
2013-05-07 22:30 . 2004-08-04 20:00	920064	----a-w-	c:\windows\system32\wininet.dll
2013-05-07 22:30 . 2004-08-04 20:00	43520	------w-	c:\windows\system32\licmgr10.dll
2013-05-07 22:30 . 2004-08-04 20:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2013-05-07 21:53 . 2004-08-04 20:00	385024	------w-	c:\windows\system32\html.iec
2013-05-03 01:30 . 2004-08-04 20:00	2149888	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-05-03 00:38 . 2004-08-03 22:59	2028544	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-04-10 01:31 . 2004-08-04 20:00	1876352	----a-w-	c:\windows\system32\win32k.sys
2012-04-10 17:21 . 2012-04-10 17:21	1263344	----a-w-	c:\program files\eset_smart_security_live_installer.exe
2010-08-29 15:32 . 2010-08-29 15:31	18862693	----a-w-	c:\program files\KoboSetup.exe
2010-08-29 15:23 . 2010-08-29 15:23	3760464	----a-w-	c:\program files\CuteWriter.exe
2010-08-19 22:08 . 2010-11-05 21:25	359656	----a-w-	c:\program files\msicuu2.exe
2010-01-24 19:09 . 2010-01-24 19:09	289584	----a-w-	c:\program files\uTorrent.exe
2009-11-11 06:06 . 2010-02-14 22:07	4787413	----a-w-	c:\program files\copistar_full.exe
2009-03-31 05:01 . 2010-05-30 23:13	401720	----a-w-	c:\program files\HiJackThis.exe
2007-08-09 02:07 . 2010-07-07 18:38	1578514	----a-w-	c:\program files\abcreb_setup.exe
2001-12-25 12:03 . 2010-08-29 16:48	249856	----a-w-	c:\program files\pelite.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2011-09-28 1937736]
.
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LTCM Client"="c:\program files\LTCM Client\ltcmClient.exe" [2009-08-05 1596096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-01-30 400480]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-03 847872]
"FileOpenBroker"="c:\program files\FileOpen\Services\FileOpenBroker32.exe" [2012-04-30 836480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2000-01-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2000-01-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2000-01-01 137752]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-01-31 295072]
"RTHDCPL"="RTHDCPL.EXE" [2000-01-01 20117136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-03-21 5078504]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2006-8-14 49152]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\EpsonNet\\EpsonNet Setup\\tool10\\ENEasyApp.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5985:TCP"= 5985:TCP:*isabled:Windows Remote Management 
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8/4/2011 9:20 AM 122240]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [5/14/2009 6:07 PM 759048]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 12:03 PM 169312]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [3/21/2013 3:19 PM 1341664]
R2 FileOpenManagerSvc;FileOpen Manager Service;c:\program files\FileOpen\Services\FileOpenManagerSvc32.exe [4/30/2012 7:56 PM 213888]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [11/29/2012 9:31 PM 38608]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [9/24/2012 3:55 PM 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [9/24/2012 3:58 PM 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [9/24/2012 3:59 PM 25704]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [10/7/2012 7:42 PM 1691480]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [4/23/2003 9:45 AM 16896]
S3 eBook;eBook;c:\windows\system32\drivers\eBook.sys [6/25/2005 11:35 AM 22072]
S3 fdrawcmd;Low-level Floppy Driver;c:\windows\system32\drivers\fdrawcmd.sys [9/27/2008 11:09 PM 27544]
S3 wdpnp;WinDriver USB Client;c:\windows\system32\drivers\wdpnp.sys [8/29/2010 1:14 PM 22748]
S4 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;"c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe" --> c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/5/2010 6:20 AM 691696]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - FileOpenWebPublisherScreenHookDriver
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32	128512	------w-	c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 07:59]
.
2013-06-12 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 00:12]
.
2013-06-13 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-13 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-13 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchAssistant = 
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2010-08-28 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-12 22:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2013-06-12 23:15:20
ComboFix-quarantined-files.txt 2013-06-13 03:15
ComboFix2.txt 2013-06-12 16:53
ComboFix3.txt 2013-06-11 23:08
ComboFix4.txt 2013-06-11 21:32
ComboFix5.txt 2013-06-13 00:21
.
Pre-Run: 110,896,648,192 bytes free
Post-Run: 110,899,490,816 bytes free
.
- - End Of File - - 9E1C59EE46E83B3F0AAF727B06D91014
8F558EB6672622401DA993E1E865C861

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Reposting CF Log Dequarantine Log

C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\instance.dat -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\instance.dat
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\mia.lib -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\mia.lib
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.dat -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.dat
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.lan -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.lan
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.msi -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.msi
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.par -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.par
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.res -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.res
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4} -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4}
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\{A91C477B-655B-4FEA-8B8E-CC6820970F3A} -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788\BZR.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788\BZR.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F\Ltclr15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F\Ltclr15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F\Lfxpm15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F\Lfxpm15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F\Lffax15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F\Lffax15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788\ATRC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788\ATRC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F\Lfmsp15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F\Lfmsp15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F\Lfpct15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F\Lfpct15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788\JIOL10.csy -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788\JIOL10.csy
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F\Ltimgclr15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F\Ltimgclr15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F\Lttwn15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F\Lttwn15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D\Ambassador.exe -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D\Ambassador.exe
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220\PmlOutBar.cfg -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220\PmlOutBar.cfg
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788\JIOL10.cht -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788\JIOL10.cht
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788\JIOL10.fra -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788\JIOL10.fra
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F\Lfeps15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F\Lfeps15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788\GenWin.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788\GenWin.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788\pml5gre.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788\pml5gre.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F\Lftga15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F\Lftga15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F\Ltimgcor15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F\Ltimgcor15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan DST.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan DST.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan Z.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan Z.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Brother.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Brother.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy DST.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy DST.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Melco.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Melco.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Pfaff.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Pfaff.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Renaissance.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Renaissance.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\SWF.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\SWF.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima Chenille.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima Chenille.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TBF.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TBF.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMCE-100 Chenille.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMCE-100 Chenille.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMLH.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMLH.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Toyota.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Toyota.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK Transport.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK Transport.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788\CDBrowserDLL.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788\CDBrowserDLL.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F\Ltimgutl15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F\Ltimgutl15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F\Ltkrn15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F\Ltkrn15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788\SETNG.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788\SETNG.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788\SEH10.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788\SEH10.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788\GGems.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788\GGems.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788\THRD.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788\THRD.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F\Lfpng15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F\Lfpng15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788\TRCNV.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788\TRCNV.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788\pml5fra.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788\pml5fra.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788\Draw.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788\Draw.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788\SCLI.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788\SCLI.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F\Lfiff15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F\Lfiff15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788\JIOL10.gre -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788\JIOL10.gre
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F\Lfgif15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F\Lfgif15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668\_Normal.style -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668\_Normal.style
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788\pml5esp.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788\pml5esp.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788\DRTD.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788\DRTD.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D\Ambassador.DAT -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D\Ambassador.DAT
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788\JIOL10.ptb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788\JIOL10.ptb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F\Lfcal15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F\Lfcal15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220\license.txt -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220\license.txt
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788\PWCT.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788\PWCT.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788\ABU.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788\ABU.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788\pml5deu.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788\pml5deu.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220\pmlstate.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220\pmlstate.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788\JIOL10.jpn -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788\JIOL10.jpn
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788\pml5ita.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788\pml5ita.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788\MULTT.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788\MULTT.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Ambassador.chm -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Ambassador.chm
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Readme.pdf -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Readme.pdf
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788\pml5csy.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788\pml5csy.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F\Lfacs15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F\Lfacs15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788\cndcnv.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788\cndcnv.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788\JIOL10.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788\JIOL10.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788\SPath.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788\SPath.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F\Lfbmp15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F\Lfbmp15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F\Ltfil15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F\Ltfil15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D\Register.exe -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D\Register.exe
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788\GenC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788\GenC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F\Lfabi15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F\Lfabi15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F\Lfdxf15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F\Lfdxf15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788\GenSC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788\GenSC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2\pedfile.ico -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2\pedfile.ico
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220\pmlhky.xml -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220\pmlhky.xml
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788\BOXF.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788\BOXF.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788\Saurer.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788\Saurer.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788\pml5cht.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788\pml5cht.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F\Lfcut15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F\Lfcut15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220\pmlstate.def -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220\pmlstate.def
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F\Pcdlib32.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F\Pcdlib32.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788\GenIO.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788\GenIO.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F\Lvkrn15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F\Lvkrn15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788\SGNS.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788\SGNS.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788\ADIG.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788\ADIG.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788\JIOL10.chi -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788\JIOL10.chi
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788\IMF.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788\IMF.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788\GenCnv.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788\GenCnv.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220\diagnostics.txt -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220\diagnostics.txt
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788\sto.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788\sto.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788\STC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788\STC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 28.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 28.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 50.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 50.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\AutoCAD.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\AutoCAD.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Country.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Country.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Flesh.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Flesh.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Burmilana.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Burmilana.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Colorful.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Colorful.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 30.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 30.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isafil.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isafil.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isalon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isalon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 28.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 28.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 50.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 50.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother - Brother Embroidery.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother - Brother Embroidery.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Country.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Country.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Flesh.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Flesh.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Alcazar.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Alcazar.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko USA Polyester.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko USA Polyester.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default DMC - Rayon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default DMC - Rayon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Durak - Visco 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Durak - Visco 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Embroidery Warehouse - Colorful.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Embroidery Warehouse - Colorful.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Cotty.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Cotty.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Sulky.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Sulky.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold - Poly.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold - Poly.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Burmilana 12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Burmilana 12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Classic 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Classic 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Polyneon 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Polyneon 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Sticku 30.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Sticku 30.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Toledo 60.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Toledo 60.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Marathon - Rayon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Marathon - Rayon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #122 SBP-7.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #122 SBP-7.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #304-4.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #304-4.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #40E 600.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #40E 600.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #70C Super Luster.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #70C Super Luster.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - SSR-7.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - SSR-7.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Rapos - Polyester.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Rapos - Polyester.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Royal - Linhasoft.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Royal - Linhasoft.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Metallic Nailheads.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Metallic Nailheads.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Swarovski.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Swarovski.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\DefaultThreads.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\DefaultThreads.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Gunold - Poly.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Gunold - Poly.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Isalon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Isalon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Janome Palette.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Janome Palette.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_1.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_1.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_10.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_10.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_11.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_11.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_13.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_13.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_14.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_14.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_15.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_15.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_16.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_16.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_17.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_17.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_18.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_18.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_19.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_19.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_2.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_2.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Thread_20.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Thread_20.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_21.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_21.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_22.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_22.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_3.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_3.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_4.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_4.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_5.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_5.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_6.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_6.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_7.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_7.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_8.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_8.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_9.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_9.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Viking Palette.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Viking Palette.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Metallic Nailheads.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Metallic Nailheads.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Swarovski.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Swarovski.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F\Lfmac15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F\Lfmac15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788\IMP.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788\IMP.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F\Ltdis15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F\Ltdis15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2\pxffile.ico -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2\pxffile.ico
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F\Lfpcd15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F\Lfpcd15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F\Lfimg15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F\Lfimg15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220\Config.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220\Config.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788\GenApp.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788\GenApp.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788\JIOL10.ita -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788\JIOL10.ita
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F\Lfica15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F\Lfica15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788\GenPat.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788\GenPat.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788\Crypt.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788\Crypt.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788\GenD.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788\GenD.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23\libxml2.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23\libxml2.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D\FREE3OF9.TXT -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D\FREE3OF9.TXT
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F\Lfpcl15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F\Lfpcl15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788\JIOL10.esp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788\JIOL10.esp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788\PLeg.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788\PLeg.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Basket Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Basket Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige and Grey Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige and Grey Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Leather.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Leather.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Thatch.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Thatch.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Rubber.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Rubber.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Wavey Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Wavey Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown and Yellow Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown and Yellow Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Corduroy.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Corduroy.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Honeycomb Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Honeycomb Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Leather.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Leather.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown ZigZag.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown ZigZag.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Burgandy Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Burgandy Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Basket.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Basket.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Linen.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Linen.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Grey Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Grey Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Rose Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Rose Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Speckled.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Speckled.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Vertical Sweater.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Vertical Sweater.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Flowers on Vertical Stripe.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Flowers on Vertical Stripe.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Gold Velvet.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Gold Velvet.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Green Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Green Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey and Brown Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey and Brown Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Blinds.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Blinds.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Herring Bone.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Herring Bone.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Leather.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Leather.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Linen.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Linen.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Horizontal.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Horizontal.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Narrow Corduroy.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Narrow Corduroy.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Thick Corduroy.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Thick Corduroy.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Medium Brown Big Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Medium Brown Big Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Multi-Color Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Multi-Color Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Orange Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Orange Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Red Towel.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Red Towel.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Rose Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Rose Fabric.bmp
239 File(s) copied


----------



## Cookiegal (Aug 27, 2003)

Sorry but that's the dequarantine log and I wanted to see the C:\Qoobox\ComboFix-quarantined-files.txt log please.


----------



## Cookiegal (Aug 27, 2003)

Also, please do the following:

Please download FRST (Farbar Recovery Scan Tool) and save it to your desktop.

*Note*: You need to run the version that's compatible with your system (32-bit or 64-bit).


Double-click FRST to run it. When the tool opens click *Yes* to the disclaimer.
Press the *Scan* button.
It will make a log named (*FRST.txt*) in the same directory the tool is run (which should be on the desktop). Please copy and paste the contents of the log in your reply.
The first time the tool is run it makes a second log named (*Addition.txt*). Please copy and paste the contents of that log as well.


----------



## sarahmuriel (Feb 1, 2004)

Sorry for that

C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\instance.dat -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\instance.dat
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\mia.lib -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\mia.lib
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.dat -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.dat
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.lan -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.lan
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.msi -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.msi
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.par -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.par
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.res -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.res
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4} -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4}
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\{A91C477B-655B-4FEA-8B8E-CC6820970F3A} -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788\BZR.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788\BZR.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F\Ltclr15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F\Ltclr15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F\Lfxpm15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F\Lfxpm15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F\Lffax15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F\Lffax15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788\ATRC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788\ATRC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F\Lfmsp15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F\Lfmsp15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F\Lfpct15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F\Lfpct15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788\JIOL10.csy -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788\JIOL10.csy
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F\Ltimgclr15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F\Ltimgclr15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F\Lttwn15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F\Lttwn15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D\Ambassador.exe -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D\Ambassador.exe
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220\PmlOutBar.cfg -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220\PmlOutBar.cfg
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788\JIOL10.cht -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788\JIOL10.cht
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788\JIOL10.fra -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788\JIOL10.fra
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F\Lfeps15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F\Lfeps15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788\GenWin.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788\GenWin.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788\pml5gre.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788\pml5gre.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F\Lftga15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F\Lftga15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F\Ltimgcor15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F\Ltimgcor15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan DST.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan DST.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan Z.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan Z.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Brother.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Brother.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy DST.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy DST.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Melco.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Melco.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Pfaff.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Pfaff.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Renaissance.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Renaissance.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\SWF.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\SWF.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima Chenille.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima Chenille.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TBF.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TBF.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMCE-100 Chenille.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMCE-100 Chenille.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMLH.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMLH.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Toyota.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Toyota.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK Transport.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK Transport.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788\CDBrowserDLL.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788\CDBrowserDLL.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F\Ltimgutl15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F\Ltimgutl15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F\Ltkrn15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F\Ltkrn15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788\SETNG.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788\SETNG.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788\SEH10.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788\SEH10.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788\GGems.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788\GGems.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788\THRD.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788\THRD.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F\Lfpng15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F\Lfpng15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788\TRCNV.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788\TRCNV.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788\pml5fra.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788\pml5fra.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788\Draw.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788\Draw.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788\SCLI.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788\SCLI.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F\Lfiff15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F\Lfiff15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788\JIOL10.gre -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788\JIOL10.gre
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F\Lfgif15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F\Lfgif15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668\_Normal.style -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668\_Normal.style
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788\pml5esp.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788\pml5esp.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788\DRTD.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788\DRTD.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D\Ambassador.DAT -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D\Ambassador.DAT
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788\JIOL10.ptb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788\JIOL10.ptb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F\Lfcal15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F\Lfcal15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220\license.txt -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220\license.txt
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788\PWCT.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788\PWCT.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788\ABU.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788\ABU.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788\pml5deu.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788\pml5deu.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220\pmlstate.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220\pmlstate.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788\JIOL10.jpn -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788\JIOL10.jpn
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788\pml5ita.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788\pml5ita.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788\MULTT.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788\MULTT.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Ambassador.chm -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Ambassador.chm
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Readme.pdf -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Readme.pdf
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788\pml5csy.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788\pml5csy.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F\Lfacs15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F\Lfacs15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788\cndcnv.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788\cndcnv.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788\JIOL10.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788\JIOL10.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788\SPath.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788\SPath.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F\Lfbmp15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F\Lfbmp15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F\Ltfil15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F\Ltfil15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D\Register.exe -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D\Register.exe
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788\GenC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788\GenC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F\Lfabi15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F\Lfabi15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F\Lfdxf15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F\Lfdxf15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788\GenSC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788\GenSC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2\pedfile.ico -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2\pedfile.ico
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220\pmlhky.xml -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220\pmlhky.xml
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788\BOXF.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788\BOXF.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788\Saurer.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788\Saurer.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788\pml5cht.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788\pml5cht.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F\Lfcut15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F\Lfcut15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220\pmlstate.def -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220\pmlstate.def
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F\Pcdlib32.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F\Pcdlib32.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788\GenIO.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788\GenIO.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F\Lvkrn15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F\Lvkrn15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788\SGNS.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788\SGNS.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788\ADIG.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788\ADIG.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788\JIOL10.chi -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788\JIOL10.chi
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788\IMF.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788\IMF.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788\GenCnv.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788\GenCnv.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220\diagnostics.txt -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220\diagnostics.txt
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788\sto.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788\sto.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788\STC.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788\STC.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 28.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 28.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 50.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 50.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\AutoCAD.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\AutoCAD.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Country.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Country.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Flesh.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Flesh.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Burmilana.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Burmilana.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Colorful.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Colorful.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 30.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 30.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isafil.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isafil.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isalon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isalon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 28.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 28.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 50.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 50.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother - Brother Embroidery.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother - Brother Embroidery.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Country.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Country.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Flesh.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Flesh.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Alcazar.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Alcazar.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko USA Polyester.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko USA Polyester.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default DMC - Rayon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default DMC - Rayon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Durak - Visco 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Durak - Visco 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Embroidery Warehouse - Colorful.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Embroidery Warehouse - Colorful.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Cotty.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Cotty.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Sulky.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Sulky.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold - Poly.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold - Poly.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Burmilana 12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Burmilana 12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Classic 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Classic 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Polyneon 40.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Polyneon 40.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Sticku 30.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Sticku 30.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Toledo 60.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Toledo 60.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Marathon - Rayon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Marathon - Rayon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #122 SBP-7.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #122 SBP-7.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #304-4.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #304-4.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #40E 600.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #40E 600.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #70C Super Luster.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #70C Super Luster.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - SSR-7.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - SSR-7.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Rapos - Polyester.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Rapos - Polyester.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Royal - Linhasoft.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Royal - Linhasoft.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Metallic Nailheads.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Metallic Nailheads.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Swarovski.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Swarovski.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\DefaultThreads.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\DefaultThreads.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Gunold - Poly.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Gunold - Poly.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Isalon.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Isalon.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Janome Palette.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Janome Palette.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_1.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_1.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_10.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_10.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_11.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_11.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_12.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_12.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_13.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_13.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_14.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_14.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_15.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_15.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_16.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_16.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_17.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_17.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_18.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_18.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_19.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_19.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_2.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_2.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Thread_20.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Thread_20.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_21.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_21.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_22.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_22.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_3.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_3.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_4.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_4.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_5.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_5.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_6.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_6.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_7.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_7.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_8.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_8.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_9.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_9.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Viking Palette.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Viking Palette.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Metallic Nailheads.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Metallic Nailheads.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Swarovski.tdb -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Swarovski.tdb
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F\Lfmac15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F\Lfmac15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788\IMP.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788\IMP.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F\Ltdis15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F\Ltdis15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2\pxffile.ico -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2\pxffile.ico
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F\Lfpcd15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F\Lfpcd15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F\Lfimg15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F\Lfimg15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220\Config.ini -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220\Config.ini
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788\GenApp.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788\GenApp.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788\JIOL10.ita -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788\JIOL10.ita
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F\Lfica15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F\Lfica15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788\GenPat.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788\GenPat.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788\Crypt.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788\Crypt.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788\GenD.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788\GenD.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23\libxml2.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23\libxml2.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D\FREE3OF9.TXT -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D\FREE3OF9.TXT
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F\Lfpcl15u.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F\Lfpcl15u.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788\JIOL10.esp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788\JIOL10.esp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788\PLeg.dll -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788\PLeg.dll
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Basket Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Basket Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige and Grey Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige and Grey Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Leather.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Leather.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Thatch.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Thatch.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Rubber.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Rubber.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Wavey Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Wavey Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown and Yellow Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown and Yellow Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Corduroy.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Corduroy.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Honeycomb Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Honeycomb Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Leather.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Leather.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown ZigZag.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown ZigZag.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Burgandy Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Burgandy Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Basket.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Basket.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Linen.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Linen.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Grey Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Grey Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Rose Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Rose Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Speckled.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Speckled.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Vertical Sweater.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Vertical Sweater.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Fabric.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Flowers on Vertical Stripe.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Flowers on Vertical Stripe.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Gold Velvet.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Gold Velvet.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Green Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Green Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey and Brown Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey and Brown Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Blinds.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Blinds.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Herring Bone.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Herring Bone.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Leather.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Leather.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Linen.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Linen.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Horizontal.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Horizontal.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Narrow Corduroy.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Narrow Corduroy.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Thick Corduroy.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Thick Corduroy.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Medium Brown Big Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Medium Brown Big Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Multi-Color Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Multi-Color Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Orange Weave.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Orange Weave.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Red Towel.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Red Towel.bmp
C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Rose Fabric.bmp -> C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Rose Fabric.bmp
239 File(s) copied
2013-06-12 16:51:42 . 2013-06-12 16:51:42 1,858 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4}.reg.dat
2013-06-12 16:51:41 . 2013-06-12 16:51:41 1,692 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Pulse Ambassador.reg.dat
2013-06-12 16:36:36 . 2013-06-12 16:36:36 896 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Pulse Ambassador Update Setup for All Users.reg.dat
2013-06-11 22:24:44 . 2013-06-13 00:39:18 0 ----a-w- C:\Qoobox\Quarantine\catchme.txt
2013-06-11 20:26:19 . 2013-06-13 02:11:57 512 ----a-w- C:\Qoobox\Quarantine\MBR_HardDisk0.mbr
2013-04-01 17:58:00 . 2013-04-01 17:58:01 902 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\EventSystem.log.vir
2013-01-31 17:11:53 . 2013-06-13 02:43:34 6,292 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2013-01-31 16:33:34 . 2013-06-13 02:17:11 1,071 ----a-w- C:\Qoobox\Quarantine\catchme.log
2012-07-22 14:46:52 . 2012-07-22 14:46:53 16,883,056 ----a-w- C:\Qoobox\Quarantine\C\IE8-WI~1.EXE.vir
2012-01-17 03:01:31 . 2012-01-17 03:04:52 941 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\all\Application Data\a3a47e80.vir
2012-01-17 03:01:31 . 2012-01-17 03:04:52 987 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\ffb54aa1.vir
2010-09-09 16:43:43 . 2010-09-13 19:45:02 787 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\wininit.ini.vir
2010-08-29 01:25:36 . 2010-08-29 01:25:36 98 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\instance.dat.vir
2010-08-29 01:25:36 . 2009-05-13 18:48:06 579,156 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\mia.lib.vir
2010-08-29 01:25:36 . 2010-08-29 01:26:07 2,801 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.dat.vir
2010-08-29 01:25:36 . 2010-08-29 01:25:36 9 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.lan.vir
2010-08-29 01:25:36 . 2010-08-29 01:25:36 17,714 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.par.vir
2010-08-29 01:25:36 . 2009-05-13 18:48:05 364,544 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.msi.vir
2010-08-29 01:25:36 . 2009-05-13 18:48:12 7,964,683 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.res.vir
2010-08-29 01:25:36 . 2009-05-13 18:48:08 2,768,848 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe.vir
2010-08-29 01:25:36 . 2010-08-29 01:25:36 0 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4}.vir
2010-08-29 01:25:01 . 2010-08-29 01:25:01 0 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}.vir
2010-08-29 01:23:25 . 1998-09-01 11:50:00 0 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220\diagnostics.txt.vir
2010-08-29 01:23:25 . 2001-08-21 15:41:38 2,700 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_7.tdb.vir
2010-08-29 01:23:25 . 2003-06-13 18:49:46 21,460 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_8.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:46:42 17,896 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_9.tdb.vir
2010-08-29 01:23:25 . 2009-02-23 12:25:22 1,565 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Viking Palette.tdb.vir
2010-08-29 01:23:25 . 2006-11-09 21:51:00 1,391 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Metallic Nailheads.tdb.vir
2010-08-29 01:23:25 . 2006-11-09 21:40:44 2,840 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\ZBSL Swarovski.tdb.vir
2010-08-29 01:23:25 . 2003-06-13 18:26:54 22,105 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_21.tdb.vir
2010-08-29 01:23:25 . 2003-09-11 19:06:18 19,989 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_22.tdb.vir
2010-08-29 01:23:25 . 2002-08-01 19:25:02 17,809 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_3.tdb.vir
2010-08-29 01:23:25 . 2003-03-16 20:08:08 25,662 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_4.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:40:54 1,835 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_5.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:41:18 1,779 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_6.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:51:42 12,573 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_17.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:52:22 28,187 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_18.tdb.vir
2010-08-29 01:23:25 . 2002-10-21 12:35:00 16,548 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_19.tdb.vir
2010-08-29 01:23:25 . 2007-09-11 20:06:14 19,934 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_2.tdb.vir
2010-08-29 01:23:25 . 2002-08-01 16:26:06 15,008 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Thread_20.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:48:14 8,004 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_10.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:48:32 3,930 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_11.tdb.vir
2010-08-29 01:23:25 . 2008-04-23 20:32:50 18,584 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_12.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:49:40 11,453 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_13.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:49:58 5,780 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_14.tdb.vir
2010-08-29 01:23:25 . 2001-08-21 15:50:50 4,827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_15.tdb.vir
2010-08-29 01:23:25 . 2004-02-12 23:09:46 20,414 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_16.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:45:42 717 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Rapos - Polyester.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:45:52 883 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Royal - Linhasoft.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:46:04 877 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Metallic Nailheads.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:46:14 910 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default ZBSL Swarovski.tdb.vir
2010-08-29 01:23:25 . 2003-09-12 15:36:36 812 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\DefaultThreads.tdb.vir
2010-08-29 01:23:25 . 2006-04-18 20:33:06 14,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Gunold - Poly.tdb.vir
2010-08-29 01:23:25 . 2004-09-30 16:17:14 17,662 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Isalon.tdb.vir
2010-08-29 01:23:25 . 2009-02-23 12:26:04 4,246 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Janome Palette.tdb.vir
2010-08-29 01:23:25 . 1998-09-01 12:50:00 571 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.tdb.vir
2010-08-29 01:23:25 . 2007-09-11 19:40:06 1,785 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\thread_1.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:44:14 949 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Sticku 30.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:44:28 948 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Toledo 60.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:44:38 685 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Marathon - Rayon.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:45:08 873 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #122 SBP-7.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:45:20 785 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #304-4.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:44:48 792 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #40E 600.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:44:58 930 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - #70C Super Luster.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:45:30 761 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default R-A - SSR-7.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:42:42 748 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default DMC - Rayon.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:42:52 888 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Durak - Visco 40.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:43:04 880 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Embroidery Warehouse - Colorful.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:43:22 979 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Cotty.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:43:32 988 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold & Stickma - Sulky.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:43:12 748 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Gunold - Poly.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:43:42 851 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Burmilana 12.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:43:52 816 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Classic 40.tdb.vir
2010-08-29 01:23:25 . 2008-04-23 19:21:42 829 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Madeira - Polyneon 40.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:41:06 827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 28.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:41:16 827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 40.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:41:28 827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 50.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:41:38 735 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother - Brother Embroidery.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:41:50 865 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Country.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:42:00 661 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Brother Flesh.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:42:12 891 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Alcazar.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:42:22 1,183 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko USA Polyester.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:42:32 836 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Coats - Sylko.tdb.vir
2010-08-29 01:23:25 . 2006-09-27 20:42:18 11,645 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\AutoCAD.tdb.vir
2010-08-29 01:23:25 . 2005-09-14 14:38:18 3,435 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Country.tdb.vir
2010-08-29 01:23:25 . 2009-02-23 12:18:50 613 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother Flesh.tdb.vir
2010-08-29 01:23:25 . 2009-04-29 11:26:37 3,146 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Brother.tdb.vir
2010-08-29 01:23:25 . 2007-09-11 18:39:10 6,681 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Burmilana.tdb.vir
2010-08-29 01:23:25 . 2004-09-15 21:35:36 11,937 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Colorful.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:40:14 988 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 30.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:40:24 980 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isacord 40.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 15:40:38 813 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isafil.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:40:48 653 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Ackermann - Isalon.tdb.vir
2010-08-29 01:23:25 . 2007-09-20 14:40:56 827 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Default Aurifil - Mako 12.tdb.vir
2010-08-29 01:23:25 . 2007-04-30 14:13:24 650 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668\_Normal.style.vir
2010-08-29 01:23:25 . 2005-02-04 08:07:12 11,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 12.tdb.vir
2010-08-29 01:23:25 . 2005-02-04 08:07:10 11,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 28.tdb.vir
2010-08-29 01:23:25 . 2005-02-04 08:07:10 11,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 40.tdb.vir
2010-08-29 01:23:25 . 2005-02-04 08:07:10 11,426 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\Aurifil - Mako 50.tdb.vir
2010-08-29 01:23:24 . 2009-05-13 17:27:52 34,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788\JIOL10.ptb.vir
2010-08-29 01:23:24 . 2009-05-13 17:23:21 35,600 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788\JIOL10.fra.vir
2010-08-29 01:23:24 . 2009-05-13 17:25:09 34,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788\JIOL10.gre.vir
2010-08-29 01:23:24 . 2009-05-13 17:26:59 26,384 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788\JIOL10.jpn.vir
2010-08-29 01:23:24 . 2009-05-13 17:26:04 34,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788\JIOL10.ita.vir
2010-08-29 01:23:24 . 2009-05-13 16:24:29 44,608 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D\Ambassador.DAT.vir
2010-08-29 01:23:24 . 2009-05-13 17:29:45 35,088 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788\JIOL10.esp.vir
2010-08-29 01:23:24 . 2009-05-13 17:21:04 32,528 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788\JIOL10.csy.vir
2010-08-29 01:23:24 . 2005-01-15 19:44:44 1,852 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220\PmlOutBar.cfg.vir
2010-08-29 01:23:24 . 2009-05-13 17:20:03 25,360 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788\JIOL10.cht.vir
2010-08-29 01:23:24 . 2009-05-13 17:18:51 24,848 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788\JIOL10.chi.vir
2010-08-29 01:23:24 . 2009-04-06 21:40:18 96,528 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788\THRD.dll.vir
2010-08-29 01:23:24 . 2009-04-06 21:50:38 24,336 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788\TRCNV.dll.vir
2010-08-29 01:23:24 . 2009-05-13 15:48:24 228,624 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788\sto.dll.vir
2010-08-29 01:23:24 . 2009-04-06 21:41:39 170,256 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788\STC.dll.vir
2010-08-29 01:23:24 . 2009-04-28 00:56:34 630,032 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788\SPath.dll.vir
2010-08-29 01:23:24 . 2009-04-06 21:44:03 130,832 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788\SGNS.dll.vir
2010-08-29 01:23:23 . 2009-05-13 15:39:34 1,195,792 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788\SETNG.dll.vir
2010-08-29 01:23:23 . 2009-04-06 21:54:17 26,384 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788\SEH10.dll.vir
2010-08-29 01:23:23 . 2009-05-13 15:52:06 3,301,648 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788\SCLI.dll.vir
2010-08-29 01:23:23 . 2009-05-04 21:18:38 91,920 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788\Saurer.dll.vir
2010-08-29 01:23:23 . 2009-04-06 21:45:17 21,776 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788\PWCT.dll.vir
2010-08-29 01:23:22 . 2009-05-13 17:26:19 4,963,088 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788\pml5ita.dll.vir
2010-08-29 01:23:22 . 2009-05-13 17:25:24 4,960,528 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788\pml5gre.dll.vir
2010-08-29 01:23:20 . 2009-05-13 17:23:36 4,977,936 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788\pml5fra.dll.vir
2010-08-29 01:23:20 . 2009-05-13 17:30:07 4,977,424 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788\pml5esp.dll.vir
2010-08-29 01:23:20 . 2009-05-13 17:24:29 4,965,136 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788\pml5deu.dll.vir
2010-08-29 01:23:20 . 2009-05-13 17:21:32 4,935,952 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788\pml5csy.dll.vir
2010-08-29 01:23:19 . 2009-05-13 17:20:20 4,815,632 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788\pml5cht.dll.vir
2010-08-29 01:23:19 . 2009-05-13 15:47:33 231,696 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788\PLeg.dll.vir
2010-08-29 01:23:19 . 2008-06-12 20:00:36 217,864 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F\Pcdlib32.dll.vir
2010-08-29 01:23:19 . 2009-04-06 21:38:49 57,616 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788\MULTT.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:36 117,904 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F\Lttwn15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:38 248,976 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F\Lvkrn15u.dll.vir
2010-08-29 01:23:19 . 2007-01-11 22:27:50 482,448 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F\Ltkrn15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:32 117,904 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F\Ltimgutl15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:30 212,112 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F\Ltimgclr15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:30:30 302,224 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F\Ltimgcor15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:29:56 150,672 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F\Ltfil15u.dll.vir
2010-08-29 01:23:19 . 2006-11-21 14:29:56 261,264 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F\Ltdis15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:24 1,711,248 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F\Ltclr15u.dll.vir
2010-08-29 01:23:17 . 2008-03-14 16:40:57 512,264 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23\libxml2.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:24 27,792 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F\Lfxpm15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:20 18,064 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F\Lftga15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:14 64,656 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F\Lfpct15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:14 126,096 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F\Lfpng15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:12 13,968 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F\Lfmsp15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:12 13,456 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F\Lfmac15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:12 17,552 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F\Lfpcd15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:12 97,424 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F\Lfpcl15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:10 22,160 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F\Lfiff15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:10 14,992 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F\Lfimg15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:08 29,840 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F\Lfica15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:08 32,912 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F\Lfgif15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:29:52 97,424 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F\Lffax15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:06 25,232 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F\Lfeps15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:06 146,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F\Lfdxf15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:04 14,992 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F\Lfcut15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:02 24,720 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F\Lfcal15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:02 24,720 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F\Lfbmp15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:00 48,272 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F\Lfacs15u.dll.vir
2010-08-29 01:23:17 . 2006-11-21 14:30:00 21,648 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F\Lfabi15u.dll.vir
2010-08-29 01:23:17 . 2009-02-13 01:08:54 35,600 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788\JIOL10.dll.vir
2010-08-29 01:23:17 . 2009-04-06 21:49:14 36,624 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788\IMF.dll.vir
2010-08-29 01:23:17 . 2009-04-06 21:48:50 57,104 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788\IMP.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:39:31 28,432 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788\GGems.dll.vir
2010-08-29 01:23:16 . 2009-05-11 21:05:49 936,720 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788\GenWin.dll.vir
2010-08-29 01:23:16 . 2009-05-13 15:49:06 551,696 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788\GenSC.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:43:17 313,616 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788\GenPat.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:39:19 354,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788\GenIO.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:41:56 250,128 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788\GenD.dll.vir
2010-08-29 01:23:16 . 2009-05-13 15:38:18 369,936 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788\GenCnv.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:41:04 352,528 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788\GenC.dll.vir
2010-08-29 01:23:16 . 2009-05-11 21:03:38 297,744 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788\GenApp.dll.vir
2010-08-29 01:23:16 . 2009-05-13 15:40:24 86,800 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788\DRTD.dll.vir
2010-08-29 01:23:16 . 2009-04-06 21:44:08 162,576 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788\Draw.dll.vir
2010-08-29 01:23:16 . 2009-02-13 00:38:43 19,728 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788\Crypt.dll.vir
2010-08-29 01:23:16 . 2009-05-13 15:55:59 63,760 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788\cndcnv.dll.vir
2010-08-29 01:23:15 . 2009-04-06 22:12:35 483,088 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788\CDBrowserDLL.dll.vir
2010-08-29 01:23:15 . 2009-04-06 21:40:04 403,216 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788\BZR.dll.vir
2010-08-29 01:23:15 . 2009-04-06 21:48:57 146,192 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788\ATRC.dll.vir
2010-08-29 01:23:15 . 2009-04-06 21:41:22 81,680 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788\BOXF.dll.vir
2010-08-29 01:23:15 . 2009-05-13 15:48:56 157,456 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788\ADIG.dll.vir
2010-08-29 01:23:15 . 2009-04-06 21:48:23 676,624 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788\ABU.dll.vir
2010-08-29 01:23:15 . 2009-04-06 22:14:22 63,248 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D\Register.exe.vir
2010-08-29 01:23:12 . 2009-05-13 16:24:27 11,411,216 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D\Ambassador.exe.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,260 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,258 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Toyota.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,272 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK Transport.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,262 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\ZSK.ini.vir
2010-08-29 01:23:12 . 2009-04-13 16:57:54 70,339 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Readme.pdf.vir
2010-08-29 01:23:12 . 2007-05-08 19:34:38 1,983 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9\threadDB.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,255 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Pfaff.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,265 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Renaissance.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,258 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\SWF.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,268 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima Chenille.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,264 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TBF.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,276 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMCE-100 Chenille.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,265 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Tajima TMLH.ini.vir
2010-08-29 01:23:12 . 2009-02-06 18:57:49 3,856 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220\pmlstate.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,261 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Brother.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,263 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy DST.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,259 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Happy.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,257 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Melco.ini.vir
2010-08-29 01:23:12 . 2007-02-20 16:38:27 14 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220\Config.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,264 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan DST.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,259 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan Z.ini.vir
2010-08-29 01:23:12 . 2009-05-06 21:40:41 1,257 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7\Barudan.ini.vir
2010-08-29 01:23:12 . 2008-10-10 20:44:14 45,091 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220\license.txt.vir
2010-08-29 01:23:12 . 2004-02-15 01:21:38 2,920 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D\FREE3OF9.TXT.vir
2010-08-29 01:23:12 . 2007-01-04 16:40:58 776 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220\pmlhky.xml.vir
2010-08-29 01:23:12 . 2009-02-06 18:58:23 3,856 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220\pmlstate.def.vir
2010-08-29 01:23:12 . 2008-09-18 20:45:20 285,478 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2\pxffile.ico.vir
2010-08-29 01:23:12 . 2008-07-15 22:05:24 1,078 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2\pedfile.ico.vir
2010-08-29 01:23:12 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Orange Weave.bmp.vir
2010-08-29 01:23:12 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Red Towel.bmp.vir
2010-08-29 01:23:12 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Rose Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Thick Corduroy.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 83,855 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Medium Brown Big Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Multi-Color Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Linen.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Horizontal.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Light Narrow Corduroy.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 9,363 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Herring Bone.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Leather.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Green Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey and Brown Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 352,106 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Grey Blinds.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Flowers on Vertical Stripe.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Gold Velvet.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Speckled.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Vertical Sweater.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Violet Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Basket.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Brown Linen.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Grey Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Dark Rose Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 18,263 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Leather.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown ZigZag.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Burgandy Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Corduroy.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown Honeycomb Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Rubber.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 78,727 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Blue Wavey Fabric.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Brown and Yellow Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Basket Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 33,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige and Grey Weave.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 17,462 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Leather.bmp.vir
2010-08-29 01:23:11 . 1998-09-01 11:50:00 31,895 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7\Beige Thatch.bmp.vir
2010-08-29 01:23:11 . 2007-08-29 12:42:16 387,392 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C\Ambassador.chm.vir
2004-08-03 22:59:02 . 2012-04-11 12:35:51 2,026,496 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_000012_.tmp.dll.vir
2004-08-03 22:59:02 . 2011-10-25 12:52:02 2,027,008 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_000013_.tmp.dll.vir
2003-02-21 09:16:08 . 2003-02-21 09:16:08 49,152 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\URTTemp\regtlib.exe.vir


running the other program


----------



## sarahmuriel (Feb 1, 2004)

FRST log

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-06-2013 04
Ran by all (administrator) on 13-06-2013 10:45:21
Running from C:\Documents and Settings\all\Desktop
Microsoft Windows XP Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
(ABBYY) C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(FileOpen Systems Inc.) C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(SupportSoft, Inc.) C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Microsoft Corporation) C:\PROGRA~1\MICROS~4\rapimgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft ActiveSync\wcescomm.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(RealNetworks, Inc.) C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE [180224 2010-04-12] (PowerISO Computing, Inc.)
HKLM\...\Run: [Reader Library Launcher] C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM\...\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe" [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2 [202560 2008-04-24] (SupportSoft, Inc.)
HKLM\...\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe /startup [1596096 2009-08-05] (Leader Technologies Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot [400480 2012-01-30] (BillP Studios)
HKLM\...\Run: [FUFAXSTM] "C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe" [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [FileOpenBroker] C:\Program Files\FileOpen\Services\FileOpenBroker32.exe [836480 2012-04-30] (FileOpen Systems Inc.)
HKLM\...\Run: [TkBellExe] "C:\program files\real\realplayer\update\realsched.exe" -osboot [295072 2013-01-31] (RealNetworks, Inc.)
HKLM\...\Run: [RTHDCPL] RTHDCPL.EXE [x]
HKLM\...\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice [5078504 2013-03-21] (ESET)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [1289000 2006-11-13] (Microsoft Corporation)
HKCU\...\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [868352 2007-07-17] ()
HKU\Owner\...\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [ 2009-02-03] (Yahoo! Inc)
HKU\Owner\...\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [ 2009-02-03] (Yahoo! Inc)
HKU\Owner\...\Run: [uTorrent] "G:\Downloads\uTorrent.exe" [x]
HKU\Owner\...\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [ 2008-10-24] (Macrovision Corporation)
HKU\Owner\...\Run: [EPSON NX410 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE /FU "C:\WINDOWS\TEMP\E_S8BB.tmp" /EF "HKCU" [x]
HKU\Owner\...\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [x]
HKU\Owner\...\Run: [MtdAcqu] "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s [ 2006-03-08] (Creative Technology Ltd)
HKU\Owner\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [ 2009-03-05] (Safer-Networking Ltd.)
HKU\Owner\...\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [x]
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\eBook USB Driver.lnk
ShortcutTarget: eBook USB Driver.lnk -> C:\Program Files\eBook Technologies\eBook USB Driver\TrayEBU.exe ()
Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ymetray.lnk
ShortcutTarget: ymetray.lnk -> C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: Winamp Toolbar Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
HKLM SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20120220050204593&tb_oid=20-02-2012&tb_mrud=20-02-2012
HKCU SearchScopes: DefaultScope {6b0d4c9d-c6eb-4a9a-981c-ac3f9d8373c0} URL = http://search.xfinity.com/?cat=subweb&con=mmchrome&cid=xfstart_tech_search&q={searchTerms}
SearchScopes: HKCU - {1BEF5668-7DD2-44C8-BA32-9036837407F9} URL = http://delicious.com/search?p={searchTerms}
SearchScopes: HKCU - {47A758D5-4E93-4CFE-A2EC-502F6CD703B7} URL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=chr-yie8
SearchScopes: HKCU - {61D30B33-61FA-4066-B03D-7CBE9A2FA94F} URL = http://rover.ebay.com/rover/1/711-43047-14818-1/4?satitle={searchTerms}
SearchScopes: HKCU - {6b0d4c9d-c6eb-4a9a-981c-ac3f9d8373c0} URL = http://search.xfinity.com/?cat=subweb&con=mmchrome&cid=xfstart_tech_search&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
SearchScopes: HKCU - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20120220050204593&tb_oid=20-02-2012&tb_mrud=20-02-2012
SearchScopes: HKCU - {F6AE964E-59BF-42E9-908D-EEEDE4C9FFD1} URL = http://www.flickr.com/search/?q={searchTerms}
BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
Toolbar: HKLM - Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKCU -Winamp Toolbar - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282722117312
DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} http://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://mozysupport.webex.com/client/T27LB/support/ieatgpc.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: ipp - No CLSID Value - 
Handler: msdaipp - No CLSID Value - 
ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 65.32.5.111 65.32.5.112

FireFox:
========
FF ProfilePath: C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default
FF SearchEngine: WOT Safe Search
FF Homepage: www.yahoo.com
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @Motive.com/NpMotive,version=1.0 - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin: @real.com/nppl3260;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.0 - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.0 - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.0 - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @sony.com/eBookLibrary - C:\Program Files\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Winamp Toolbar - C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\Extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: ChatZilla - C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\Extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
FF Extension: Yahoo! Toolbar - C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF Extension: WOT - C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

========================== Services (Whitelisted) =================

R2 6to4; C:\Windows\System32\6to4svc.dll [100864 2010-02-12] (Microsoft Corporation)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AdobeActiveFileMonitor7.0; C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [169312 2008-09-16] (Adobe Systems Incorporated)
S4 Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [44032 1999-12-13] (Creative Technology Ltd)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1341664 2013-03-21] (ESET)
R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 sprtsvc_ddoctorv2; C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [202560 2008-04-24] (SupportSoft, Inc.)
S3 AppMgmt; %SystemRoot%\System32\appmgmts.dll [x]
R2 JavaQuickStarterService; "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf" [x]
S4 Roxio UPnP Renderer 11; "C:\Program Files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 Ambfilt; C:\Windows\System32\drivers\Ambfilt.sys [1691480 1999-12-31] (Creative)
S3 busbcrw; C:\Windows\System32\Drivers\busbcrw.sys [16896 2003-04-23] (Brother Industries, Ltd.)
R1 eamon; C:\Windows\System32\DRIVERS\eamon.sys [161368 2013-01-10] (ESET)
S3 eBook; C:\Windows\System32\Drivers\eBook.sys [22072 2005-06-25] (eBook Technologies, Inc.)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [122240 2013-01-10] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [150080 2013-01-10] (ESET)
R3 Epfwndis; C:\Windows\System32\DRIVERS\Epfwndis.sys [40376 2013-01-10] (ESET)
R1 epfwtdi; C:\Windows\System32\DRIVERS\epfwtdi.sys [62512 2013-02-20] (ESET)
S3 fdrawcmd; C:\WINDOWS\system32\drivers\fdrawcmd.sys [27544 2008-09-27] (simonowen.com)
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [9344 2009-04-17] (GARMIN Corp.)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
S3 Monfilt; C:\Windows\System32\drivers\Monfilt.sys [1395800 1999-12-31] (Creative Technology Ltd.)
S3 MREMP50; C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [21248 2010-05-26] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [20096 2010-05-26] (Printing Communications Assoc., Inc. (PCAUSA))
R2 NwlnkIpx; C:\Windows\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-13] (Microsoft Corporation)
R2 NwlnkNb; C:\Windows\System32\DRIVERS\nwlnknb.sys [63232 2004-08-04] (Microsoft Corporation)
R2 NwlnkSpx; C:\Windows\System32\DRIVERS\nwlnkspx.sys [55936 2004-08-04] (Microsoft Corporation)
R3 RTLE8023xp; C:\Windows\System32\DRIVERS\Rtenicxp.sys [117888 2008-10-30] (Realtek Semiconductor Corporation )
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-05] (Duplex Secure Ltd.)
S3 StMp3Rec; C:\Windows\System32\Drivers\StMp3Rec.sys [19840 2007-06-15] (Generic)
R1 Tcpip6; C:\Windows\System32\DRIVERS\tcpip6.sys [226880 2010-02-11] (Microsoft Corporation)
S3 wceusbsh; C:\Windows\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
S3 wdpnp; C:\Windows\System32\Drivers\wdpnp.sys [22748 2001-11-12] ()
R3 WsAudio_DeviceS(1); C:\Windows\System32\drivers\WsAudio_DeviceS(1).sys [25704 2012-03-07] (Wondershare)
R3 WsAudio_DeviceS(2); C:\Windows\System32\drivers\WsAudio_DeviceS(2).sys [25704 2012-03-07] (Wondershare)
R3 WsAudio_DeviceS(3); C:\Windows\System32\drivers\WsAudio_DeviceS(3).sys [25704 2012-03-07] (Wondershare)
R3 WsAudio_DeviceS(4); C:\Windows\System32\drivers\WsAudio_DeviceS(4).sys [25704 2012-03-07] (Wondershare)
R3 WsAudio_DeviceS(5); C:\Windows\System32\drivers\WsAudio_DeviceS(5).sys [25704 2012-03-07] (Wondershare)
S4 Abiosdsk; No ImagePath
S4 abp480n5; No ImagePath
S4 adpu160m; No ImagePath
S4 Aha154x; No ImagePath
S4 aic78u2; No ImagePath
S4 aic78xx; No ImagePath
S4 AliIde; No ImagePath
S4 amsint; No ImagePath
S4 asc; No ImagePath
S4 asc3350p; No ImagePath
S4 asc3550; No ImagePath
S4 Atdisk; No ImagePath
R3 catchme; \??\C:\DOCUME~1\all\LOCALS~1\Temp\catchme.sys [x]
S4 cd20xrnt; No ImagePath
S1 Changer; No ImagePath
S4 CmdIde; No ImagePath
S4 Cpqarray; No ImagePath
U4 dac2w2k; No ImagePath
S4 dac960nt; No ImagePath
S4 dpti2o; No ImagePath
S4 hpn; No ImagePath
S1 i2omgmt; No ImagePath
S4 i2omp; No ImagePath
S4 ini910u; No ImagePath
S4 IntelIde; No ImagePath
S1 lbrtfdc; No ImagePath
S4 mraid35x; No ImagePath
S1 PCIDump; No ImagePath
S3 PDCOMP; No ImagePath
S3 PDFRAME; No ImagePath
S3 PDRELI; No ImagePath
S3 PDRFRAME; No ImagePath
S4 perc2; No ImagePath
S4 perc2hib; No ImagePath
S4 ql1080; No ImagePath
S4 Ql10wnt; No ImagePath
S4 ql12160; No ImagePath
S4 ql1240; No ImagePath
S4 ql1280; No ImagePath
S4 Simbad; No ImagePath
S4 Sparrow; No ImagePath
S4 symc810; No ImagePath
S4 symc8xx; No ImagePath
S4 sym_hi; No ImagePath
S4 sym_u3; No ImagePath
U3 TlntSvr; 
S4 TosIde; No ImagePath
S4 ultra; No ImagePath
S4 ViaIde; No ImagePath
S3 WDICA; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-13 10:44 - 2013-06-13 10:44 - 00000000 ____D C:\FRST
2013-06-13 10:43 - 2013-06-13 10:43 - 01359203 ____A (Farbar) C:\Documents and Settings\all\Desktop\FRST.exe
2013-06-12 23:15 - 2013-06-12 23:15 - 00012613 ____A C:\ComboFix.txt
2013-06-12 22:04 - 2009-04-20 00:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-12 21:55 - 2013-06-12 21:55 - 00000942 ____A C:\Documents and Settings\all\Desktop\inst.txt
2013-06-12 21:53 - 2013-06-12 21:54 - 00000628 ____A C:\Documents and Settings\all\Desktop\defogger_disable.log
2013-06-12 21:53 - 2013-06-12 21:54 - 00000020 ____A C:\Documents and Settings\all\defogger_reenable
2013-06-12 21:51 - 2013-06-12 21:51 - 00050477 ____A C:\Documents and Settings\all\Desktop\Defogger.exe
2013-06-12 21:15 - 2013-06-12 21:15 - 00000000 __HDC C:\Windows\$NtUninstallKB2839229$
2013-06-12 20:59 - 2013-06-12 21:02 - 00013205 ____A C:\Windows\KB2838727-IE8.log
2013-06-12 20:45 - 2013-06-12 20:45 - 00073474 ____A C:\Documents and Settings\all\Desktop\DeQuarantine.txt
2013-06-12 20:40 - 2013-06-12 20:41 - 00073474 ____A C:\DeQuarantine.txt
2013-06-12 20:40 - 2013-06-12 20:41 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
2013-06-12 13:20 - 2013-06-12 21:16 - 00018233 ____A C:\Windows\KB2839229.log
2013-06-11 16:14 - 2013-06-11 16:14 - 05078680 ____R (Swearware) C:\Documents and Settings\all\Desktop\ComboFix.exe
2013-06-09 17:53 - 2013-06-10 18:20 - 00000710 ____A C:\Documents and Settings\all\Desktop\SystemLook.txt
2013-06-09 17:48 - 2013-06-09 17:48 - 00020338 ____A C:\Documents and Settings\all\Desktop\OTS Fix.txt
2013-06-09 17:37 - 2013-06-09 17:37 - 00000000 ____D C:\_OTS
2013-06-09 17:30 - 2013-06-09 17:52 - 00075264 ____A C:\Documents and Settings\all\Desktop\SystemLook.exe
2013-06-09 11:24 - 2013-06-09 12:01 - 00357702 ____A C:\Documents and Settings\all\Desktop\OTS.Txt
2013-06-09 11:00 - 2013-06-09 11:01 - 00646656 ____A (OldTimer Tools) C:\Documents and Settings\all\Desktop\OTS.exe
2013-06-06 11:26 - 2013-06-06 11:26 - 00002253 ____A C:\Documents and Settings\all\Desktop\aswMBR.txt
2013-06-06 10:44 - 2013-06-06 11:26 - 00000512 ____A C:\Documents and Settings\all\Desktop\MBR.dat
2013-06-06 10:14 - 2013-06-06 10:16 - 04745728 ____A (AVAST Software) C:\Documents and Settings\all\Desktop\aswMBR.exe
2013-06-05 11:54 - 2013-06-05 11:55 - 05555190 ____A C:\Documents and Settings\all\Desktop\tweaking.com_windows_repair_aio_setup.exe
2013-06-04 20:44 - 2013-06-04 20:43 - 00094112 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-06-04 20:44 - 2013-06-04 20:42 - 00263584 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-06-04 20:44 - 2013-06-04 20:42 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-06-04 20:44 - 2013-06-04 20:42 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2013-06-04 20:44 - 2013-06-04 20:42 - 00144896 ____A (Oracle Corporation) C:\Windows\System32\javacpl.cpl
2013-05-31 18:00 - 2013-05-31 18:00 - 00011809 ____A C:\Documents and Settings\all\Desktop\hijackthis.log
2013-05-31 17:52 - 2013-05-31 17:52 - 00000803 ____A C:\Documents and Settings\all\Desktop\Internet Explorer.lnk
2013-05-31 17:50 - 2013-05-31 17:50 - 00018951 ____A C:\Documents and Settings\all\Desktop\ark.txt file..log
2013-05-31 15:26 - 2013-05-31 15:26 - 00020957 ____A C:\Documents and Settings\all\Desktop\attach.txt
2013-05-31 15:26 - 2013-05-31 15:26 - 00017089 ____A C:\Documents and Settings\all\Desktop\dds.txt
2013-05-31 14:58 - 2013-05-31 15:05 - 00007322 ____A C:\Windows\spupdsvc.log
2013-05-31 14:56 - 2013-05-31 14:58 - 00009059 ____A C:\Windows\ie8.log
2013-05-31 14:45 - 2013-05-31 14:59 - 00032493 ____A C:\Windows\ie8_main.log
2013-05-31 11:00 - 2013-05-31 11:00 - 00011524 ____A C:\Documents and Settings\all\Desktop\hijackthis
2013-05-25 18:17 - 2013-06-04 13:15 - 00025683 ____A C:\Windows\KB2829530-IE8.log
2013-05-25 17:52 - 2013-06-04 13:14 - 00018560 ____A C:\Windows\KB2847204-IE8.log
2013-05-25 17:52 - 2013-05-25 17:52 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-25 17:51 - 2013-05-25 17:52 - 00014323 ____A C:\Windows\KB2820197.log
2013-05-25 17:40 - 2013-05-25 17:40 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-25 17:09 - 2013-05-25 17:40 - 00025629 ____A C:\Windows\KB2829361.log
2013-05-24 02:03 - 2013-05-28 10:11 - 00000000 ____D C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders ========

2013-06-13 10:44 - 2013-06-13 10:44 - 00000000 ____D C:\FRST
2013-06-13 10:43 - 2013-06-13 10:43 - 01359203 ____A (Farbar) C:\Documents and Settings\all\Desktop\FRST.exe
2013-06-13 09:59 - 2012-03-31 05:15 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-12 23:18 - 2010-08-25 14:13 - 01343183 ____A C:\Windows\WindowsUpdate.log
2013-06-12 23:15 - 2013-06-12 23:15 - 00012613 ____A C:\ComboFix.txt
2013-06-12 23:15 - 2013-01-31 12:33 - 00000000 ____D C:\Qoobox
2013-06-12 23:15 - 2010-08-25 14:24 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-12 22:53 - 2004-08-04 16:00 - 00000227 ____A C:\Windows\system.ini
2013-06-12 22:18 - 2011-07-27 10:20 - 00000274 ____A C:\Windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
2013-06-12 22:18 - 2010-08-25 14:24 - 00032544 ____A C:\Windows\SchedLgU.Txt
2013-06-12 22:17 - 2013-01-31 10:10 - 00000282 ____A C:\Windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
2013-06-12 22:17 - 2013-01-31 10:10 - 00000274 ____A C:\Windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
2013-06-12 22:17 - 2010-01-25 00:54 - 00000000 ____D C:\Windows\Registration
2013-06-12 22:16 - 2010-08-25 14:27 - 00000062 __ASH C:\Documents and Settings\all\Local Settings\desktop.ini
2013-06-12 22:16 - 2010-08-25 10:06 - 00000159 ____A C:\Windows\wiadebug.log
2013-06-12 22:16 - 2010-08-25 10:06 - 00000049 ____A C:\Windows\wiaservc.log
2013-06-12 22:15 - 2010-08-25 14:24 - 00000062 __ASH C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\desktop.ini
2013-06-12 22:15 - 2010-08-25 14:24 - 00000062 __ASH C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\desktop.ini
2013-06-12 22:12 - 2010-08-25 14:27 - 00000178 ___SH C:\Documents and Settings\all\ntuser.ini
2013-06-12 21:55 - 2013-06-12 21:55 - 00000942 ____A C:\Documents and Settings\all\Desktop\inst.txt
2013-06-12 21:54 - 2013-06-12 21:53 - 00000628 ____A C:\Documents and Settings\all\Desktop\defogger_disable.log
2013-06-12 21:54 - 2013-06-12 21:53 - 00000020 ____A C:\Documents and Settings\all\defogger_reenable
2013-06-12 21:51 - 2013-06-12 21:51 - 00050477 ____A C:\Documents and Settings\all\Desktop\Defogger.exe
2013-06-12 21:18 - 2010-08-25 20:35 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
2013-06-12 21:16 - 2013-06-12 13:20 - 00018233 ____A C:\Windows\KB2839229.log
2013-06-12 21:16 - 2013-02-21 10:30 - 00117481 ____A C:\Windows\FaxSetup.log
2013-06-12 21:16 - 2013-02-21 10:30 - 00056164 ____A C:\Windows\ocgen.log
2013-06-12 21:16 - 2013-02-21 10:30 - 00044821 ____A C:\Windows\tsoc.log
2013-06-12 21:16 - 2013-02-21 10:30 - 00039164 ____A C:\Windows\comsetup.log
2013-06-12 21:16 - 2013-02-21 10:30 - 00023711 ____A C:\Windows\ntdtcsetup.log
2013-06-12 21:16 - 2013-02-21 10:30 - 00018657 ____A C:\Windows\iis6.log
2013-06-12 21:16 - 2013-02-21 10:30 - 00006498 ____A C:\Windows\ocmsn.log
2013-06-12 21:16 - 2013-02-21 10:30 - 00005871 ____A C:\Windows\msgsocm.log
2013-06-12 21:16 - 2013-02-21 10:30 - 00001374 ____A C:\Windows\imsins.log
2013-06-12 21:16 - 2013-02-07 20:39 - 00054979 ____A C:\Windows\setupapi.log
2013-06-12 21:15 - 2013-06-12 21:15 - 00000000 __HDC C:\Windows\$NtUninstallKB2839229$
2013-06-12 21:02 - 2013-06-12 20:59 - 00013205 ____A C:\Windows\KB2838727-IE8.log
2013-06-12 21:02 - 2013-02-21 10:30 - 00001374 ____A C:\Windows\imsins.BAK
2013-06-12 21:02 - 2010-08-25 14:15 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 21:01 - 2013-02-21 10:29 - 00016040 ____A C:\Windows\updspapi.log
2013-06-12 21:01 - 2010-01-24 16:02 - 00000000 ____D C:\Windows\ie8updates
2013-06-12 20:45 - 2013-06-12 20:45 - 00073474 ____A C:\Documents and Settings\all\Desktop\DeQuarantine.txt
2013-06-12 20:41 - 2013-06-12 20:40 - 00073474 ____A C:\DeQuarantine.txt
2013-06-12 20:41 - 2013-06-12 20:40 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
2013-06-12 03:59 - 2012-03-31 05:15 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 03:59 - 2011-05-14 01:23 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-11 23:05 - 2012-02-09 00:03 - 00000256 ____A C:\Windows\Tasks\Disk Cleanup.job
2013-06-11 16:37 - 2004-08-04 16:00 - 00013646 ____A C:\Windows\System32\wpa.dbl
2013-06-11 16:14 - 2013-06-11 16:14 - 05078680 ____R (Swearware) C:\Documents and Settings\all\Desktop\ComboFix.exe
2013-06-10 18:20 - 2013-06-09 17:53 - 00000710 ____A C:\Documents and Settings\all\Desktop\SystemLook.txt
2013-06-09 17:52 - 2013-06-09 17:30 - 00075264 ____A C:\Documents and Settings\all\Desktop\SystemLook.exe
2013-06-09 17:48 - 2013-06-09 17:48 - 00020338 ____A C:\Documents and Settings\all\Desktop\OTS Fix.txt
2013-06-09 17:37 - 2013-06-09 17:37 - 00000000 ____D C:\_OTS
2013-06-09 12:01 - 2013-06-09 11:24 - 00357702 ____A C:\Documents and Settings\all\Desktop\OTS.Txt
2013-06-09 11:01 - 2013-06-09 11:00 - 00646656 ____A (OldTimer Tools) C:\Documents and Settings\all\Desktop\OTS.exe
2013-06-09 10:49 - 2011-07-27 10:20 - 00000282 ____A C:\Windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
2013-06-07 16:06 - 2012-02-15 18:34 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-06-07 16:01 - 2013-01-31 12:23 - 02240352 ____A (Kaspersky Lab ZAO) C:\Documents and Settings\all\Desktop\tdsskiller.exe
2013-06-06 11:26 - 2013-06-06 11:26 - 00002253 ____A C:\Documents and Settings\all\Desktop\aswMBR.txt
2013-06-06 11:26 - 2013-06-06 10:44 - 00000512 ____A C:\Documents and Settings\all\Desktop\MBR.dat
2013-06-06 10:16 - 2013-06-06 10:14 - 04745728 ____A (AVAST Software) C:\Documents and Settings\all\Desktop\aswMBR.exe
2013-06-05 11:55 - 2013-06-05 11:54 - 05555190 ____A C:\Documents and Settings\all\Desktop\tweaking.com_windows_repair_aio_setup.exe
2013-06-05 11:39 - 2010-08-30 15:01 - 00000000 ____D C:\Documents and Settings\all\Local Settings\Application Data\CutePDF Writer
2013-06-05 11:39 - 2010-08-25 04:53 - 00000000 ____D C:\Documents and Settings\all\Desktop\Projects
2013-06-04 20:43 - 2013-06-04 20:44 - 00094112 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-06-04 20:42 - 2013-06-04 20:44 - 00263584 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-06-04 20:42 - 2013-06-04 20:44 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-06-04 20:42 - 2013-06-04 20:44 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2013-06-04 20:42 - 2013-06-04 20:44 - 00144896 ____A (Oracle Corporation) C:\Windows\System32\javacpl.cpl
2013-06-04 20:42 - 2012-06-26 08:59 - 00866720 ____A (Oracle Corporation) C:\Windows\System32\npdeployJava1.dll
2013-06-04 20:42 - 2010-11-05 16:05 - 00788896 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2013-06-04 20:42 - 2010-01-24 15:44 - 00000000 ____D C:\Program Files\Java
2013-06-04 20:40 - 2010-08-02 21:13 - 00000000 ____D C:\Program Files\SpywareBlaster
2013-06-04 13:15 - 2013-05-25 18:17 - 00025683 ____A C:\Windows\KB2829530-IE8.log
2013-06-04 13:14 - 2013-05-25 17:52 - 00018560 ____A C:\Windows\KB2847204-IE8.log
2013-06-04 12:45 - 2012-02-19 21:22 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate
2013-05-31 18:14 - 2010-08-25 03:13 - 00000000 __SHD C:\Documents and Settings\all\UserData
2013-05-31 18:00 - 2013-05-31 18:00 - 00011809 ____A C:\Documents and Settings\all\Desktop\hijackthis.log
2013-05-31 17:58 - 2012-02-13 14:44 - 00002443 ____A C:\Documents and Settings\all\Desktop\HiJackThis.lnk
2013-05-31 17:52 - 2013-05-31 17:52 - 00000803 ____A C:\Documents and Settings\all\Desktop\Internet Explorer.lnk
2013-05-31 17:50 - 2013-05-31 17:50 - 00018951 ____A C:\Documents and Settings\all\Desktop\ark.txt file..log
2013-05-31 15:26 - 2013-05-31 15:26 - 00020957 ____A C:\Documents and Settings\all\Desktop\attach.txt
2013-05-31 15:26 - 2013-05-31 15:26 - 00017089 ____A C:\Documents and Settings\all\Desktop\dds.txt
2013-05-31 15:05 - 2013-05-31 14:58 - 00007322 ____A C:\Windows\spupdsvc.log
2013-05-31 14:59 - 2013-05-31 14:45 - 00032493 ____A C:\Windows\ie8_main.log
2013-05-31 14:58 - 2013-05-31 14:56 - 00009059 ____A C:\Windows\ie8.log
2013-05-31 11:00 - 2013-05-31 11:00 - 00011524 ____A C:\Documents and Settings\all\Desktop\hijackthis
2013-05-30 11:15 - 2012-04-25 17:40 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-05-28 10:11 - 2013-05-24 02:03 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-28 10:03 - 2010-10-15 13:01 - 00000000 ____D C:\PMBoutique5
2013-05-28 10:03 - 2010-08-25 10:01 - 00277352 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-25 18:37 - 2010-01-24 17:53 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-25 18:14 - 2010-08-25 10:02 - 00584876 ____A C:\Windows\System32\PerfStringBackup.INI
2013-05-25 17:52 - 2013-05-25 17:52 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-25 17:52 - 2013-05-25 17:51 - 00014323 ____A C:\Windows\KB2820197.log
2013-05-25 17:51 - 2010-01-25 00:58 - 00000000 ____D C:\Windows\$hf_mig$
2013-05-25 17:40 - 2013-05-25 17:40 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-25 17:40 - 2013-05-25 17:09 - 00025629 ____A C:\Windows\KB2829361.log
2013-05-17 18:07 - 2004-08-04 16:00 - 06014976 ____C (Microsoft Corporation) C:\Windows\System32\dllcache\mshtml.dll
2013-05-17 18:07 - 2004-08-04 16:00 - 06014976 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

Addition log

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-06-2013 04
Ran by all at 2013-06-13 10:47:29 Run:
Running from C:\Documents and Settings\all\Desktop
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

µTorrent (Version: 3.1.3)
ABBYY FineReader 9.0 Sprint (Version: 9.01.513.58212)
ABC Amber LIT Converter
ABC Amber Text Converter
[email protected] ISO Burner (Version: 2.1.0)
Adobe AIR (Version: 3.3.0.3670)
Adobe Digital Editions
Adobe Flash Player 11 Plugin (Version: 11.7.700.224)
Adobe Photoshop Elements 7.0 (Version: 7.0)
Adobe Reader X (10.1.7) (Version: 10.1.7)
Aimersoft Music Converter(Build 1.4.3.0)
AnyTV Free 2.63
Ashampoo Burning Studio 6 FREE v.6.81 (Version: 6.8.1)
AudibleManager (Version: 2147307520.2147348480.1422696.1310008)
Auto Updater (Version: 0.09.990)
Borders Desktop
Buzz Tools
calibre (Version: 0.8.69)
CCleaner (Version: 3.27)
ConvertXtoDVD 4.1.2.336 (Version: 4.1.2.336)
Coupon Printer for Windows (Version: 5.0.0.0)
Creative MediaSource 5 (Version: 5.00)
Creative Removable Disk Manager
Creative System Information
Creative ZEN V Series (R2) (Version: 1.0)
CutePDF Writer 2.8
Dear Jane (Version: 1.0)
Desktop Doctor (Version: 2.5.5)
Download Updater (AOL LLC)
Epson CreativeZone
Epson Easy Photo Print 2 (Version: 2.2.0.0)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (Version: 1.00.0000)
Epson Easy Photo Print Plug-in for Windows Live Photo Gallery
Epson Easy Photo Print Plug-in for Windows Live Photo Gallery Setup (Version: 1.00.0000)
Epson Event Manager (Version: 2.40.0001)
Epson FAX Utility (Version: 1.10.00)
EPSON NX410 Series Printer Uninstall
Epson PC-FAX Driver
EPSON Scan
EPSON WorkForce 520 Series Printer Uninstall
EpsonNet Print (Version: 2.4i)
EpsonNet Setup 3.2 (Version: 3.2a)
EQ5 (Version: 1.00.0000)
ESET Online Scanner v3
ESET Smart Security (Version: 6.0.316.0)
Family Tree Maker 2006
Family Tree Maker 2010 (Version: 19.0.180)
Fdrawcmd.sys 1.0.1.10 (Version: 1.0.1.10)
FileOpen Client (Version: 3.0.83.920)
Foundation Factory Quilt Mag Blocks For Quilt-Pro
Free M4a to MP3 Converter 7.1
G7 Video Player Driver (Version: 1.00.0000)
Garmin POI Loader (Version: 2.6.0.0)
Garmin USB Drivers (Version: 2.3.0.0)
Garmin WebUpdater (Version: 2.4.2)
GoToMeeting 4.5.0.457
HiJackThis (Version: 1.0.0)
iCare by Wild Ginger Software, Inc.
Intel(R) Graphics Media Accelerator Driver
Intel(R) IPP Run-Time Installer 5.2 for Windows* on IA-32 (Version: 5.2.0.2)
Japanese Fonts Support For Adobe Reader 8 (Version: 8.0)
Java 7 Update 21 (Version: 7.0.210)
Java Auto Updater (Version: 2.1.9.5)
Knitting Math Wizard
Knitting Math Wizard (Version: 1.0)
LTCM Client
Magna-Hoop (Version: 2.01.0001)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2742597)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft ActiveSync (Version: 4.5.5096.0)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Compression Client Pack 1.0 for Windows XP (Version: 1)
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Money Plus (Version: 17)
Microsoft Money Shared Libraries (Version: 17.0.0.3817)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Professional Plus 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Primary Interoperability Assemblies 2005 (Version: 8.0.50727.42)
Microsoft Reader
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Software Update for Web Folders (English) 12 (Version: 12.0.6612.1000)
Microsoft SQL Server Compact 3.5 ENU (Version: 3.5.5386.0)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft VC9 runtime libraries (Version: 2.0.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft WSE 3.0 (Version: 3.0.5305.0)
Mozilla Firefox 21.0 (x86 en-US) (Version: 21.0)
Mozilla Maintenance Service (Version: 21.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 6 Service Pack 2 (KB973686) (Version: 6.20.2003.0)
OverDrive Media Console (Version: 3.2.20)
Pattern Master 5 Help and Movies
PatternMaster Boutique 4
PatternMaster Boutique 5
PatternMaster Boutique 5 Update
PatternMaster Boutique x5 (Version: 5.0)
PCStitch Pattern Viewer (Version: 7.2.8)
PED-Basic (Version: ANY)
PE-DESIGN Ver.6 (Version: ANY)
PE-DESIGN Ver.7 (Version: ANY)
Pick-A-Stitch (Version: 2.0)
PL-2303 USB-to-Serial
PowerISO (Version: 4.7)
Print-A-Grid
Print-A-Grid (Version: 2.5.0)
PRS-500 USB driver (Version: 1.0.00.08110)
Quilt-Pro Version 5
Quilt-Pro Version 6
RCA Opal (Model M4001, M4002, MC4001 and MC4002) Firmware Update Utility (Version: )
Reader Library by Sony (Version: 3.3.00.07130)
RealDownloader (Version: 1.3.0)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0)
RealPlayer (Version: 16.0.0)
REALTEK GbE & FE Ethernet PCI and PCIE Windows NIC Driver (Version: 1.06.0000)
Realtek High Definition Audio Driver (Version: 5.10.0.6710)
RealUpgrade 1.1 (Version: 1.1.0)
RegScrubXP 3.25
Sew Precise
Sew Precise 4
Shirley Liby Designs for Sew Precise!
SlimDrivers (Version: 2.2.28413)
SmartSound Quicktracks Plugin (Version: 3.0.8.0)
SMPlayer 0.6.9 (Version: 0.6.9)
Sock Wizard V2
Sock Wizard V2 (Version: 2.0.0)
Spybot - Search & Destroy (Version: 1.6.2)
SpywareBlaster 5.0 (Version: 5.0.0)
Sweater Wizard V3
Sweater Wizard V3 (Version: 3.0.0)
The Complete Genealogy Reporter (Version: Version 2010)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition
Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)
Update for Windows Internet Explorer 8 (KB2632503) (Version: 1)
Update for Windows Internet Explorer 8 (KB976662) (Version: 1)
Update for Windows XP (KB2467659) (Version: 1)
Update for Windows XP (KB2492386) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2607712) (Version: 1)
Update for Windows XP (KB2616676) (Version: 1)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Visual C++ 2008 x86 Runtime - (v9.0.30729) (Version: 9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (Version: 9.0.30729.01)
WebEx
WebFldrs XP (Version: 9.50.7523)
Wild Things! by Wild Ginger Software, Inc. (Version: 1.0)
Winamp (Version: 5.623 )
Winamp Toolbar
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0)
Windows Driver Package - Sony Corporation (PRSUSB) USB (08/08/2006 1.0.03.08080) (Version: 08/08/2006 1.0.03.08080)
Windows Imaging Component (Version: 3.0.0.0)
Windows Installer Clean Up (Version: 3.00.00.0000)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Management Framework Core
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series (Version: 9.00.2980)
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB895316
Windows Media Player 11
Windows XP Service Pack 3 (Version: 20080414.031525)
WinPatrol (Version: 24.1.2012)
WinRAR archiver
Yahoo! Music Jukebox
Yahoo! Software Update
Yahoo! Toolbar
ZEN V Series Media Explorer
ZENcast Organizer

==================== Restore Points =========================

14-03-2013 18:33:33 System Checkpoint
15-03-2013 20:23:16 System Checkpoint
16-03-2013 12:53:15 Software Distribution Service 3.0
17-03-2013 13:00:38 System Checkpoint
18-03-2013 13:09:39 System Checkpoint
19-03-2013 14:09:56 System Checkpoint
20-03-2013 15:10:14 System Checkpoint
21-03-2013 17:01:32 System Checkpoint
22-03-2013 17:33:52 System Checkpoint
23-03-2013 18:09:46 System Checkpoint
24-03-2013 14:45:07 Software Distribution Service 3.0
25-03-2013 15:09:49 System Checkpoint
26-03-2013 16:08:32 System Checkpoint
27-03-2013 17:09:49 System Checkpoint
28-03-2013 18:08:32 System Checkpoint
29-03-2013 19:08:55 System Checkpoint
30-03-2013 20:09:01 System Checkpoint
31-03-2013 21:08:57 System Checkpoint
01-04-2013 17:27:30 SlimDrivers Installing Drivers
01-04-2013 17:44:04 Installed Realtek High Definition Audio Driver
01-04-2013 17:49:16 SlimDrivers Installing Drivers
02-04-2013 18:06:53 System Checkpoint
03-04-2013 18:19:24 System Checkpoint
04-04-2013 19:19:21 System Checkpoint
05-04-2013 19:33:47 System Checkpoint
06-04-2013 20:33:41 System Checkpoint
07-04-2013 21:33:42 System Checkpoint
08-04-2013 22:33:44 System Checkpoint
09-04-2013 23:33:34 System Checkpoint
11-04-2013 00:33:39 System Checkpoint
12-04-2013 01:33:38 System Checkpoint
13-04-2013 02:33:51 System Checkpoint
14-04-2013 03:33:42 System Checkpoint
14-04-2013 15:19:04 Software Distribution Service 3.0
15-04-2013 15:51:18 System Checkpoint
16-04-2013 15:58:53 System Checkpoint
17-04-2013 16:58:35 System Checkpoint
18-04-2013 17:56:16 System Checkpoint
19-04-2013 17:59:06 System Checkpoint
20-04-2013 18:58:56 System Checkpoint
21-04-2013 19:08:08 System Checkpoint
22-04-2013 20:00:21 System Checkpoint
23-04-2013 20:58:29 System Checkpoint
24-04-2013 22:21:11 System Checkpoint
25-04-2013 23:02:35 System Checkpoint
26-04-2013 23:36:34 System Checkpoint
28-04-2013 00:36:36 System Checkpoint
29-04-2013 00:53:34 System Checkpoint
30-04-2013 01:36:42 System Checkpoint
01-05-2013 02:36:35 System Checkpoint
02-05-2013 03:36:32 System Checkpoint
02-05-2013 18:36:44 Removed ESET Smart Security
02-05-2013 18:38:23 Installed ESET Smart Security
03-05-2013 19:10:52 System Checkpoint
04-05-2013 20:11:05 System Checkpoint
05-05-2013 21:11:09 System Checkpoint
06-05-2013 22:11:09 System Checkpoint
07-05-2013 23:10:39 System Checkpoint
09-05-2013 00:10:38 System Checkpoint
10-05-2013 00:58:13 System Checkpoint
11-05-2013 01:10:54 System Checkpoint
11-05-2013 23:29:09 Restore Operation
11-05-2013 23:36:30 Restore Operation
11-05-2013 23:44:16 Restore Operation
25-05-2013 21:38:55 Software Distribution Service 3.0
28-05-2013 15:19:16 System Checkpoint
29-05-2013 15:45:42 System Checkpoint
30-05-2013 16:04:30 System Checkpoint
31-05-2013 16:06:45 System Checkpoint
31-05-2013 18:58:19 Installed Windows Internet Explorer 8.
01-06-2013 19:08:18 System Checkpoint
02-06-2013 20:08:22 System Checkpoint
03-06-2013 21:18:39 System Checkpoint
04-06-2013 17:12:51 Software Distribution Service 3.0
05-06-2013 00:40:23 Removed Java 7 Update 13
05-06-2013 00:42:07 Installed Java 7 Update 21
06-06-2013 01:19:46 System Checkpoint
07-06-2013 01:24:14 System Checkpoint
08-06-2013 02:24:24 System Checkpoint
09-06-2013 03:30:03 System Checkpoint
10-06-2013 03:48:37 System Checkpoint
11-06-2013 04:48:56 System Checkpoint
13-06-2013 00:59:33 Software Distribution Service 3.0

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (06/11/2013 06:30:17 PM) (Source: Application Error) (User: )
Description: Faulting application pev.exe, version 0.0.0.0, faulting module pev.exe, version 0.0.0.0, fault address 0x0008d1c0.
Processing media-specific event for [pev.exe!ws!]

Error: (06/11/2013 06:04:01 PM) (Source: Application Hang) (User: )
Description: Hanging application ComboFix.exe, version 13.6.8.2, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (06/11/2013 06:03:59 PM) (Source: Application Hang) (User: )
Description: Hanging application ComboFix.exe, version 13.6.8.2, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (06/11/2013 06:03:45 PM) (Source: Application Hang) (User: )
Description: Hanging application ERUNT.3XE, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (06/11/2013 05:56:35 PM) (Source: Application Hang) (User: )
Description: Hanging application ComboFix.exe, version 13.6.8.2, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (06/09/2013 05:35:10 PM) (Source: Application Hang) (User: )
Description: Hanging application OTS.exe, version 3.1.47.2, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (06/07/2013 04:01:44 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.

Error: (05/31/2013 03:31:44 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.

Error: (05/31/2013 02:39:54 PM) (Source: Application Hang) (User: )
Description: Fault bucket -710996888.

Error: (05/31/2013 02:39:41 PM) (Source: Application Hang) (User: )
Description: Hanging application firefox.exe, version 21.0.0.4879, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

System errors:
=============
Error: (06/09/2013 05:38:07 PM) (Source: Service Control Manager) (User: )
Description: The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

Error: (06/09/2013 05:38:03 PM) (Source: Service Control Manager) (User: )
Description: The Yahoo! Updater service terminated unexpectedly. It has done this 1 time(s).

Error: (06/09/2013 05:38:03 PM) (Source: Service Control Manager) (User: )
Description: The SupportSoft Sprocket Service (ddoctorv2) service terminated unexpectedly. It has done this 1 time(s).

Error: (06/09/2013 05:38:02 PM) (Source: Service Control Manager) (User: )
Description: The RealNetworks Downloader Resolver Service service terminated unexpectedly. It has done this 1 time(s).

Error: (06/09/2013 05:38:02 PM) (Source: Service Control Manager) (User: )
Description: The McciCMService service terminated unexpectedly. It has done this 1 time(s).

Error: (06/09/2013 05:38:02 PM) (Source: Service Control Manager) (User: )
Description: The FileOpen Manager Service service terminated unexpectedly. It has done this 1 time(s).

Error: (06/09/2013 05:38:01 PM) (Source: Service Control Manager) (User: )
Description: The Adobe Active File Monitor V7 service terminated unexpectedly. It has done this 1 time(s).

Error: (06/09/2013 05:38:01 PM) (Source: Service Control Manager) (User: )
Description: The ABBYY FineReader 9.0 Sprint Licensing Service service terminated unexpectedly. It has done this 1 time(s).

Error: (06/09/2013 05:38:01 PM) (Source: Service Control Manager) (User: )
Description: The EpsonBidirectionalService service terminated unexpectedly. It has done this 1 time(s).

Error: (06/04/2013 08:38:50 PM) (Source: Service Control Manager) (User: )
Description: The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

Microsoft Office Sessions:
=========================
Error: (03/22/2011 02:31:11 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 271695 seconds with 480 seconds of active time. This session ended with a crash.

Error: (03/10/2011 05:26:17 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 269041 seconds with 1800 seconds of active time. This session ended with a crash.

Error: (02/25/2011 00:15:09 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 356052 seconds with 900 seconds of active time. This session ended with a crash.

Error: (02/03/2011 02:45:28 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 2723 seconds with 720 seconds of active time. This session ended with a crash.

Error: (12/13/2010 09:51:02 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 29008 seconds with 240 seconds of active time. This session ended with a crash.

Error: (10/10/2010 07:52:13 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 119771 seconds with 300 seconds of active time. This session ended with a crash.

Error: (09/24/2010 07:51:05 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 35 seconds with 0 seconds of active time. This session ended with a crash.

==================== Memory info ===========================

Percentage of memory in use: 77%
Total physical RAM: 1015.23 MB
Available physical RAM: 223.91 MB
Total Pagefile: 2443.28 MB
Available Pagefile: 1722.24 MB
Total Virtual: 2047.88 MB
Available Virtual: 1949.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:149.04 GB) (Free:103.18 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive f: ( Elements G ) (Fixed) (Total:1397.26 GB) (Free:1198.26 GB) NTFS
Drive g: (Local Disk F) (Fixed) (Total:298.09 GB) (Free:174.58 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 149 GB) (Disk ID: AF61AF61)
Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 1397 GB) (Disk ID: 0003A97D)
Partition 1: (Not Active) - (Size=-698724909056) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 298 GB) (Disk ID: 6DF5F803)
Partition 1: (Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================


----------



## Cookiegal (Aug 27, 2003)

It's odd that the Pulse Ambassador program won't work as the log indicates all files were restored, including the ADIG.dll one. Are you trying to start it from a shortcut? Perhaps the shorcut is corrupt. Can you try to start the program from within the program files?

Download *OTS.exe * to your Desktop. 

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Double-click on *OTS.exe* to start the program.
At the top put a check mark in the box beside "Scan All Users".
Under the *Additional Scans *section put a check in the box next to Disabled MS Config Items, NetSvcs and EventViewer logs (Last 10 errors)
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## sarahmuriel (Feb 1, 2004)

Yes I was able to open the program by going to the Program files directly. Will run OTS now


----------



## sarahmuriel (Feb 1, 2004)

Log attached


----------



## Cookiegal (Aug 27, 2003)

That's good. I'm glad the program is working now. You can create a new shortcut if you want to have it on the desktop.

Please download *OTL* to your Desktop. 

Double-click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. 
Click the Run Scan button. Do not change any other settings unless otherwise instructed. The scan won't take long. 
When the scan completes, it will open two Notepad windows called *OTL.Txt* and *Extras.Txt*. These are saved in the same location as OTL. 
Please copy and paste the contents of both of these files here in your next reply.


----------



## sarahmuriel (Feb 1, 2004)

Logs as requested
OTL TXT

OTL logfile created on: 6/13/2013 3:58:24 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\all\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.23 Mb Total Physical Memory | 512.27 Mb Available Physical Memory | 50.46% Memory free
2.39 Gb Paging File | 1.98 Gb Available in Paging File | 82.89% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 103.24 Gb Free Space | 69.27% Space Free | Partition Type: NTFS
Drive F: | 1397.26 Gb Total Space | 1198.26 Gb Free Space | 85.76% Space Free | Partition Type: NTFS
Drive G: | 298.09 Gb Total Space | 174.58 Gb Free Space | 58.57% Space Free | Partition Type: NTFS

Computer Name: LENOVO | User Name: all | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/13 15:57:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTL.exe
PRC - [2013/06/04 20:43:13 | 000,181,664 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2013/03/21 15:19:46 | 001,341,664 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe
PRC - [2013/03/21 15:19:40 | 005,078,504 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
PRC - [2012/11/29 21:33:06 | 000,232,608 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
PRC - [2012/11/29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
PRC - [2012/04/30 19:56:52 | 000,213,888 | ---- | M] (FileOpen Systems Inc.) -- C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
PRC - [2009/05/14 18:07:14 | 000,759,048 | ---- | M] (ABBYY) -- C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
PRC - [2008/04/24 13:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe

========== Modules (No Company Name) ==========

MOD - [2012/11/29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
MOD - [2010/03/15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2009/11/05 08:39:40 | 000,087,552 | ---- | M] () -- C:\WINDOWS\system32\cpwmon2k.dll

========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\Program Files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe -- (Roxio UPnP Renderer 11)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2013/06/12 03:59:49 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/06/04 20:43:13 | 000,181,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/05/24 02:05:01 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/03/21 15:19:46 | 001,341,664 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn)
SRV - [2012/11/29 21:31:04 | 000,038,608 | ---- | M] () [Auto | Running] -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service)
SRV - [2012/04/30 19:56:52 | 000,213,888 | ---- | M] (FileOpen Systems Inc.) [Auto | Running] -- C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe -- (FileOpenManagerSvc)
SRV - [2010/05/15 10:56:20 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/04/02 22:34:12 | 000,073,728 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe -- (Sony SCSI Helper Service)
SRV - [2009/05/14 18:07:14 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Sprint.9.0)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0)
SRV - [2008/04/24 13:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe -- (sprtsvc_ddoctorv2)
SRV - [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe -- (EpsonBidirectionalService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Running] -- C:\DOCUME~1\all\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2013/02/20 11:07:38 | 000,062,512 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi)
DRV - [2013/01/10 15:08:16 | 000,150,080 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw)
DRV - [2013/01/10 15:08:16 | 000,040,376 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis)
DRV - [2013/01/10 15:08:14 | 000,161,368 | ---- | M] (ESET) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2013/01/10 15:08:14 | 000,122,240 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys -- (WsAudio_DeviceS(5)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys -- (WsAudio_DeviceS(4)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys -- (WsAudio_DeviceS(3)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys -- (WsAudio_DeviceS(2)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys -- (WsAudio_DeviceS(1)
DRV - [2010/10/05 06:20:02 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010/05/26 22:21:22 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2010/05/26 22:20:34 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2010/04/12 04:44:34 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2010/02/11 08:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2008/10/30 09:14:20 | 000,117,888 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/09/27 23:09:50 | 000,027,544 | ---- | M] (simonowen.com) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fdrawcmd.sys -- (fdrawcmd)
DRV - [2008/04/13 14:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2007/06/18 21:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2007/06/15 10:49:30 | 000,019,840 | R--- | M] (Generic) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\StMp3Rec.sys -- (StMp3Rec)
DRV - [2005/07/25 10:04:08 | 000,048,640 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2005/06/25 11:35:22 | 000,022,072 | ---- | M] (eBook Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\eBook.sys -- (eBook)
DRV - [2004/08/04 16:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004/08/04 16:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2003/04/23 09:45:00 | 000,016,896 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\busbcrw.sys -- (busbcrw)
DRV - [2001/11/12 06:23:12 | 000,022,748 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdpnp.sys -- (wdpnp)
DRV - [1999/12/31 20:00:00 | 006,168,208 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [1999/12/31 20:00:00 | 001,691,480 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [1999/12/31 20:00:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = 
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20120220050204593&tb_oid=20-02-2012&tb_mrud=20-02-2012

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKCU\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {6b0d4c9d-c6eb-4a9a-981c-ac3f9d8373c0}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{1BEF5668-7DD2-44C8-BA32-9036837407F9}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\..\SearchScopes\{47A758D5-4E93-4CFE-A2EC-502F6CD703B7}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=chr-yie8
IE - HKCU\..\SearchScopes\{61D30B33-61FA-4066-B03D-7CBE9A2FA94F}: "URL" = http://rover.ebay.com/rover/1/711-43047-14818-1/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{6b0d4c9d-c6eb-4a9a-981c-ac3f9d8373c0}: "URL" = http://search.xfinity.com/?cat=subweb&con=mmchrome&cid=xfstart_tech_search&q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
IE - HKCU\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20120220050204593&tb_oid=20-02-2012&tb_mrud=20-02-2012
IE - HKCU\..\SearchScopes\{F6AE964E-59BF-42E9-908D-EEEDE4C9FFD1}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "WOT Safe Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.yahoo.com"
FF - prefs.js..extensions.enabledAddons: %7B34712C68-7391-4c47-94F3-8F88D49AD632%7D:1.3.0
FF - prefs.js..extensions.enabledAddons: %7B59c81df5-4b7a-477b-912d-4e0fdf64e5f2%7D:0.9.90
FF - prefs.js..extensions.enabledAddons: %7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:2.5.9.20130418100420
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100127023632
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@sony.com/eBookLibrary: C:\Program Files\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013/01/31 10:08:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/24 02:05:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/06/10 10:11:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2013/05/02 14:42:22 | 000,000,000 | ---D | M]

[2010/08/29 11:43:41 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\all\Application Data\Mozilla\Extensions
[2013/05/25 14:29:57 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions
[2013/04/03 11:07:31 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010/09/09 13:07:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/02/09 13:55:46 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2013/04/26 09:56:01 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013/05/16 14:49:02 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/05/25 14:29:57 | 000,534,261 | ---- | M] () (No name found) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012/03/12 15:19:37 | 000,002,306 | ---- | M] () -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\searchplugins\wot-safe-search.xml
[2013/05/24 02:05:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/24 02:03:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/05/24 02:05:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/24 02:05:08 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/01/31 10:08:11 | 000,000,000 | ---D | M] (RealDownloader) -- C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2012/08/30 12:53:29 | 000,466,944 | ---- | M] (Catalina Marketing Corporation) -- C:\Program Files\mozilla firefox\plugins\NPcol400.dll
[2009/11/19 17:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2009/11/19 17:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2013/01/31 10:06:03 | 000,124,056 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2011/12/09 13:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2010/10/06 10:51:30 | 000,003,277 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\xfinitylcsearch.xml

O1 HOSTS File: ([2013/06/12 12:32:58 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
O4 - HKLM..\Run: [ddoctorv2] C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [FileOpenBroker] C:\Program Files\FileOpen\Services\FileOpenBroker32.exe (FileOpen Systems Inc.)
O4 - HKLM..\Run: [FUFAXSTM] C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [Reader Library Launcher] C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Sony Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: //@[email protected]/ ([]money in Local intranet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282722117312 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1342019053406 (MUWebControl Class)
O16 - DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} http://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab (DASWebDownload Class)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://mozysupport.webex.com/client/T27LB/support/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}: DhcpNameServer = 65.32.5.111 65.32.5.112
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\all\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\all\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/01/25 00:58:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2012/02/19 01:34:27 | 000,000,000 | R--D | M] - F:\autorun -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/13 15:57:04 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTL.exe
[2013/06/13 12:36:53 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2013/06/13 10:44:54 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/13 10:43:52 | 001,359,203 | ---- | C] (Farbar) -- C:\Documents and Settings\all\Desktop\FRST.exe
[2013/06/12 22:04:32 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2013/06/12 20:40:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
[2013/06/11 16:14:10 | 005,078,680 | R--- | C] (Swearware) -- C:\Documents and Settings\all\Desktop\ComboFix.exe
[2013/06/09 17:37:57 | 000,000,000 | ---D | C] -- C:\_OTS
[2013/06/09 11:00:27 | 000,646,656 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTS.exe
[2013/06/06 10:14:52 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Documents and Settings\all\Desktop\aswMBR.exe
[2013/06/04 20:44:24 | 000,144,896 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2013/06/04 20:44:21 | 000,263,584 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2013/06/04 20:44:09 | 000,094,112 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/06/04 20:44:08 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2013/06/04 20:44:08 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2013/05/24 02:03:40 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012/04/10 13:21:44 | 001,263,344 | ---- | C] (ESET) -- C:\Program Files\eset_smart_security_live_installer.exe
[2010/11/05 17:25:48 | 000,359,656 | ---- | C] (Microsoft Corporation) -- C:\Program Files\msicuu2.exe
[2010/08/29 11:23:14 | 003,760,464 | ---- | C] (Acro Software Inc. ) -- C:\Program Files\CuteWriter.exe
[2010/05/30 19:13:47 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Program Files\HiJackThis.exe
[2010/01/24 15:09:12 | 000,289,584 | ---- | C] (BitTorrent, Inc.) -- C:\Program Files\uTorrent.exe

========== Files - Modified Within 30 Days ==========

[2013/06/13 15:59:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/06/13 15:57:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTL.exe
[2013/06/13 12:37:57 | 000,646,656 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTS.exe
[2013/06/13 10:43:57 | 001,359,203 | ---- | M] (Farbar) -- C:\Documents and Settings\all\Desktop\FRST.exe
[2013/06/12 22:18:02 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
[2013/06/12 22:17:36 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
[2013/06/12 22:17:35 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
[2013/06/12 22:15:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/06/12 21:54:17 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\all\defogger_reenable
[2013/06/12 21:51:54 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\all\Desktop\Defogger.exe
[2013/06/12 21:02:15 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/06/12 12:32:58 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013/06/12 03:59:44 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/06/12 03:59:43 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/06/11 23:05:00 | 000,000,256 | ---- | M] () -- C:\WINDOWS\tasks\Disk Cleanup.job
[2013/06/11 16:37:31 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/06/11 16:14:13 | 005,078,680 | R--- | M] (Swearware) -- C:\Documents and Settings\all\Desktop\ComboFix.exe
[2013/06/09 17:52:19 | 000,075,264 | ---- | M] () -- C:\Documents and Settings\all\Desktop\SystemLook.exe
[2013/06/09 10:49:41 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
[2013/06/07 16:01:02 | 002,240,352 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\all\Desktop\tdsskiller.exe
[2013/06/06 11:26:46 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\all\Desktop\MBR.dat
[2013/06/06 10:16:02 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Documents and Settings\all\Desktop\aswMBR.exe
[2013/06/05 11:55:07 | 005,555,190 | ---- | M] () -- C:\Documents and Settings\all\Desktop\tweaking.com_windows_repair_aio_setup.exe
[2013/06/04 20:43:19 | 000,094,112 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/06/04 20:42:58 | 000,263,584 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2013/06/04 20:42:58 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2013/06/04 20:42:58 | 000,144,896 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2013/06/04 20:42:57 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2013/06/04 20:42:54 | 000,866,720 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\npdeployJava1.dll
[2013/06/04 20:42:53 | 000,788,896 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2013/05/31 17:58:28 | 000,002,443 | ---- | M] () -- C:\Documents and Settings\all\Desktop\HiJackThis.lnk
[2013/05/31 17:52:02 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\all\Desktop\Internet Explorer.lnk
[2013/05/31 11:00:15 | 000,011,524 | ---- | M] () -- C:\Documents and Settings\all\Desktop\hijackthis
[2013/05/30 11:06:46 | 000,604,966 | ---- | M] () -- C:\Documents and Settings\all\Desktop\sari june.JPG
[2013/05/28 10:03:57 | 000,277,352 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/25 18:14:45 | 000,505,306 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/25 18:14:44 | 000,087,712 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/17 18:07:22 | 006,014,976 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll

========== Files Created - No Company Name ==========

[2013/06/12 21:53:47 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\all\defogger_reenable
[2013/06/12 21:51:49 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\all\Desktop\Defogger.exe
[2013/06/09 17:30:31 | 000,075,264 | ---- | C] () -- C:\Documents and Settings\all\Desktop\SystemLook.exe
[2013/06/06 10:44:26 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\all\Desktop\MBR.dat
[2013/06/05 11:54:54 | 005,555,190 | ---- | C] () -- C:\Documents and Settings\all\Desktop\tweaking.com_windows_repair_aio_setup.exe
[2013/05/31 17:52:02 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\all\Desktop\Internet Explorer.lnk
[2013/05/31 11:00:15 | 000,011,524 | ---- | C] () -- C:\Documents and Settings\all\Desktop\hijackthis
[2013/05/30 11:06:13 | 000,604,966 | ---- | C] () -- C:\Documents and Settings\all\Desktop\sari june.JPG
[2013/01/31 12:33:43 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2013/01/31 12:33:43 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2013/01/31 12:33:43 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2013/01/31 12:33:43 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2013/01/31 12:33:43 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/10/07 19:42:46 | 000,025,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTAIODAT.DAT
[2012/10/07 19:23:45 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2012/09/24 15:54:46 | 000,153,600 | ---- | C] () -- C:\WINDOWS\System32\WS_ATLMovie.dll
[2012/03/10 10:22:25 | 000,000,432 | ---- | C] () -- C:\WINDOWS\Sp03.ini
[2012/02/18 17:52:11 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/02/08 18:36:11 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/01/16 23:01:31 | 000,001,015 | ---- | C] () -- C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2
[2011/08/25 15:36:56 | 000,000,286 | ---- | C] () -- C:\WINDOWS\System32\commong7.dat
[2011/08/25 15:33:40 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2011/06/27 14:46:49 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2011/06/27 14:46:49 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2010/11/05 17:25:36 | 000,315,121 | ---- | C] () -- C:\Program Files\msicuu2.zip
[2010/10/15 13:05:09 | 000,000,637 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft.SqlServer.Compact.351.32.bc
[2010/09/04 17:26:31 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\all\Application Data\$_hpcst$.hpc
[2010/08/29 13:29:32 | 000,071,106 | ---- | C] () -- C:\Program Files\UserGuide.htm
[2010/08/29 12:48:10 | 000,249,856 | ---- | C] () -- C:\Program Files\pelite.exe
[2010/08/29 11:31:29 | 018,862,693 | ---- | C] () -- C:\Program Files\KoboSetup.exe
[2010/08/28 12:44:36 | 000,018,944 | ---- | C] () -- C:\Documents and Settings\all\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/17 17:20:49 | 000,105,704 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/07/07 14:38:54 | 001,578,514 | ---- | C] () -- C:\Program Files\abcreb_setup.exe
[2010/02/14 18:07:42 | 004,787,413 | ---- | C] () -- C:\Program Files\copistar_full.exe
[2010/01/24 17:20:47 | 001,909,451 | ---- | C] () -- C:\Program Files\abcpdf.zip

========== ZeroAccess Check ==========

[2012/01/16 23:01:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\$NtUninstallKB15309$\3647988386\L
[2012/01/16 23:01:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\$NtUninstallKB15309$\3647988386\U
[2010/08/26 09:56:25 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/13 20:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/13 20:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\all\My Documents\untitled.bmp:Roxio EMC Stream
@Alternate Data Stream - 196 bytes -> C:\Documents and Settings\all\My Documents\Ladies Prefer rogues.pdf:SummaryInformation
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\all\My Documents\Ladies Prefer rogues.pdf:DocumentSummaryInformation

< End of report >

EXTRAS

OTL Extras logfile created on: 6/13/2013 3:58:24 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\all\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.23 Mb Total Physical Memory | 512.27 Mb Available Physical Memory | 50.46% Memory free
2.39 Gb Paging File | 1.98 Gb Available in Paging File | 82.89% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 103.24 Gb Free Space | 69.27% Space Free | Partition Type: NTFS
Drive F: | 1397.26 Gb Total Space | 1198.26 Gb Free Space | 85.76% Space Free | Partition Type: NTFS
Drive G: | 298.09 Gb Total Space | 174.58 Gb Free Space | 58.57% Space Free | Partition Type: NTFS

Computer Name: LENOVO | User Name: all | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"1900:UDP" = 1900:UDP:LocalSubNetisabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNetisabledxpsp2res.dll,-22008
"5985:TCP" = 5985:TCP:*isabled:Windows Remote Management

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\Epson Software\Event Manager\EEventManager.exe" = C:\Program Files\Epson Software\Event Manager\EEventManager.exe:*:Enabled:EEventManager.exe -- (SEIKO EPSON CORPORATION)
"C:\Program Files\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe" = C:\Program Files\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe:*:Enabled:EpsonNet Setup -- (SEIKO EPSON CORPORATION)
"C:\Program Files\Winamp\winamp.exe" = C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp -- (Nullsoft, Inc.)
"C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox -- (Yahoo!)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{007811BF-E310-4285-BFC6-55DB29B3EDDE}" = WinPatrol
"{024AB1F9-2387-4FDD-A5BD-9ADAFA5CE772}" = calibre
"{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}" = Epson Event Manager
"{0A22BA52-9F00-4A14-8DAF-A86793E0E113}" = G7 Video Player Driver
"{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}" = Epson FAX Utility
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2514199A-EB1C-4BAF-9D2D-BE02AFFBBC95}" = Sock Wizard V2
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{27040F24-7260-4BCE-B45F-E19B40970EEE}" = PE-DESIGN Ver.7
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{362C8212-C6CA-4BBC-A9BA-A0C134C4F02E}" = PED-Basic
"{3756F880-B20D-434E-B52D-C094B898CD35}" = Magna-Hoop
"{38F48AED-66D8-464C-993E-C7296C7A199B}" = Intel(R) IPP Run-Time Installer 5.2 for Windows* on IA-32
"{39F58DDB-B2B8-4B86-AF20-4706A80EB30D}" = Epson Easy Photo Print 2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{45AB2DEF-2577-43CC-95FF-A027AD6ADFE8}" = Sweater Wizard V3
"{46946FCD-E712-47AF-8C78-C69D27D02940}" = PatternMaster Boutique x5
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{4AA3980B-6035-4F05-8B2C-93C7790A28B8}" = Dear Jane
"{4C597111-97A2-4114-BA80-4294CF516A8B}" = PatternMaster Boutique x5
"{4CA6A2DF-A805-4E40-95A9-CC8FE86DC742}" = EQ5
"{553C904F-57A2-4113-888E-BA0C3D1C69C0}" = Microsoft VC9 runtime libraries
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74CB82A8-4FB0-4031-81F2-D8762E5DA13C}" = Auto Updater
"{7694E0B1-2332-448B-9235-929F84B41E3F}" = [email protected] ISO Burner
"{76A64A33-D197-4525-85EE-255D6E5F3604}" = FileOpen Client
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{7B7044AE-6D1F-456D-B2BA-28BFFFAF3F71}" = Epson Easy Photo Print Plug-in for Windows Live Photo Gallery Setup
"{7BB3D57E-6FA1-47A1-8068-A405F81CE4E4}" = PCStitch Pattern Viewer
"{7E052F74-10A7-42E7-84EB-01C172F5AB5D}" = SlimDrivers
"{7F1B3341-A94E-4F5C-B587-CA0EB964221E}" = Microsoft Money Shared Libraries
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89EAD745-088B-4160-B964-42C4D4D273AD}" = Family Tree Maker 2010
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9862E0CB-4727-4FFC-963A-E22A9E9EC10C}" = Creative ZEN V Series (R2)
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A212E6C2-20F7-4A8E-BD8E-DC3EE7483FA2}" = PRS-500 USB driver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4C38F93-2AA4-7B66-E5BA-6D0182E57BD1}" = Pick-A-Stitch
"{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.7)
"{AC76BA86-7AD7-5760-0000-800000000003}" = Japanese Fonts Support For Adobe Reader 8
"{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}" = RealDownloader
"{B202B201-5D15-4CA7-A978-047AB4A28960}" = PE-DESIGN Ver.6
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6F7DBE7-2FE2-458F-A738-B10832746036}" = Microsoft Reader
"{B70E5793-F912-4C62-AFE2-C4F0B078FD31}" = Reader Library by Sony
"{BCC899FE-2DAA-460C-A5FB-60291E73D9C3}" = Microsoft SQL Server Compact 3.5 ENU
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4A9CFAF-8957-489F-898F-DB8647FFDB42}" = Garmin POI Loader
"{C9D8A041-2963-4B31-8FFC-1500F3DB9293}" = EpsonNet Setup 3.2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D07205E7-F6D3-4333-AFCC-782A07685B72}" = OverDrive Media Console
"{D17111CB-C992-42A9-9D56-C19395102AAA}" = Garmin WebUpdater
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D87149B3-7A1D-4548-9CBF-032B791E5908}" = Desktop Doctor
"{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1" = ConvertXtoDVD 4.1.2.336
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E6C82F8F-2031-4825-8CC3-98C5960875C1}" = Epson CreativeZone
"{E8AD944D-70C7-4477-92C0-628D516F9E1C}" = Print-A-Grid
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EDEA8AB7-7683-4ED2-AA19-E6C078064C0D}" = Microsoft WSE 3.0
"{EFE0F631-6748-4A2F-A409-FA1A287D8075}" = PL-2303 USB-to-Serial
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2F4C144-7D1A-47C4-9D53-395A57B0CD64}" = Family Tree Maker 2006
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F38C8A69-17EC-4B99-9243-E4C700742B00}" = RCA Opal (Model M4001, M4002, MC4001 and MC4002) Firmware Update Utility
"{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}" = REALTEK GbE & FE Ethernet PCI and PCIE Windows NIC Driver
"{F9000000-0018-0000-0000-074957833700}" = ABBYY FineReader 9.0 Sprint
"{FBFA7DDB-4188-457E-BD16-81B26E2B447C}" = ESET Smart Security
"{FE8663DE-8E26-431F-B069-4DB08AD1B444}" = Knitting Math Wizard
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"75070B1806113224B16C70296B90DD1AD8A53479" = Windows Driver Package - Sony Corporation (PRSUSB) USB (08/08/2006 1.0.03.08080)
"ABBYY FineReader 9.0 Sprint" = ABBYY FineReader 9.0 Sprint
"ABC Amber LIT Converter" = ABC Amber LIT Converter
"ABC Amber Text Converter" = ABC Amber Text Converter
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0
"Aimersoft Music Converter_is1" = Aimersoft Music Converter(Build 1.4.3.0)
"AnyTV Free_is1" = AnyTV Free 2.63
"Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE v.6.81
"AudibleManager" = AudibleManager
"Borders Desktop" = Borders Desktop
"Buzz Tools" = Buzz Tools
"CCleaner" = CCleaner
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"Creative Removable Disk Manager" = Creative Removable Disk Manager
"CutePDF Writer Installation" = CutePDF Writer 2.8
"Digital Editions" = Adobe Digital Editions
"EEPPPlugIn" = Epson Easy Photo Print Plug-in for Windows Live Photo Gallery
"EPSON NX410 Series" = EPSON NX410 Series Printer Uninstall
"EPSON PC-FAX Driver 2" = Epson PC-FAX Driver
"EPSON Scanner" = EPSON Scan
"EPSON WorkForce 520 Series" = EPSON WorkForce 520 Series Printer Uninstall
"ESET Online Scanner" = ESET Online Scanner v3
"Family Tree Maker 2010" = Family Tree Maker 2010
"fdrawcmd" = Fdrawcmd.sys 1.0.1.10
"Foundation Factory Quilt Mag Blocks For Quilt-Pro" = Foundation Factory Quilt Mag Blocks For Quilt-Pro
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.1
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"iCare by Wild Ginger Software, Inc." = iCare by Wild Ginger Software, Inc.
"ie8" = Windows Internet Explorer 8
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{4AA3980B-6035-4F05-8B2C-93C7790A28B8}" = Dear Jane
"InstallShield_{4CA6A2DF-A805-4E40-95A9-CC8FE86DC742}" = EQ5
"Knitting Math Wizard" = Knitting Math Wizard
"LTCM Client" = LTCM Client
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Money2008b" = Microsoft Money Plus
"Mozilla Firefox 21.0 (x86 en-US)" = Mozilla Firefox 21.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Pattern Master 5 Help and Movies" = Pattern Master 5 Help and Movies
"PatternMaster Boutique 4" = PatternMaster Boutique 4
"PatternMaster Boutique 5" = PatternMaster Boutique 5
"PatternMaster Boutique 5 Update" = PatternMaster Boutique 5 Update
"Pick-A-Stitch" = Pick-A-Stitch
"PowerISO" = PowerISO
"Print-A-Grid" = Print-A-Grid
"PROPLUS" = Microsoft Office Professional Plus 2007
"Quilt-Pro Version 5" = Quilt-Pro Version 5
"Quilt-Pro Version 6" = Quilt-Pro Version 6
"RealPlayer 16.0" = RealPlayer
"RegScrubXP_is1" = RegScrubXP 3.25
"Sew Precise" = Sew Precise
"Sew Precise 4" = Sew Precise 4
"Shirley Liby Designs for Sew Precise!" = Shirley Liby Designs for Sew Precise!
"SMPlayer" = SMPlayer 0.6.9
"Sock Wizard V2" = Sock Wizard V2
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SpywareBlaster_is1" = SpywareBlaster 5.0
"Sweater Wizard V3" = Sweater Wizard V3
"SysInfo" = Creative System Information
"The Complete Genealogy Reporter_is1" = The Complete Genealogy Reporter
"uTorrent" = µTorrent
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Wild Things! by Wild Ginger Software, Inc." = Wild Things! by Wild Ginger Software, Inc.
"Winamp" = Winamp
"Winamp Toolbar" = Winamp Toolbar
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Music Engine" = Yahoo! Music Jukebox
"Yahoo! Software Update" = Yahoo! Software Update
"Zen V Series Media Explorer" = ZEN V Series Media Explorer
"ZENcast Organizer" = ZENcast Organizer

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.5.0.457
"Winamp Toolbar" = Winamp Toolbar

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 5/31/2013 2:39:54 PM | Computer Name = LENOVO | Source = Application Hang | ID = 1001
Description = Fault bucket -710996888.

Error - 5/31/2013 3:31:44 PM | Computer Name = LENOVO | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 6/7/2013 4:01:44 PM | Computer Name = LENOVO | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 6/9/2013 5:35:10 PM | Computer Name = LENOVO | Source = Application Hang | ID = 1002
Description = Hanging application OTS.exe, version 3.1.47.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 6/11/2013 5:56:35 PM | Computer Name = LENOVO | Source = Application Hang | ID = 1002
Description = Hanging application ComboFix.exe, version 13.6.8.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 6/11/2013 6:03:45 PM | Computer Name = LENOVO | Source = Application Hang | ID = 1002
Description = Hanging application ERUNT.3XE, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 6/11/2013 6:03:59 PM | Computer Name = LENOVO | Source = Application Hang | ID = 1002
Description = Hanging application ComboFix.exe, version 13.6.8.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 6/11/2013 6:04:01 PM | Computer Name = LENOVO | Source = Application Hang | ID = 1002
Description = Hanging application ComboFix.exe, version 13.6.8.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 6/11/2013 6:30:17 PM | Computer Name = LENOVO | Source = Application Error | ID = 1000
Description = Faulting application pev.exe, version 0.0.0.0, faulting module pev.exe,
version 0.0.0.0, fault address 0x0008d1c0.

Error - 6/13/2013 12:41:29 PM | Computer Name = LENOVO | Source = Application Hang | ID = 1002
Description = Hanging application OTS.exe, version 3.1.47.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ OSession Events ]
Error - 9/24/2010 7:51:05 PM | Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 35
seconds with 0 seconds of active time. This session ended with a crash.

Error - 10/10/2010 7:52:13 PM | Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 119771
seconds with 300 seconds of active time. This session ended with a crash.

Error - 12/13/2010 9:51:02 PM | Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 29008
seconds with 240 seconds of active time. This session ended with a crash.

Error - 2/3/2011 2:45:28 PM | Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 2723
seconds with 720 seconds of active time. This session ended with a crash.

Error - 2/25/2011 12:15:09 AM | Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 356052
seconds with 900 seconds of active time. This session ended with a crash.

Error - 3/10/2011 5:26:17 PM | Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 269041
seconds with 1800 seconds of active time. This session ended with a crash.

Error - 3/22/2011 2:31:11 PM | Computer Name = LENOVO | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6212.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 271695
seconds with 480 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 6/4/2013 8:38:50 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 6/9/2013 5:38:01 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The EpsonBidirectionalService service terminated unexpectedly. It
has done this 1 time(s).

Error - 6/9/2013 5:38:01 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The ABBYY FineReader 9.0 Sprint Licensing Service service terminated
unexpectedly. It has done this 1 time(s).

Error - 6/9/2013 5:38:01 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The Adobe Active File Monitor V7 service terminated unexpectedly. 
It has done this 1 time(s).

Error - 6/9/2013 5:38:02 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The FileOpen Manager Service service terminated unexpectedly. It 
has done this 1 time(s).

Error - 6/9/2013 5:38:02 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The McciCMService service terminated unexpectedly. It has done this
1 time(s).

Error - 6/9/2013 5:38:02 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The RealNetworks Downloader Resolver Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 6/9/2013 5:38:03 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The SupportSoft Sprocket Service (ddoctorv2) service terminated unexpectedly.
It has done this 1 time(s).

Error - 6/9/2013 5:38:03 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The Yahoo! Updater service terminated unexpectedly. It has done this
1 time(s).

Error - 6/9/2013 5:38:07 PM | Computer Name = LENOVO | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

< End of report >


----------



## Cookiegal (Aug 27, 2003)

Now we're getting somewhere. Before I even go through that entire log, I see the problem and want you to run ComboFix again. Be sure to turn off your security programs temporarily when running the scan.

Open Notepad and copy and paste the text in the code box below into it:


```
Folder::
C:\WINDOWS\$NtUninstallKB15309$
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe (or the renamed puppy.exe if you were asked to rename it).










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.


----------



## sarahmuriel (Feb 1, 2004)

Finally it ended

CF text Log

ComboFix 13-06-08.02 - all 06/13/2013 20:13:25.15.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.580 [GMT -4:00]
Running from: c:\documents and settings\all\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\all\Desktop\CFScript.txt
AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ESET Personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB15309$
c:\windows\$NtUninstallKB15309$\1501995166
.
.
((((((((((((((((((((((((( Files Created from 2013-05-14 to 2013-06-14 )))))))))))))))))))))))))))))))
.
.
2013-06-13 14:44 . 2013-06-13 14:44	--------	d-----w-	C:\FRST
2013-06-13 00:40 . 2013-06-13 00:41	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
2013-06-09 21:37 . 2013-06-09 21:37	--------	d-----w-	C:\_OTS
2013-06-05 00:44 . 2013-06-05 00:42	144896	----a-w-	c:\windows\system32\javacpl.cpl
2013-06-05 00:44 . 2013-06-05 00:43	94112	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 07:59 . 2012-03-31 09:15	692104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-06-12 07:59 . 2011-05-14 05:23	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-05 00:42 . 2012-06-26 12:59	866720	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-06-05 00:42 . 2010-11-05 20:05	788896	----a-w-	c:\windows\system32\deployJava1.dll
2013-05-07 22:30 . 2004-08-04 20:00	920064	----a-w-	c:\windows\system32\wininet.dll
2013-05-07 22:30 . 2004-08-04 20:00	43520	------w-	c:\windows\system32\licmgr10.dll
2013-05-07 22:30 . 2004-08-04 20:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2013-05-07 21:53 . 2004-08-04 20:00	385024	------w-	c:\windows\system32\html.iec
2013-05-03 01:30 . 2004-08-04 20:00	2149888	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-05-03 00:38 . 2004-08-03 22:59	2028544	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-04-10 01:31 . 2004-08-04 20:00	1876352	----a-w-	c:\windows\system32\win32k.sys
2012-04-10 17:21 . 2012-04-10 17:21	1263344	----a-w-	c:\program files\eset_smart_security_live_installer.exe
2010-08-29 15:32 . 2010-08-29 15:31	18862693	----a-w-	c:\program files\KoboSetup.exe
2010-08-29 15:23 . 2010-08-29 15:23	3760464	----a-w-	c:\program files\CuteWriter.exe
2010-08-19 22:08 . 2010-11-05 21:25	359656	----a-w-	c:\program files\msicuu2.exe
2010-01-24 19:09 . 2010-01-24 19:09	289584	----a-w-	c:\program files\uTorrent.exe
2009-11-11 06:06 . 2010-02-14 22:07	4787413	----a-w-	c:\program files\copistar_full.exe
2009-03-31 05:01 . 2010-05-30 23:13	401720	----a-w-	c:\program files\HiJackThis.exe
2007-08-09 02:07 . 2010-07-07 18:38	1578514	----a-w-	c:\program files\abcreb_setup.exe
2001-12-25 12:03 . 2010-08-29 16:48	249856	----a-w-	c:\program files\pelite.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2011-09-28 1937736]
.
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WinampTb.AOLTBSearch]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LTCM Client"="c:\program files\LTCM Client\ltcmClient.exe" [2009-08-05 1596096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-01-30 400480]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-03 847872]
"FileOpenBroker"="c:\program files\FileOpen\Services\FileOpenBroker32.exe" [2012-04-30 836480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2000-01-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2000-01-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2000-01-01 137752]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-01-31 295072]
"RTHDCPL"="RTHDCPL.EXE" [2000-01-01 20117136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-03-21 5078504]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2006-8-14 49152]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\EpsonNet\\EpsonNet Setup\\tool10\\ENEasyApp.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5985:TCP"= 5985:TCP:*isabled:Windows Remote Management 
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8/4/2011 9:20 AM 122240]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [5/14/2009 6:07 PM 759048]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 12:03 PM 169312]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [3/21/2013 3:19 PM 1341664]
R2 FileOpenManagerSvc;FileOpen Manager Service;c:\program files\FileOpen\Services\FileOpenManagerSvc32.exe [4/30/2012 7:56 PM 213888]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [11/29/2012 9:31 PM 38608]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [9/24/2012 3:55 PM 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [9/24/2012 3:58 PM 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [9/24/2012 3:59 PM 25704]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [10/7/2012 7:42 PM 1691480]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [4/23/2003 9:45 AM 16896]
S3 eBook;eBook;c:\windows\system32\drivers\eBook.sys [6/25/2005 11:35 AM 22072]
S3 fdrawcmd;Low-level Floppy Driver;c:\windows\system32\drivers\fdrawcmd.sys [9/27/2008 11:09 PM 27544]
S3 wdpnp;WinDriver USB Client;c:\windows\system32\drivers\wdpnp.sys [8/29/2010 1:14 PM 22748]
S4 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;"c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe" --> c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/5/2010 6:20 AM 691696]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - FileOpenWebPublisherScreenHookDriver
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32	128512	------w-	c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 07:59]
.
2013-06-12 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 00:12]
.
2013-06-14 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-14 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-14 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchAssistant = 
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2010-08-28 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-13 21:08
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2368)
c:\windows\system32\WININET.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\msdtc.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Comcast\Desktop Doctor\bin\sprtsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\RTHDCPL.EXE
c:\progra~1\MICROS~4\rapimgr.exe
c:\windows\System32\logon.scr
.
**************************************************************************
.
Completion time: 2013-06-13 21:34:47 - machine was rebooted
ComboFix-quarantined-files.txt 2013-06-14 01:34
ComboFix2.txt 2013-06-13 03:15
ComboFix3.txt 2013-06-12 16:53
ComboFix4.txt 2013-06-11 23:08
ComboFix5.txt 2013-06-13 23:57
.
Pre-Run: 110,803,677,184 bytes free
Post-Run: 110,863,667,200 bytes free
.
- - End Of File - - 32D2DC1AE42F69463147EE48BB051F78
8F558EB6672622401DA993E1E865C861


----------



## Cookiegal (Aug 27, 2003)

That's good. Please run OTL again and post the new log.

I'm signing off for the night and will review all of these logs in the morning.


----------



## sarahmuriel (Feb 1, 2004)

OTL new log

OTL logfile created on: 6/14/2013 6:05:38 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\all\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.23 Mb Total Physical Memory | 416.87 Mb Available Physical Memory | 41.06% Memory free
2.39 Gb Paging File | 1.93 Gb Available in Paging File | 81.08% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 103.33 Gb Free Space | 69.33% Space Free | Partition Type: NTFS
Drive F: | 1397.26 Gb Total Space | 1198.26 Gb Free Space | 85.76% Space Free | Partition Type: NTFS
Drive G: | 298.09 Gb Total Space | 174.58 Gb Free Space | 58.57% Space Free | Partition Type: NTFS

Computer Name: LENOVO | User Name: all | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/13 15:57:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTL.exe
PRC - [2013/06/04 20:43:13 | 000,181,664 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2013/03/21 15:19:46 | 001,341,664 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe
PRC - [2013/03/21 15:19:40 | 005,078,504 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
PRC - [2013/01/31 10:05:49 | 000,295,072 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2012/11/29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
PRC - [2012/04/30 19:56:52 | 000,213,888 | ---- | M] (FileOpen Systems Inc.) -- C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
PRC - [2012/04/30 19:56:50 | 000,836,480 | ---- | M] (FileOpen Systems Inc.) -- C:\Program Files\FileOpen\Services\FileOpenBroker32.exe
PRC - [2012/01/30 14:35:14 | 000,400,480 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2010/07/13 02:34:46 | 000,906,648 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
PRC - [2010/04/12 04:40:16 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files\PowerISO\PWRISOVM.EXE
PRC - [2009/12/03 11:12:12 | 000,976,320 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Epson Software\Event Manager\EEventManager.exe
PRC - [2009/12/03 00:00:00 | 000,847,872 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
PRC - [2009/05/14 18:07:14 | 000,759,048 | ---- | M] (ABBYY) -- C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
PRC - [2008/04/24 13:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
PRC - [2008/04/24 13:25:22 | 000,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/07/17 11:03:38 | 000,868,352 | ---- | M] () -- C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
PRC - [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
PRC - [2006/08/14 13:12:46 | 000,049,152 | ---- | M] () -- C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe

========== Modules (No Company Name) ==========

MOD - [2012/11/29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
MOD - [2011/04/14 21:01:33 | 000,548,854 | ---- | M] () -- C:\Program Files\BillP Studios\WinPatrol\sqlite3.dll
MOD - [2010/07/13 02:29:42 | 000,143,360 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\launcher\connectionDetector.dll
MOD - [2010/07/13 02:28:42 | 000,856,064 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\launcher\fsk.dll
MOD - [2010/07/13 02:26:12 | 000,018,432 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\launcher\FskNetInterface.dll
MOD - [2010/07/13 02:25:56 | 000,008,704 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\launcher\FskTimeHardware.dll
MOD - [2010/07/13 02:25:50 | 000,028,160 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\launcher\ticket.dll
MOD - [2010/07/13 02:25:42 | 000,011,776 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\launcher\ebookDeviceNotifier.dll
MOD - [2010/07/13 02:22:36 | 000,020,480 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\FskinLocalize.dll
MOD - [2010/07/13 02:22:02 | 000,009,728 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\FskPower.dll
MOD - [2010/07/13 02:16:16 | 000,118,784 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\FskDocumentViewer.dll
MOD - [2010/07/13 02:15:58 | 000,010,240 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\FskMobileMediaDevice.dll
MOD - [2010/07/13 02:15:52 | 000,233,472 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\Fskin.dll
MOD - [2010/07/13 02:13:42 | 000,033,792 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\FskMediaPlayers.dll
MOD - [2010/07/13 02:10:56 | 000,172,032 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\launcher\USBDetector.dll
MOD - [2010/04/02 22:23:36 | 000,815,104 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\FskSecurity.dll
MOD - [2010/04/02 21:44:16 | 000,086,016 | ---- | M] () -- C:\Program Files\Sony\Reader\Data\bin\launcher\ebookUsb.dll
MOD - [2009/11/05 08:39:40 | 000,087,552 | ---- | M] () -- C:\WINDOWS\system32\cpwmon2k.dll
MOD - [2007/07/17 11:03:38 | 000,868,352 | ---- | M] () -- C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
MOD - [2007/04/02 08:49:20 | 000,355,112 | ---- | M] () -- C:\WINDOWS\system32\msjetoledb40.dll
MOD - [2007/02/07 16:51:20 | 000,188,416 | ---- | M] () -- C:\Program Files\Creative\Sync Manager Unicode\CTSyncRs.crl
MOD - [2006/08/14 13:12:46 | 000,049,152 | ---- | M] () -- C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe

========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\Program Files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe -- (Roxio UPnP Renderer 11)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2013/06/12 03:59:49 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/06/04 20:43:13 | 000,181,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/05/24 02:05:01 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/03/21 15:19:46 | 001,341,664 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn)
SRV - [2012/11/29 21:31:04 | 000,038,608 | ---- | M] () [Auto | Running] -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service)
SRV - [2012/04/30 19:56:52 | 000,213,888 | ---- | M] (FileOpen Systems Inc.) [Auto | Running] -- C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe -- (FileOpenManagerSvc)
SRV - [2010/05/15 10:56:20 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/04/02 22:34:12 | 000,073,728 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe -- (Sony SCSI Helper Service)
SRV - [2009/05/14 18:07:14 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Sprint.9.0)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0)
SRV - [2008/04/24 13:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe -- (sprtsvc_ddoctorv2)
SRV - [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe -- (EpsonBidirectionalService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\DOCUME~1\all\LOCALS~1\Temp\mbr.sys -- (mbr)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2013/02/20 11:07:38 | 000,062,512 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi)
DRV - [2013/01/10 15:08:16 | 000,150,080 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw)
DRV - [2013/01/10 15:08:16 | 000,040,376 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis)
DRV - [2013/01/10 15:08:14 | 000,161,368 | ---- | M] (ESET) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2013/01/10 15:08:14 | 000,122,240 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys -- (WsAudio_DeviceS(5)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys -- (WsAudio_DeviceS(4)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys -- (WsAudio_DeviceS(3)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys -- (WsAudio_DeviceS(2)
DRV - [2012/03/07 14:31:08 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys -- (WsAudio_DeviceS(1)
DRV - [2010/10/05 06:20:02 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010/05/26 22:21:22 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2010/05/26 22:20:34 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2010/04/12 04:44:34 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2010/02/11 08:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2008/10/30 09:14:20 | 000,117,888 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/09/27 23:09:50 | 000,027,544 | ---- | M] (simonowen.com) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fdrawcmd.sys -- (fdrawcmd)
DRV - [2008/04/13 14:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2007/06/18 21:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2007/06/15 10:49:30 | 000,019,840 | R--- | M] (Generic) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\StMp3Rec.sys -- (StMp3Rec)
DRV - [2005/07/25 10:04:08 | 000,048,640 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2005/06/25 11:35:22 | 000,022,072 | ---- | M] (eBook Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\eBook.sys -- (eBook)
DRV - [2004/08/04 16:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004/08/04 16:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2003/04/23 09:45:00 | 000,016,896 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\busbcrw.sys -- (busbcrw)
DRV - [2001/11/12 06:23:12 | 000,022,748 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdpnp.sys -- (wdpnp)
DRV - [1999/12/31 20:00:00 | 006,168,208 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [1999/12/31 20:00:00 | 001,691,480 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [1999/12/31 20:00:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = 
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20120220050204593&tb_oid=20-02-2012&tb_mrud=20-02-2012

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKCU\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {6b0d4c9d-c6eb-4a9a-981c-ac3f9d8373c0}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{1BEF5668-7DD2-44C8-BA32-9036837407F9}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\..\SearchScopes\{47A758D5-4E93-4CFE-A2EC-502F6CD703B7}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=chr-yie8
IE - HKCU\..\SearchScopes\{61D30B33-61FA-4066-B03D-7CBE9A2FA94F}: "URL" = http://rover.ebay.com/rover/1/711-43047-14818-1/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{6b0d4c9d-c6eb-4a9a-981c-ac3f9d8373c0}: "URL" = http://search.xfinity.com/?cat=subweb&con=mmchrome&cid=xfstart_tech_search&q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
IE - HKCU\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20120220050204593&tb_oid=20-02-2012&tb_mrud=20-02-2012
IE - HKCU\..\SearchScopes\{F6AE964E-59BF-42E9-908D-EEEDE4C9FFD1}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "WOT Safe Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.yahoo.com"
FF - prefs.js..extensions.enabledAddons: %7B34712C68-7391-4c47-94F3-8F88D49AD632%7D:1.3.0
FF - prefs.js..extensions.enabledAddons: %7B59c81df5-4b7a-477b-912d-4e0fdf64e5f2%7D:0.9.90
FF - prefs.js..extensions.enabledAddons: %7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:2.5.9.20130418100420
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100127023632
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@sony.com/eBookLibrary: C:\Program Files\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013/01/31 10:08:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/24 02:05:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/06/10 10:11:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2013/05/02 14:42:22 | 000,000,000 | ---D | M]

[2010/08/29 11:43:41 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\all\Application Data\Mozilla\Extensions
[2013/05/25 14:29:57 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions
[2013/04/03 11:07:31 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010/09/09 13:07:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/02/09 13:55:46 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2013/04/26 09:56:01 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013/05/16 14:49:02 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/05/25 14:29:57 | 000,534,261 | ---- | M] () (No name found) -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012/03/12 15:19:37 | 000,002,306 | ---- | M] () -- C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\searchplugins\wot-safe-search.xml
[2013/05/24 02:05:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/24 02:03:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/05/24 02:05:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/24 02:05:08 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/01/31 10:08:11 | 000,000,000 | ---D | M] (RealDownloader) -- C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2012/08/30 12:53:29 | 000,466,944 | ---- | M] (Catalina Marketing Corporation) -- C:\Program Files\mozilla firefox\plugins\NPcol400.dll
[2009/11/19 17:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2009/11/19 17:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2013/01/31 10:06:03 | 000,124,056 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2011/12/09 13:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2010/10/06 10:51:30 | 000,003,277 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\xfinitylcsearch.xml

O1 HOSTS File: ([2013/06/13 21:08:30 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
O4 - HKLM..\Run: [ddoctorv2] C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [FileOpenBroker] C:\Program Files\FileOpen\Services\FileOpenBroker32.exe (FileOpen Systems Inc.)
O4 - HKLM..\Run: [FUFAXSTM] C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [Reader Library Launcher] C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Sony Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: //@[email protected]/ ([]money in Local intranet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282722117312 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1342019053406 (MUWebControl Class)
O16 - DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} http://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab (DASWebDownload Class)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://mozysupport.webex.com/client/T27LB/support/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}: DhcpNameServer = 65.32.5.111 65.32.5.112
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\all\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\all\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/01/25 00:58:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2012/02/19 01:34:27 | 000,000,000 | R--D | M] - F:\autorun -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/13 15:57:04 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTL.exe
[2013/06/13 10:44:54 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/13 10:43:52 | 001,359,203 | ---- | C] (Farbar) -- C:\Documents and Settings\all\Desktop\FRST.exe
[2013/06/12 22:04:32 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2013/06/12 20:40:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
[2013/06/11 16:14:10 | 005,078,680 | R--- | C] (Swearware) -- C:\Documents and Settings\all\Desktop\ComboFix.exe
[2013/06/09 17:37:57 | 000,000,000 | ---D | C] -- C:\_OTS
[2013/06/09 11:00:27 | 000,646,656 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTS.exe
[2013/06/06 10:14:52 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Documents and Settings\all\Desktop\aswMBR.exe
[2013/06/04 20:44:24 | 000,144,896 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2013/06/04 20:44:21 | 000,263,584 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2013/06/04 20:44:09 | 000,094,112 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/06/04 20:44:08 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2013/06/04 20:44:08 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2013/05/24 02:03:40 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012/04/10 13:21:44 | 001,263,344 | ---- | C] (ESET) -- C:\Program Files\eset_smart_security_live_installer.exe
[2010/11/05 17:25:48 | 000,359,656 | ---- | C] (Microsoft Corporation) -- C:\Program Files\msicuu2.exe
[2010/08/29 11:23:14 | 003,760,464 | ---- | C] (Acro Software Inc. ) -- C:\Program Files\CuteWriter.exe
[2010/05/30 19:13:47 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Program Files\HiJackThis.exe
[2010/01/24 15:09:12 | 000,289,584 | ---- | C] (BitTorrent, Inc.) -- C:\Program Files\uTorrent.exe

========== Files - Modified Within 30 Days ==========

[2013/06/14 05:59:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/06/13 23:05:00 | 000,000,256 | ---- | M] () -- C:\WINDOWS\tasks\Disk Cleanup.job
[2013/06/13 21:08:30 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013/06/13 21:08:26 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
[2013/06/13 21:08:22 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
[2013/06/13 21:08:21 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
[2013/06/13 20:40:58 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/06/13 15:57:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTL.exe
[2013/06/13 12:37:57 | 000,646,656 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\all\Desktop\OTS.exe
[2013/06/13 10:43:57 | 001,359,203 | ---- | M] (Farbar) -- C:\Documents and Settings\all\Desktop\FRST.exe
[2013/06/12 21:54:17 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\all\defogger_reenable
[2013/06/12 21:51:54 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\all\Desktop\Defogger.exe
[2013/06/12 21:02:15 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/06/12 03:59:44 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/06/12 03:59:43 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/06/11 16:37:31 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/06/11 16:14:13 | 005,078,680 | R--- | M] (Swearware) -- C:\Documents and Settings\all\Desktop\ComboFix.exe
[2013/06/09 17:52:19 | 000,075,264 | ---- | M] () -- C:\Documents and Settings\all\Desktop\SystemLook.exe
[2013/06/09 10:49:41 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
[2013/06/07 16:01:02 | 002,240,352 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\all\Desktop\tdsskiller.exe
[2013/06/06 11:26:46 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\all\Desktop\MBR.dat
[2013/06/06 10:16:02 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Documents and Settings\all\Desktop\aswMBR.exe
[2013/06/05 11:55:07 | 005,555,190 | ---- | M] () -- C:\Documents and Settings\all\Desktop\tweaking.com_windows_repair_aio_setup.exe
[2013/06/04 20:43:19 | 000,094,112 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/06/04 20:42:58 | 000,263,584 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2013/06/04 20:42:58 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2013/06/04 20:42:58 | 000,144,896 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2013/06/04 20:42:57 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2013/06/04 20:42:54 | 000,866,720 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\npdeployJava1.dll
[2013/06/04 20:42:53 | 000,788,896 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2013/05/31 17:58:28 | 000,002,443 | ---- | M] () -- C:\Documents and Settings\all\Desktop\HiJackThis.lnk
[2013/05/31 17:52:02 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\all\Desktop\Internet Explorer.lnk
[2013/05/31 11:00:15 | 000,011,524 | ---- | M] () -- C:\Documents and Settings\all\Desktop\hijackthis
[2013/05/30 11:06:46 | 000,604,966 | ---- | M] () -- C:\Documents and Settings\all\Desktop\sari june.JPG
[2013/05/28 10:03:57 | 000,277,352 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/25 18:14:45 | 000,505,306 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/25 18:14:44 | 000,087,712 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/17 18:07:22 | 006,014,976 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll

========== Files Created - No Company Name ==========

[2013/06/12 21:53:47 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\all\defogger_reenable
[2013/06/12 21:51:49 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\all\Desktop\Defogger.exe
[2013/06/09 17:30:31 | 000,075,264 | ---- | C] () -- C:\Documents and Settings\all\Desktop\SystemLook.exe
[2013/06/06 10:44:26 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\all\Desktop\MBR.dat
[2013/06/05 11:54:54 | 005,555,190 | ---- | C] () -- C:\Documents and Settings\all\Desktop\tweaking.com_windows_repair_aio_setup.exe
[2013/05/31 17:52:02 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\all\Desktop\Internet Explorer.lnk
[2013/05/31 11:00:15 | 000,011,524 | ---- | C] () -- C:\Documents and Settings\all\Desktop\hijackthis
[2013/05/30 11:06:13 | 000,604,966 | ---- | C] () -- C:\Documents and Settings\all\Desktop\sari june.JPG
[2013/01/31 12:33:43 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2013/01/31 12:33:43 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2013/01/31 12:33:43 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2013/01/31 12:33:43 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2013/01/31 12:33:43 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/10/07 19:42:46 | 000,025,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTAIODAT.DAT
[2012/10/07 19:23:45 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2012/09/24 15:54:46 | 000,153,600 | ---- | C] () -- C:\WINDOWS\System32\WS_ATLMovie.dll
[2012/03/10 10:22:25 | 000,000,432 | ---- | C] () -- C:\WINDOWS\Sp03.ini
[2012/02/18 17:52:11 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/02/08 18:36:11 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/01/16 23:01:31 | 000,001,015 | ---- | C] () -- C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2
[2011/08/25 15:36:56 | 000,000,286 | ---- | C] () -- C:\WINDOWS\System32\commong7.dat
[2011/08/25 15:33:40 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2011/06/27 14:46:49 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2011/06/27 14:46:49 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2010/11/05 17:25:36 | 000,315,121 | ---- | C] () -- C:\Program Files\msicuu2.zip
[2010/10/15 13:05:09 | 000,000,637 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft.SqlServer.Compact.351.32.bc
[2010/09/04 17:26:31 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\all\Application Data\$_hpcst$.hpc
[2010/08/29 13:29:32 | 000,071,106 | ---- | C] () -- C:\Program Files\UserGuide.htm
[2010/08/29 12:48:10 | 000,249,856 | ---- | C] () -- C:\Program Files\pelite.exe
[2010/08/29 11:31:29 | 018,862,693 | ---- | C] () -- C:\Program Files\KoboSetup.exe
[2010/08/28 12:44:36 | 000,018,944 | ---- | C] () -- C:\Documents and Settings\all\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/17 17:20:49 | 000,105,704 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/07/07 14:38:54 | 001,578,514 | ---- | C] () -- C:\Program Files\abcreb_setup.exe
[2010/02/14 18:07:42 | 004,787,413 | ---- | C] () -- C:\Program Files\copistar_full.exe
[2010/01/24 17:20:47 | 001,909,451 | ---- | C] () -- C:\Program Files\abcpdf.zip

========== ZeroAccess Check ==========

[2010/08/26 09:56:25 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/13 20:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/13 20:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\all\My Documents\untitled.bmp:Roxio EMC Stream
@Alternate Data Stream - 196 bytes -> C:\Documents and Settings\all\My Documents\Ladies Prefer rogues.pdf:SummaryInformation
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\all\My Documents\Ladies Prefer rogues.pdf:DocumentSummaryInformation

< End of report >


----------



## Cookiegal (Aug 27, 2003)

Does this look familiar to you as a trusted site that you place in the Trusted Zone intentionally?

*O15 - HKCU\..Trusted Domains: //@[email protected]/ ([]money in Local intranet*

Also, please tell me what device generally appears as your F drive as it may be infected.


----------



## Cookiegal (Aug 27, 2003)

Something else I'd like you to do please.

Please download AdwCleaner from here to your desktop

Run AdwCleaner and select "Search" (do not select "Delete" at this time)

Once the scan is finished a log will be produced. Please copy and paste the log into your next reply.


----------



## sarahmuriel (Feb 1, 2004)

I have no idea nor have ever used surf.mar, Scotty just advised that Real Networks installer wanted to be added to 
c/documents and settings/all/applicationdata/real/update/upgradehelper. I said no. Requested it again said no. In my drive F the 1 TB outside drive. I know of 1 specific file there that has creepies. It's the Embird (embroidery program) which I did deleate from my computer but looking at the F drive I found the original download in zip files is still there. How can I seriously deleate from that drive, Just delete or something more ? Will start the scan of ADW cleaner


----------



## sarahmuriel (Feb 1, 2004)

ADw clear log

# AdwCleaner v2.303 - Logfile created 06/14/2013 at 19:45:38
# Updated 08/06/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : all - LENOVO
# Boot Mode : Normal
# Running from : C:\Documents and Settings\all\My Documents\Downloads\AdwCleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

File Found : C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnu.xpt
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.xpt
Folder Found : C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate
Folder Found : C:\Documents and Settings\All Users.WINDOWS\Application Data\Premium
Folder Found : C:\Documents and Settings\All Users.WINDOWS\Application Data\Winamp Toolbar
Folder Found : C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
Folder Found : C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\WinampToolbarData
Folder Found : C:\Documents and Settings\all\Local Settings\Application Data\Winamp Toolbar
Folder Found : C:\Program Files\Common Files\Software Update Utility
Folder Found : C:\Program Files\Winamp Toolbar

***** [Registry] *****

Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Winamp Toolbar
Key Found : HKCU\Software\Winamp Toolbar
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{49BC4DD1-0E69-4611-9164-0009538C5E46}
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\winamptbServer.exe
Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6EF4E91D-DDD5-4478-BCA7-DA04435934C0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B38D6EDE-390B-4620-8365-29E16459EBDA}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F20F11FD-203E-45A9-B7BB-AFC1B4FEA7A6}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE178B09-C8AA-4734-804D-1849BCCA0C29}
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{0F54B66A-21CF-4548-AE59-A6B83EE6676F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{51A971CA-D36E-4D13-A799-2CF0A491D04D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{56FBEA9F-EF93-4318-B75F-A96FC7C7BD7B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66DD22B9-6521-4B05-97DB-0EBC00B1DA5D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{78B3C85E-44FF-4DC8-B3AD-156F39DC75E5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E19FDA06-5BDF-43C2-B794-BCD8A4C2051F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FAB076F5-E4DD-4EA4-AFEE-F18BF972B057}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{507591C2-2F4E-46A7-92D6-E6CFF82E5F26}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{538CD77C-BFDD-49B0-9562-77419CAB89D1}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.Downloader
Key Found : HKLM\SOFTWARE\Classes\WinampTb.Downloader.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarInfo
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarInfo.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams.1
Key Found : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper
Key Found : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper.1
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1791C1B5-FFD0-4D4B-ABCD-7A7DF6EAA89C}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49BC4DD1-0E69-4611-9164-0009538C5E46}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A8C2644D-BF72-4A89-A88C-D85F565F2F46}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Winamp Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Winamp Toolbar
Key Found : HKLM\Software\Winamp Toolbar
Key Found : HKU\S-1-5-21-1644491937-115176313-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Key Found : HKU\S-1-5-21-1644491937-115176313-682003330-1004\Software\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Mozilla Firefox v21.0 (en-US)

File : C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\prefs.js

Found : user_pref("browser.search.defaultthis.engineName", "MyAshampoo Customized Web Search");

*************************

AdwCleaner[R1].txt - [9537 octets] - [14/06/2013 19:45:38]

########## EOF - C:\AdwCleaner[R1].txt - [9597 octets] ##########


----------



## Cookiegal (Aug 27, 2003)

Is the Embird program free software and do you use it?

We can check the external drive.

Be sure to have your external drive connected before doing this.

I'm attaching a MountPoints Diagnostic.zip file to this post. Save it to your desktop. Unzjip it and double click the MountPoints Diagnostic.bat file and let it run. It will create a report in Notepad named Diagnostic.txt. Please upload the Diagnostic.txt file as an attachment.


Also, please run AdwCleaner again and select the "delete" option then post the resulting log.


----------



## sarahmuriel (Feb 1, 2004)

Embird is an embroidery software that you can download and use free for 30 days, then you have to pay for it. I found a key to continue using it. later I found it funky and decided to stop using it. It has not been open in more than a year. I purchased others. Still prefer the Embird, will have to dish out the $200+ for it in the future.

I have 2 outside drives Maxtor Drive G and Elements drive F 
Elements is 1 TB, I have no programs on it, it has my ebooks, quilt info and tutorials, cooking recipes, music and embroidery files. It also has some movie files on how to Knit and serge etc. No TV or movie files.

Diagnostic Txt

Diagnostic Report
Sat 06/15/2013 10:20:29.32

Mountpoints > Drives subkeys: 
------------------------------------

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab844a9c-09ae-11df-8ecd-806d6172696f}]
"BaseClass"="Drive"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab844a9d-09ae-11df-8ecd-806d6172696f}]
"BaseClass"="Drive"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d15714a8-09df-11df-b4cb-002197606606}]
"BaseClass"="Drive"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d93c5f5d-b11b-11df-b8e1-002197606606}]
"BaseClass"="Drive"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fef0929e-44f6-11e0-b973-002197606606}]
"BaseClass"="Drive"

~~~~~~~~~~~~~~~~~~~~~~~~~ 
No Autorun files found in C:\WINDOWS

No Autorun files found in C:\WINDOWS\system32

No Autorun files found in root of C:

No Autorun files found in root of G:

ADW files after delete

# AdwCleaner v2.303 - Logfile created 06/15/2013 at 10:10:54
# Updated 08/06/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : all - LENOVO
# Boot Mode : Normal
# Running from : C:\Documents and Settings\all\My Documents\Downloads\AdwCleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.xpt
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.xpt
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\Premium
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\Winamp Toolbar
Folder Deleted : C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
Folder Deleted : C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\WinampToolbarData
Folder Deleted : C:\Documents and Settings\all\Local Settings\Application Data\Winamp Toolbar
Folder Deleted : C:\Program Files\Common Files\Software Update Utility
Folder Deleted : C:\Program Files\Winamp Toolbar

***** [Registry] *****

Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Winamp Toolbar
Key Deleted : HKCU\Software\Winamp Toolbar
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{49BC4DD1-0E69-4611-9164-0009538C5E46}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\winamptbServer.exe
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6EF4E91D-DDD5-4478-BCA7-DA04435934C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B38D6EDE-390B-4620-8365-29E16459EBDA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F20F11FD-203E-45A9-B7BB-AFC1B4FEA7A6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE178B09-C8AA-4734-804D-1849BCCA0C29}
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0F54B66A-21CF-4548-AE59-A6B83EE6676F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{51A971CA-D36E-4D13-A799-2CF0A491D04D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{56FBEA9F-EF93-4318-B75F-A96FC7C7BD7B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66DD22B9-6521-4B05-97DB-0EBC00B1DA5D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{78B3C85E-44FF-4DC8-B3AD-156F39DC75E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E19FDA06-5BDF-43C2-B794-BCD8A4C2051F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FAB076F5-E4DD-4EA4-AFEE-F18BF972B057}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{507591C2-2F4E-46A7-92D6-E6CFF82E5F26}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{538CD77C-BFDD-49B0-9562-77419CAB89D1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch.1
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand.1
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.Downloader
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.Downloader.1
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.ToolbarInfo
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.ToolbarInfo.1
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams
Key Deleted : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams.1
Key Deleted : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper
Key Deleted : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper.1
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1791C1B5-FFD0-4D4B-ABCD-7A7DF6EAA89C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49BC4DD1-0E69-4611-9164-0009538C5E46}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A8C2644D-BF72-4A89-A88C-D85F565F2F46}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Winamp Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Winamp Toolbar
Key Deleted : HKLM\Software\Winamp Toolbar
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Mozilla Firefox v21.0 (en-US)

File : C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\prefs.js

C:\Documents and Settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\user.js ... Deleted !

Deleted : user_pref("browser.search.defaultthis.engineName", "MyAshampoo Customized Web Search");

*************************

AdwCleaner[R1].txt - [9666 octets] - [14/06/2013 19:45:38]
AdwCleaner[S1].txt - [9609 octets] - [15/06/2013 10:10:54]

########## EOF - C:\AdwCleaner[S1].txt - [9669 octets] ##########

Thanks in advance Sarah


----------



## Cookiegal (Aug 27, 2003)

Was the Elements drive inserted when you ran Mountpoints Diagnostic?


----------



## sarahmuriel (Feb 1, 2004)

Yes, that was inserted, has no programs to run on it, just files. Yes, Elements 1 TB is drive G and Maxtor is drive F. All my drives are always connected to my desktop. I never disconnect them.


----------



## Cookiegal (Aug 27, 2003)

Please do a search on the F drive for a file called "autorun.inf" If found, please right-click on it and select "open with" and then "Notepad" and copy and paste the contents here.

Also, please do this:

Please run OTL again. Under the *Custom Scans/Fixes* box at the bottom paste in the following:


```
:OTL
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
O15 - HKCU\..Trusted Domains: //@[email protected]/ ([]money in Local intranet)
[2012/01/16 23:01:31 | 000,001,015 | ---- | C] () -- C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2
```

Then click the *Run Fix* button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

I also would like you to run GMER again but please drag it to the Recycle Bin and redownload it be sure you have the latest version.

Please download GMER from: http://www.gmer.net

Click on the "Download EXE" button and save the randomly named .exe file to your desktop.

*Note: You must uninstall any CD Emulation programs that you have before running GMER as they can cause conflicts and give false results.*

Double click the GMER .exe file on your desktop to run the tool and it will automatically do a quick scan.

If the tool warns of rootkit activity and asks if you want to run a full scan, click on No and make sure the following are *unchecked *on the right-hand side:

IAT/EAT
Any drive letter other than the primary system drive (which is generally C).

Click the *Scan *button and when the scan is finished, click *Save* and save the log in Notepad with the name ark.txt to your desktop.

*Note: It's important that all other windows be closed and that you don't touch the mouse or do anything with the computer during the scan as it may cause it to freeze. You should disable your screen saver as if it comes on it may cause the program to freeze.*

Open the ark.txt file and copy and paste the contents of the log here please.


----------



## sarahmuriel (Feb 1, 2004)

I have run the autorun.info in the F drive, but everytime it finishes and I select all to them copy windows says it has run into a problem and it must shut down to send the error report. Thrice I have run into this problem. What can I do, there are some embird files, a book, 3 quilting programs I rarely used. Will work on the other request. Let me know if you know of any solution.

Sarah


----------



## Cookiegal (Aug 27, 2003)

If you go to My Computer and then click on the F drive letter to open the drive, do you see an autorun.inf file listed there as: F:\autorun.inf? It may just show as F:\autorun without any file extension.


----------



## sarahmuriel (Feb 1, 2004)

Right now gamer is running, wick as soon as it ends. I has gone to search with words autorun.inf as the search parameter.


----------



## sarahmuriel (Feb 1, 2004)

Don't you hate when the tablet tries to correct your spelling. Urghhhhhhh


----------



## Cookiegal (Aug 27, 2003)

sarahmuriel said:


> Right now gamer is running, wick as soon as it ends. I has gone to search with words autorun.inf as the search parameter.


Please don't use search but follow the instructions I gave for locating the file.


----------



## sarahmuriel (Feb 1, 2004)

Oh yes, found the autorun folder with only one entry for the drive which is a WD and a hidden file Thumbs db, not the 13 entries when I searched on the drive, it even had an auto run on a book. Sorry, unable to copy that file, there is no open with option and when I choose to open. it will open and show contents but it will not copy when I left click on the file or the contents on the files.

OTL Log of today

========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//@[email protected]/\ deleted successfully.
C:\Documents and Settings\all\Local Settings\Application Data\d1e682a2 moved successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 06152013_162825
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ARK text

GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-06-15 22:13:56
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-6 Hitachi_HDP725016GLA380 rev.GMBOA5NA 149.05GB
Running: 8m5f8j14.exe; Driver: C:\DOCUME~1\all\LOCALS~1\Temp\pxtdapod.sys

---- System - GMER 2.1 ----

SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwAssignProcessToJobObject [0x9F8474B0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwCreateThread [0x9F8477F0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwDebugActiveProcess [0x9F847AB0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwDuplicateObject [0x9F8475D0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwLoadDriver [0x9F8478B0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwOpenProcess [0x9F847350]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwOpenThread [0x9F847410]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwProtectVirtualMemory [0x9F847570]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwQueueApcThread [0x9F847630]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSetContextThread [0x9F847530]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSetInformationThread [0x9F8474F0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSetSecurityObject [0x9F847670]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSetSystemInformation [0x9F847870]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSuspendProcess [0x9F8473B0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSuspendThread [0x9F847430]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwSystemDebugControl [0x9F847830]
SSDT  \SystemRoot\system32\DRIVERS\ehdrv.sys ZwTerminateProcess [0x9F847370]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwTerminateThread [0x9F847470]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys ZwWriteVirtualMemory [0x9F8475F0]

---- Kernel code sections - GMER 2.1 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 307C 80504964 12 Bytes [B0, 73, 84, 9F, 30, 74, 84, ...] {MOV AL, 0x73; TEST [EDI-0x607b8bd0], BL; XOR [EAX-0x7c], BH; LAHF }
? System32\Drivers\SCDEmu.SYS The system cannot find the path specified. !

---- User code sections - GMER 2.1 ----

.text C:\WINDOWS\system32\SearchIndexer.exe[492] kernel32.dll!WriteFile 7C8112FF 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL
.text C:\program files\real\realplayer\update\realsched.exe[1628] kernel32.dll!SetUnhandledExceptionFilter 7C8449CD 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[1648] kernel32.dll!SetUnhandledExceptionFilter 7C8449CD 4 Bytes [C2, 04, 00, 00]

---- Devices - GMER 2.1 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys
AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys

Device \Driver\FileOpenWebPublisherScreenHookDriver \Device\FileOpenWebPublisherScreenHookDriver fowp32.sys

AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\[email protected] 11656
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}@LeaseObtainedTime 1371327376
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}@T1 1371329176
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}@T2 1371330526
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}@LeaseTerminatesTime 1371330976
Reg HKLM\SYSTEM\CurrentControlSet\Services\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}\Parameters\[email protected] 1371327376
Reg HKLM\SYSTEM\CurrentControlSet\Services\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}\Parameters\[email protected] 1371329176
Reg HKLM\SYSTEM\CurrentControlSet\Services\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}\Parameters\[email protected] 1371330526
Reg HKLM\SYSTEM\CurrentControlSet\Services\{1CF735F3-05ED-46E0-AEDA-C301C5D5D37F}\Parameters\[email protected] 1371330976

---- EOF - GMER 2.1 ----


----------



## Cookiegal (Aug 27, 2003)

Please run SystemLook again with the following script and post that log:


```
:dir
F:\autorun
```


----------



## sarahmuriel (Feb 1, 2004)

System Look Log

SystemLook 04.09.10 by jpshortstuff
Log created at 09:34 on 16/06/2013 by all
Administrator - Elevation successful

========== dir ==========

F:\autorun - Parameters: "(none)"

---Files---
Thumbs.db	--ahs-- 7168 bytes	[05:34 19/02/2012]	[02:02 16/06/2013]
wdlogo.ico	-ra---- 766 bytes	[10:11 01/07/2010]	[08:57 14/10/2002]

---Folders---
None found.

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

OK so it's just an autorun folder. No problems there. 

Now I'd like you to run ComboFix again (be sure to disable your security programs temporarily) then post the new log. You should not receive an alert to ZeroAccess rootkit this time but please advise if you do.


----------



## sarahmuriel (Feb 1, 2004)

No it did not mention Zero Access, it did not find any rootkit, it did not restart, but it took forever.

Here is the CF log

ComboFix 13-06-15.01 - all 06/16/2013 10:21:19.16.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.342 [GMT -4:00]
Running from: c:\documents and settings\all\Desktop\ComboFix.exe
AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ESET Personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
.
((((((((((((((((((((((((( Files Created from 2013-05-16 to 2013-06-16 )))))))))))))))))))))))))))))))
.
.
2013-06-15 20:28 . 2013-06-15 20:28	--------	d-----w-	C:\_OTL
2013-06-13 14:44 . 2013-06-13 14:44	--------	d-----w-	C:\FRST
2013-06-13 00:40 . 2013-06-13 00:41	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}
2013-06-09 21:37 . 2013-06-09 21:37	--------	d-----w-	C:\_OTS
2013-06-05 00:44 . 2013-06-05 00:42	144896	----a-w-	c:\windows\system32\javacpl.cpl
2013-06-05 00:44 . 2013-06-05 00:43	94112	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 07:59 . 2012-03-31 09:15	692104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-06-12 07:59 . 2011-05-14 05:23	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-05 00:42 . 2012-06-26 12:59	866720	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-06-05 00:42 . 2010-11-05 20:05	788896	----a-w-	c:\windows\system32\deployJava1.dll
2013-05-07 22:30 . 2004-08-04 20:00	920064	----a-w-	c:\windows\system32\wininet.dll
2013-05-07 22:30 . 2004-08-04 20:00	43520	------w-	c:\windows\system32\licmgr10.dll
2013-05-07 22:30 . 2004-08-04 20:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2013-05-07 21:53 . 2004-08-04 20:00	385024	------w-	c:\windows\system32\html.iec
2013-05-03 01:30 . 2004-08-04 20:00	2149888	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-05-03 00:38 . 2004-08-03 22:59	2028544	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-04-10 01:31 . 2004-08-04 20:00	1876352	----a-w-	c:\windows\system32\win32k.sys
2012-04-10 17:21 . 2012-04-10 17:21	1263344	----a-w-	c:\program files\eset_smart_security_live_installer.exe
2010-08-29 15:32 . 2010-08-29 15:31	18862693	----a-w-	c:\program files\KoboSetup.exe
2010-08-29 15:23 . 2010-08-29 15:23	3760464	----a-w-	c:\program files\CuteWriter.exe
2010-08-19 22:08 . 2010-11-05 21:25	359656	----a-w-	c:\program files\msicuu2.exe
2010-01-24 19:09 . 2010-01-24 19:09	289584	----a-w-	c:\program files\uTorrent.exe
2009-11-11 06:06 . 2010-02-14 22:07	4787413	----a-w-	c:\program files\copistar_full.exe
2009-03-31 05:01 . 2010-05-30 23:13	401720	----a-w-	c:\program files\HiJackThis.exe
2007-08-09 02:07 . 2010-07-07 18:38	1578514	----a-w-	c:\program files\abcreb_setup.exe
2001-12-25 12:03 . 2010-08-29 16:48	249856	----a-w-	c:\program files\pelite.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LTCM Client"="c:\program files\LTCM Client\ltcmClient.exe" [2009-08-05 1596096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-01-30 400480]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-03 847872]
"FileOpenBroker"="c:\program files\FileOpen\Services\FileOpenBroker32.exe" [2012-04-30 836480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2000-01-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2000-01-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2000-01-01 137752]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-01-31 295072]
"RTHDCPL"="RTHDCPL.EXE" [2000-01-01 20117136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-03-21 5078504]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe c:\program files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe -preload [2006-8-14 49152]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\EpsonNet\\EpsonNet Setup\\tool10\\ENEasyApp.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5985:TCP"= 5985:TCP:*isabled:Windows Remote Management 
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8/4/2011 9:20 AM 122240]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [9/24/2012 3:55 PM 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [9/24/2012 3:57 PM 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [9/24/2012 3:58 PM 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [9/24/2012 3:59 PM 25704]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [10/7/2012 7:42 PM 1691480]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [4/23/2003 9:45 AM 16896]
S3 eBook;eBook;c:\windows\system32\drivers\eBook.sys [6/25/2005 11:35 AM 22072]
S3 fdrawcmd;Low-level Floppy Driver;c:\windows\system32\drivers\fdrawcmd.sys [9/27/2008 11:09 PM 27544]
S3 wdpnp;WinDriver USB Client;c:\windows\system32\drivers\wdpnp.sys [8/29/2010 1:14 PM 22748]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/5/2010 6:20 AM 691696]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - FileOpenWebPublisherScreenHookDriver
*Deregistered* - pxtdapod
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32	128512	------w-	c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 07:59]
.
2013-06-16 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 00:12]
.
2013-06-15 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-15 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-15 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 20:30]
.
2013-06-15 c:\windows\Tasks\ReclaimerUpdateXML_all.job
- c:\documents and settings\all\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-06-14 14:18]
.
2013-06-15 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_all.job
- c:\documents and settings\all\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\rnupgagent.exe [2013-06-14 14:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchAssistant = 
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\all\Application Data\Mozilla\Firefox\Profiles\4zkw72so.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - WOT Safe Search
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2010-08-28 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-{007811BF-E310-4285-BFC6-55DB29B3EDDE} - c:\docume~1\ALLUSE~1.WIN\APPLIC~1\INSTAL~2\{00781~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-16 11:37
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1176)
c:\windows\system32\igfxdev.dll
.
- - - - - - - > 'explorer.exe'(6496)
c:\windows\system32\WININET.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-06-16 12:11:22
ComboFix-quarantined-files.txt 2013-06-16 16:10
ComboFix2.txt 2013-06-14 01:34
ComboFix3.txt 2013-06-13 03:15
ComboFix4.txt 2013-06-12 16:53
ComboFix5.txt 2013-06-16 14:16
.
Pre-Run: 111,023,980,544 bytes free
Post-Run: 111,098,613,760 bytes free
.
- - End Of File - - 8A9A9C80F244343536B1E193EFA284ED
8F558EB6672622401DA993E1E865C861


----------



## Cookiegal (Aug 27, 2003)

Are there any other problems that remain with the computer?


----------



## sarahmuriel (Feb 1, 2004)

It seems to be working much better, still have the wobbly Microsoft music, I thought there might be something like a trojan there for the sound to be so bad. I had even bought new speakers (sorry not doing good today, strokes, had to go to Tiger Direct to get the work speaker, it's awful when you know what you want but the word will not come out) but still the same wobbly sound. All in all it looks good to me. Now, how can I get, really get rid of Embird from my system. I have C Cleaners but I am afraid to use it and mess my computer.

Thanks a lot Sarah


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in *devmgmt.msc* to open the Device Manager. Then click on "View" and select "Show hidden devices" and let me know if you see any yellow alerts to the left of any of the devices listed there.

Also, please do the following:

Please go to *Sart *- *Run *- type in *dxdiag *and click OK. It will open a screen called DirectX Diagnostic Tool which will run for a minute to collect information from the system. Once it's finished, to the bottom right you will see a button called "Save All Information". Please click on that and save it to Notepad and then copy and paste the contents here.

Also, can you click on your external drive letter to open the drive that has the Embird installer on it and post a screenshot of what you see there please.


----------



## sarahmuriel (Feb 1, 2004)

Ran Devmgmt and there was no yellow alerst next to any of the devices.

Tried getting a Print Screen button, tried using Alt+ Print Screen button and also tried the select all and copy to paste and no way was I able to get a print screen of a drive. Remember I am using Windows XP.

Ran Dxdiag and here's the log

------------------
System Information
------------------
Time of this report: 6/17/2013, 13:49:41
Machine name: LENOVO
Operating System: Windows XP Home Edition (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_qfe.130503-0418)
Language: English (Regional Setting: English)
System Manufacturer: LENOVO
System Model: SS09355224
BIOS: Lenovo BIOS Version: 5GKT20A V2.0A
Processor: Intel(R) Atom(TM) CPU 230 @ 1.60GHz (2 CPUs)
Memory: 1016MB RAM
Page File: 806MB used, 1637MB available
Windows Dir: C:\WINDOWS
DirectX Version: DirectX 9.0c (4.09.0000.0904)
DX Setup Parameters: Not found
DxDiag Version: 5.03.2600.5512 32bit Unicode

------------
DxDiag Notes
------------
DirectX Files Tab: No problems found.
Display Tab 1: No problems found.
Sound Tab 1: No problems found.
Sound Tab 2: The file WsAudio_DeviceS(1).sys is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL). You may be able to get a WHQL logo'd driver from the hardware manufacturer.
Sound Tab 3: The file WsAudio_DeviceS(2).sys is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL). You may be able to get a WHQL logo'd driver from the hardware manufacturer.
Sound Tab 4: The file WsAudio_DeviceS(3).sys is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL). You may be able to get a WHQL logo'd driver from the hardware manufacturer.
Sound Tab 5: The file WsAudio_DeviceS(4).sys is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL). You may be able to get a WHQL logo'd driver from the hardware manufacturer.
Sound Tab 6: The file WsAudio_DeviceS(5).sys is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL). You may be able to get a WHQL logo'd driver from the hardware manufacturer.
Music Tab: No problems found.
Input Tab: No problems found.
Network Tab: No problems found.

--------------------
DirectX Debug Levels
--------------------
Direct3D: 0/4 (n/a)
DirectDraw: 0/4 (retail)
DirectInput: 0/5 (n/a)
DirectMusic: 0/5 (n/a)
DirectPlay: 0/9 (retail)
DirectSound: 0/5 (retail)
DirectShow: 0/6 (retail)

---------------
Display Devices
---------------
Card name: Intel(R) 82945G Express Chipset Family
Manufacturer: Intel Corporation
Chip type: Intel(R) 82945G Express Chipset Family
DAC type: Internal
Device Key: Enum\PCI\VEN_8086&DEV_2772&SUBSYS_304E17AA&REV_02
Display Memory: 128.0 MB
Current Mode: 1360 x 768 (32 bit) (60Hz)
Monitor: Plug and Play Monitor
Monitor Max Res: 1600,1200
Driver Name: igxprd32.dll
Driver Version: 6.14.0010.4926 (English)
DDI Version: 9 (or higher)
Driver Attributes: Final Retail
Driver Date/Size: 12/31/1999 20:00:00, 57344 bytes
WHQL Logo'd: Yes
WHQL Date Stamp: n/a
VDD: n/a
Mini VDD: igxpmp32.sys
Mini VDD Date: 12/31/1999 20:00:00, 5854752 bytes
Device Identifier: {D7B78E66-6432-11CF-2467-4410A3C2CB35}
Vendor ID: 0x8086
Device ID: 0x2772
SubSys ID: 0x304E17AA
Revision ID: 0x0002
Revision ID: 0x0002
Video Accel: 
Deinterlace Caps: n/a
Registry: OK
DDraw Status: Enabled
D3D Status: Enabled
AGP Status: Not Available
DDraw Test Result: Not run
D3D7 Test Result: Not run
D3D8 Test Result: Not run
D3D9 Test Result: Not run

-------------
Sound Devices
-------------
Description: Realtek HD Audio output
Default Sound Playback: Yes
Default Voice Playback: Yes
Hardware ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0662&SUBSYS_17AA304E&REV_1001
Manufacturer ID: 1
Product ID: 100
Type: WDM
Driver Name: RtkHDAud.sys
Driver Version: 5.10.0000.6710 (English)
Driver Attributes: Final Retail
WHQL Logo'd: Yes
Date and Size: 12/31/1999 20:00:00, 6168208 bytes
Other Files: 
Driver Provider: Realtek Semiconductor Corp.
HW Accel Level: Full
Cap Flags: 0xF5F
Min/Max Sample Rate: 8000, 192000
Static/Strm HW Mix Bufs: 33, 32
Static/Strm HW 3D Bufs: 33, 32
HW Memory: 0
Voice Management: No
EAX(tm) 2.0 Listen/Src: Yes, Yes
I3DL2(tm) Listen/Src: Yes, Yes
Sensaura(tm) ZoomFX(tm): No
Registry: OK
Sound Test Result: Not run

Description: WsAudio_DeviceS(1)
Default Sound Playback: No
Default Voice Playback: No
Hardware ID: WsAudio_DeviceS(1)
Manufacturer ID: 1
Product ID: 65535
Type: WDM
Driver Name: WsAudio_DeviceS(1).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
WHQL Logo'd: No
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Other Files: 
Driver Provider: WsAudio_DeviceS(1)
HW Accel Level: Full
Cap Flags: 0xB5B
Min/Max Sample Rate: 11025, 64000
Static/Strm HW Mix Bufs: 15, 14
Static/Strm HW 3D Bufs: 0, 0
HW Memory: 0
Voice Management: No
EAX(tm) 2.0 Listen/Src: No, No
I3DL2(tm) Listen/Src: No, No
Sensaura(tm) ZoomFX(tm): No
Registry: OK
Sound Test Result: Not run

Description: WsAudio_DeviceS(2)
Default Sound Playback: No
Default Voice Playback: No
Hardware ID: WsAudio_DeviceS(2)
Manufacturer ID: 1
Product ID: 65535
Type: WDM
Driver Name: WsAudio_DeviceS(2).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
WHQL Logo'd: No
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Other Files: 
Driver Provider: WsAudio_DeviceS(2)
HW Accel Level: Full
Cap Flags: 0xB5B
Min/Max Sample Rate: 11025, 64000
Static/Strm HW Mix Bufs: 15, 14
Static/Strm HW 3D Bufs: 0, 0
HW Memory: 0
Voice Management: No
EAX(tm) 2.0 Listen/Src: No, No
I3DL2(tm) Listen/Src: No, No
Sensaura(tm) ZoomFX(tm): No
Registry: OK
Sound Test Result: Not run

Description: WsAudio_DeviceS(3)
Default Sound Playback: No
Default Voice Playback: No
Hardware ID: WsAudio_DeviceS(3)
Manufacturer ID: 1
Product ID: 65535
 Type: WDM
Driver Name: WsAudio_DeviceS(3).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
WHQL Logo'd: No
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Other Files: 
Driver Provider: WsAudio_DeviceS(3)
HW Accel Level: Full
Cap Flags: 0xB5B
Min/Max Sample Rate: 11025, 64000
Static/Strm HW Mix Bufs: 15, 14
Static/Strm HW 3D Bufs: 0, 0
HW Memory: 0
Voice Management: No
EAX(tm) 2.0 Listen/Src: No, No
I3DL2(tm) Listen/Src: No, No
Sensaura(tm) ZoomFX(tm): No
Registry: OK
Sound Test Result: Not run

Description: WsAudio_DeviceS(4)
Default Sound Playback: No
Default Voice Playback: No
Hardware ID: WsAudio_DeviceS(4)
Manufacturer ID: 1
Product ID: 65535
Type: WDM
Driver Name: WsAudio_DeviceS(4).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
WHQL Logo'd: No
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Other Files: 
Driver Provider: WsAudio_DeviceS(4)
HW Accel Level: Full
Cap Flags: 0xB5B
Min/Max Sample Rate: 11025, 64000
Static/Strm HW Mix Bufs: 15, 14
Static/Strm HW 3D Bufs: 0, 0
HW Memory: 0
Voice Management: No
EAX(tm) 2.0 Listen/Src: No, No
I3DL2(tm) Listen/Src: No, No
Sensaura(tm) ZoomFX(tm): No
Registry: OK
Sound Test Result: Not run

Description: WsAudio_DeviceS(5)
Default Sound Playback: No
Default Voice Playback: No
Hardware ID: WsAudio_DeviceS(5)
Manufacturer ID: 1
Product ID: 65535
Type: WDM
Driver Name: WsAudio_DeviceS(5).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
WHQL Logo'd: No
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Other Files: 
Driver Provider: WsAudio_DeviceS(5)
HW Accel Level: Full
Cap Flags: 0xB5B
Min/Max Sample Rate: 11025, 64000
Static/Strm HW Mix Bufs: 15, 14
Static/Strm HW 3D Bufs: 0, 0
HW Memory: 0
Voice Management: No
EAX(tm) 2.0 Listen/Src: No, No
I3DL2(tm) Listen/Src: No, No
Sensaura(tm) ZoomFX(tm): No
Registry: OK
Sound Test Result: Not run

---------------------
Sound Capture Devices
---------------------
Description: Realtek HD Audio Input
Default Sound Capture: Yes
Default Voice Capture: Yes
Driver Name: RtkHDAud.sys
Driver Version: 5.10.0000.6710 (English)
Driver Attributes: Final Retail
Date and Size: 12/31/1999 20:00:00, 6168208 bytes
Cap Flags: 0x41
Format Flags: 0xCC0

Description: WsAudio_DeviceS(1)
Default Sound Capture: No
Default Voice Capture: No
Driver Name: WsAudio_DeviceS(1).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Cap Flags: 0x41
Format Flags: 0xCCC

Description: WsAudio_DeviceS(2)
Default Sound Capture: No
Default Voice Capture: No
Driver Name: WsAudio_DeviceS(2).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Cap Flags: 0x41
Format Flags: 0xCCC

Description: WsAudio_DeviceS(3)
Default Sound Capture: No
Default Voice Capture: No
Driver Name: WsAudio_DeviceS(3).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Cap Flags: 0x41
Format Flags: 0xCCC

Description: WsAudio_DeviceS(4)
Default Sound Capture: No
Default Voice Capture: No
Driver Name: WsAudio_DeviceS(4).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Cap Flags: 0x41
Format Flags: 0xCCC

Description: WsAudio_DeviceS(5)
Default Sound Capture: No
Default Voice Capture: No
Driver Name: WsAudio_DeviceS(5).sys
Driver Version: 1.00.0000.0001 (English)
Driver Attributes: Final Retail
Date and Size: 3/7/2012 14:31:08, 25704 bytes
Cap Flags: 0x41
Format Flags: 0xCCC

-----------
DirectMusic
-----------
DLS Path: C:\WINDOWS\SYSTEM32\drivers\GM.DLS
DLS Version: 1.00.0016.0002
Acceleration: n/a
Ports: Microsoft Synthesizer, Software (Not Kernel Mode), Output, DLS, Internal, Default Port
WsAudio_DeviceS(1), Software (Kernel Mode), Output, DLS, Internal
WsAudio_DeviceS(2), Software (Kernel Mode), Output, DLS, Internal
WsAudio_DeviceS(3), Software (Kernel Mode), Output, DLS, Internal
WsAudio_DeviceS(4), Software (Kernel Mode), Output, DLS, Internal
WsAudio_DeviceS(5), Software (Kernel Mode), Output, DLS, Internal
Microsoft MIDI Mapper [Emulated], Hardware (Not Kernel Mode), Output, No DLS, Internal
Microsoft GS Wavetable SW Synth [Emulated], Hardware (Not Kernel Mode), Output, No DLS, Internal
Registry: OK
Test Result: Not run

-------------------
DirectInput Devices
-------------------
Device Name: Mouse
Attached: 1
Controller ID: n/a
Vendor/Product ID: n/a
FF Driver: n/a

Device Name: Keyboard
Attached: 1
Controller ID: n/a
Vendor/Product ID: n/a
FF Driver: n/a

Device Name: 2.4GHz 2way RF Receiver
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x1BCF, 0x053A
FF Driver: n/a

Device Name: 2.4GHz 2way RF Receiver
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x1BCF, 0x053A
FF Driver: n/a

Device Name: 2.4GHz 2way RF Receiver
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x1BCF, 0x053A
FF Driver: n/a

Device Name: 2.4GHz 2way RF Receiver
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x1BCF, 0x053A
FF Driver: n/a

Poll w/ Interrupt: No
Registry: OK

-----------
USB Devices
-----------
+ USB Root Hub
| Vendor/Product ID: 0x8086, 0x27C8
| Matching Device ID: usb\root_hub
| Service: usbhub
| Driver: usbhub.sys, 4/13/2008 14:45:38, 59520 bytes
| Driver: usbd.sys, 8/4/2004 16:00:00, 4736 bytes
| 
+-+ USB Human Interface Device
| | Vendor/Product ID: 0x1BCF, 0x053A
| | Location: 2.4GHz 2way RF Receiver
| | Matching Device ID: usb\class_03&subclass_01
| | Service: HidUsb
| | Driver: hidusb.sys, 4/13/2008 14:45:27, 10368 bytes
| | Driver: hidclass.sys, 4/13/2008 14:45:26, 36864 bytes
| | Driver: hidparse.sys, 4/13/2008 14:45:22, 24960 bytes
| | Driver: hid.dll, 4/13/2008 20:11:54, 20992 bytes
| | 
| +-+ HID-compliant device
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device
| | | 
| +-+ HID-compliant consumer control device
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device_up:000c_u:0001
| | | Driver: hidserv.dll, 4/13/2008 21:11:54, 21504 bytes
| | | 
| +-+ HID-compliant device
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device
| | | 
| +-+ HID-compliant device
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device
| | | 
| +-+ HID-compliant mouse
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device_system_mouse
| | | Service: mouhid
| | | Driver: mouclass.sys, 4/13/2008 14:39:47, 23040 bytes
| | | Driver: mouhid.sys, 8/4/2004 16:00:00, 12160 bytes

----------------
Gameport Devices
----------------

------------
PS/2 Devices
------------
+ Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
| Matching Device ID: *pnp0303
| Service: i8042prt
| Driver: i8042prt.sys, 4/13/2008 15:18:00, 52480 bytes
| Driver: kbdclass.sys, 4/13/2008 14:39:47, 24576 bytes
| 
+ Terminal Server Keyboard Driver
| Matching Device ID: root\rdp_kbd
| Upper Filters: kbdclass
| Service: TermDD
| Driver: termdd.sys, 4/13/2008 20:13:20, 40840 bytes
| Driver: kbdclass.sys, 4/13/2008 14:39:47, 24576 bytes
| 
+ Terminal Server Mouse Driver
| Matching Device ID: root\rdp_mou
| Upper Filters: mouclass
| Service: TermDD
| Driver: termdd.sys, 4/13/2008 20:13:20, 40840 bytes
| Driver: mouclass.sys, 4/13/2008 14:39:47, 23040 bytes

----------------------------
DirectPlay Service Providers
----------------------------
DirectPlay8 Modem Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.6311)
DirectPlay8 Serial Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.6311)
DirectPlay8 IPX Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.6311)
DirectPlay8 TCP/IP Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.6311)
Internet TCP/IP Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (5.03.2600.5512)
IPX Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (5.03.2600.5512)
Modem Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (5.03.2600.5512)
Serial Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (5.03.2600.5512)

DirectPlay Voice Wizard Tests: Full Duplex: Not run, Half Duplex: Not run, Mic: Not run
DirectPlay Test Result: Not run
Registry: OK

-------------------
DirectPlay Adapters
-------------------
DirectPlay8 Serial Service Provider: COM1
DirectPlay8 IPX Service Provider: IPX Adapter 1 - (00000000,002197606606)
DirectPlay8 TCP/IP Service Provider: Local Area Connection 4 - IPv6 - fe80::221:97ff:fe60:6606
DirectPlay8 TCP/IP Service Provider: Teredo Tunneling Pseudo-Interface - IPv6 - fe80::ffff:ffff:fffd
DirectPlay8 TCP/IP Service Provider: Automatic Tunneling Pseudo-Interface - IPv6 - fe80::5efe:
DirectPlay8 TCP/IP Service Provider: Local Area Connection 4 - IPv4 -

-----------------------
DirectPlay Voice Codecs
-----------------------
Voxware VR12 1.4kbit/s
Voxware SC06 6.4kbit/s
Voxware SC03 3.2kbit/s
MS-PCM 64 kbit/s
MS-ADPCM 32.8 kbit/s
Microsoft GSM 6.10 13 kbit/s
TrueSpeech(TM) 8.6 kbit/s

-------------------------
DirectPlay Lobbyable Apps
-------------------------

------------------------
Disk & DVD/CD-ROM Drives
------------------------
Drive: C:
Free Space: 106.0 GB
Total Space: 152.6 GB
File System: NTFS
Model: Hitachi HDP725016GLA380

Drive: F:
Free Space: 1230.5 GB
Total Space: 1430.8 GB
File System: NTFS
Model: WD Ext HDD 1021 USB Device

Drive: G:
Free Space: 179.2 GB
Total Space: 305.2 GB
File System: NTFS
Model: Maxtor 3200 USB Device

Drive: E:
Model: HL-DT-ST DVD-RAM GH10N
Driver: c:\windows\system32\drivers\cdrom.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:46, 62976 bytes

--------------
System Devices
--------------
Name: Intel(R) ICH7 Family Ultra ATA Storage Controllers - 27DF
Device ID: PCI\VEN_8086&DEV_27DF&SUBSYS_304E17AA&REV_01\3&11583659&0&F9
Driver: C:\WINDOWS\system32\DRIVERS\pciide.sys, 5.01.2600.0000 (English), 8/17/2001 13:51:52, 3328 bytes
Driver: C:\WINDOWS\system32\DRIVERS\pciidex.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 24960 bytes
Driver: C:\WINDOWS\system32\DRIVERS\atapi.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 96512 bytes

Name: Intel(R) N10/ICH7 Family SMBus Controller - 27DA
Device ID: PCI\VEN_8086&DEV_27DA&SUBSYS_304E17AA&REV_01\3&11583659&0&FB
Driver: n/a

Name: Microsoft UAA Bus Driver for High Definition Audio
Device ID: PCI\VEN_8086&DEV_27D8&SUBSYS_304E17AA&REV_01\3&11583659&0&D8
Driver: C:\WINDOWS\system32\DRIVERS\hdaudbus.sys, 5.10.0001.5013 (English), 4/13/2008 12:36:05, 144384 bytes

Name: Intel(R) N10/ICH7 Family PCI Express Root Port - 27D0
Device ID: PCI\VEN_8086&DEV_27D0&SUBSYS_00000000&REV_01\3&11583659&0&E0
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:44, 68224 bytes

Name: Intel(R) N10/ICH7 Family USB2 Enhanced Host Controller - 27CC
Device ID: PCI\VEN_8086&DEV_27CC&SUBSYS_304E17AA&REV_01\3&11583659&0&EF
Driver: C:\WINDOWS\system32\drivers\usbehci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 30208 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes
Driver: C:\WINDOWS\system32\hccoin.dll, 5.01.2600.5512 (English), 4/13/2008 20:11:54, 7168 bytes

Name: Intel(R) N10/ICH7 Family USB Universal Host Controller - 27CB
Device ID: PCI\VEN_8086&DEV_27CB&SUBSYS_304E17AA&REV_01\3&11583659&0&EB
Driver: C:\WINDOWS\system32\drivers\usbuhci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 20608 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes

Name: Intel(R) N10/ICH7 Family USB Universal Host Controller - 27CA
Device ID: PCI\VEN_8086&DEV_27CA&SUBSYS_304E17AA&REV_01\3&11583659&0&EA
Driver: C:\WINDOWS\system32\drivers\usbuhci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 20608 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes

Name: Intel(R) N10/ICH7 Family USB Universal Host Controller - 27C9
Device ID: PCI\VEN_8086&DEV_27C9&SUBSYS_304E17AA&REV_01\3&11583659&0&E9
Driver: C:\WINDOWS\system32\drivers\usbuhci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 20608 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes

Name: Intel(R) N10/ICH7 Family USB Universal Host Controller - 27C8
Device ID: PCI\VEN_8086&DEV_27C8&SUBSYS_304E17AA&REV_01\3&11583659&0&E8
Driver: C:\WINDOWS\system32\drivers\usbuhci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 20608 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes

Name: Intel(R) N10/ICH7 Family Serial ATA Storage Controller - 27C0
Device ID: PCI\VEN_8086&DEV_27C0&SUBSYS_304E17AA&REV_01\3&11583659&0&FA
Driver: C:\WINDOWS\system32\DRIVERS\pciide.sys, 5.01.2600.0000 (English), 8/17/2001 13:51:52, 3328 bytes
Driver: C:\WINDOWS\system32\DRIVERS\pciidex.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 24960 bytes
Driver: C:\WINDOWS\system32\DRIVERS\atapi.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 96512 bytes

Name: Intel(R) ICH7 Family LPC Interface Controller - 27B8
Device ID: PCI\VEN_8086&DEV_27B8&SUBSYS_00000000&REV_01\3&11583659&0&F8
Driver: C:\WINDOWS\system32\DRIVERS\isapnp.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:42, 37248 bytes

Name: Intel(R) 82945G Express Chipset Family
Device ID: PCI\VEN_8086&DEV_2772&SUBSYS_304E17AA&REV_02\3&11583659&0&10
Driver: C:\WINDOWS\system32\DRIVERS\igxpmp32.sys, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 5854752 bytes
Driver: C:\WINDOWS\system32\igxprd32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 57344 bytes
Driver: C:\WINDOWS\system32\igxpgd32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 151040 bytes
Driver: C:\WINDOWS\system32\igxpdv32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 1670144 bytes
Driver: C:\WINDOWS\system32\igxpdx32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 2643968 bytes
Driver: C:\WINDOWS\system32\igxpxk32.vp, 12/31/1999 20:00:00, 2096 bytes
Driver: C:\WINDOWS\system32\igxpxs32.vp, 12/31/1999 20:00:00, 27024 bytes
Driver: C:\WINDOWS\system32\hccutils.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 102400 bytes
Driver: C:\WINDOWS\system32\igfxsrvc.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 48128 bytes
Driver: C:\WINDOWS\system32\igfxsrvc.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 256536 bytes
Driver: C:\WINDOWS\system32\igfxpph.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 204800 bytes
Driver: C:\WINDOWS\system32\igfxcpl.cpl, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 122880 bytes
Driver: C:\WINDOWS\system32\igfxcfg.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 530968 bytes
Driver: C:\WINDOWS\system32\igfxdev.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 208896 bytes
Driver: C:\WINDOWS\system32\igfxdo.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 135168 bytes
Driver: C:\WINDOWS\system32\igfxtray.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 141848 bytes
Driver: C:\WINDOWS\system32\igfxzoom.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 170520 bytes
Driver: C:\WINDOWS\system32\hkcmd.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 166424 bytes
Driver: C:\WINDOWS\system32\igfxress.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 3293184 bytes
Driver: C:\WINDOWS\system32\igfxpers.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 137752 bytes
Driver: C:\WINDOWS\system32\igfxrara.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 159744 bytes
Driver: C:\WINDOWS\system32\igfxrchs.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 110592 bytes
Driver: C:\WINDOWS\system32\igfxrcht.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 110592 bytes
Driver: C:\WINDOWS\system32\igfxrdan.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxrdeu.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 192512 bytes
Driver: C:\WINDOWS\system32\igfxrenu.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxresp.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 188416 bytes
Driver: C:\WINDOWS\system32\igfxrfin.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 176128 bytes
Driver: C:\WINDOWS\system32\igfxrfra.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 184320 bytes
Driver: C:\WINDOWS\system32\igfxrheb.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 155648 bytes
Driver: C:\WINDOWS\system32\igfxrita.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 188416 bytes
Driver: C:\WINDOWS\system32\igfxrjpn.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 131072 bytes
Driver: C:\WINDOWS\system32\igfxrkor.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 126976 bytes
Driver: C:\WINDOWS\system32\igfxrnld.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 188416 bytes
Driver: C:\WINDOWS\system32\igfxrnor.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 176128 bytes
Driver: C:\WINDOWS\system32\igfxrplk.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrptb.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrptg.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrrus.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrsky.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 176128 bytes
Driver: C:\WINDOWS\system32\igfxrslv.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxrsve.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxrtha.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 163840 bytes
Driver: C:\WINDOWS\system32\igfxrcsy.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 176128 bytes
Driver: C:\WINDOWS\system32\igfxrell.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 192512 bytes
Driver: C:\WINDOWS\system32\igfxrhun.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrtrk.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxext.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 170520 bytes
Driver: C:\WINDOWS\system32\igfxexps.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 24576 bytes
Driver: C:\WINDOWS\system32\iglicd32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 2334720 bytes
Driver: C:\WINDOWS\system32\igldev32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 294912 bytes
Driver: C:\WINDOWS\system32\igfxCoIn_v4926.dll, 12/31/1999 20:00:00, 147456 bytes

Name: Intel(R) 945G/GZ/GC/P/PL Processor to I/O Controller - 2770
Device ID: PCI\VEN_8086&DEV_2770&SUBSYS_00000000&REV_02\3&11583659&0&00
Driver: n/a

Name: Intel(R) 82801 PCI Bridge - 244E
Device ID: PCI\VEN_8086&DEV_244E&SUBSYS_00000000&REV_E1\3&11583659&0&F0
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:44, 68224 bytes

Name: Realtek RTL8102E/RTL8103E Family PCI-E Fast Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_304E17AA&REV_02\4&293AFFCC&0&00E0
Driver: C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys, 5.708.1030.2008 (English), 10/30/2008 09:14:20, 117888 bytes
Driver: C:\WINDOWS\system32\RtNicProp32.dll, 1.01.0716.2008 (English), 7/16/2008 10:35:28, 9728 bytes

------------------
DirectX Components
------------------
ddraw.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 279552 bytes
ddrawex.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 27136 bytes
dxapi.sys: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 10496 bytes
d3d8.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 1179648 bytes
d3d8thk.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 8192 bytes
d3d9.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 1689088 bytes
d3dim.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 436224 bytes
d3dim700.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 824320 bytes
d3dramp.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 590336 bytes
d3drm.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 350208 bytes
d3dxof.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 47616 bytes
d3dpmesh.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 34816 bytes
dplay.dll: 5.00.2134.0001 English Final Retail 8/4/2004 16:00:00 33040 bytes
dplayx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 229888 bytes
dpmodemx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 23552 bytes
dpwsock.dll: 5.00.2134.0001 English Final Retail 8/4/2004 16:00:00 42768 bytes
dpwsockx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 57344 bytes
dplaysvr.exe: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:17 29696 bytes
dpnsvr.exe: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:17 17920 bytes
dpnet.dll: 5.03.2600.6311 English Final Retail 11/1/2012 22:02:42 375296 bytes
dpnlobby.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:09:20 3072 bytes
dpnaddr.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:09:19 3072 bytes
dpvoice.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 212480 bytes
dpvsetup.exe: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:18 83456 bytes
dpvvox.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 116736 bytes
dpvacm.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 21504 bytes
dpnhpast.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 35328 bytes
dpnhupnp.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 60928 bytes
dpserial.dll: 5.00.2134.0001 English Final Retail 8/4/2004 16:00:00 53520 bytes
dinput.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 158720 bytes
dinput8.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 181760 bytes
dimap.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 44032 bytes
diactfrm.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 394240 bytes
joy.cpl: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:41 68608 bytes
gcdef.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 76800 bytes
pid.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:02 35328 bytes
dsound.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 367616 bytes
dsound3d.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 1293824 bytes
dswave.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 19456 bytes
dsdmo.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 181248 bytes
dsdmoprp.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 71680 bytes
dmusic.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 104448 bytes
dmband.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 28672 bytes
dmcompos.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 61440 bytes
dmime.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 181248 bytes
dmloader.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 35840 bytes
dmstyle.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 105984 bytes
dmsynth.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 103424 bytes
dmscript.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 82432 bytes
system.dll: 1.01.4322.2502 English Final Retail 1/9/2013 17:33:41 1232896 bytes
Microsoft.DirectX.Direct3D.dll: 9.05.0132.0000 English Final Retail 9/11/2010 12:02:05 473600 bytes
Microsoft.DirectX.Direct3DX.dll: 5.04.0000.3900 English Final Retail 9/11/2010 12:01:59 2676224 bytes
Microsoft.DirectX.Direct3DX.dll: 9.04.0091.0000 English Final Retail 9/11/2010 12:02:00 2846720 bytes
Microsoft.DirectX.Direct3DX.dll: 9.05.0132.0000 English Final Retail 9/11/2010 12:02:01 563712 bytes
Microsoft.DirectX.Direct3DX.dll: 9.06.0168.0000 English Final Retail 9/11/2010 12:02:01 567296 bytes
Microsoft.DirectX.Direct3DX.dll: 9.07.0239.0000 English Final Retail 9/11/2010 12:02:02 576000 bytes
Microsoft.DirectX.Direct3DX.dll: 9.08.0299.0000 English Final Retail 9/11/2010 12:02:02 577024 bytes
Microsoft.DirectX.Direct3DX.dll: 9.09.0376.0000 English Final Retail 9/11/2010 12:02:03 577536 bytes
Microsoft.DirectX.Direct3DX.dll: 9.10.0455.0000 English Final Retail 9/11/2010 12:02:03 577536 bytes
Microsoft.DirectX.Direct3DX.dll: 9.11.0519.0000 English Final Retail 9/11/2010 12:02:04 578560 bytes
Microsoft.DirectX.Direct3DX.dll: 9.12.0589.0000 English Final Retail 9/11/2010 12:02:06 578560 bytes
Microsoft.DirectX.DirectDraw.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:06 145920 bytes
Microsoft.DirectX.DirectInput.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:07 159232 bytes
Microsoft.DirectX.DirectPlay.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:07 364544 bytes
Microsoft.DirectX.DirectSound.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:07 178176 bytes
Microsoft.DirectX.AudioVideoPlayback.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:05 53248 bytes
Microsoft.DirectX.Diagnostics.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:05 12800 bytes
Microsoft.DirectX.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:05 223232 bytes
dx7vb.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 619008 bytes
dx8vb.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 1227264 bytes
dxdiagn.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 2113536 bytes
mfc40.dll: 4.01.0000.6151 English Beta Retail 9/18/2010 02:53:25 954368 bytes
mfc42.dll: 6.02.8081.0000 English Final Retail 2/8/2011 09:33:55 978944 bytes
wsock32.dll: 5.01.2600.5512 English Final Retail 4/13/2008 20:12:10 22528 bytes
amstream.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:49 70656 bytes
devenum.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:51 59904 bytes
dxmasf.dll: 6.04.0009.1133 English Final Retail 4/13/2008 20:11:52 498742 bytes
mciqtz32.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:56 35328 bytes
mpg2splt.ax: 6.05.2600.6333 English Final Retail 1/2/2013 02:49:10 148992 bytes
msdmo.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:59 14336 bytes
encapi.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:53 20480 bytes
qasf.dll: 11.00.5721.5145 English Final Retail 10/18/2006 21:47:18 211456 bytes
qcap.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:03 192512 bytes
qdv.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:03 279040 bytes
qdvd.dll: 6.05.2600.6169 English Final Retail 11/3/2011 11:28:36 386048 bytes
qedit.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:03 562176 bytes
qedwipes.dll: 6.05.2600.5512 English Final Retail 4/13/2008 13:21:32 733696 bytes
quartz.dll: 6.05.2600.6333 English Final Retail 1/2/2013 02:49:10 1292288 bytes
strmdll.dll: 4.01.0000.3938 English Final Retail 8/26/2009 04:16:37 247326 bytes
iac25_32.ax: 2.00.0005.0053 English Final Retail 4/13/2008 20:12:42 199680 bytes
ir41_32.ax: 4.51.0016.0003 English Final Retail 4/13/2008 20:12:42 848384 bytes
ir41_qc.dll: 4.30.0062.0002 English Final Retail 4/13/2008 20:11:55 120320 bytes
ir41_qcx.dll: 4.30.0064.0001 English Final Retail 4/13/2008 20:11:55 338432 bytes
ir50_32.dll: 5.2562.0015.0055 English Final Retail 4/13/2008 20:11:55 755200 bytes
ir50_qc.dll: 5.00.0063.0048 English Final Retail 4/13/2008 20:11:55 200192 bytes
ir50_qcx.dll: 5.00.0064.0048 English Final Retail 4/13/2008 20:11:55 183808 bytes
ivfsrc.ax: 5.10.0002.0051 English Final Retail 4/13/2008 20:12:42 154624 bytes
mswebdvd.dll: 6.05.2600.5857 English Final Retail 8/5/2009 05:01:48 204800 bytes
ks.sys: 5.03.2600.5512 English Final Retail 4/13/2008 15:16:36 141056 bytes
ksproxy.ax: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:42 129536 bytes
ksuser.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:56 4096 bytes
stream.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:45:16 49408 bytes
mspclock.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:39:50 5376 bytes
mspqm.sys: 5.01.2600.5512 English Final Retail 4/13/2008 14:39:51 4992 bytes
mskssrv.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:39:52 7552 bytes
swenum.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:39:53 4352 bytes
mpeg2data.ax: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:42 118272 bytes
msvidctl.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:01 1428992 bytes
vbisurf.ax: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:42 30208 bytes
msyuv.dll: 5.03.2600.5908 English Final Retail 11/27/2009 13:11:44 17920 bytes
wstdecod.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:10 50688 bytes

------------------
DirectShow Filters
------------------

DirectShow Filters:
WMAudio Decoder DMO,0x00800800,1,1,,
WMAPro over S/PDIF DMO,0x00600800,1,1,,
WMA Voice Decoder DMO,0x00600800,1,1,,
WMVideo Advanced Decoder DMO,0x00800001,1,1,,
G2M Session Decoder,0x00600000,1,1,,
Mpeg4s Decoder DMO,0x00800001,1,1,,
WMV Screen decoder DMO,0x00800001,1,1,,
WMVideo Decoder DMO,0x00800001,1,1,,
Mpeg43 Decoder DMO,0x00800001,1,1,,
Mpeg4 Decoder DMO,0x00800001,1,1,,
Annodex Demux Source Filter,0x00600000,0,0,dsfAnxDemux.dll,
Annodex Mux Filter,0x00200000,1,0,dsfAnxMux.dll,
CMML Decode Filter,0x00800002,1,1,dsfCMMLDecoder.dll,
CMML Raw Source Filter,0x00600000,0,0,dsfCMMLRawSource.dll,
FLAC Decode Filter,0x00600000,1,1,dsfFLACDecoder.dll,
FLAC Encode Filter,0x00200000,1,1,dsfFLACEncoder.dll,
Native FLAC Source Filter,0x00600000,0,0,dsfNativeFLACSource.dll,
Ogg Demux Source Filter,0x00600000,0,0,dsfOggDemux.dll,
Ogg Mux Filter,0x00200000,1,0,dsfOggMux.dll,
Speex Decode Filter,0x00600000,1,1,dsfSpeexDecoder.dll,
Speex Encode Filter,0x00200000,1,1,dsfSpeexEncoder.dll,
Subtitle VMR9 Filter,0x00800002,1,1,dsfSubtitleVMR9.dll,
Theora Decode Filter,0x00600000,1,1,dsfTheoraDecoder.dll,
Theora Encode Filter,0x00200000,1,1,dsfTheoraEncoder.dll,
Vorbis Decode Filter,0x00600000,1,1,dsfVorbisDecoder.dll,
Vorbis Encode Filter,0x00200000,1,1,dsfVorbisEncoder.dll,
WMT MuxDeMux Filter,0x00200000,0,0,wmm2filt.dll,2.01.4026.0000
ffdshow MPEG-4 Video Decoder,0xff800001,2,1,ffdshow.ax,1.00.0000.0001
Full Screen Renderer,0x00200000,1,0,quartz.dll,6.05.2600.6333
ffdshow raw video filter,0x00200000,2,1,ffdshow.ax,1.00.0000.0001
RealPlayer Video Filter,0x00200000,1,1,rdsf3260.dll,16.00.0000.0282
CT Upsampler filter,0x00100000,1,1,Upsample.ax,2.00.0005.0000
ffdshow Audio Decoder,0x3fffffff,1,1,ffdshow.ax,1.00.0000.0001
Creative Wave Writer,0x00200000,1,0,WavWrite.ax,3.01.0004.0000
DV Muxer,0x00400000,0,0,qdv.dll,6.05.2600.5512
Color Space Converter,0x00400001,1,1,quartz.dll,6.05.2600.6333
WS ScreenCapture,0x00200000,0,1,ScreenCaptureFilter.ax,2.02.0005.0001
WM ASF Reader,0x00400000,0,0,qasf.dll,11.00.5721.5145
Audio Source,0x00200000,0,1,wmprevu.dll,9.00.0000.2980
Nero Digital API ES Video Reader,0x00600000,0,1,nDxParser.ax,2.00.0002.0047
Screen Capture filter,0x00200000,0,1,wmpsrcwp.dll,11.00.5721.5145
AVI Splitter,0x00600000,1,1,quartz.dll,6.05.2600.6333
WMT AudioAnalyzer,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Creative Frame Rate Converter,0x00200000,1,1,CTFRConv.ax,1.00.0003.0000
Track2Filter,0x00200000,0,0,Track2Filter.dll,
VGA 16 Color Ditherer,0x00400000,1,1,quartz.dll,6.05.2600.6333
Indeo® video 5.10 Compression Filter,0x00200000,1,1,ir50_32.dll,5.2562.0015.0055
BPM Metadata,0x001fffff,1,1,MetaBPMu.ax,2.00.0002.0000
Cucusoft DataExtractor,0x00200000,1,0,,
Windows Media Audio Decoder,0x00800001,1,1,msadds32.ax,8.00.0000.4487
RealVideo Decoder,0x00400000,1,1,RealMedia.dll,1.00.0000.0009
AC3 Parser Filter,0x00600000,1,1,mpg2splt.ax,6.05.2600.6333
WMT Format Conversion,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
CT Time-Scaling filter,0x00100000,1,1,TimeScal.ax,2.03.0003.0000
StreamBufferSink,0x00200000,0,0,sbe.dll,6.05.2600.6076
WMT Black Frame Generator,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
MJPEG Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6333
Indeo® video 5.10 Decompression Filter,0x00640000,1,1,ir50_32.dll,5.2562.0015.0055
Creative Video Processing Filter,0x00200000,1,1,VidProcU.ax,1.00.0007.0000
WMT Screen Capture filter,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
Creative Media Select,0x00200000,1,1,MediaSel.ax,1.00.0003.0000
RealPlayer MPEG4 Transform,0x00600000,1,1,rdsf3260.dll,16.00.0000.0282
Microsoft Screen Video Decompressor,0x00800000,1,1,msscds32.ax,8.00.0000.4487
MPEG-I Stream Splitter,0x00600000,1,2,quartz.dll,6.05.2600.6333
SAMI (CC) Parser,0x00400000,1,1,quartz.dll,6.05.2600.6333
MPEG Layer-3 Decoder,0x00810000,1,1,L3CODECX.AX,1.06.0000.0052
Sonic MPEG-4 Video Decoder,0x00000000,0,0,,
MPEG-2 Splitter,0x005fffff,1,0,mpg2splt.ax,6.05.2600.6333
ACELP.net Sipro Lab Audio Decoder,0x00800001,1,1,acelpdec.ax,1.04.0000.0000
Internal Script Command Renderer,0x00800001,1,0,quartz.dll,6.05.2600.6333
Nero Digital API Audio Decoder,0x00600000,1,1,nDxAudDec.ax,1.00.0004.0060
MPEG Audio Decoder,0x03680001,1,1,quartz.dll,6.05.2600.6333
_ VSO Preview Filter,0x00200000,0,1,VsoVprev.ax,3.00.0001.0043
File Source (Netshow URL),0x00400000,0,1,wmpasf.dll,11.00.5721.5145
WMT Import Filter,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
DV Splitter,0x00600000,1,2,qdv.dll,6.05.2600.5512
Bitmap Generate,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Windows Media Video Decoder,0x00800000,1,1,wmvds32.ax,8.00.0000.4487
Video Mixing Renderer 9,0x00200000,1,0,quartz.dll,
Windows Media Video Decoder,0x00800000,1,1,wmv8ds32.ax,8.00.0000.4000
WMT VIH2 Fix,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Record Queue,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Creative File Reader Filter,0x00400000,0,1,FileRead.ax,1.00.0000.0000
Disk Record Queue,0x00200000,1,1,wmedque.dll,9.00.0000.2980
CT Karaoke filter,0x00100000,1,1,Karaoke.ax,2.00.0007.0000
Nero Digital API Parser,0x00600000,0,3,nDxParser.ax,2.00.0002.0047
Creative AC3 Source Filter,0x00400000,0,1,AC3Srcu.ax,3.01.0000.0000
Creative PCM Raw Writer,0x00200000,1,0,RawWritu.ax,1.00.0000.0000
Color Converter,0x00200000,1,1,declrds.ax,9.00.0000.2980
Windows Media Multiplexer,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASX file Parser,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASX v.2 file Parser,0x00600000,1,0,wmpasf.dll,11.00.5721.5145
NSC file Parser,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
CT PDP filter,0x00100000,1,1,PDP.ax,1.00.0008.0000
ACM Wrapper,0x00600000,1,1,quartz.dll,6.05.2600.6333
Windows Media source filter,0x00600000,0,2,wmpasf.dll,11.00.5721.5145
Video Renderer,0x00800001,1,0,quartz.dll,6.05.2600.6333
Creative MP3 Dump Filter,0x00200000,1,0,Mp3Dump.ax,1.00.0001.0000
Frame Eater,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
MPEG-2 Video Stream Analyzer,0x00200000,0,0,sbe.dll,6.05.2600.6076
Line 21 Decoder,0x00600000,1,1,qdvd.dll,6.05.2600.6169
Video Port Manager,0x00600000,2,1,quartz.dll,6.05.2600.6333
SmartSound Soundtrack,0x00400000,0,1,DirectQX.dll,3.00.0008.0000
SmartSound SDS Reader,0x00400000,0,1,SDSReader.dll,3.00.0008.0000
WST Decoder,0x00600000,1,1,wstdecod.dll,5.03.2600.5512
Video Renderer,0x00400000,1,0,quartz.dll,6.05.2600.6333
RealMedia Source,0x00600000,0,0,RealMedia.dll,1.00.0000.0009
CT SmartVolumeManagement filter,0x00100000,1,1,DSCompr.ax,1.00.0005.0000
Creative Audio Gain Filter,0x00200000,1,1,AudGain.ax,1.00.0000.0000
WM ASF Writer,0x00400000,0,0,qasf.dll,11.00.5721.5145
WMT Sample Information Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
VBI Surface Allocator,0x00600000,1,1,vbisurf.ax,5.03.2600.5512
Microsoft MPEG-4 Video Decompressor,0x00800000,1,1,mpg4ds32.ax,8.00.0000.4504
Creative Flac Source Filter,0x00400000,0,1,FlacSrcu.ax,1.00.0000.0000
File writer,0x00200000,1,0,qcap.dll,6.05.2600.5512
Creative MLP Source Filter,0x00400000,0,1,MlpSrcu.ax,3.01.0000.0000
SVM Metadata,0x001fffff,1,1,MetaSVMu.ax,2.00.0002.0000
CT HPVirtualizer filter,0x00100000,1,1,Virtual.ax,1.00.0000.0000
RealPlayer MP3 Transform,0x00600000,1,1,rdsf3260.dll,16.00.0000.0282
WMT Log Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WMT Virtual Renderer,0x00200000,1,0,wmm2filt.dll,2.01.4026.0000
RealAudio Decoder,0x00400000,1,1,RealMedia.dll,1.00.0000.0009
ffdshow VFW decoder helper,0x00200000,2,1,ffdshow.ax,1.00.0000.0001
DVD Navigator,0x00200000,0,2,qdvd.dll,6.05.2600.6169
Creative Wave Transform Filter,0x00200000,0,0,WavTrans.ax,1.00.0001.0000
Overlay Mixer2,0x00400000,1,1,qdvd.dll,6.05.2600.6169
AC3Filter,0x40000000,1,1,ac3filter.ax,0.06.0008.0000
CT CMSS3 filter,0x00100000,1,1,CMSS3.ax,3.00.0013.0000
AVI Draw,0x00600064,9,1,quartz.dll,6.05.2600.6333
.RAM file Parser,0x00600000,1,0,wmpasf.dll,11.00.5721.5145
WMT DirectX Transform Wrapper,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
G.711 Codec,0x00200000,1,1,g711codc.ax,5.01.2600.0000
MPEG-2 Demultiplexer,0x00600000,1,1,mpg2splt.ax,6.05.2600.6333
Creative Ogg Source Filter,0x00400000,0,1,OggSrcu.ax,1.00.0001.0000
DV Video Decoder,0x00800000,1,1,qdv.dll,6.05.2600.5512
Creative NVF Filter,0x00400000,0,1,NvfSrcu.ax,3.01.0001.0000
RealPlayer Transcode Filter,0x00600000,0,0,rdsf3260.dll,16.00.0000.0282
Indeo® audio software,0x00500000,1,1,iac25_32.ax,2.00.0005.0053
Windows Media Update Filter,0x00400000,1,0,wmpasf.dll,11.00.5721.5145
Creative QT Source Filter,0x00400000,0,2,CTQTSF.ax,1.01.0007.0000
Noise Reduction,0x00100000,1,1,NoisRedu.ax,3.00.0004.0000
Screen Capture filter,0x00200000,0,1,wmesrcwp.dll,9.00.0000.2980
ASF DIB Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF ACM Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF ICM Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF URL Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF JPEG Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF DJPEG Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF embedded stuff Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
9x8Resize,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WIA Stream Snapshot Filter,0x00200000,1,1,wiasf.ax,1.00.0000.0000
Allocator Fix,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
SampleGrabber,0x00200000,1,1,qedit.dll,6.05.2600.5512
Null Renderer,0x00200000,1,0,qedit.dll,6.05.2600.5512
Creative WMA Writer,0x00200000,1,0,WMAWrite.ax,3.01.0004.0000
WMT Virtual Source,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
MPEG-2 Sections and Tables,0x005fffff,1,0,mpeg2data.ax,
WMT Interlacer,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
StreamBufferSource,0x00200000,0,0,sbe.dll,6.05.2600.6076
Smart Tee,0x00200000,1,2,qcap.dll,6.05.2600.5512
Creative WMA Source Filter,0x00400000,0,1,WmaSrc.ax,3.01.0001.0000
Overlay Mixer,0x00200000,0,0,qdvd.dll,6.05.2600.6169
RealPlayer Audio Filter,0x00200000,1,1,rdsf3260.dll,16.00.0000.0282
AVI Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6333
Uncompressed Domain Shot Detection Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Audible Words Codec,0x00500000,1,1,awrdscdc.ax,5.00.0000.0005
AVI/WAV File Source,0x00400000,0,2,quartz.dll,6.05.2600.6333
QuickTime Movie Parser,0x00600000,1,1,quartz.dll,6.05.2600.6333
Wave Parser,0x00400000,1,1,quartz.dll,6.05.2600.6333
MIDI Parser,0x00400000,1,1,quartz.dll,6.05.2600.6333
Multi-file Parser,0x00400000,1,1,quartz.dll,6.05.2600.6333
File stream renderer,0x00400000,1,1,quartz.dll,6.05.2600.6333
XML Playlist,0x00400000,1,0,wmpasf.dll,11.00.5721.5145
Extractor,0x00200000,1,0,Extractor.ax,1.00.0000.8010
Video Source,0x00200000,0,1,wmprevu.dll,9.00.0000.2980
RealMedia Splitter,0x00600000,1,1,RealMedia.dll,1.00.0000.0009
AVI Mux,0x00200000,1,0,qcap.dll,6.05.2600.5512
CyberLink QuickTime Source Filter,0x00200000,0,2,Quicktime.dll,1.00.0000.1016
Line 21 Decoder 2,0x00600002,1,1,quartz.dll,6.05.2600.6333
File Source (Async.),0x00400000,0,1,quartz.dll,6.05.2600.6333
File Source (URL),0x00400000,0,1,quartz.dll,6.05.2600.6333
WMT DV Extract,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Creative Null Audio,0x00600000,1,0,NullAud.ax,1.00.0001.0000
Creative CDDA Source Filter,0x00400000,0,1,CDDA.ax,3.00.0002.0000
Creative LiveRecording Filter SxS,0x00400000,0,1,LiveRecu.ax,5.00.0001.0000
WMT Switch Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WMT Volume,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Creative Internet Source Filter,0x00400000,0,1,InetSrcu.ax,1.00.0000.0000
Track1Filter,0x00200000,0,0,Track1Filter.dll,
Stretch Video,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Infinite Pin Tee Filter,0x00200000,1,1,qcap.dll,6.05.2600.5512
QT Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6333
MPEG Video Decoder,0x40000001,1,1,quartz.dll,6.05.2600.6333
Indeo® video 4.4 Decompression Filter,0x00640000,1,1,ir41_32.ax,4.51.0016.0003
Indeo® video 4.4 Compression Filter,0x00200000,1,1,ir41_32.ax,4.51.0016.0003

WDM Streaming Data Transforms:
Microsoft Kernel Acoustic Echo Canceller,0x00000000,0,0,,
Microsoft Kernel GS Wavetable Synthesizer,0x00200000,1,1,,5.03.2600.5512
Microsoft Kernel DLS Synthesizer,0x00200000,1,1,,5.03.2600.5512
Microsoft Kernel DRM Audio Descrambler,0x00200000,1,1,,5.03.2600.5512

Video Compressors:
WMVideo8 Encoder DMO,0x00600800,1,1,,
MSScreen encoder DMO,0x00600800,1,1,,
WMVideo9 Encoder DMO,0x00600800,1,1,,
MSScreen 9 encoder DMO,0x00600800,1,1,,
DV Video Encoder,0x00200000,0,0,qdv.dll,6.05.2600.5512
ffdshow video encoder,0x00100000,1,1,ffdshow.ax,1.00.0000.0001
Indeo® video 5.10 Compression Filter,0x00100000,1,1,ir50_32.dll,5.2562.0015.0055
MJPEG Compressor,0x00200000,0,0,quartz.dll,6.05.2600.6333
Cinepak Codec by Radius,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel 4:2:0 Video V2.50,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel Indeo(R) Video R3.2,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel Indeo® Video 4.5,0x00200000,1,1,qcap.dll,6.05.2600.5512
Indeo® video 5.10,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel IYUV codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft H.261 Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft H.263 Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft RLE,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft Video 1,0x00200000,1,1,qcap.dll,6.05.2600.5512
TechSmith Screen Capture Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512

Audio Compressors:
WMA Voice Encoder DMO,0x00600800,1,1,,
WM Speech Encoder DMO,0x00600800,1,1,,
WMAudio Encoder DMO,0x00600800,1,1,,
IAC2,0x00200000,1,1,quartz.dll,6.05.2600.6333
IMA ADPCM,0x00200000,1,1,quartz.dll,6.05.2600.6333
PCM,0x00200000,1,1,quartz.dll,6.05.2600.6333
Microsoft ADPCM,0x00200000,1,1,quartz.dll,6.05.2600.6333
ACELP.net,0x00200000,1,1,quartz.dll,6.05.2600.6333
DSP Group TrueSpeech(TM),0x00200000,1,1,quartz.dll,6.05.2600.6333
Windows Media Audio V1,0x00200000,1,1,quartz.dll,6.05.2600.6333
Windows Media Audio V2,0x00200000,1,1,quartz.dll,6.05.2600.6333
GSM 6.10,0x00200000,1,1,quartz.dll,6.05.2600.6333
Microsoft G.723.1,0x00200000,1,1,quartz.dll,6.05.2600.6333
CCITT A-Law,0x00200000,1,1,quartz.dll,6.05.2600.6333
CCITT u-Law,0x00200000,1,1,quartz.dll,6.05.2600.6333
MPEG Layer-3,0x00200000,1,1,quartz.dll,6.05.2600.6333

Audio Capture Sources:
Realtek HD Audio Input,0x00200000,0,0,qcap.dll,6.05.2600.5512
WsAudio_DeviceS(1),0x00200000,0,0,qcap.dll,6.05.2600.5512
WsAudio_DeviceS(2),0x00200000,0,0,qcap.dll,6.05.2600.5512
WsAudio_DeviceS(3),0x00200000,0,0,qcap.dll,6.05.2600.5512
WsAudio_DeviceS(4),0x00200000,0,0,qcap.dll,6.05.2600.5512
WsAudio_DeviceS(5),0x00200000,0,0,qcap.dll,6.05.2600.5512

Midi Renderers:
Default MidiOut Device,0x00800000,1,0,quartz.dll,6.05.2600.6333
Microsoft GS Wavetable SW Synth,0x00200000,1,0,quartz.dll,6.05.2600.6333

WDM Streaming Capture Devices:
Realtek HD Audio Input,0x00200000,1,1,,5.03.2600.5512
WsAudio_DeviceS(1),0x00200000,2,2,,5.03.2600.5512
WsAudio_DeviceS(2),0x00200000,2,2,,5.03.2600.5512
WsAudio_DeviceS(3),0x00200000,2,2,,5.03.2600.5512
WsAudio_DeviceS(4),0x00200000,2,2,,5.03.2600.5512
WsAudio_DeviceS(5),0x00200000,2,2,,5.03.2600.5512

WDM Streaming Rendering Devices:
Realtek HD Audio output,0x00200000,1,1,,5.03.2600.5512
WsAudio_DeviceS(1),0x00200000,2,2,,5.03.2600.5512
WsAudio_DeviceS(2),0x00200000,2,2,,5.03.2600.5512
WsAudio_DeviceS(3),0x00200000,2,2,,5.03.2600.5512
WsAudio_DeviceS(4),0x00200000,2,2,,5.03.2600.5512
WsAudio_DeviceS(5),0x00200000,2,2,,5.03.2600.5512

BDA Transport Information Renderers:
MPEG-2 Sections and Tables,0x00600000,1,0,mpeg2data.ax,

WDM Streaming Mixer Devices:
Microsoft Kernel Wave Audio Mixer,0x00000000,0,0,,

BDA CP/CA Filters:
Decrypt/Tag,0x00600000,1,0,encdec.dll,6.05.2600.6161
Encrypt/Tag,0x00200000,0,0,encdec.dll,6.05.2600.6161
XDS Codec,0x00200000,0,0,encdec.dll,6.05.2600.6161

Audio Renderers:
Realtek HD Audio output,0x00200000,1,0,quartz.dll,6.05.2600.6333
Default DirectSound Device,0x00800000,1,0,quartz.dll,6.05.2600.6333
Default WaveOut Device,0x00200000,1,0,quartz.dll,6.05.2600.6333
DirectSound: Realtek HD Audio output,0x00200000,1,0,quartz.dll,6.05.2600.6333
DirectSound: WsAudio_DeviceS(1),0x00200000,1,0,quartz.dll,6.05.2600.6333
DirectSound: WsAudio_DeviceS(2),0x00200000,1,0,quartz.dll,6.05.2600.6333
DirectSound: WsAudio_DeviceS(3),0x00200000,1,0,quartz.dll,6.05.2600.6333
DirectSound: WsAudio_DeviceS(4),0x00200000,1,0,quartz.dll,6.05.2600.6333
DirectSound: WsAudio_DeviceS(5),0x00200000,1,0,quartz.dll,6.05.2600.6333
WsAudio_DeviceS(1),0x00200000,1,0,quartz.dll,6.05.2600.6333
WsAudio_DeviceS(2),0x00200000,1,0,quartz.dll,6.05.2600.6333
WsAudio_DeviceS(3),0x00200000,1,0,quartz.dll,6.05.2600.6333
WsAudio_DeviceS(4),0x00200000,1,0,quartz.dll,6.05.2600.6333
WsAudio_DeviceS(5),0x00200000,1,0,quartz.dll,6.05.2600.6333

WDM Streaming System Devices:
Realtek HD Audio Input,0x00200000,3,1,,5.03.2600.5512
Realtek HD Audio output,0x00200000,9,1,,5.03.2600.5512
WsAudio_DeviceS(1),0x00200000,6,2,,5.03.2600.5512
WsAudio_DeviceS(2),0x00200000,6,2,,5.03.2600.5512
WsAudio_DeviceS(3),0x00200000,6,2,,5.03.2600.5512
WsAudio_DeviceS(4),0x00200000,6,2,,5.03.2600.5512
WsAudio_DeviceS(5),0x00200000,6,2,,5.03.2600.5512


----------



## sarahmuriel (Feb 1, 2004)

You know, I might be hysterical and paranoid, I just ran Eset to that file and it found nothing wrong with it. I think just deleting might be the best way to deal with it.


----------



## Cookiegal (Aug 27, 2003)

Yes, I know you're running XP. All you need to do to take a print screen is press the "Print Screen" or "Prt Scrn" key on the keyboard (not in combination with any other keys) and then open up Paint and paste it there. Then you have to save it and upload it as an attachment.

But what file are you referring to?


Also, did you try to install some sound drivers named WsAudio from Wondershare?


----------



## sarahmuriel (Feb 1, 2004)

Cookiegal said:


> Also, can you click on your external drive letter to open the drive that has the Embird installer on it and post a screenshot of what you see there please.


I was trying to get a screen shot of the drive that had the Embird files as you had requested. I don't know if I misunderstood your request to get a screen shot of the files on that drive.

In reference to the drives I used a programs called SlimDrivers to update the drives in my computer, but the reason I did that was because of the wobbly noise when Windows started. So that issue was there before and has been there for quite a while, should I drop that issue. It just annoying to me, the music wobbles and I get stress cause I just want to get in and fix the bugger.

I hope the screen shot I uploaded took

Sarah


----------



## Cookiegal (Aug 27, 2003)

That is not a good way to update drivers. In fact, it's not always a good idea to update drivers unless the update fixes a known issue. I think we can fix that problem.

I don't see the screenshot though. 

Please download  *Autoruns for Windows* and save the *Autoruns.zip* file to your desktop.

Unzip it (extract) the file and double click the *autoruns.exe* file to run the program.

Then click on *File* - *Save* and save it as *AutoRuns.txt* to your desktop. You also need to click on the drop-down menu beside "save as type" and change the file type to *Text (.txt)*.

Then open the AutoRuns.txt file in Notepad and copy and paste the contents. If the file is too large then upload it as an attachment please.


----------



## sarahmuriel (Feb 1, 2004)

Every time I try to upload the Drive F screen shot that I have in paint, it fails......

Below is a copy of the Autorun
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	""	""	""	"6/16/2013 12:11 PM"
+ "Adobe ARM"	"Adobe Reader and Acrobat Manager"	"Adobe Systems Incorporated"	"c:\program files\common files\adobe\arm\1.0\adobearm.exe"	"4/4/2013 5:05 PM"
+ "ddoctorv2"	""	"SupportSoft, Inc."	"c:\program files\comcast\desktop doctor\bin\sprtcmd.exe"	"3/27/2008 9:39 PM"
+ "EEventManager"	"EEventManager Application"	"SEIKO EPSON CORPORATION"	"c:\program files\epson software\event manager\eeventmanager.exe"	"12/2/2009 9:06 PM"
+ "egui"	"ESET Main GUI"	"ESET"	"c:\program files\eset\eset smart security\egui.exe"	"3/21/2013 10:05 AM"
+ "FileOpenBroker"	"FileOpen Broker"	"FileOpen Systems Inc."	"c:\program files\fileopen\services\fileopenbroker32.exe"	"4/30/2012 1:39 PM"
+ "FUFAXSTM"	"FAX Status Monitor"	"SEIKO EPSON CORPORATION"	"c:\program files\epson software\fax utility\fufaxstm.exe"	"12/2/2009 11:22 PM"
+ "HotKeysCmds"	"hkcmd Module"	"Intel Corporation"	"c:\windows\system32\hkcmd.exe"	"2/15/2008 4:46 PM"
+ "IgfxTray"	"igfxTray Module"	"Intel Corporation"	"c:\windows\system32\igfxtray.exe"	"2/15/2008 4:46 PM"
+ "LTCM Client"	"LTCM Communications Client"	"Leader Technologies Inc."	"c:\program files\ltcm client\ltcmclient.exe"	"8/5/2009 1:20 PM"
+ "Persistence"	"persistence Module"	"Intel Corporation"	"c:\windows\system32\igfxpers.exe"	"2/15/2008 4:46 PM"
+ "Reader Library Launcher"	"Reader Library Launcher"	"Sony Corporation"	"c:\program files\sony\reader\data\bin\launcher\reader library launcher.exe"	"7/13/2010 4:07 AM"
+ "RTHDCPL"	"Realtek HD Audio Control Panel"	"Realtek Semiconductor Corp."	"c:\windows\rthdcpl.exe"	"8/6/2012 3:41 AM"
+ "SunJavaUpdateSched"	"Java(TM) Update Scheduler"	"Oracle Corporation"	"c:\program files\common files\java\java update\jusched.exe"	"3/12/2013 11:32 AM"
+ "TkBellExe"	"RealNetworks Scheduler"	"RealNetworks, Inc."	"c:\program files\real\realplayer\update\realsched.exe"	"11/30/2012 7:17 PM"
+ "WinPatrol"	"WinPatrol System Monitor"	"BillP Studios"	"c:\program files\billp studios\winpatrol\winpatrol.exe"	"1/30/2012 2:34 PM"
"C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup"	""	""	""	"5/8/2012 8:48 AM"
+ "ymetray.lnk"	""	""	"c:\program files\yahoo!\yahoo! music jukebox\ymetray.exe"	"8/14/2006 1:12 PM"
"HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components"	""	""	""	"2/18/2012 5:40 PM"
+ "Address Book 6"	"Outlook Express Setup Library"	"Microsoft Corporation"	"c:\program files\outlook express\setup50.exe"	"4/13/2008 2:30 PM"
+ "Microsoft Outlook Express 6"	"Outlook Express Setup Library"	"Microsoft Corporation"	"c:\program files\outlook express\setup50.exe"	"4/13/2008 2:30 PM"
"HKCU\Software\Microsoft\Windows\CurrentVersion\Run"	""	""	""	"6/16/2013 10:16 AM"
+ "CTSyncU.exe"	"Creative Sync Manager"	""	"c:\program files\creative\sync manager unicode\ctsyncu.exe"	"7/16/2007 11:03 PM"
+ "EPSON NX410 Series"	"EPSON Status Monitor 3"	"SEIKO EPSON CORPORATION"	"c:\windows\system32\spool\drivers\w32x86\3\e_fatifca.exe"	"10/1/2008 10:03 PM"
+ "H/PC Connection Agent"	"ActiveSync Connection Manager"	"Microsoft Corporation"	"c:\program files\microsoft activesync\wcescomm.exe"	"11/13/2006 4:57 PM"
"HKLM\SOFTWARE\Classes\Protocols\Filter"	""	""	""	"8/25/2010 2:13 PM"
+ "text/xml"	"Microsoft Office XML MIME Filter"	"Microsoft Corporation"	"c:\program files\common files\microsoft shared\office12\msoxmlmf.dll"	"10/25/2008 4:26 AM"
"HKLM\SOFTWARE\Classes\Protocols\Handler"	""	""	""	"8/25/2010 2:13 PM"
+ "ms-help"	"Microsoft® Help Data Services Module"	"Microsoft Corporation"	"c:\program files\common files\microsoft shared\help\hxds.dll"	"8/19/2006 4:23 AM"
"HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components"	""	""	""	"6/15/2013 10:27 PM"
+ "0"	""	""	"File not found: About:Home"	""
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks"	""	""	""	"4/10/2012 1:11 PM"
+ "Windows Desktop Search Namespace Manager"	"Windows Search Namespace Manager"	"Microsoft Corporation"	"c:\program files\windows desktop search\msnlnamespacemgr.dll"	"5/25/2009 1:41 AM"
"HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers"	""	""	""	"8/25/2010 10:02 AM"
+ "CTMTPMediaExplorer"	"CME ContextMenu Shell Extension"	"Creative Technology Ltd"	"c:\program files\creative\shared files\ctcmectx.dll"	"9/21/2005 5:32 AM"
+ "ESET Smart Security - Context Menu Shell Extension"	"ESET Shell Extension"	"ESET"	"c:\program files\eset\eset smart security\shellext.dll"	"3/21/2013 10:14 AM"
+ "Sprint.ExplorerIntegration"	"ABBYY Sprint Integration"	"ABBYY"	"c:\program files\common files\abbyy\finereadersprint\9.00\integration\sprintintegration.dll"	"11/25/2009 11:14 AM"
+ "WinRAR"	""	""	"c:\program files\winrar\rarext.dll"	"3/15/2010 2:28 AM"
"HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers"	""	""	""	"8/26/2010 12:13 PM"
+ "WinRAR"	""	""	"c:\program files\winrar\rarext.dll"	"3/15/2010 2:28 AM"
"HKLM\Software\Classes\Directory\Shellex\DragDropHandlers"	""	""	""	"8/26/2010 12:13 PM"
+ "WinRAR"	""	""	"c:\program files\winrar\rarext.dll"	"3/15/2010 2:28 AM"
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers"	""	""	""	"8/25/2010 2:13 PM"
+ "igfxcui"	"igfxpph Module"	"Intel Corporation"	"c:\windows\system32\igfxpph.dll"	"2/15/2008 4:46 PM"
"HKLM\Software\Classes\Folder\Shellex\ColumnHandlers"	""	""	""	"8/25/2010 2:13 PM"
+ "PDF Shell Extension"	"PDF Shell Extension"	"Adobe Systems, Inc."	"c:\program files\common files\adobe\acrobat\activex\pdfshell.dll"	"5/10/2013 2:33 AM"
"HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers"	""	""	""	"8/25/2010 2:13 PM"
+ "CTMTPMediaExplorer"	"CME ContextMenu Shell Extension"	"Creative Technology Ltd"	"c:\program files\creative\shared files\ctcmectx.dll"	"9/21/2005 5:32 AM"
+ "ESET Smart Security - Context Menu Shell Extension"	"ESET Shell Extension"	"ESET"	"c:\program files\eset\eset smart security\shellext.dll"	"3/21/2013 10:14 AM"
+ "WinRAR"	""	""	"c:\program files\winrar\rarext.dll"	"3/15/2010 2:28 AM"
"HKLM\Software\Classes\Folder\ShellEx\DragDropHandlers"	""	""	""	"8/25/2010 2:13 PM"
+ "WinRAR"	""	""	"c:\program files\winrar\rarext.dll"	"3/15/2010 2:28 AM"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects"	""	""	""	"4/10/2012 1:11 PM"
+ "Easy Photo Print"	"Epson Easy Photo Print (TBL)"	"SEIKO EPSON CORPORATION / CyCom Technology Corp."	"c:\program files\epson software\easy photo print\eptbl.dll"	"3/29/2008 5:41 AM"
+ "Java(tm) Plug-In 2 SSV Helper"	"Java(TM) Platform SE binary"	"Oracle Corporation"	"c:\program files\java\jre7\bin\jp2ssv.dll"	"4/4/2013 8:27 AM"
+ "Java(tm) Plug-In SSV Helper"	"Java(TM) Platform SE binary"	"Oracle Corporation"	"c:\program files\java\jre7\bin\ssv.dll"	"4/4/2013 8:27 AM"
+ "RealNetworks Download and Record Plugin for Internet Explorer"	"RealPlayer Download and Record Plugin"	"RealDownloader"	"c:\documents and settings\all users.windows\application data\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll"	"11/30/2012 12:33 AM"
+ "SingleInstance Class"	"Yahoo! Single Instance for Mail"	"Yahoo! Inc"	"c:\program files\yahoo!\companion\installs\cpn2\ytsingleinstance.dll"	"3/23/2010 3:49 AM"
+ "Spybot-S&D IE Protection"	"SBSD IE Protection"	"Safer Networking Limited"	"c:\program files\spybot - search & destroy\sdhelper.dll"	"6/19/1992 6:22 PM"
"HKLM\Software\Microsoft\Internet Explorer\Toolbar"	""	""	""	"5/11/2013 8:47 PM"
+ "EPTBL"	"Epson Easy Photo Print (TBL)"	"SEIKO EPSON CORPORATION / CyCom Technology Corp."	"c:\program files\epson software\easy photo print\eptbl.dll"	"3/29/2008 5:41 AM"
"HKLM\Software\Microsoft\Internet Explorer\Extensions"	""	""	""	"5/11/2013 8:47 PM"
+ "Create Mobile Favorite"	"ActiveSync Favorite Synchronization"	"Microsoft Corporation"	"c:\program files\microsoft activesync\inetrepl.dll"	"11/13/2006 4:55 PM"
+ "Create Mobile Favorite..."	"ActiveSync Favorite Synchronization"	"Microsoft Corporation"	"c:\program files\microsoft activesync\inetrepl.dll"	"11/13/2006 4:55 PM"
+ "Spybot - Search & Destroy Configuration"	"SBSD IE Protection"	"Safer Networking Limited"	"c:\program files\spybot - search & destroy\sdhelper.dll"	"6/19/1992 6:22 PM"
+ "Windows Messenger"	"Windows Messenger"	"Microsoft Corporation"	"c:\program files\messenger\msmsgs.exe"	"4/13/2008 2:34 PM"
"Task Scheduler"	""	""	""	""
+ "Adobe Flash Player Updater.job"	"Adobe® Flash® Player Update Service 11.7 r700"	"Adobe Systems Incorporated"	"c:\windows\system32\macromed\flash\flashplayerupdateservice.exe"	"5/29/2013 5:43 PM"
+ "RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job"	"RealUpgrade Launcher"	"RealNetworks, Inc."	"c:\program files\real\realupgrade\realupgrade.exe"	"11/30/2012 7:30 PM"
+ "RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job"	"RealUpgrade Launcher"	"RealNetworks, Inc."	"c:\program files\real\realupgrade\realupgrade.exe"	"11/30/2012 7:30 PM"
+ "RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job"	"RealUpgrade Launcher"	"RealNetworks, Inc."	"c:\program files\real\realupgrade\realupgrade.exe"	"11/30/2012 7:30 PM"
+ "RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job"	"RealUpgrade Launcher"	"RealNetworks, Inc."	"c:\program files\real\realupgrade\realupgrade.exe"	"11/30/2012 7:30 PM"
+ "ReclaimerUpdateXML_all.job"	"RealNetworks Installer"	"RealNetworks, Inc."	"c:\documents and settings\all\application data\real\update\upgradehelper\realplayer\10.50\agent\rnupgagent.exe"	"6/3/2013 1:47 PM"
+ "RNUpgradeHelperLogonPrompt_all.job"	"RealNetworks Installer"	"RealNetworks, Inc."	"c:\documents and settings\all\application data\real\update\upgradehelper\realplayer\10.50\agent\rnupgagent.exe"	"6/3/2013 1:47 PM"
"HKLM\System\CurrentControlSet\Services"	""	""	""	"4/1/2013 1:55 PM"
+ "ABBYY.Licensing.FineReader.Sprint.9.0"	"This service is required for the operation of the ABBYY FineReader 9.0 Express Edition licensing mechanism."	"ABBYY"	"c:\program files\common files\abbyy\finereadersprint\9.00\licensing\networklicenseserver.exe"	"5/14/2009 10:07 AM"
+ "AdobeActiveFileMonitor7.0"	"Tracks files that are managed by Adobe Photoshop Elements"	"Adobe Systems Incorporated"	"c:\program files\adobe\photoshop elements 7.0\photoshopelementsfileagent.exe"	"9/16/2008 1:22 PM"
+ "AdobeFlashPlayerUpdateSvc"	"This service keeps your Adobe Flash Player installation up to date with the latest enhancements and security fixes."	"Adobe Systems Incorporated"	"c:\windows\system32\macromed\flash\flashplayerupdateservice.exe"	"5/29/2013 5:43 PM"
+ "AppMgmt"	"Provides software installation services such as Assign, Publish, and Remove."	""	"File not found: C:\WINDOWS\System32\appmgmts.dll"	""
+ "ekrn"	"ESET Service"	"ESET"	"c:\program files\eset\eset smart security\ekrn.exe"	"3/21/2013 10:04 AM"
+ "EpsonBidirectionalService"	"eEBAPI Core Process module"	"SEIKO EPSON CORPORATION"	"c:\program files\common files\epson\ebapi\eebsvc.exe"	"12/19/2006 8:53 AM"
+ "FileOpenManagerSvc"	"FileOpen client manager"	"FileOpen Systems Inc."	"c:\program files\fileopen\services\fileopenmanagersvc32.exe"	"4/30/2012 1:36 PM"
+ "FLEXnet Licensing Service"	"This service performs licensing functions on behalf of FLEXnet enabled products."	"Macrovision Europe Ltd."	"c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe"	"11/27/2007 3:30 PM"
+ "IDriverT"	"Provides support for the Running Object Table for InstallShield Drivers"	"Macrovision Corporation"	"c:\program files\common files\installshield\driver\1050\intel 32\idrivert.exe"	"10/22/2004 4:24 AM"
+ "JavaQuickStarterService"	"Prefetches JRE files for faster startup of Java applets and applications"	"Oracle Corporation"	"c:\program files\java\jre7\bin\jqs.exe"	"4/4/2013 8:22 AM"
+ "McciCMService"	"mcci+McciCMService"	"Alcatel-Lucent"	"c:\program files\common files\motive\mccicmservice.exe"	"1/26/2010 2:26 PM"
+ "MozillaMaintenance"	"The Mozilla Maintenance Service ensures that you have the latest and most secure version of Mozilla Firefox on your computer. Keeping Firefox up to date is very important for your online security, and Mozilla strongly recommends that you keep this service enabled."	"Mozilla Foundation"	"c:\program files\mozilla maintenance service\maintenanceservice.exe"	"5/11/2013 4:53 PM"
+ "odserv"	"Run portions of Microsoft Office Diagnostics."	"Microsoft Corporation"	"c:\program files\common files\microsoft shared\office12\odserv.exe"	"10/25/2008 1:09 AM"
+ "ose"	"Saves installation files used for updates and repairs and is required for the downloading of Setup updates and Watson error reports."	"Microsoft Corporation"	"c:\program files\common files\microsoft shared\source engine\ose.exe"	"10/26/2006 5:00 PM"
+ "RealNetworks Downloader Resolver Service"	"Manage different Downloader versions in RealNetworks' products."	""	"c:\program files\realnetworks\realdownloader\rndlresolversvc.exe"	"11/30/2012 12:31 AM"
+ "Sony SCSI Helper Service"	"SCSI Helper Service"	"Sony Corporation"	"c:\program files\common files\sony shared\fsk\sonyscsihelperservice.exe"	"8/19/2005 5:46 AM"
+ "sprtsvc_ddoctorv2"	"SupportSoft Sprocket Service"	"SupportSoft, Inc."	"c:\program files\comcast\desktop doctor\bin\sprtsvc.exe"	"3/27/2008 9:40 PM"
+ "WMPNetworkSvc"	"Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play"	"Microsoft Corporation"	"c:\program files\windows media player\wmpnetwk.exe"	"10/19/2006 12:05 AM"
+ "YahooAUService"	"Keeps your favorite Yahoo! software up-to-date with the latest features, tools, and enhancements."	"Yahoo! Inc."	"c:\program files\yahoo!\softwareupdate\yahooauservice.exe"	"11/9/2008 4:47 PM"
"HKLM\System\CurrentControlSet\Services"	""	""	""	"4/1/2013 1:55 PM"
+ "Ambfilt"	"Creative WDM 3D Audio Driver"	"Creative"	"c:\windows\system32\drivers\ambfilt.sys"	"8/5/2008 8:10 AM"
+ "busbcrw"	"Brother USB Card Reader Writer Driver"	"Brother Industries, Ltd."	"c:\windows\system32\drivers\busbcrw.sys"	"4/22/2003 8:44 PM"
+ "catchme"	""	""	"File not found: C:\DOCUME~1\all\LOCALS~1\Temp\catchme.sys"	""
+ "Changer"	""	""	"File not found: C:\WINDOWS\System32\Drivers\Changer.sys"	""
+ "eamon"	"Eset file on-access scanner"	"ESET"	"c:\windows\system32\drivers\eamon.sys"	"12/21/2012 8:02 AM"
+ "eBook"	"eBook Network Driver"	"eBook Technologies, Inc."	"c:\windows\system32\drivers\ebook.sys"	"6/24/2005 5:42 PM"
+ "ehdrv"	"Eset Helper driver"	"ESET"	"c:\windows\system32\drivers\ehdrv.sys"	"12/21/2012 8:03 AM"
+ "epfw"	"EPFW Filter Driver"	"ESET"	"c:\windows\system32\drivers\epfw.sys"	"12/21/2012 7:59 AM"
+ "Epfwndis"	"ESET Personal Firewall NDIS filter"	"ESET"	"c:\windows\system32\drivers\epfwndis.sys"	"12/21/2012 7:59 AM"
+ "epfwtdi"	"EPFW Filter Driver"	"ESET"	"c:\windows\system32\drivers\epfwtdi.sys"	"2/5/2013 4:20 AM"
+ "fdrawcmd"	"Low-level floppy filter"	"simonowen.com"	"c:\windows\system32\drivers\fdrawcmd.sys"	"9/27/2008 11:07 PM"
+ "grmnusb"	"grmnusb.sys"	"GARMIN Corp."	"c:\windows\system32\drivers\grmnusb.sys"	"4/17/2009 4:48 PM"
+ "HDAudBus"	"High Definition Audio Bus Driver v1.0a"	"Windows (R) Server 2003 DDK provider"	"c:\windows\system32\drivers\hdaudbus.sys"	"5/26/2005 11:46 AM"
+ "i2omgmt"	""	""	"File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys"	""
+ "ialm"	"Intel Graphics Miniport Driver"	"Intel Corporation"	"c:\windows\system32\drivers\igxpmp32.sys"	"2/15/2008 5:12 PM"
+ "IntcAzAudAddService"	"Realtek(r) High Definition Audio Function Driver"	"Realtek Semiconductor Corp."	"c:\windows\system32\drivers\rtkhdaud.sys"	"8/21/2012 6:16 AM"
+ "lbrtfdc"	""	""	"File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys"	""
+ "Monfilt"	"Creative WDM Audio Driver (32-bit)"	"Creative Technology Ltd."	"c:\windows\system32\drivers\monfilt.sys"	"1/4/2006 3:41 AM"
+ "motmodem"	"Motorola USB Modem and Ports Driver"	"Motorola"	"c:\windows\system32\drivers\motmodem.sys"	"6/18/2007 3:31 PM"
+ "MREMP50"	"PCAUSA NDIS 5.0 MPR Protocol Driver"	"Printing Communications Assoc., Inc. (PCAUSA)"	"c:\program files\common files\motive\mremp50.sys"	"11/19/2005 4:13 AM"
+ "MRESP50"	"PCAUSA NDIS 5.0 SPR Protocol Driver"	"Printing Communications Assoc., Inc. (PCAUSA)"	"c:\program files\common files\motive\mresp50.sys"	"11/19/2005 4:13 AM"
+ "PCIDump"	""	""	"File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys"	""
+ "PDCOMP"	""	""	"File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys"	""
+ "PDFRAME"	""	""	"File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys"	""
+ "PDRELI"	""	""	"File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys"	""
+ "PDRFRAME"	""	""	"File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys"	""
+ "Ptilink"	"Direct Parallel Link Driver"	"Parallel Technologies, Inc."	"c:\windows\system32\drivers\ptilink.sys"	"8/17/2001 4:49 PM"
+ "PxHelp20"	"Px Engine Device Driver for Windows 2000/XP"	"Sonic Solutions"	"c:\windows\system32\drivers\pxhelp20.sys"	"10/20/2009 1:57 PM"
+ "RTLE8023xp"	"Realtek 10/100/1000 NDIS 5.1 Driver "	"Realtek Semiconductor Corporation "	"c:\windows\system32\drivers\rtenicxp.sys"	"10/30/2008 9:14 AM"
+ "Secdrv"	"SafeDisc driver"	"Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K."	"c:\windows\system32\drivers\secdrv.sys"	"9/13/2006 9:18 AM"
+ "Ser2pl"	"USB-to-Serial Cable Driver"	"Prolific Technology Inc."	"c:\windows\system32\drivers\ser2pl.sys"	"7/22/2005 4:23 AM"
+ "StMp3Rec"	"Recovery Mode Driver"	"Generic"	"c:\windows\system32\drivers\stmp3rec.sys"	"1/4/2007 5:38 PM"
+ "SWDUMon"	"Driver Update Installer Monitor"	""	"c:\windows\system32\drivers\swdumon.sys"	"1/21/2013 4:15 PM"
+ "WDICA"	""	""	"File not found: C:\WINDOWS\System32\Drivers\WDICA.sys"	""
+ "wdpnp"	""	""	"c:\windows\system32\drivers\wdpnp.sys"	"11/11/2001 6:19 AM"
+ "WsAudio_DeviceS(1)"	"Wondershare Virtual Audio Device"	"Wondershare"	"c:\windows\system32\drivers\wsaudio_devices(1).sys"	"7/29/2009 10:09 AM"
+ "WsAudio_DeviceS(2)"	"Wondershare Virtual Audio Device"	"Wondershare"	"c:\windows\system32\drivers\wsaudio_devices(2).sys"	"7/29/2009 10:09 AM"
+ "WsAudio_DeviceS(3)"	"Wondershare Virtual Audio Device"	"Wondershare"	"c:\windows\system32\drivers\wsaudio_devices(3).sys"	"7/29/2009 10:09 AM"
+ "WsAudio_DeviceS(4)"	"Wondershare Virtual Audio Device"	"Wondershare"	"c:\windows\system32\drivers\wsaudio_devices(4).sys"	"7/29/2009 10:09 AM"
+ "WsAudio_DeviceS(5)"	"Wondershare Virtual Audio Device"	"Wondershare"	"c:\windows\system32\drivers\wsaudio_devices(5).sys"	"7/29/2009 10:09 AM"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32"	""	""	""	"6/17/2013 9:13 AM"
+ "msacm.iac2"	"Indeo® audio software"	"Intel Corporation"	"c:\windows\system32\iac25_32.ax"	"4/13/2008 8:09 PM"
+ "msacm.l3acm"	"MPEG Layer-3 Audio Codec for MSACM"	"Fraunhofer Institut Integrierte Schaltungen IIS"	"c:\windows\system32\l3codeca.acm"	"1/29/2010 10:43 AM"
+ "msacm.sl_anet"	"Audio codec for MS ACM"	"Sipro Lab Telecom Inc."	"c:\windows\system32\sl_anet.acm"	"4/13/2008 8:11 PM"
+ "msacm.trspch"	"DSP Group TrueSpeech(TM) Audio Codec for MSACM V3.50"	"DSP GROUP, INC."	"c:\windows\system32\tssoft32.acm"	"8/18/2001 1:35 AM"
+ "vidc.cvid"	"Cinepak® Codec"	"Radius Inc."	"c:\windows\system32\iccvid.dll"	"6/17/2010 10:03 AM"
+ "vidc.iv31"	""	""	"c:\windows\system32\ir32_32.dll"	"8/18/2001 1:33 AM"
+ "vidc.iv32"	""	""	"c:\windows\system32\ir32_32.dll"	"8/18/2001 1:33 AM"
+ "vidc.iv41"	"Intel Indeo® Video 4.5"	"Intel Corporation"	"c:\windows\system32\ir41_32.ax"	"4/13/2008 8:10 PM"
+ "vidc.iv50"	"Intel Indeo® video 5.10"	"Intel Corporation"	"c:\windows\system32\ir50_32.dll"	"4/13/2008 8:10 PM"
+ "vidc.tscc"	"TechSmith Screen Capture Codec"	"TechSmith Corporation"	"c:\windows\system32\tsccvid.dll"	"9/20/2004 11:06 AM"
"HKLM\Software\Classes\Filter"	""	""	""	"6/16/2013 12:11 PM"
+ "Indeo® video 4.4 Compression Filter"	"Intel Indeo® Video 4.5"	"Intel Corporation"	"c:\windows\system32\ir41_32.ax"	"4/13/2008 8:10 PM"
+ "Indeo® video 4.4 Compression Filter"	"Intel Indeo® Video 4.5"	"Intel Corporation"	"c:\windows\system32\ir41_32.ax"	"4/13/2008 8:10 PM"
+ "Indeo® video 4.4 Decompression Filter"	"Intel Indeo® Video 4.5"	"Intel Corporation"	"c:\windows\system32\ir41_32.ax"	"4/13/2008 8:10 PM"
+ "Indeo® video 4.4 Decompression Filter"	"Intel Indeo® Video 4.5"	"Intel Corporation"	"c:\windows\system32\ir41_32.ax"	"4/13/2008 8:10 PM"
"HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance"	""	""	""	"9/25/2010 11:58 AM"
+ "9x8Resize"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "_ VSO Preview Filter"	"Video preview filter"	"VSO Software SARL"	"c:\program files\vso\common\vsovprev.ax"	"8/29/2008 4:56 AM"
+ "AC3Filter"	"ac3filter"	""	"c:\windows\system32\ac3filter.ax"	"4/2/2003 6:17 PM"
+ "ACELP.net Audio Decoder"	"ACELP.net Audio Decoder"	"Sipro Lab Telecom Inc."	"c:\windows\system32\acelpdec.ax"	"8/18/2001 1:35 AM"
+ "Allocator Fix"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "Audible Words Codec"	"Audible Media Player Filter"	"Audible, Inc."	"c:\windows\system32\awrdscdc.ax"	"2/13/2006 6:13 PM"
+ "Audio Source"	"Windows Media Preview Object"	"Microsoft Corporation"	"c:\program files\windows media components\encoder\wmprevu.dll"	"12/11/2002 9:34 PM"
+ "Bitmap"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "BPM Metadata"	"Creative BPM Metadata Filter"	"Creative Technology Ltd."	"c:\program files\creative\shared files\metabpmu.ax"	"9/21/2005 11:13 PM"
+ "Creative AC3 Source Filter"	"Creative AC3 Source Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\ac3srcu.ax"	"4/10/2005 9:37 PM"
+ "Creative Audio Gain Filter"	"Audio Gain Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\audgain.ax"	"5/11/2005 5:27 AM"
+ "Creative CDDA Source Filter"	"CDDA Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\cdda.ax"	"10/13/2004 2:47 AM"
+ "Creative File Reader Filter"	"Creative File Reader Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\fileread.ax"	"3/2/2006 3:01 AM"
+ "Creative Flac Source Filter"	"Creative FLAC Source Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\flacsrcu.ax"	"4/17/2005 11:32 PM"
+ "Creative Frame Rate Converter"	"Creative Frame Rate Converter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\ctfrconv.ax"	"12/17/2006 10:30 PM"
+ "Creative Internet Source Filter"	"Creative Internet Source Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\inetsrcu.ax"	"5/12/2005 4:06 AM"
+ "Creative LiveRecording Filter_SxS"	"Live Recording Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\liverecu.ax"	"6/3/2005 3:21 AM"
+ "Creative Media Select"	""	"Creative Technology Ltd."	"c:\program files\creative\shared files\mediasel.ax"	"11/6/2006 10:42 PM"
+ "Creative MLP Source Filter"	"Creative MLP Source Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\mlpsrcu.ax"	"4/10/2005 9:55 PM"
+ "Creative Null Audio"	""	"Creative Technology Ltd."	"c:\program files\creative\shared files\nullaud.ax"	"11/7/2006 2:07 AM"
+ "Creative NVF Filter"	"Creative Nomad Voice File Source Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\nvfsrcu.ax"	"12/29/2005 5:24 AM"
+ "Creative Ogg Source Filter"	"Creative Ogg Source Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\oggsrcu.ax"	"8/25/2005 1:29 AM"
+ "Creative PCM Raw Writer"	"Creative Raw Writer"	"Creative Technology Ltd"	"c:\program files\creative\shared files\rawwritu.ax"	"6/29/2005 2:36 AM"
+ "Creative QT Source Filter"	"Creative QT Source Filter"	"Creative Technology Ltd."	"c:\program files\creative\shared files\ctqtsf.ax"	"9/6/2007 3:57 AM"
+ "Creative Video Processing Filter"	"Creative Video Processing Filter"	"Creative Technology Ltd."	"c:\program files\creative\shared files\vidprocu.ax"	"2/4/2007 11:59 PM"
+ "Creative Wave Writer"	"Wave Writer"	"Creative Technology Ltd"	"c:\program files\creative\shared files\wavwrite.ax"	"12/8/2005 1:52 AM"
+ "Creative WMA Source Filter"	"Creative WMA Source Filter"	"Creative Technology Ltd"	"c:\program files\creative\shared files\wmasrc.ax"	"2/14/2006 11:12 PM"
+ "Creative WMA Writer"	"WMA Writer"	"Creative Technology Ltd"	"c:\program files\creative\shared files\wmawrite.ax"	"11/27/2005 10:43 PM"
+ "CT CMSS3 filter"	"Sample"	"Creative Technology Ltd"	"c:\program files\creative\shared files\cmss3.ax"	"7/22/2005 5:59 PM"
+ "CT HPVirtualizer filter"	"Creative Headphone Virtualizer Filter"	"Creative Technology, Ltd."	"c:\program files\creative\shared files\virtual.ax"	"6/1/2005 7:56 PM"
+ "CT Karaoke filter"	"Creative Karaoke Filter"	"Creative Technology Ltd."	"c:\program files\creative\shared files\karaoke.ax"	"8/14/2006 7:55 PM"
+ "CT PDP filter"	"Creative Crystalizer Filter"	"Creative Technology, Ltd."	"c:\program files\creative\shared files\pdp.ax"	"5/26/2005 1:36 PM"
+ "CT SmartVolumeManagement filter"	"Creative Compressor Plugin"	"Creative Technology Ltd."	"c:\program files\creative\shared files\dscompr.ax"	"9/6/2006 2:47 AM"
+ "CT Time-Scaling filter"	"Sample"	"Creative Technology Ltd."	"c:\program files\creative\shared files\timescal.ax"	"7/24/2006 1:25 PM"
+ "CT Upsampler filter"	"Sample"	"Creative Technology Ltd"	"c:\program files\creative\shared files\upsample.ax"	"7/22/2005 5:57 PM"
+ "Extractor"	"Stream Data Extractor Filter"	"Sony Corporation"	"c:\program files\common files\sony shared\fsk\extractor.ax"	"8/1/2005 1:59 AM"
+ "ffdshow Audio Decoder"	"DirectShow and VFW video and audio decoding/encoding/processing filter"	""	"c:\windows\system32\ffdshow.ax"	"10/12/2004 2:46 AM"
+ "ffdshow MPEG-4 Video Decoder"	"DirectShow and VFW video and audio decoding/encoding/processing filter"	""	"c:\windows\system32\ffdshow.ax"	"10/12/2004 2:46 AM"
+ "ffdshow raw video filter"	"DirectShow and VFW video and audio decoding/encoding/processing filter"	""	"c:\windows\system32\ffdshow.ax"	"10/12/2004 2:46 AM"
+ "ffdshow VFW decoder helper"	"DirectShow and VFW video and audio decoding/encoding/processing filter"	""	"c:\windows\system32\ffdshow.ax"	"10/12/2004 2:46 AM"
+ "Frame Eater"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "Indeo® audio software"	"Indeo® audio software"	"Intel Corporation"	"c:\windows\system32\iac25_32.ax"	"4/13/2008 8:09 PM"
+ "Indeo® video 5.10 Compression Filter"	"Intel Indeo® video 5.10"	"Intel Corporation"	"c:\windows\system32\ir50_32.dll"	"4/13/2008 8:10 PM"
+ "Indeo® video 5.10 Decompression Filter"	"Intel Indeo® video 5.10"	"Intel Corporation"	"c:\windows\system32\ir50_32.dll"	"4/13/2008 8:10 PM"
+ "Mp3Dump"	""	"Creative Technology Ltd."	"c:\program files\creative\shared files\mp3dump.ax"	"3/22/2006 9:50 PM"
+ "MPEG Layer-3 Decoder"	"MPEG Layer-3 Audio Decoder"	"Fraunhofer Institut Integrierte Schaltungen IIS"	"c:\windows\system32\l3codecx.ax"	"6/15/2010 12:17 PM"
+ "Nero Digital API Audio Decoder"	"Nero Audio Decoder"	"Nero AG"	"c:\program files\yahoo!\yahoo! music jukebox\ndxauddec.ax"	"6/16/2005 8:45 AM"
+ "Nero Digital API ES Video Reader"	"NeroDigital / mp4 / avi / mov parser"	"Nero AG"	"c:\program files\yahoo!\yahoo! music jukebox\ndxparser.ax"	"6/13/2005 11:00 AM"
+ "Nero Digital API Parser"	"NeroDigital / mp4 / avi / mov parser"	"Nero AG"	"c:\program files\yahoo!\yahoo! music jukebox\ndxparser.ax"	"6/13/2005 11:00 AM"
+ "Noise Reduction"	"Creative Noise Reduction Filter"	"Creative Technology Ltd."	"c:\program files\creative\shared files\noisredu.ax"	"7/24/2006 1:46 PM"
+ "QTSrc"	"CLQTSrc"	"Cyberlink"	"c:\program files\cucusoft\avi-dvd-pro\filter\quicktime.dll"	"10/16/2003 3:05 AM"
+ "RealAudio Decoder"	"RealMedia Splitter"	"Gabest"	"c:\program files\cucusoft\avi-dvd-pro\filter\realmedia.dll"	"1/25/2004 12:49 PM"
+ "RealMedia Source"	"RealMedia Splitter"	"Gabest"	"c:\program files\cucusoft\avi-dvd-pro\filter\realmedia.dll"	"1/25/2004 12:49 PM"
+ "RealMedia Splitter"	"RealMedia Splitter"	"Gabest"	"c:\program files\cucusoft\avi-dvd-pro\filter\realmedia.dll"	"1/25/2004 12:49 PM"
+ "RealPlayer Audio Filter"	"Audio Filter Plugin"	"RealNetworks, Inc."	"c:\program files\real\realplayer\rdsf3260.dll"	"11/30/2012 7:23 PM"
+ "RealPlayer Mp3 Transform Filter"	"Audio Filter Plugin"	"RealNetworks, Inc."	"c:\program files\real\realplayer\rdsf3260.dll"	"11/30/2012 7:23 PM"
+ "RealPlayer MPEG4 Transform Filter"	"Audio Filter Plugin"	"RealNetworks, Inc."	"c:\program files\real\realplayer\rdsf3260.dll"	"11/30/2012 7:23 PM"
+ "RealPlayer Transcode Filter"	"Audio Filter Plugin"	"RealNetworks, Inc."	"c:\program files\real\realplayer\rdsf3260.dll"	"11/30/2012 7:23 PM"
+ "RealPlayer Video Filter"	"Audio Filter Plugin"	"RealNetworks, Inc."	"c:\program files\real\realplayer\rdsf3260.dll"	"11/30/2012 7:23 PM"
+ "RealVideo Decoder"	"RealMedia Splitter"	"Gabest"	"c:\program files\cucusoft\avi-dvd-pro\filter\realmedia.dll"	"1/25/2004 12:49 PM"
+ "Record Queue"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "Record Queue"	"WME Record Queue"	"Microsoft Corporation"	"c:\program files\windows media components\encoder\wmedque.dll"	"12/11/2002 9:34 PM"
+ "ShotDetect"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "SmartSound SDS Reader"	"SDS Media File Reader Filter"	"SmartSound Software Inc."	"c:\program files\smartsound software\quicktracks\sdsreader.dll"	"8/14/2007 12:42 AM"
+ "SmartSound Soundtrack"	"Quicktracks Soundtrack source filter"	"SmartSound Software Inc."	"c:\program files\smartsound software\quicktracks\directqx.dll"	"8/14/2007 1:12 AM"
+ "Stetch"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "SVM Metadata"	"Creative SVM Metadata Filter"	"Creative Technology Ltd."	"c:\program files\creative\shared files\metasvmu.ax"	"9/21/2005 11:14 PM"
+ "Track1Filter"	""	""	"c:\program files\adobe\photoshop elements 7.0\track1filter.dll"	"9/16/2008 1:20 PM"
+ "Track2Filter"	""	""	"c:\program files\adobe\photoshop elements 7.0\track2filter.dll"	"9/16/2008 1:20 PM"
+ "Video Source"	"Windows Media Preview Object"	"Microsoft Corporation"	"c:\program files\windows media components\encoder\wmprevu.dll"	"12/11/2002 9:34 PM"
+ "WavTrans"	""	"Creative Technology Ltd."	"c:\program files\creative\shared files\wavtrans.ax"	"3/22/2006 9:50 PM"
+ "WIA Stream Snapshot Filter"	"WIA Stream Snapshot Filter"	"MyCompanyName"	"c:\windows\system32\wiasf.ax"	"8/18/2001 1:35 AM"
+ "WM VIH2 Fix"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMEnc Screen Capture Filter"	"WMESrcWp Module"	"Microsoft Corporation"	"c:\program files\windows media components\encoder\wmesrcwp.dll"	"12/11/2002 9:34 PM"
+ "WMT Audio Analyzer"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Black Frame Generator"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT DirectX Transform Wrapper"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT DV Extract Filter"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT FormatConversion"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Import Filter"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Interlacer"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Log Filter"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT MuxDeMux Filter"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Sample Info Filter"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Screen capture Filter"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Switch Filter"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Virtual Renderer"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Virtual Source"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WMT Volume"	"Movie Maker Filters"	"Microsoft Corporation"	"c:\program files\movie maker\wmm2filt.dll"	"4/13/2008 8:11 PM"
+ "WS ScreenCapture"	"ScreenCa Dynamic Link Library"	""	"c:\program files\aimersoft\music converter\screencapturefilter.ax"	"1/14/2011 11:16 PM"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"	""	""	""	"6/17/2013 9:13 AM"
+ "igfxcui"	"igfxdev Module"	"Intel Corporation"	"c:\windows\system32\igfxdev.dll"	"2/15/2008 4:45 PM"
"HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors"	""	""	""	"6/17/2013 9:14 AM"
+ "CutePDF Writer Monitor"	""	""	"c:\windows\system32\cpwmon2k.dll"	"7/12/2007 10:06 PM"
+ "EPSON NX410 Series 32MonitorBA"	"EPSON Bi-directional Monitor x86"	"SEIKO EPSON CORPORATION"	"c:\windows\system32\e_flbfca.dll"	"8/8/2008 3:54 AM"
+ "EPSON WorkForce 520 Series 32MonitorBA"	"EPSON Bi-directional Monitor x86"	"SEIKO EPSON CORPORATION"	"c:\windows\system32\e_flbgia.dll"	"11/11/2008 9:36 PM"
+ "EpsonNet Print Port"	"EpsonNet Print Port Monitor DLL"	"SEIKO EPSON CORPORATION"	"c:\windows\system32\enppmon.dll"	"11/30/2008 11:58 PM"


----------



## Cookiegal (Aug 27, 2003)

Please run Autoruns again and scroll down to the following section:

"HKLM\System\CurrentControlSet\Services".

Scroll down in that section to the following items and uncheck all five of them:

+ "WsAudio_DeviceS(1)" "Wondershare Virtual Audio Device" "Wondershare" "c:\windows\system32\drivers\wsaudio_devices(1).sys" "7/29/2009 10:09 AM"
+ "WsAudio_DeviceS(2)" "Wondershare Virtual Audio Device" "Wondershare" "c:\windows\system32\drivers\wsaudio_devices(2).sys" "7/29/2009 10:09 AM"
+ "WsAudio_DeviceS(3)" "Wondershare Virtual Audio Device" "Wondershare" "c:\windows\system32\drivers\wsaudio_devices(3).sys" "7/29/2009 10:09 AM"
+ "WsAudio_DeviceS(4)" "Wondershare Virtual Audio Device" "Wondershare" "c:\windows\system32\drivers\wsaudio_devices(4).sys" "7/29/2009 10:09 AM"
+ "WsAudio_DeviceS(5)" "Wondershare Virtual Audio Device" "Wondershare" "c:\windows\system32\drivers\wsaudio_devices(5).sys" "7/29/2009 10:09 AM"

Restart your computer and let me know if there's any improvement in the sound.


----------



## Cookiegal (Aug 27, 2003)

What is the format (file extension like jpg, bmp, etc.) of the screenshot and what is the size? It's possible it's too big but you should see a warning about that on the upload screen.


----------



## sarahmuriel (Feb 1, 2004)

The format was a BMP, dont remember the size and there was no warning about size on the upload, only said it had failed and I had tried twice.

Unchecked and restarted windows, same wobbly sound as before. 

The last 2 times that I have restarted the computer I have noticed that it takes forever for the screen that shows the Windows logo and has the little running square. like its loading. This time it took 1min and 12sec. Is that a normal time? Yes, it was also slow before, but I had not timed it.


----------



## Cookiegal (Aug 27, 2003)

If you start the computer in safe mode does it boot up faster?


----------



## sarahmuriel (Feb 1, 2004)

Not much of a difference it took 1 min and 17sec.


----------



## Cookiegal (Aug 27, 2003)

Do you think it's slower since unchecking those items?

If not when did it start getting slow?


----------



## sarahmuriel (Feb 1, 2004)

I was just writing some info for you but my browser just closed the tab Tech Support was in while I was typing

ARRGHHHHHHHHHHHHHHHHHHHHHHHHHHHHH

Lost all the info, had to start again

It could be, I know that I ran the ComboFix on May 12, because I had been noticing for some time that the system was very slow, then I got sick and was not able to contact the forum until I was somewhat better. 

Thinking it over, yes I believe that start up did get somewhat slower when we uncheck those items. But it was slow before, for anything, when the bug was in. Now it is just slow in the starting it took the blue squares running on window 56 times to get to a dark blue screen that takes around 12 seconds to clear and then comes a black screen and clears quite promptly getting to the browser.

Thanks for your help
Sarah


----------



## Cookiegal (Aug 27, 2003)

Please open HijackThis.
Click on *Open Misc Tools Section*
Make sure that both boxes beside "Generate StartupList Log" are checked:

*List all minor sections(Full)*
*List Empty Sections(Complete)*
Click *Generate StartupList Log*.
Click *Yes* at the prompt.
It will open a text file. Please copy the entire contents of that page and paste it here.


----------



## sarahmuriel (Feb 1, 2004)

HJT log for startup

StartupList report, 6/19/2013, 2:54:09 PM
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HiJackThis\HiJackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v8.00 (8.00.6001.18702)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
C:\Program Files\FileOpen\Services\FileOpenBroker32.exe
C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\program files\real\realplayer\update\realsched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\all\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup]
ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Reader Library Launcher = C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
EEventManager = "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
ddoctorv2 = "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
LTCM Client = C:\Program Files\LTCM Client\ltcmClient.exe /startup
Adobe ARM = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
WinPatrol = C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
FileOpenBroker = C:\Program Files\FileOpen\Services\FileOpenBroker32.exe
IgfxTray = C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\system32\hkcmd.exe
Persistence = C:\WINDOWS\system32\igfxpers.exe
TkBellExe = "C:\program files\real\realplayer\update\realsched.exe" -osboot
RTHDCPL = RTHDCPL.EXE
egui = "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
SunJavaUpdateSched = "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

H/PC Connection Agent = "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
CTSyncU.exe = "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
EPSON NX410 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE /FU "C:\DOCUME~1\all\LOCALS~1\Temp\E_S8E.tmp" /EF "HKCU"

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[Disabled (Startup Manager)]
*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

[Disabled (Startup Manager)]
Google Update = "C:\Documents and Settings\all\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\ComFile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = C:\WINDOWS\inf\unregmp2.exe /HideWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}]
StubPath = C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *
StubPath = "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[>{64A10DCF-7FF1-4600-9824-DE0BCC2AA72E}] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

[{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}] *
StubPath = C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\advpack.dll,LaunchINFSectionEx C:\Program Files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=*Registry value not found*

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll - {3049C3E9-B461-4BC5-8870-4C09146192CA}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Java\jre7\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll - {9421DD08-935F-4701-A9CA-22DF90AC4EA6}
(no name) - C:\Program Files\Java\jre7\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
(no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Adobe Flash Player Updater.job
Disk Cleanup.job
RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
ReclaimerUpdateXML_all.job
RNUpgradeHelperLogonPrompt_all.job

--------------------------------------------------

Enumerating Download Program Files:

[Garmin Communicator Plug-In]
CODEBASE = https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
OSD = C:\WINDOWS\Downloaded Program Files\OSD74A1.OSD

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\wuweb.dll
CODEBASE = http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282722117312

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1342019053406

[DASWebDownload Class]
InProcServer32 = C:\WINDOWS\DASAct.dll
CODEBASE = http://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab

[GpcContainer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ieatgpc.dll
CODEBASE = https://mozysupport.webex.com/client/T27LB/support/ieatgpc.cab

[{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]
CODEBASE = http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
NameSpace #4: C:\WINDOWS\System32\nwprovau.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll
Protocol #16: C:\WINDOWS\system32\mswsock.dll
Protocol #17: C:\WINDOWS\system32\mswsock.dll
Protocol #18: C:\WINDOWS\system32\mswsock.dll
Protocol #19: C:\WINDOWS\system32\mswsock.dll
Protocol #20: C:\WINDOWS\system32\mswsock.dll
Protocol #21: C:\WINDOWS\system32\mswsock.dll
Protocol #22: C:\WINDOWS\system32\mswsock.dll
Protocol #23: C:\WINDOWS\system32\mswsock.dll
Protocol #24: C:\WINDOWS\system32\mswsock.dll
Protocol #25: C:\WINDOWS\system32\mswsock.dll
Protocol #26: C:\WINDOWS\system32\mswsock.dll
Protocol #27: C:\WINDOWS\system32\mswsock.dll
Protocol #28: C:\WINDOWS\system32\mswsock.dll
Protocol #29: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

IPv6 Helper Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
ABBYY FineReader 9.0 Sprint Licensing Service: "C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe" -service (autostart)
Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)
Adobe Active File Monitor V7: C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (autostart)
Adobe Flash Player Update Service: C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (manual start)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
Ambfilt: system32\drivers\Ambfilt.sys (manual start)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)
BITS: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
USB Card Reader Writer driver: System32\Drivers\busbcrw.sys (manual start)
catchme: \??\C:\DOCUME~1\all\LOCALS~1\Temp\catchme.sys (manual start)
CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (manual start)
.NET Runtime Optimization Service v2.0.50727_X86: c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
Microsoft .NET Framework NGEN v4.0.30319_X86: C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (autostart)
COM+ System Application: %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Creative Service for CDROM Access: C:\WINDOWS\system32\CTsvcCDA.exe (disabled)
CryptSvc: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Disk Driver: system32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Wired AutoConfig: %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
eamon: system32\DRIVERS\eamon.sys (system)
Extensible Authentication Protocol Service: %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)
eBook: System32\Drivers\eBook.sys (manual start)
ehdrv: system32\DRIVERS\ehdrv.sys (system)
ESET Service: "C:\Program Files\ESET\ESET Smart Security\ekrn.exe" (autostart)
epfw: system32\DRIVERS\epfw.sys (autostart)
Eset Personal Firewall: system32\DRIVERS\Epfwndis.sys (manual start)
epfwtdi: system32\DRIVERS\epfwtdi.sys (system)
EpsonBidirectionalService: C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe (autostart)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (autostart)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Low-level Floppy Driver: \??\C:\WINDOWS\system32\drivers\fdrawcmd.sys (manual start)
FileOpen Manager Service: "C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe" (autostart)
FLEXnet Licensing Service: "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Windows Presentation Foundation Font Cache 3.0.0.0: C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (manual start)
Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)
Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)
Garmin USB Driver: system32\drivers\grmnusb.sys (manual start)
Microsoft UAA Bus Driver for High Definition Audio: system32\DRIVERS\HDAudBus.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
Health Key and Certificate Management Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)
ialm: system32\DRIVERS\igxpmp32.sys (manual start)
InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe" (manual start)
Windows CardSpace: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" (manual start)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: %systemroot%\system32\imapi.exe (manual start)
Service for Realtek HD Audio (WDM): system32\drivers\RtkHDAud.sys (manual start)
Intel Processor Driver: system32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)
IPSEC driver: system32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)
Java Quick Starter: "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf" (autostart)
Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
McciCMService: "C:\Program Files\Common Files\Motive\McciCMService.exe" (autostart)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
Monfilt: system32\drivers\Monfilt.sys (manual start)
Motorola USB CDC ACM Driver: system32\DRIVERS\motmodem.sys (manual start)
Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start)
Mozilla Maintenance Service: "C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe" (manual start)
MREMP50 NDIS Protocol Driver: \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS (manual start)
MRESP50 NDIS Protocol Driver: \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS (manual start)
WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (autostart)
Windows Installer: %systemroot%\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)
Network Access Protection Agent: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: system32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\system32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Net.Tcp Port Sharing Service: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" (disabled)
Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)
NWLink IPX/SPX/NetBIOS Compatible Transport Protocol: system32\DRIVERS\nwlnkipx.sys (autostart)
NWLink NetBIOS: system32\DRIVERS\nwlnknb.sys (autostart)
NWLink SPX/SPXII Protocol: system32\DRIVERS\nwlnkspx.sys (autostart)
Microsoft Office Diagnostics Service: "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" (manual start)
Office Source Engine: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (manual start)
PCI Bus Driver: system32\DRIVERS\pci.sys (system)
PCIIde: system32\DRIVERS\pciide.sys (system)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\Drivers\PxHelp20.sys (system)
Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
RealNetworks Downloader Resolver Service: "C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe" (autostart)
Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
Roxio UPnP Renderer 11: "C:\Program Files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe" (disabled)
Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost.exe -k rpcss (autostart)
QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver: system32\DRIVERS\Rtenicxp.sys (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Prolific2 Serial port driver: system32\DRIVERS\ser2pl.sys (manual start)
Serenum Filter Driver: system32\DRIVERS\serenum.sys (manual start)
Serial port driver: system32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Sony SCSI Helper Service: "C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe" (manual start)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
SupportSoft Sprocket Service (ddoctorv2): "C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe" /service /P ddoctorv2 (autostart)
sptd: \SystemRoot\System32\Drivers\sptd.sys (disabled)
System Restore Filter Driver: system32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
Player Recovery Device Control Driver: System32\Drivers\StMp3Rec.sys (manual start)
SWDUMon: system32\DRIVERS\SWDUMon.sys (manual start)
Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{8CD0A93A-0970-4363-AF79-F69C15F3276B} (autostart)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)
Microsoft IPv6 Protocol Driver: system32\DRIVERS\tcpip6.sys (system)
Terminal Device Driver: system32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost.exe -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microsoft Tun Miniport Adapter Driver: system32\DRIVERS\tunmp.sys (manual start)
Microcode Update Driver: system32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)
Microsoft USB Standard Hub Driver: system32\DRIVERS\usbhub.sys (manual start)
Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (manual start)
USB RNDIS Adapter: system32\DRIVERS\usb8023x.sys (manual start)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)
Windows CE USB Serial Host Driver: system32\DRIVERS\wceusbsh.sys (manual start)
Wdf01000: system32\DRIVERS\Wdf01000.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WinDriver USB Client: System32\Drivers\wdpnp.sys (manual start)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Remote Management (WS-Management): %SystemRoot%\system32\svchost.exe -k WINRM (manual start)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Windows Media Player Network Sharing Service: "C:\Program Files\Windows Media Player\WMPNetwk.exe" (manual start)
WpdUsb: system32\DRIVERS\wpdusb.sys (manual start)
Windows Presentation Foundation Font Cache 4.0.0.0: C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (manual start)
Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
WsAudio_DeviceS(1): system32\drivers\WsAudio_DeviceS(1).sys (disabled)
WsAudio_DeviceS(2): system32\drivers\WsAudio_DeviceS(2).sys (disabled)
WsAudio_DeviceS(3): system32\drivers\WsAudio_DeviceS(3).sys (disabled)
WsAudio_DeviceS(4): system32\drivers\WsAudio_DeviceS(4).sys (disabled)
WsAudio_DeviceS(5): system32\drivers\WsAudio_DeviceS(5).sys (disabled)
wscsvc: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Windows Search: %systemroot%\system32\SearchIndexer.exe /Embedding (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (system)
Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Yahoo! Updater: "C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe" (autostart)

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\shell32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

End of report, 40,722 bytes
Report generated in 0.469 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Cookiegal (Aug 27, 2003)

I'm sorry, I just had a thought that would be helpful. Would you remind rebooting the machine and then without opening up any other programs immediately run that same scan log with HijackThis and post the new log? That way I may be able to see what is starting up that may be causing problems but I'm sure with the first one you had been running it and using things. Thanks.


----------



## sarahmuriel (Feb 1, 2004)

I will be babysitting my granddaughter today, so I might not respond until evening,

HJT after startup

StartupList report, 6/20/2013, 7:36:28 AM
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HiJackThis\HiJackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v8.00 (8.00.6001.18702)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
C:\Program Files\FileOpen\Services\FileOpenBroker32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\program files\real\realplayer\update\realsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
c:\program files\real\realplayer\RealPlay.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\all\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup]
ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Reader Library Launcher = C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
EEventManager = "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
ddoctorv2 = "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
LTCM Client = C:\Program Files\LTCM Client\ltcmClient.exe /startup
Adobe ARM = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
WinPatrol = C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
FileOpenBroker = C:\Program Files\FileOpen\Services\FileOpenBroker32.exe
IgfxTray = C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\system32\hkcmd.exe
Persistence = C:\WINDOWS\system32\igfxpers.exe
TkBellExe = "C:\program files\real\realplayer\update\realsched.exe" -osboot
RTHDCPL = RTHDCPL.EXE
egui = "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
SunJavaUpdateSched = "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

H/PC Connection Agent = "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
CTSyncU.exe = "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
EPSON NX410 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCA.EXE /FU "C:\DOCUME~1\all\LOCALS~1\Temp\E_S8E.tmp" /EF "HKCU"

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[Disabled (Startup Manager)]
*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

[Disabled (Startup Manager)]
Google Update = "C:\Documents and Settings\all\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\ComFile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = C:\WINDOWS\inf\unregmp2.exe /HideWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}]
StubPath = C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *
StubPath = "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[>{64A10DCF-7FF1-4600-9824-DE0BCC2AA72E}] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

[{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}] *
StubPath = C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\advpack.dll,LaunchINFSectionEx C:\Program Files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=*Registry value not found*

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll - {3049C3E9-B461-4BC5-8870-4C09146192CA}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Java\jre7\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll - {9421DD08-935F-4701-A9CA-22DF90AC4EA6}
(no name) - C:\Program Files\Java\jre7\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
(no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Adobe Flash Player Updater.job
Disk Cleanup.job
RealPlayerRealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
RealPlayerRealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
RealUpgradeLogonTaskS-1-5-21-1644491937-115176313-682003330-1004.job
RealUpgradeScheduledTaskS-1-5-21-1644491937-115176313-682003330-1004.job
ReclaimerUpdateXML_all.job
RNUpgradeHelperLogonPrompt_all.job

--------------------------------------------------

Enumerating Download Program Files:

[Garmin Communicator Plug-In]
CODEBASE = https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
OSD = C:\WINDOWS\Downloaded Program Files\OSD74A1.OSD

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\wuweb.dll
CODEBASE = http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282722117312

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1342019053406

[DASWebDownload Class]
InProcServer32 = C:\WINDOWS\DASAct.dll
CODEBASE = http://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab

[GpcContainer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ieatgpc.dll
CODEBASE = https://mozysupport.webex.com/client/T27LB/support/ieatgpc.cab

[{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]
CODEBASE = http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
NameSpace #4: C:\WINDOWS\System32\nwprovau.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll
Protocol #16: C:\WINDOWS\system32\mswsock.dll
Protocol #17: C:\WINDOWS\system32\mswsock.dll
Protocol #18: C:\WINDOWS\system32\mswsock.dll
Protocol #19: C:\WINDOWS\system32\mswsock.dll
Protocol #20: C:\WINDOWS\system32\mswsock.dll
Protocol #21: C:\WINDOWS\system32\mswsock.dll
Protocol #22: C:\WINDOWS\system32\mswsock.dll
Protocol #23: C:\WINDOWS\system32\mswsock.dll
Protocol #24: C:\WINDOWS\system32\mswsock.dll
Protocol #25: C:\WINDOWS\system32\mswsock.dll
Protocol #26: C:\WINDOWS\system32\mswsock.dll
Protocol #27: C:\WINDOWS\system32\mswsock.dll
Protocol #28: C:\WINDOWS\system32\mswsock.dll
Protocol #29: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

IPv6 Helper Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
ABBYY FineReader 9.0 Sprint Licensing Service: "C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe" -service (autostart)
Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)
Adobe Active File Monitor V7: C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (autostart)
Adobe Flash Player Update Service: C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (manual start)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
Ambfilt: system32\drivers\Ambfilt.sys (manual start)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)
BITS: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
USB Card Reader Writer driver: System32\Drivers\busbcrw.sys (manual start)
catchme: \??\C:\DOCUME~1\all\LOCALS~1\Temp\catchme.sys (manual start)
CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (manual start)
.NET Runtime Optimization Service v2.0.50727_X86: c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
Microsoft .NET Framework NGEN v4.0.30319_X86: C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (autostart)
COM+ System Application: %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Creative Service for CDROM Access: C:\WINDOWS\system32\CTsvcCDA.exe (disabled)
CryptSvc: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Disk Driver: system32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Wired AutoConfig: %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
eamon: system32\DRIVERS\eamon.sys (system)
Extensible Authentication Protocol Service: %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)
eBook: System32\Drivers\eBook.sys (manual start)
ehdrv: system32\DRIVERS\ehdrv.sys (system)
ESET Service: "C:\Program Files\ESET\ESET Smart Security\ekrn.exe" (autostart)
epfw: system32\DRIVERS\epfw.sys (autostart)
Eset Personal Firewall: system32\DRIVERS\Epfwndis.sys (manual start)
epfwtdi: system32\DRIVERS\epfwtdi.sys (system)
EpsonBidirectionalService: C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe (autostart)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (autostart)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Low-level Floppy Driver: \??\C:\WINDOWS\system32\drivers\fdrawcmd.sys (manual start)
FileOpen Manager Service: "C:\Program Files\FileOpen\Services\FileOpenManagerSvc32.exe" (autostart)
FLEXnet Licensing Service: "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Windows Presentation Foundation Font Cache 3.0.0.0: C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (manual start)
Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)
Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)
Garmin USB Driver: system32\drivers\grmnusb.sys (manual start)
Microsoft UAA Bus Driver for High Definition Audio: system32\DRIVERS\HDAudBus.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
Health Key and Certificate Management Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)
ialm: system32\DRIVERS\igxpmp32.sys (manual start)
InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe" (manual start)
Windows CardSpace: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" (manual start)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: %systemroot%\system32\imapi.exe (manual start)
Service for Realtek HD Audio (WDM): system32\drivers\RtkHDAud.sys (manual start)
Intel Processor Driver: system32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)
IPSEC driver: system32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)
Java Quick Starter: "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf" (autostart)
Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
McciCMService: "C:\Program Files\Common Files\Motive\McciCMService.exe" (autostart)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
Monfilt: system32\drivers\Monfilt.sys (manual start)
Motorola USB CDC ACM Driver: system32\DRIVERS\motmodem.sys (manual start)
Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start)
Mozilla Maintenance Service: "C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe" (manual start)
MREMP50 NDIS Protocol Driver: \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS (manual start)
MRESP50 NDIS Protocol Driver: \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS (manual start)
WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (autostart)
Windows Installer: %systemroot%\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)
Network Access Protection Agent: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: system32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\system32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Net.Tcp Port Sharing Service: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" (disabled)
Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)
NWLink IPX/SPX/NetBIOS Compatible Transport Protocol: system32\DRIVERS\nwlnkipx.sys (autostart)
NWLink NetBIOS: system32\DRIVERS\nwlnknb.sys (autostart)
NWLink SPX/SPXII Protocol: system32\DRIVERS\nwlnkspx.sys (autostart)
Microsoft Office Diagnostics Service: "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" (manual start)
Office Source Engine: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (manual start)
PCI Bus Driver: system32\DRIVERS\pci.sys (system)
PCIIde: system32\DRIVERS\pciide.sys (system)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\Drivers\PxHelp20.sys (system)
Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
RealNetworks Downloader Resolver Service: "C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe" (autostart)
Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
Roxio UPnP Renderer 11: "C:\Program Files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe" (disabled)
Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost.exe -k rpcss (autostart)
QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver: system32\DRIVERS\Rtenicxp.sys (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Prolific2 Serial port driver: system32\DRIVERS\ser2pl.sys (manual start)
Serenum Filter Driver: system32\DRIVERS\serenum.sys (manual start)
Serial port driver: system32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Sony SCSI Helper Service: "C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe" (manual start)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
SupportSoft Sprocket Service (ddoctorv2): "C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe" /service /P ddoctorv2 (autostart)
sptd: \SystemRoot\System32\Drivers\sptd.sys (disabled)
System Restore Filter Driver: system32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
Player Recovery Device Control Driver: System32\Drivers\StMp3Rec.sys (manual start)
SWDUMon: system32\DRIVERS\SWDUMon.sys (manual start)
Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{8CD0A93A-0970-4363-AF79-F69C15F3276B} (autostart)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)
Microsoft IPv6 Protocol Driver: system32\DRIVERS\tcpip6.sys (system)
Terminal Device Driver: system32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost.exe -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microsoft Tun Miniport Adapter Driver: system32\DRIVERS\tunmp.sys (manual start)
Microcode Update Driver: system32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)
Microsoft USB Standard Hub Driver: system32\DRIVERS\usbhub.sys (manual start)
Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (manual start)
USB RNDIS Adapter: system32\DRIVERS\usb8023x.sys (manual start)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)
Windows CE USB Serial Host Driver: system32\DRIVERS\wceusbsh.sys (manual start)
Wdf01000: system32\DRIVERS\Wdf01000.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WinDriver USB Client: System32\Drivers\wdpnp.sys (manual start)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Remote Management (WS-Management): %SystemRoot%\system32\svchost.exe -k WINRM (manual start)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Windows Media Player Network Sharing Service: "C:\Program Files\Windows Media Player\WMPNetwk.exe" (manual start)
WpdUsb: system32\DRIVERS\wpdusb.sys (manual start)
Windows Presentation Foundation Font Cache 4.0.0.0: C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (manual start)
Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
WsAudio_DeviceS(1): system32\drivers\WsAudio_DeviceS(1).sys (disabled)
WsAudio_DeviceS(2): system32\drivers\WsAudio_DeviceS(2).sys (disabled)
WsAudio_DeviceS(3): system32\drivers\WsAudio_DeviceS(3).sys (disabled)
WsAudio_DeviceS(4): system32\drivers\WsAudio_DeviceS(4).sys (disabled)
WsAudio_DeviceS(5): system32\drivers\WsAudio_DeviceS(5).sys (disabled)
wscsvc: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Windows Search: %systemroot%\system32\SearchIndexer.exe /Embedding (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (system)
Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Yahoo! Updater: "C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe" (autostart)

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\shell32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

End of report, 40,541 bytes
Report generated in 0.672 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start * *Run *- type *msconfig*  click OK and click on the *startup tab*. Uncheck everything there except for your anti-virus program. Then reboot and let me know if the problem persists please.


----------



## sarahmuriel (Feb 1, 2004)

Not much of an improvement, I counted to 80 Mississippi on the Windows screen and up to 26 Mississippi on the dark blue screen. I forgot to mention that when I started the computer on safe mode quite a number of drives where shown on the black screen. Don't know what that means, just FYI. The system started with a window requesting me to select a startup.

Sarah


----------



## Cookiegal (Aug 27, 2003)

Go to *Start * *Run *- type *msconfig*  click OK and click on the the "services" tab and check "Hide All Microsoft Services"

Take note of which ones are checked so you can put it back the way it was after the test.

Then try unchecking all the NON Microsoft services except for your anti-virus program and reboot.

Let me know if there's any improvement after doing that.


----------



## sarahmuriel (Feb 1, 2004)

I would say there was some improvement 47 Mississippi Window screen and 20 Mississippi on the dark blue screen.

Sarah


----------



## Cookiegal (Aug 27, 2003)

Were there only entries from Eset left checked there?


----------



## sarahmuriel (Feb 1, 2004)

Cookiegal said:


> Go to *Start * *Run *- type *msconfig*
> 
> Then try unchecking all the NON Microsoft services except for your anti-virus program and reboot.
> 
> Let me know if there's any improvement after doing that.


I unchecked all the non MS services so that will include ESET. Sorry it took me so long, family emergency.


----------



## sarahmuriel (Feb 1, 2004)

But if I am not wrong my ESET does not pull up until I open a browser on a browser, Always Eset image comes on and then the browser will open.


----------



## Cookiegal (Aug 27, 2003)

sarahmuriel said:


> I unchecked all the non MS services so that will include ESET. Sorry it took me so long, family emergency.


No problem. I hope everything is OK.

The instructions did say (except your anti-virus program, which is Eset). Anyway, Eset services will start when the machine is booted.

Please run Autoruns again and put a check beside those WSAudio services again then reboot and let me know if there's any improvement.


----------



## sarahmuriel (Feb 1, 2004)

Ran Autorun again and clicking on all the ws audio services and I believe it got worst, the count for the windows screen went up to 90 Mississippi and the music got Wobblier. 

Thanks Sarah


----------



## Cookiegal (Aug 27, 2003)

OK please use Autoruns to uncheck those WSAudio drivers again.

I'm going to ask someone to help with obtaining the latest Realtek sound driver.


----------



## flavallee (May 12, 2002)

> Description: Realtek HD Audio output
> Default Sound Playback: Yes
> Default Voice Playback: Yes
> Hardware ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0662&SUBSYS_17AA304E&REV_1001
> ...


Your computer appears to have *Realtek ALC662 High Definition Audio* and driver version *5.10.0.6710*

The most current version for Windows XP SP3 is *5.10.0.6873*

Go here and click one of the "Download @ MajorGeeks" links to download and save the *WDM_R271.exe* file.

After it's downloaded and saved, close all open windows.

Double-click it to start the install process.

Read each window carefully that appears during the install process because you may need to restart the computer twice.

After you're done, open *Realtek Audio Manager*(or a similar name) in the Control Panel.

You can then adjust the volume and make setting changes.

Hopefully, that'll help with the audio issue.

-----------------------------------------------------------


----------



## Cookiegal (Aug 27, 2003)

Thank you Frank.


----------



## sarahmuriel (Feb 1, 2004)

Thanks to both of you, downloaded the Realtek driver and followed instructions, BTW I had unchecked the WS audio with autorun before downloading Realtek. Once the download and installation went through I went ahead and played some music from Down to the Bone, they have a great Jazz sound. Like always, the sound was not outstanding in Windows, sounded a lot better in Winamp. but still some times it became wobbly. 

Thanks Sarah


----------



## Cookiegal (Aug 27, 2003)

Please reboot the machine if you didn't do that after the installation and then run dxdiag again so we can verify the new driver is indeed there.

Please go to *Sart *- *Run *- type in *dxdiag *and click OK. It will open a screen called DirectX Diagnostic Tool which will run for a minute to collect information from the system. Once it's finished, to the bottom right you will see a button called "Save All Information". Please click on that and save it to Notepad and then copy and paste the contents here.


----------



## sarahmuriel (Feb 1, 2004)

Dxdiag test results

------------------
System Information
------------------
Time of this report: 6/23/2013, 19:46:32
Machine name: LENOVO
Operating System: Windows XP Home Edition (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_qfe.130503-0418)
Language: English (Regional Setting: English)
System Manufacturer: LENOVO
System Model: SS09355224
BIOS: Lenovo BIOS Version: 5GKT20A V2.0A
Processor: Intel(R) Atom(TM) CPU 230 @ 1.60GHz (2 CPUs)
Memory: 1016MB RAM
Page File: 399MB used, 2044MB available
Windows Dir: C:\WINDOWS
DirectX Version: DirectX 9.0c (4.09.0000.0904)
DX Setup Parameters: Not found
DxDiag Version: 5.03.2600.5512 32bit Unicode

------------
DxDiag Notes
------------
DirectX Files Tab: No problems found.
Display Tab 1: No problems found.
Sound Tab 1: No problems found.
Music Tab: No problems found.
Input Tab: No problems found.
Network Tab: No problems found.

--------------------
DirectX Debug Levels
--------------------
Direct3D: 0/4 (n/a)
DirectDraw: 0/4 (retail)
DirectInput: 0/5 (n/a)
DirectMusic: 0/5 (n/a)
DirectPlay: 0/9 (retail)
DirectSound: 0/5 (retail)
DirectShow: 0/6 (retail)

---------------
Display Devices
---------------
Card name: Intel(R) 82945G Express Chipset Family
Manufacturer: Intel Corporation
Chip type: Intel(R) 82945G Express Chipset Family
DAC type: Internal
Device Key: Enum\PCI\VEN_8086&DEV_2772&SUBSYS_304E17AA&REV_02
Display Memory: 128.0 MB
Current Mode: 1360 x 768 (32 bit) (60Hz)
Monitor: Plug and Play Monitor
Monitor Max Res: 1600,1200
Driver Name: igxprd32.dll
Driver Version: 6.14.0010.4926 (English)
DDI Version: 9 (or higher)
Driver Attributes: Final Retail
Driver Date/Size: 12/31/1999 20:00:00, 57344 bytes
WHQL Logo'd: Yes
WHQL Date Stamp: n/a
VDD: n/a
Mini VDD: igxpmp32.sys
Mini VDD Date: 12/31/1999 20:00:00, 5854752 bytes
Device Identifier: {D7B78E66-6432-11CF-2467-4410A3C2CB35}
Vendor ID: 0x8086
Device ID: 0x2772
SubSys ID: 0x304E17AA
Revision ID: 0x0002
Revision ID: 0x0002
Video Accel: 
Deinterlace Caps: n/a
Registry: OK
DDraw Status: Enabled
D3D Status: Enabled
AGP Status: Not Available
DDraw Test Result: Not run
D3D7 Test Result: Not run
D3D8 Test Result: Not run
D3D9 Test Result: Not run

-------------
Sound Devices
-------------
Description: Realtek HD Audio output
Default Sound Playback: Yes
Default Voice Playback: Yes
Hardware ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0662&SUBSYS_17AA304E&REV_1001
Manufacturer ID: 1
Product ID: 100
Type: WDM
Driver Name: RtkHDAud.sys
Driver Version: 5.10.0000.6873 (English)
Driver Attributes: Final Retail
WHQL Logo'd: Yes
Date and Size: 3/29/2013 21:42:40, 5444680 bytes
Other Files: 
Driver Provider: Realtek Semiconductor Corp.
HW Accel Level: Full
Cap Flags: 0xF5F
Min/Max Sample Rate: 8000, 192000
Static/Strm HW Mix Bufs: 33, 32
Static/Strm HW 3D Bufs: 33, 32
HW Memory: 0
Voice Management: No
EAX(tm) 2.0 Listen/Src: Yes, Yes
I3DL2(tm) Listen/Src: Yes, Yes
Sensaura(tm) ZoomFX(tm): No
Registry: OK
Sound Test Result: The tests were cancelled before completing.

---------------------
Sound Capture Devices
---------------------
Description: Realtek HD Audio Input
Default Sound Capture: Yes
Default Voice Capture: Yes
Driver Name: RtkHDAud.sys
Driver Version: 5.10.0000.6873 (English)
Driver Attributes: Final Retail
Date and Size: 3/29/2013 21:42:40, 5444680 bytes
Cap Flags: 0x41
Format Flags: 0xCC0

-----------
DirectMusic
-----------
DLS Path: C:\WINDOWS\SYSTEM32\drivers\GM.DLS
DLS Version: 1.00.0016.0002
Acceleration: n/a
Ports: Microsoft Synthesizer, Software (Not Kernel Mode), Output, DLS, Internal, Default Port
Microsoft MIDI Mapper [Emulated], Hardware (Not Kernel Mode), Output, No DLS, Internal
Microsoft GS Wavetable SW Synth [Emulated], Hardware (Not Kernel Mode), Output, No DLS, Internal
Registry: OK
Test Result: Not run

-------------------
DirectInput Devices
-------------------
Device Name: Mouse
Attached: 1
Controller ID: n/a
Vendor/Product ID: n/a
FF Driver: n/a

Device Name: Keyboard
Attached: 1
Controller ID: n/a
Vendor/Product ID: n/a
FF Driver: n/a

Device Name: 2.4GHz 2way RF Receiver
Attached: 1
 Controller ID: 0x0
Vendor/Product ID: 0x1BCF, 0x053A
FF Driver: n/a

Device Name: 2.4GHz 2way RF Receiver
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x1BCF, 0x053A
FF Driver: n/a

Device Name: 2.4GHz 2way RF Receiver
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x1BCF, 0x053A
FF Driver: n/a

Device Name: 2.4GHz 2way RF Receiver
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x1BCF, 0x053A
FF Driver: n/a

Poll w/ Interrupt: No
Registry: OK

-----------
USB Devices
-----------
+ USB Root Hub
| Vendor/Product ID: 0x8086, 0x27C8
| Matching Device ID: usb\root_hub
| Service: usbhub
| Driver: usbhub.sys, 4/13/2008 14:45:38, 59520 bytes
| Driver: usbd.sys, 8/4/2004 16:00:00, 4736 bytes
| 
+-+ USB Human Interface Device
| | Vendor/Product ID: 0x1BCF, 0x053A
| | Location: 2.4GHz 2way RF Receiver
| | Matching Device ID: usb\class_03&subclass_01
| | Service: HidUsb
| | Driver: hidusb.sys, 4/13/2008 14:45:27, 10368 bytes
| | Driver: hidclass.sys, 4/13/2008 14:45:26, 36864 bytes
| | Driver: hidparse.sys, 4/13/2008 14:45:22, 24960 bytes
| | Driver: hid.dll, 4/13/2008 20:11:54, 20992 bytes
| | 
| +-+ HID-compliant device
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device
| | | 
| +-+ HID-compliant consumer control device
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device_up:000c_u:0001
| | | Driver: hidserv.dll, 4/13/2008 21:11:54, 21504 bytes
| | | 
| +-+ HID-compliant device
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device
| | | 
| +-+ HID-compliant device
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device
| | | 
| +-+ HID-compliant mouse
| | | Vendor/Product ID: 0x1BCF, 0x053A
| | | Matching Device ID: hid_device_system_mouse
| | | Service: mouhid
| | | Driver: mouclass.sys, 4/13/2008 14:39:47, 23040 bytes
| | | Driver: mouhid.sys, 8/4/2004 16:00:00, 12160 bytes

----------------
Gameport Devices
----------------

------------
PS/2 Devices
------------
+ Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
| Matching Device ID: *pnp0303
| Service: i8042prt
| Driver: i8042prt.sys, 4/13/2008 15:18:00, 52480 bytes
| Driver: kbdclass.sys, 4/13/2008 14:39:47, 24576 bytes
| 
+ Terminal Server Keyboard Driver
| Matching Device ID: root\rdp_kbd
| Upper Filters: kbdclass
| Service: TermDD
| Driver: termdd.sys, 4/13/2008 20:13:20, 40840 bytes
| Driver: kbdclass.sys, 4/13/2008 14:39:47, 24576 bytes
| 
+ Terminal Server Mouse Driver
| Matching Device ID: root\rdp_mou
| Upper Filters: mouclass
| Service: TermDD
| Driver: termdd.sys, 4/13/2008 20:13:20, 40840 bytes
| Driver: mouclass.sys, 4/13/2008 14:39:47, 23040 bytes

----------------------------
DirectPlay Service Providers
----------------------------
DirectPlay8 Modem Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.6311)
DirectPlay8 Serial Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.6311)
DirectPlay8 IPX Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.6311)
DirectPlay8 TCP/IP Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.6311)
Internet TCP/IP Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (5.03.2600.5512)
IPX Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (5.03.2600.5512)
Modem Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (5.03.2600.5512)
Serial Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (5.03.2600.5512)

DirectPlay Voice Wizard Tests: Full Duplex: Not run, Half Duplex: Not run, Mic: Not run
DirectPlay Test Result: Not run
Registry: OK

-------------------
DirectPlay Adapters
-------------------
DirectPlay8 Serial Service Provider: COM1
DirectPlay8 IPX Service Provider: IPX Adapter 1 - (00000000,002197606606)
DirectPlay8 TCP/IP Service Provider: Local Area Connection 4 - IPv6 - fe80::221:97ff:fe60:6606
DirectPlay8 TCP/IP Service Provider: Teredo Tunneling Pseudo-Interface - IPv6 - fe80::ffff:ffff:fffd
DirectPlay8 TCP/IP Service Provider: Automatic Tunneling Pseudo-Interface - IPv6 - fe80::5efe:
DirectPlay8 TCP/IP Service Provider: Local Area Connection 4 - IPv4 -

-----------------------
DirectPlay Voice Codecs
-----------------------
Voxware VR12 1.4kbit/s
Voxware SC06 6.4kbit/s
Voxware SC03 3.2kbit/s
MS-PCM 64 kbit/s
MS-ADPCM 32.8 kbit/s
Microsoft GSM 6.10 13 kbit/s
TrueSpeech(TM) 8.6 kbit/s

-------------------------
DirectPlay Lobbyable Apps
-------------------------

------------------------
Disk & DVD/CD-ROM Drives
------------------------
Drive: C:
Free Space: 105.7 GB
Total Space: 152.6 GB
File System: NTFS
Model: Hitachi HDP725016GLA380

Drive: F:
Free Space: 1230.5 GB
Total Space: 1430.8 GB
File System: NTFS
Model: WD Ext HDD 1021 USB Device

Drive: G:
Free Space: 179.2 GB
Total Space: 305.2 GB
File System: NTFS
Model: Maxtor 3200 USB Device

Drive: E:
Model: HL-DT-ST DVD-RAM GH10N
Driver: c:\windows\system32\drivers\cdrom.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:46, 62976 bytes

--------------
System Devices
--------------
Name: Intel(R) ICH7 Family Ultra ATA Storage Controllers - 27DF
Device ID: PCI\VEN_8086&DEV_27DF&SUBSYS_304E17AA&REV_01\3&11583659&0&F9
Driver: C:\WINDOWS\system32\DRIVERS\pciide.sys, 5.01.2600.0000 (English), 8/17/2001 13:51:52, 3328 bytes
Driver: C:\WINDOWS\system32\DRIVERS\pciidex.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 24960 bytes
Driver: C:\WINDOWS\system32\DRIVERS\atapi.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 96512 bytes

Name: Intel(R) N10/ICH7 Family SMBus Controller - 27DA
Device ID: PCI\VEN_8086&DEV_27DA&SUBSYS_304E17AA&REV_01\3&11583659&0&FB
Driver: n/a

Name: Microsoft UAA Bus Driver for High Definition Audio
Device ID: PCI\VEN_8086&DEV_27D8&SUBSYS_304E17AA&REV_01\3&11583659&0&D8
Driver: C:\WINDOWS\system32\DRIVERS\hdaudbus.sys, 5.10.0001.5013 (English), 4/13/2008 12:36:05, 144384 bytes

Name: Intel(R) N10/ICH7 Family PCI Express Root Port - 27D0
Device ID: PCI\VEN_8086&DEV_27D0&SUBSYS_00000000&REV_01\3&11583659&0&E0
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:44, 68224 bytes

Name: Intel(R) N10/ICH7 Family USB2 Enhanced Host Controller - 27CC
Device ID: PCI\VEN_8086&DEV_27CC&SUBSYS_304E17AA&REV_01\3&11583659&0&EF
Driver: C:\WINDOWS\system32\drivers\usbehci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 30208 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes
Driver: C:\WINDOWS\system32\hccoin.dll, 5.01.2600.5512 (English), 4/13/2008 20:11:54, 7168 bytes

Name: Intel(R) N10/ICH7 Family USB Universal Host Controller - 27CB
Device ID: PCI\VEN_8086&DEV_27CB&SUBSYS_304E17AA&REV_01\3&11583659&0&EB
Driver: C:\WINDOWS\system32\drivers\usbuhci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 20608 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes

Name: Intel(R) N10/ICH7 Family USB Universal Host Controller - 27CA
Device ID: PCI\VEN_8086&DEV_27CA&SUBSYS_304E17AA&REV_01\3&11583659&0&EA
Driver: C:\WINDOWS\system32\drivers\usbuhci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 20608 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes

Name: Intel(R) N10/ICH7 Family USB Universal Host Controller - 27C9
Device ID: PCI\VEN_8086&DEV_27C9&SUBSYS_304E17AA&REV_01\3&11583659&0&E9
Driver: C:\WINDOWS\system32\drivers\usbuhci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 20608 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes

Name: Intel(R) N10/ICH7 Family USB Universal Host Controller - 27C8
Device ID: PCI\VEN_8086&DEV_27C8&SUBSYS_304E17AA&REV_01\3&11583659&0&E8
Driver: C:\WINDOWS\system32\drivers\usbuhci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 20608 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:38, 59520 bytes

Name: Intel(R) N10/ICH7 Family Serial ATA Storage Controller - 27C0
Device ID: PCI\VEN_8086&DEV_27C0&SUBSYS_304E17AA&REV_01\3&11583659&0&FA
Driver: C:\WINDOWS\system32\DRIVERS\pciide.sys, 5.01.2600.0000 (English), 8/17/2001 13:51:52, 3328 bytes
Driver: C:\WINDOWS\system32\DRIVERS\pciidex.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 24960 bytes
Driver: C:\WINDOWS\system32\DRIVERS\atapi.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 96512 bytes

Name: Intel(R) ICH7 Family LPC Interface Controller - 27B8
Device ID: PCI\VEN_8086&DEV_27B8&SUBSYS_00000000&REV_01\3&11583659&0&F8
Driver: C:\WINDOWS\system32\DRIVERS\isapnp.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:42, 37248 bytes

Name: Intel(R) 82945G Express Chipset Family
Device ID: PCI\VEN_8086&DEV_2772&SUBSYS_304E17AA&REV_02\3&11583659&0&10
Driver: C:\WINDOWS\system32\DRIVERS\igxpmp32.sys, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 5854752 bytes
Driver: C:\WINDOWS\system32\igxprd32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 57344 bytes
Driver: C:\WINDOWS\system32\igxpgd32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 151040 bytes
Driver: C:\WINDOWS\system32\igxpdv32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 1670144 bytes
Driver: C:\WINDOWS\system32\igxpdx32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 2643968 bytes
Driver: C:\WINDOWS\system32\igxpxk32.vp, 12/31/1999 20:00:00, 2096 bytes
Driver: C:\WINDOWS\system32\igxpxs32.vp, 12/31/1999 20:00:00, 27024 bytes
Driver: C:\WINDOWS\system32\hccutils.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 102400 bytes
Driver: C:\WINDOWS\system32\igfxsrvc.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 48128 bytes
Driver: C:\WINDOWS\system32\igfxsrvc.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 256536 bytes
Driver: C:\WINDOWS\system32\igfxpph.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 204800 bytes
Driver: C:\WINDOWS\system32\igfxcpl.cpl, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 122880 bytes
Driver: C:\WINDOWS\system32\igfxcfg.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 530968 bytes
Driver: C:\WINDOWS\system32\igfxdev.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 208896 bytes
Driver: C:\WINDOWS\system32\igfxdo.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 135168 bytes
Driver: C:\WINDOWS\system32\igfxtray.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 141848 bytes
Driver: C:\WINDOWS\system32\igfxzoom.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 170520 bytes
Driver: C:\WINDOWS\system32\hkcmd.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 166424 bytes
Driver: C:\WINDOWS\system32\igfxress.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 3293184 bytes
Driver: C:\WINDOWS\system32\igfxpers.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 137752 bytes
Driver: C:\WINDOWS\system32\igfxrara.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 159744 bytes
Driver: C:\WINDOWS\system32\igfxrchs.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 110592 bytes
Driver: C:\WINDOWS\system32\igfxrcht.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 110592 bytes
Driver: C:\WINDOWS\system32\igfxrdan.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxrdeu.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 192512 bytes
Driver: C:\WINDOWS\system32\igfxrenu.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxresp.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 188416 bytes
Driver: C:\WINDOWS\system32\igfxrfin.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 176128 bytes
Driver: C:\WINDOWS\system32\igfxrfra.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 184320 bytes
Driver: C:\WINDOWS\system32\igfxrheb.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 155648 bytes
Driver: C:\WINDOWS\system32\igfxrita.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 188416 bytes
Driver: C:\WINDOWS\system32\igfxrjpn.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 131072 bytes
Driver: C:\WINDOWS\system32\igfxrkor.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 126976 bytes
Driver: C:\WINDOWS\system32\igfxrnld.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 188416 bytes
Driver: C:\WINDOWS\system32\igfxrnor.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 176128 bytes
Driver: C:\WINDOWS\system32\igfxrplk.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrptb.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrptg.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrrus.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrsky.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 176128 bytes
Driver: C:\WINDOWS\system32\igfxrslv.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxrsve.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxrtha.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 163840 bytes
Driver: C:\WINDOWS\system32\igfxrcsy.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 176128 bytes
Driver: C:\WINDOWS\system32\igfxrell.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 192512 bytes
Driver: C:\WINDOWS\system32\igfxrhun.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 180224 bytes
Driver: C:\WINDOWS\system32\igfxrtrk.lrc, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 172032 bytes
Driver: C:\WINDOWS\system32\igfxext.exe, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 170520 bytes
Driver: C:\WINDOWS\system32\igfxexps.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 24576 bytes
Driver: C:\WINDOWS\system32\iglicd32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 2334720 bytes
Driver: C:\WINDOWS\system32\igldev32.dll, 6.14.0010.4926 (English), 12/31/1999 20:00:00, 294912 bytes
Driver: C:\WINDOWS\system32\igfxCoIn_v4926.dll, 12/31/1999 20:00:00, 147456 bytes

Name: Intel(R) 945G/GZ/GC/P/PL Processor to I/O Controller - 2770
Device ID: PCI\VEN_8086&DEV_2770&SUBSYS_00000000&REV_02\3&11583659&0&00
Driver: n/a

Name: Intel(R) 82801 PCI Bridge - 244E
Device ID: PCI\VEN_8086&DEV_244E&SUBSYS_00000000&REV_E1\3&11583659&0&F0
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:44, 68224 bytes

Name: Realtek RTL8102E/RTL8103E Family PCI-E Fast Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_304E17AA&REV_02\4&293AFFCC&0&00E0
Driver: C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys, 5.708.1030.2008 (English), 10/30/2008 09:14:20, 117888 bytes
Driver: C:\WINDOWS\system32\RtNicProp32.dll, 1.01.0716.2008 (English), 7/16/2008 10:35:28, 9728 bytes

------------------
DirectX Components
------------------
ddraw.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 279552 bytes
ddrawex.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 27136 bytes
dxapi.sys: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 10496 bytes
d3d8.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 1179648 bytes
d3d8thk.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 8192 bytes
d3d9.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 1689088 bytes
d3dim.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 436224 bytes
d3dim700.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 824320 bytes
d3dramp.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 590336 bytes
d3drm.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 350208 bytes
d3dxof.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 47616 bytes
d3dpmesh.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 34816 bytes
dplay.dll: 5.00.2134.0001 English Final Retail 8/4/2004 16:00:00 33040 bytes
dplayx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 229888 bytes
dpmodemx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 23552 bytes
dpwsock.dll: 5.00.2134.0001 English Final Retail 8/4/2004 16:00:00 42768 bytes
dpwsockx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 57344 bytes
dplaysvr.exe: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:17 29696 bytes
dpnsvr.exe: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:17 17920 bytes
dpnet.dll: 5.03.2600.6311 English Final Retail 11/1/2012 22:02:42 375296 bytes
dpnlobby.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:09:20 3072 bytes
dpnaddr.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:09:19 3072 bytes
dpvoice.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 212480 bytes
dpvsetup.exe: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:18 83456 bytes
dpvvox.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 116736 bytes
dpvacm.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 21504 bytes
dpnhpast.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 35328 bytes
dpnhupnp.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 60928 bytes
dpserial.dll: 5.00.2134.0001 English Final Retail 8/4/2004 16:00:00 53520 bytes
dinput.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 158720 bytes
dinput8.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 181760 bytes
dimap.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 44032 bytes
diactfrm.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 394240 bytes
joy.cpl: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:41 68608 bytes
gcdef.dll: 5.01.2600.0000 English Final Retail 8/4/2004 16:00:00 76800 bytes
pid.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:02 35328 bytes
dsound.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 367616 bytes
dsound3d.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 1293824 bytes
dswave.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 19456 bytes
dsdmo.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 181248 bytes
dsdmoprp.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 71680 bytes
dmusic.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 104448 bytes
dmband.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 28672 bytes
dmcompos.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 61440 bytes
dmime.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 181248 bytes
dmloader.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 35840 bytes
dmstyle.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 105984 bytes
dmsynth.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 103424 bytes
dmscript.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 82432 bytes
system.dll: 1.01.4322.2502 English Final Retail 1/9/2013 17:33:41 1232896 bytes
Microsoft.DirectX.Direct3D.dll: 9.05.0132.0000 English Final Retail 9/11/2010 12:02:05 473600 bytes
Microsoft.DirectX.Direct3DX.dll: 5.04.0000.3900 English Final Retail 9/11/2010 12:01:59 2676224 bytes
Microsoft.DirectX.Direct3DX.dll: 9.04.0091.0000 English Final Retail 9/11/2010 12:02:00 2846720 bytes
Microsoft.DirectX.Direct3DX.dll: 9.05.0132.0000 English Final Retail 9/11/2010 12:02:01 563712 bytes
Microsoft.DirectX.Direct3DX.dll: 9.06.0168.0000 English Final Retail 9/11/2010 12:02:01 567296 bytes
Microsoft.DirectX.Direct3DX.dll: 9.07.0239.0000 English Final Retail 9/11/2010 12:02:02 576000 bytes
Microsoft.DirectX.Direct3DX.dll: 9.08.0299.0000 English Final Retail 9/11/2010 12:02:02 577024 bytes
Microsoft.DirectX.Direct3DX.dll: 9.09.0376.0000 English Final Retail 9/11/2010 12:02:03 577536 bytes
Microsoft.DirectX.Direct3DX.dll: 9.10.0455.0000 English Final Retail 9/11/2010 12:02:03 577536 bytes
Microsoft.DirectX.Direct3DX.dll: 9.11.0519.0000 English Final Retail 9/11/2010 12:02:04 578560 bytes
Microsoft.DirectX.Direct3DX.dll: 9.12.0589.0000 English Final Retail 9/11/2010 12:02:06 578560 bytes
Microsoft.DirectX.DirectDraw.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:06 145920 bytes
Microsoft.DirectX.DirectInput.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:07 159232 bytes
Microsoft.DirectX.DirectPlay.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:07 364544 bytes
Microsoft.DirectX.DirectSound.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:07 178176 bytes
Microsoft.DirectX.AudioVideoPlayback.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:05 53248 bytes
Microsoft.DirectX.Diagnostics.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:05 12800 bytes
Microsoft.DirectX.dll: 5.04.0000.2904 English Final Retail 9/11/2010 12:02:05 223232 bytes
dx7vb.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 619008 bytes
dx8vb.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 1227264 bytes
dxdiagn.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 2113536 bytes
mfc40.dll: 4.01.0000.6151 English Beta Retail 9/18/2010 02:53:25 954368 bytes
mfc42.dll: 6.02.8081.0000 English Final Retail 2/8/2011 09:33:55 978944 bytes
wsock32.dll: 5.01.2600.5512 English Final Retail 4/13/2008 20:12:10 22528 bytes
amstream.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:49 70656 bytes
devenum.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:51 59904 bytes
dxmasf.dll: 6.04.0009.1133 English Final Retail 4/13/2008 20:11:52 498742 bytes
mciqtz32.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:56 35328 bytes
mpg2splt.ax: 6.05.2600.6333 English Final Retail 1/2/2013 02:49:10 148992 bytes
msdmo.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:59 14336 bytes
encapi.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:53 20480 bytes
qasf.dll: 11.00.5721.5145 English Final Retail 10/18/2006 21:47:18 211456 bytes
qcap.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:03 192512 bytes
qdv.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:03 279040 bytes
qdvd.dll: 6.05.2600.6169 English Final Retail 11/3/2011 11:28:36 386048 bytes
qedit.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:03 562176 bytes
qedwipes.dll: 6.05.2600.5512 English Final Retail 4/13/2008 13:21:32 733696 bytes
quartz.dll: 6.05.2600.6333 English Final Retail 1/2/2013 02:49:10 1292288 bytes
strmdll.dll: 4.01.0000.3938 English Final Retail 8/26/2009 04:16:37 247326 bytes
iac25_32.ax: 2.00.0005.0053 English Final Retail 4/13/2008 20:12:42 199680 bytes
ir41_32.ax: 4.51.0016.0003 English Final Retail 4/13/2008 20:12:42 848384 bytes
ir41_qc.dll: 4.30.0062.0002 English Final Retail 4/13/2008 20:11:55 120320 bytes
ir41_qcx.dll: 4.30.0064.0001 English Final Retail 4/13/2008 20:11:55 338432 bytes
ir50_32.dll: 5.2562.0015.0055 English Final Retail 4/13/2008 20:11:55 755200 bytes
ir50_qc.dll: 5.00.0063.0048 English Final Retail 4/13/2008 20:11:55 200192 bytes
ir50_qcx.dll: 5.00.0064.0048 English Final Retail 4/13/2008 20:11:55 183808 bytes
ivfsrc.ax: 5.10.0002.0051 English Final Retail 4/13/2008 20:12:42 154624 bytes
mswebdvd.dll: 6.05.2600.5857 English Final Retail 8/5/2009 05:01:48 204800 bytes
ks.sys: 5.03.2600.5512 English Final Retail 4/13/2008 15:16:36 141056 bytes
ksproxy.ax: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:42 129536 bytes
ksuser.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:56 4096 bytes
stream.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:45:16 49408 bytes
mspclock.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:39:50 5376 bytes
mspqm.sys: 5.01.2600.5512 English Final Retail 4/13/2008 14:39:51 4992 bytes
mskssrv.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:39:52 7552 bytes
swenum.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:39:53 4352 bytes
mpeg2data.ax: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:42 118272 bytes
msvidctl.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:01 1428992 bytes
vbisurf.ax: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:42 30208 bytes
msyuv.dll: 5.03.2600.5908 English Final Retail 11/27/2009 13:11:44 17920 bytes
wstdecod.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:10 50688 bytes

------------------
DirectShow Filters
------------------

DirectShow Filters:
WMAudio Decoder DMO,0x00800800,1,1,,
WMAPro over S/PDIF DMO,0x00600800,1,1,,
WMA Voice Decoder DMO,0x00600800,1,1,,
WMVideo Advanced Decoder DMO,0x00800001,1,1,,
G2M Session Decoder,0x00600000,1,1,,
Mpeg4s Decoder DMO,0x00800001,1,1,,
WMV Screen decoder DMO,0x00800001,1,1,,
WMVideo Decoder DMO,0x00800001,1,1,,
Mpeg43 Decoder DMO,0x00800001,1,1,,
Mpeg4 Decoder DMO,0x00800001,1,1,,
Annodex Demux Source Filter,0x00600000,0,0,dsfAnxDemux.dll,
Annodex Mux Filter,0x00200000,1,0,dsfAnxMux.dll,
CMML Decode Filter,0x00800002,1,1,dsfCMMLDecoder.dll,
CMML Raw Source Filter,0x00600000,0,0,dsfCMMLRawSource.dll,
FLAC Decode Filter,0x00600000,1,1,dsfFLACDecoder.dll,
FLAC Encode Filter,0x00200000,1,1,dsfFLACEncoder.dll,
Native FLAC Source Filter,0x00600000,0,0,dsfNativeFLACSource.dll,
Ogg Demux Source Filter,0x00600000,0,0,dsfOggDemux.dll,
Ogg Mux Filter,0x00200000,1,0,dsfOggMux.dll,
Speex Decode Filter,0x00600000,1,1,dsfSpeexDecoder.dll,
Speex Encode Filter,0x00200000,1,1,dsfSpeexEncoder.dll,
Subtitle VMR9 Filter,0x00800002,1,1,dsfSubtitleVMR9.dll,
Theora Decode Filter,0x00600000,1,1,dsfTheoraDecoder.dll,
Theora Encode Filter,0x00200000,1,1,dsfTheoraEncoder.dll,
Vorbis Decode Filter,0x00600000,1,1,dsfVorbisDecoder.dll,
Vorbis Encode Filter,0x00200000,1,1,dsfVorbisEncoder.dll,
WMT MuxDeMux Filter,0x00200000,0,0,wmm2filt.dll,2.01.4026.0000
ffdshow MPEG-4 Video Decoder,0xff800001,2,1,ffdshow.ax,1.00.0000.0001
Full Screen Renderer,0x00200000,1,0,quartz.dll,6.05.2600.6333
ffdshow raw video filter,0x00200000,2,1,ffdshow.ax,1.00.0000.0001
RealPlayer Video Filter,0x00200000,1,1,rdsf3260.dll,16.00.0000.0282
CT Upsampler filter,0x00100000,1,1,Upsample.ax,2.00.0005.0000
ffdshow Audio Decoder,0x3fffffff,1,1,ffdshow.ax,1.00.0000.0001
Creative Wave Writer,0x00200000,1,0,WavWrite.ax,3.01.0004.0000
DV Muxer,0x00400000,0,0,qdv.dll,6.05.2600.5512
Color Space Converter,0x00400001,1,1,quartz.dll,6.05.2600.6333
WS ScreenCapture,0x00200000,0,1,ScreenCaptureFilter.ax,2.02.0005.0001
WM ASF Reader,0x00400000,0,0,qasf.dll,11.00.5721.5145
Audio Source,0x00200000,0,1,wmprevu.dll,9.00.0000.2980
Nero Digital API ES Video Reader,0x00600000,0,1,nDxParser.ax,2.00.0002.0047
Screen Capture filter,0x00200000,0,1,wmpsrcwp.dll,11.00.5721.5145
AVI Splitter,0x00600000,1,1,quartz.dll,6.05.2600.6333
WMT AudioAnalyzer,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Creative Frame Rate Converter,0x00200000,1,1,CTFRConv.ax,1.00.0003.0000
Track2Filter,0x00200000,0,0,Track2Filter.dll,
VGA 16 Color Ditherer,0x00400000,1,1,quartz.dll,6.05.2600.6333
Indeo® video 5.10 Compression Filter,0x00200000,1,1,ir50_32.dll,5.2562.0015.0055
BPM Metadata,0x001fffff,1,1,MetaBPMu.ax,2.00.0002.0000
Cucusoft DataExtractor,0x00200000,1,0,,
Windows Media Audio Decoder,0x00800001,1,1,msadds32.ax,8.00.0000.4487
RealVideo Decoder,0x00400000,1,1,RealMedia.dll,1.00.0000.0009
AC3 Parser Filter,0x00600000,1,1,mpg2splt.ax,6.05.2600.6333
WMT Format Conversion,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
CT Time-Scaling filter,0x00100000,1,1,TimeScal.ax,2.03.0003.0000
StreamBufferSink,0x00200000,0,0,sbe.dll,6.05.2600.6076
WMT Black Frame Generator,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
MJPEG Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6333
Indeo® video 5.10 Decompression Filter,0x00640000,1,1,ir50_32.dll,5.2562.0015.0055
Creative Video Processing Filter,0x00200000,1,1,VidProcU.ax,1.00.0007.0000
WMT Screen Capture filter,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
Creative Media Select,0x00200000,1,1,MediaSel.ax,1.00.0003.0000
RealPlayer MPEG4 Transform,0x00600000,1,1,rdsf3260.dll,16.00.0000.0282
Microsoft Screen Video Decompressor,0x00800000,1,1,msscds32.ax,8.00.0000.4487
MPEG-I Stream Splitter,0x00600000,1,2,quartz.dll,6.05.2600.6333
SAMI (CC) Parser,0x00400000,1,1,quartz.dll,6.05.2600.6333
MPEG Layer-3 Decoder,0x00810000,1,1,L3CODECX.AX,1.06.0000.0052
Sonic MPEG-4 Video Decoder,0x00000000,0,0,,
MPEG-2 Splitter,0x005fffff,1,0,mpg2splt.ax,6.05.2600.6333
ACELP.net Sipro Lab Audio Decoder,0x00800001,1,1,acelpdec.ax,1.04.0000.0000
Internal Script Command Renderer,0x00800001,1,0,quartz.dll,6.05.2600.6333
Nero Digital API Audio Decoder,0x00600000,1,1,nDxAudDec.ax,1.00.0004.0060
MPEG Audio Decoder,0x03680001,1,1,quartz.dll,6.05.2600.6333
_ VSO Preview Filter,0x00200000,0,1,VsoVprev.ax,3.00.0001.0043
File Source (Netshow URL),0x00400000,0,1,wmpasf.dll,11.00.5721.5145
WMT Import Filter,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
DV Splitter,0x00600000,1,2,qdv.dll,6.05.2600.5512
Bitmap Generate,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Windows Media Video Decoder,0x00800000,1,1,wmvds32.ax,8.00.0000.4487
Video Mixing Renderer 9,0x00200000,1,0,quartz.dll,
Windows Media Video Decoder,0x00800000,1,1,wmv8ds32.ax,8.00.0000.4000
WMT VIH2 Fix,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Record Queue,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Creative File Reader Filter,0x00400000,0,1,FileRead.ax,1.00.0000.0000
Disk Record Queue,0x00200000,1,1,wmedque.dll,9.00.0000.2980
CT Karaoke filter,0x00100000,1,1,Karaoke.ax,2.00.0007.0000
Nero Digital API Parser,0x00600000,0,3,nDxParser.ax,2.00.0002.0047
Creative AC3 Source Filter,0x00400000,0,1,AC3Srcu.ax,3.01.0000.0000
Creative PCM Raw Writer,0x00200000,1,0,RawWritu.ax,1.00.0000.0000
Color Converter,0x00200000,1,1,declrds.ax,9.00.0000.2980
Windows Media Multiplexer,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASX file Parser,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASX v.2 file Parser,0x00600000,1,0,wmpasf.dll,11.00.5721.5145
NSC file Parser,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
CT PDP filter,0x00100000,1,1,PDP.ax,1.00.0008.0000
ACM Wrapper,0x00600000,1,1,quartz.dll,6.05.2600.6333
Windows Media source filter,0x00600000,0,2,wmpasf.dll,11.00.5721.5145
Video Renderer,0x00800001,1,0,quartz.dll,6.05.2600.6333
Creative MP3 Dump Filter,0x00200000,1,0,Mp3Dump.ax,1.00.0001.0000
Frame Eater,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
MPEG-2 Video Stream Analyzer,0x00200000,0,0,sbe.dll,6.05.2600.6076
Line 21 Decoder,0x00600000,1,1,qdvd.dll,6.05.2600.6169
Video Port Manager,0x00600000,2,1,quartz.dll,6.05.2600.6333
SmartSound Soundtrack,0x00400000,0,1,DirectQX.dll,3.00.0008.0000
SmartSound SDS Reader,0x00400000,0,1,SDSReader.dll,3.00.0008.0000
WST Decoder,0x00600000,1,1,wstdecod.dll,5.03.2600.5512
Video Renderer,0x00400000,1,0,quartz.dll,6.05.2600.6333
RealMedia Source,0x00600000,0,0,RealMedia.dll,1.00.0000.0009
CT SmartVolumeManagement filter,0x00100000,1,1,DSCompr.ax,1.00.0005.0000
Creative Audio Gain Filter,0x00200000,1,1,AudGain.ax,1.00.0000.0000
WM ASF Writer,0x00400000,0,0,qasf.dll,11.00.5721.5145
WMT Sample Information Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
VBI Surface Allocator,0x00600000,1,1,vbisurf.ax,5.03.2600.5512
Microsoft MPEG-4 Video Decompressor,0x00800000,1,1,mpg4ds32.ax,8.00.0000.4504
Creative Flac Source Filter,0x00400000,0,1,FlacSrcu.ax,1.00.0000.0000
File writer,0x00200000,1,0,qcap.dll,6.05.2600.5512
Creative MLP Source Filter,0x00400000,0,1,MlpSrcu.ax,3.01.0000.0000
SVM Metadata,0x001fffff,1,1,MetaSVMu.ax,2.00.0002.0000
CT HPVirtualizer filter,0x00100000,1,1,Virtual.ax,1.00.0000.0000
RealPlayer MP3 Transform,0x00600000,1,1,rdsf3260.dll,16.00.0000.0282
WMT Log Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WMT Virtual Renderer,0x00200000,1,0,wmm2filt.dll,2.01.4026.0000
RealAudio Decoder,0x00400000,1,1,RealMedia.dll,1.00.0000.0009
ffdshow VFW decoder helper,0x00200000,2,1,ffdshow.ax,1.00.0000.0001
DVD Navigator,0x00200000,0,2,qdvd.dll,6.05.2600.6169
Creative Wave Transform Filter,0x00200000,0,0,WavTrans.ax,1.00.0001.0000
Overlay Mixer2,0x00400000,1,1,qdvd.dll,6.05.2600.6169
AC3Filter,0x40000000,1,1,ac3filter.ax,0.06.0008.0000
CT CMSS3 filter,0x00100000,1,1,CMSS3.ax,3.00.0013.0000
AVI Draw,0x00600064,9,1,quartz.dll,6.05.2600.6333
.RAM file Parser,0x00600000,1,0,wmpasf.dll,11.00.5721.5145
WMT DirectX Transform Wrapper,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
G.711 Codec,0x00200000,1,1,g711codc.ax,5.01.2600.0000
MPEG-2 Demultiplexer,0x00600000,1,1,mpg2splt.ax,6.05.2600.6333
Creative Ogg Source Filter,0x00400000,0,1,OggSrcu.ax,1.00.0001.0000
DV Video Decoder,0x00800000,1,1,qdv.dll,6.05.2600.5512
Creative NVF Filter,0x00400000,0,1,NvfSrcu.ax,3.01.0001.0000
RealPlayer Transcode Filter,0x00600000,0,0,rdsf3260.dll,16.00.0000.0282
Indeo® audio software,0x00500000,1,1,iac25_32.ax,2.00.0005.0053
Windows Media Update Filter,0x00400000,1,0,wmpasf.dll,11.00.5721.5145
Creative QT Source Filter,0x00400000,0,2,CTQTSF.ax,1.01.0007.0000
Noise Reduction,0x00100000,1,1,NoisRedu.ax,3.00.0004.0000
Screen Capture filter,0x00200000,0,1,wmesrcwp.dll,9.00.0000.2980
ASF DIB Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF ACM Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF ICM Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF URL Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF JPEG Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF DJPEG Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
ASF embedded stuff Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5145
9x8Resize,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WIA Stream Snapshot Filter,0x00200000,1,1,wiasf.ax,1.00.0000.0000
Allocator Fix,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
SampleGrabber,0x00200000,1,1,qedit.dll,6.05.2600.5512
Null Renderer,0x00200000,1,0,qedit.dll,6.05.2600.5512
Creative WMA Writer,0x00200000,1,0,WMAWrite.ax,3.01.0004.0000
WMT Virtual Source,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
MPEG-2 Sections and Tables,0x005fffff,1,0,mpeg2data.ax,
WMT Interlacer,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
StreamBufferSource,0x00200000,0,0,sbe.dll,6.05.2600.6076
Smart Tee,0x00200000,1,2,qcap.dll,6.05.2600.5512
Creative WMA Source Filter,0x00400000,0,1,WmaSrc.ax,3.01.0001.0000
Overlay Mixer,0x00200000,0,0,qdvd.dll,6.05.2600.6169
RealPlayer Audio Filter,0x00200000,1,1,rdsf3260.dll,16.00.0000.0282
AVI Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6333
Uncompressed Domain Shot Detection Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Audible Words Codec,0x00500000,1,1,awrdscdc.ax,5.00.0000.0005
AVI/WAV File Source,0x00400000,0,2,quartz.dll,6.05.2600.6333
QuickTime Movie Parser,0x00600000,1,1,quartz.dll,6.05.2600.6333
Wave Parser,0x00400000,1,1,quartz.dll,6.05.2600.6333
MIDI Parser,0x00400000,1,1,quartz.dll,6.05.2600.6333
Multi-file Parser,0x00400000,1,1,quartz.dll,6.05.2600.6333
File stream renderer,0x00400000,1,1,quartz.dll,6.05.2600.6333
XML Playlist,0x00400000,1,0,wmpasf.dll,11.00.5721.5145
Extractor,0x00200000,1,0,Extractor.ax,1.00.0000.8010
Video Source,0x00200000,0,1,wmprevu.dll,9.00.0000.2980
RealMedia Splitter,0x00600000,1,1,RealMedia.dll,1.00.0000.0009
AVI Mux,0x00200000,1,0,qcap.dll,6.05.2600.5512
CyberLink QuickTime Source Filter,0x00200000,0,2,Quicktime.dll,1.00.0000.1016
Line 21 Decoder 2,0x00600002,1,1,quartz.dll,6.05.2600.6333
File Source (Async.),0x00400000,0,1,quartz.dll,6.05.2600.6333
File Source (URL),0x00400000,0,1,quartz.dll,6.05.2600.6333
WMT DV Extract,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Creative Null Audio,0x00600000,1,0,NullAud.ax,1.00.0001.0000
Creative CDDA Source Filter,0x00400000,0,1,CDDA.ax,3.00.0002.0000
Creative LiveRecording Filter SxS,0x00400000,0,1,LiveRecu.ax,5.00.0001.0000
WMT Switch Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WMT Volume,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Creative Internet Source Filter,0x00400000,0,1,InetSrcu.ax,1.00.0000.0000
Track1Filter,0x00200000,0,0,Track1Filter.dll,
Stretch Video,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Infinite Pin Tee Filter,0x00200000,1,1,qcap.dll,6.05.2600.5512
QT Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6333
MPEG Video Decoder,0x40000001,1,1,quartz.dll,6.05.2600.6333
Indeo® video 4.4 Decompression Filter,0x00640000,1,1,ir41_32.ax,4.51.0016.0003
Indeo® video 4.4 Compression Filter,0x00200000,1,1,ir41_32.ax,4.51.0016.0003

WDM Streaming Data Transforms:
Microsoft Kernel Acoustic Echo Canceller,0x00000000,0,0,,
Microsoft Kernel GS Wavetable Synthesizer,0x00200000,1,1,,5.03.2600.5512
Microsoft Kernel DLS Synthesizer,0x00200000,1,1,,5.03.2600.5512
Microsoft Kernel DRM Audio Descrambler,0x00200000,1,1,,5.03.2600.5512

Video Compressors:
WMVideo8 Encoder DMO,0x00600800,1,1,,
MSScreen encoder DMO,0x00600800,1,1,,
WMVideo9 Encoder DMO,0x00600800,1,1,,
MSScreen 9 encoder DMO,0x00600800,1,1,,
DV Video Encoder,0x00200000,0,0,qdv.dll,6.05.2600.5512
ffdshow video encoder,0x00100000,1,1,ffdshow.ax,1.00.0000.0001
Indeo® video 5.10 Compression Filter,0x00100000,1,1,ir50_32.dll,5.2562.0015.0055
MJPEG Compressor,0x00200000,0,0,quartz.dll,6.05.2600.6333
Cinepak Codec by Radius,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel 4:2:0 Video V2.50,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel Indeo(R) Video R3.2,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel Indeo® Video 4.5,0x00200000,1,1,qcap.dll,6.05.2600.5512
Indeo® video 5.10,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel IYUV codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft H.261 Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft H.263 Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft RLE,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft Video 1,0x00200000,1,1,qcap.dll,6.05.2600.5512
TechSmith Screen Capture Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512

Audio Compressors:
WMA Voice Encoder DMO,0x00600800,1,1,,
WM Speech Encoder DMO,0x00600800,1,1,,
WMAudio Encoder DMO,0x00600800,1,1,,
IAC2,0x00200000,1,1,quartz.dll,6.05.2600.6333
IMA ADPCM,0x00200000,1,1,quartz.dll,6.05.2600.6333
PCM,0x00200000,1,1,quartz.dll,6.05.2600.6333
Microsoft ADPCM,0x00200000,1,1,quartz.dll,6.05.2600.6333
ACELP.net,0x00200000,1,1,quartz.dll,6.05.2600.6333
DSP Group TrueSpeech(TM),0x00200000,1,1,quartz.dll,6.05.2600.6333
Windows Media Audio V1,0x00200000,1,1,quartz.dll,6.05.2600.6333
Windows Media Audio V2,0x00200000,1,1,quartz.dll,6.05.2600.6333
GSM 6.10,0x00200000,1,1,quartz.dll,6.05.2600.6333
Microsoft G.723.1,0x00200000,1,1,quartz.dll,6.05.2600.6333
CCITT A-Law,0x00200000,1,1,quartz.dll,6.05.2600.6333
CCITT u-Law,0x00200000,1,1,quartz.dll,6.05.2600.6333
MPEG Layer-3,0x00200000,1,1,quartz.dll,6.05.2600.6333

Audio Capture Sources:
Realtek HD Audio Input,0x00200000,0,0,qcap.dll,6.05.2600.5512

Midi Renderers:
Default MidiOut Device,0x00800000,1,0,quartz.dll,6.05.2600.6333
Microsoft GS Wavetable SW Synth,0x00200000,1,0,quartz.dll,6.05.2600.6333

WDM Streaming Capture Devices:
Realtek HD Audio Input,0x00200000,1,1,,5.03.2600.5512

WDM Streaming Rendering Devices:
Realtek HD Audio output,0x00200000,1,1,,5.03.2600.5512

BDA Transport Information Renderers:
MPEG-2 Sections and Tables,0x00600000,1,0,mpeg2data.ax,

WDM Streaming Mixer Devices:
Microsoft Kernel Wave Audio Mixer,0x00000000,0,0,,

BDA CP/CA Filters:
Decrypt/Tag,0x00600000,1,0,encdec.dll,6.05.2600.6161
Encrypt/Tag,0x00200000,0,0,encdec.dll,6.05.2600.6161
XDS Codec,0x00200000,0,0,encdec.dll,6.05.2600.6161

Audio Renderers:
Realtek HD Audio output,0x00200000,1,0,quartz.dll,6.05.2600.6333
Default DirectSound Device,0x00800000,1,0,quartz.dll,6.05.2600.6333
Default WaveOut Device,0x00200000,1,0,quartz.dll,6.05.2600.6333
DirectSound: Realtek HD Audio output,0x00200000,1,0,quartz.dll,6.05.2600.6333

WDM Streaming System Devices:
Realtek HD Audio Input,0x00200000,3,1,,5.03.2600.5512
Realtek HD Audio output,0x00200000,9,1,,5.03.2600.5512


----------



## Cookiegal (Aug 27, 2003)

What is the size of the paging file? To find that information, do this:

Click on *Start *and then click *Control Panel.*

If you're in Category view, click on *Performance and Maintenance* and then click *System *(if in Classic view just click *System*).

On the Advanced tab, under *Performance*, click on *Settings*.

On the Advanced tab, under *Virtual memory*, click *Change*.

Don't change anything but let me know what it says for the initial size and the maximum size please.


----------



## sarahmuriel (Feb 1, 2004)

Drive C 

Initial memory 1524

Maximum memory 3048

Sarah


----------



## Cookiegal (Aug 27, 2003)

Can you explain in a little more detail what the problem with the sound is and when it occurs?

For instance, does it happen when:

watching YouTube videos?

playing a CD or a DVD?

and what exactly does it do?


----------



## sarahmuriel (Feb 1, 2004)

It is extremely an woobly distorted sound when you turn on the computer and the Windows sound comes on. When I am watching YOUtube or a CD or MP3 the sound comes and goes. Its more the correct sound and once in a while, for a small moment it can be a little woobly. 

Sarah


----------



## Cookiegal (Aug 27, 2003)

Go to *Control Panel* - *Sounds and Audio Devices* to open the *Sounds and Audio Devices Properties*.

Under the *Volume Tab* beside the speaker icon at the top does it show your Realtek device there?

Under the *Volume Tab* click on *Advanced *to open up the *Master Volume* box. Next, click on "Options" and "Properties" and be sure that everything is checked in the boxes under "show the following volume controls".

Now back out of that screen to the Sounds and Audio Devices Properties again and click on the Audio tab. Does it show Realtek as the default device at the top for sound playback?


----------



## sarahmuriel (Feb 1, 2004)

Yes it does show Realtek in all the areas and check marks where needed. FYI when Windows is closing there is no woobly sound to that signature sound, but when Windows is starting it sounds like a scratch disk, dating myself, an LP, scratch LP.


----------



## Cookiegal (Aug 27, 2003)

Are you sure all of your wires are inserted securely in the back of the speakers and the back of the computer?


----------



## sarahmuriel (Feb 1, 2004)

Yes,they are correctly connected. As the speakers I had were old and the noise was annoying me, I bought new speakers some months ago and no improvement. Same sound. Does MS offers a new download of their music?


----------



## Cookiegal (Aug 27, 2003)

You shouldn't have to download it. You call that music?  I find those sounds annoying and have them all turned off.  But it's a matter of preference for sure. 

Try running this Microsoft sound troubleshooter:

http://support.microsoft.com/kb/307918/sr-cs

Scroll down to the FixIt button and click on it to start the troubleshooting and then follow the prompts.

Let me know how that goes please.


----------



## flavallee (May 12, 2002)

Hopefully, there isn't a hardware issue with the audio device speaker ports.

---------------------------------------------------------


----------



## sarahmuriel (Feb 1, 2004)

Ok guys, ran the program and I am going to post the Results Found Txt 

Sound, If it cannot be fixed, lets just mute it. Computer is running slow, it is old, I think I must just let her work (until I can afford a new one) at her one pace, it might be, not enough power and there is no juice to help my computer. It moves correctly once it goes thru the slow pace of pulling up Windows, that is the only issue at the moment, besides the pesky Windows sound, which can be muted.

If you believe there is anything more that can be done, let me know, if not, well let dying dogs die, slowwwwwwly.....


Txt Results 

Windows Audio Playback TroubleshooterPublisher details

Issues found
Check audio deviceCheck audio device
There might be a problem with your audio device.Fixed
Uninstall and rescan devicesSucceeded

Low audio device volumeLow audio device volume
Audio device volume might be too low to hear.Fixed
Increase the audio device volumeSucceeded

Issues checked
One or more audio services are not runningOne or more audio services are 
not running
Both the Windows Audio and the Windows Audio End Point Builder services 
must be running for audio to work correctly. At least one of these 
services isnt running.Checked
Audio device mutedAudio device muted
Audio can't play if the device is muted.Checked
Audio device isn't set as defaultAudio device isn't set as default
The default audio device is usually used to play sounds on your 
computer.Checked

Issues foundDetection details

6Check audio deviceFixed

There might be a problem with your audio device.
Uninstall and rescan devicesSucceeded

Uninstall and rescan devices for changes.

6Low audio device volumeFixed

Audio device volume might be too low to hear.
Increase the audio device volumeSucceeded

To increase the volume, move the volume slider in the Volume Mixer. 
When you have finished click Next to continue.


Issues checkedDetection details

6One or more audio services are not runningChecked

Both the Windows Audio and the Windows Audio End Point Builder services 
must be running for audio to work correctly. At least one of these 
services isnt running.
Start required audio servicesNot Run

Start the Windows Audio and the Windows Audio End Point Builder 
services.

6Audio device mutedChecked

Audio can't play if the device is muted.
Unmute audio deviceNot Run

Unmute the audio device to play sound.

6Audio device isn't set as defaultChecked

The default audio device is usually used to play sounds on your computer.
Change the default audio deviceNot Run

Set the selected audio device as the default.


Detection details

Collection information
Computer Name: LENOVO
Windows Version:5.1
Architecture:x86
Time:6/24/2013 8:09:17 PM

Publisher details

Windows Audio Playback Troubleshooter
Repair computer sound problems when your computer cannot play audio or 
when sound is muted in Windows.
Package Version:2.2
Publisher:Microsoft Corporation


----------



## Cookiegal (Aug 27, 2003)

Did you reboot after running the troubleshooter? Because I'm thinking some things need a reboot to take effect.


----------



## sarahmuriel (Feb 1, 2004)

Yes I did as I wanted to check if the Window wobbly sound was gone. Do you want me to run it again? Right now I am babysitting grand children but I could do it when I get home later in the day.


----------



## Cookiegal (Aug 27, 2003)

I'm not familiar with the troubleshooter so don't know what options were presented to you. I see some things have "Not Run" beside them. I don't know if that means it wasn't done or is perhaps irrelevant.

I would try it one more time and be sure to run all of the diagnostics presented (which I'm sure you did but just repeating) and then reboot the machine and see if there's any difference please.


----------



## sarahmuriel (Feb 1, 2004)

When the program runs it gives you 2 options. First run and let us fix whatever we find or run and chose the ones you want fixed. Being clueless I chose to run and fix whatever they find. In a good MS way everything sounds legal jargon, hard to understand as it keep talking about mute and nothing was muted. If that had been so, that woobly sound would not irk me. 
Thanks Sarah


----------



## Cookiegal (Aug 27, 2003)

Please navigage to this file:

C:\Program Files\Windows Media Player\wmplayer.exe

Right-click on the wmplayer.exe file and select "properties" and then click on the version tab and let me know what the version number is please.


Also, please go to Control Panel - Folder Options and click on the File Types tab then scroll down and highlight the .wav file type and let me know if Windows Media Player is the program set to open this type of file with.


----------



## sarahmuriel (Feb 1, 2004)

Version is 11.0.5721.5145 and WAV files are to open with Windows Media Player

Thanks Sarah


----------



## Cookiegal (Aug 27, 2003)

Open Windows Media Player and right-click the black bar at the top and then click on "Help" and then on "About Windows Media Player" and let me know what version it says there please. I found the file version and actual version may not match.


----------



## sarahmuriel (Feb 1, 2004)

You are right, the version shown there is 11.0.5721.5280

Sarah


----------



## Cookiegal (Aug 27, 2003)

Try running this to repair Windows Media Player:

http://support.microsoft.com/mats/windows_media_player_diagnostic


----------



## sarahmuriel (Feb 1, 2004)

Followed your instructions, ran the program, rebooted, it had said it had found some issues. Went back to check on both areas to see if the versions matched. No, still same different versions shown. But the windows starting sound now sounds a lot BETTER. I played a music CD to check how its working and it played fine and sounded fine.

Result Txt for Media Player

Windows Media Player TroubleshooterPublisher details

Issues found
Scripting registration corruptScripting registration corrupt
Windows Media Player does not start, or some UI elements are blank. This 
problem can be caused by a corrupted registration for Java Script or 
Visual Basic Script.Fixed
Resetting jscript.dll and vbscript.dll registrationSucceeded

Windows Media Player LibraryWindows Media Player Library
Windows Media Player Library may be corrupted. This causes media browsing 
and search problems in Windows Media Player.Fixed
Reset Windows Media Player LibrarySucceeded

Settings for Windows Media network streaming are corruptedSettings for 
Windows Media network streaming are corrupted
The Windows Media network streaming settings may be corrupted. This 
prevents streaming video or audio from playing.Fixed
Reset network streaming settingsSucceeded

Issues checked
Your CD/DVD player is not recognizedYour CD/DVD player is not recognized
Your DVD player may not be recognized when you plug it into a USB port on 
your computer. This problem may occur if upper and lower filters are being 
used in the registry.Checked
DVD Player is disabledDVD Player is disabled
Your DVD player is disabled.Checked
DVD player has an unknown problemDVD player has an unknown problem
If your DVD player has a problem that was not found by one of the previous 
checks, then we recommended to uninstall and reinstall the DVD 
device.Checked
Unable to install Windows Media PlayerUnable to install Windows Media 
Player
Folder permissions used by Windows Media Player may need to be repaired in 
order to install Windows Media Player.Checked
Nero Video Burning PluginNero Video Burning Plugin
Nero Video Burning Plugin is incompatible with Windows Media Player 11 or 
newer versions, and may cause Windows Media Player to crash or stop 
responding.Checked
DVD player not detectedDVD player not detected
No DVD player was detected on the computer.Checked
PicVideo watermarks are displayed over video imagesPicVideo watermarks are 
displayed over video images
Videos are overlaid by a "PICVideo M-JPEG 3, www.accusoft.com" or a 
"PICVIDEO, WWW.JPG.COM" watermark.Checked
Reset Windows Media PlayerReset Windows Media Player
Windows Media Player may not be set up correctly and may not run as 
expected.Checked

Issues foundDetection details

6Scripting registration corruptFixed

Windows Media Player does not start, or some UI elements are blank. This 
problem can be caused by a corrupted registration for Java Script or 
Visual Basic Script.
Resetting jscript.dll and vbscript.dll registrationSucceeded

Resetting the registration for Java Script and Visual Basic Script 
will resolve this problem.

6Windows Media Player LibraryFixed

Windows Media Player Library may be corrupted. This causes media browsing 
and search problems in Windows Media Player.
Reset Windows Media Player LibrarySucceeded

Deleting the library resolves this problem. No media files will be 
deleted. But the library will be rebuilt the next time that you run 
Windows Media Player.

6Settings for Windows Media network streaming are corruptedFixed

The Windows Media network streaming settings may be corrupted. This 
prevents streaming video or audio from playing.
Reset network streaming settingsSucceeded

Resetting the Windows Media network streaming settings rebuilds the 
configuration file and resolves this issue.


Issues checkedDetection details

6Your CD/DVD player is not recognizedChecked

Your DVD player may not be recognized when you plug it into a USB port on 
your computer. This problem may occur if upper and lower filters are being 
used in the registry.
Remove upper and lower filters for CD/DVD devicesNot Run

Enable the DVD player.

6DVD Player is disabledChecked

Your DVD player is disabled.
Enable DVD playerNot Run

Enable the DVD player.

6DVD player has an unknown problemChecked

If your DVD player has a problem that was not found by one of the previous 
checks, then we recommended to uninstall and reinstall the DVD device.
Uninstall and reinstall DVD deviceNot Run

Uninstalling the DVD device will allow Windows to rescan and 
reinstall the device driver.

6Unable to install Windows Media PlayerChecked

Folder permissions used by Windows Media Player may need to be repaired in 
order to install Windows Media Player.
Repair folder permissionsNot Run

Repair folder permissions used by Windows Media Player.

6Nero Video Burning PluginChecked

Nero Video Burning Plugin is incompatible with Windows Media Player 11 or 
newer versions, and may cause Windows Media Player to crash or stop 
responding.
Unregister Nero Video burning pluginNot Run

Unregister the Nero Video Burning Plugin (Neroburnplugin.dll) from 
the Windows registry to resolve this problem.

6DVD player not detectedChecked

No DVD player was detected on the computer.
Scan for hardware changesNot Run

Scanning for hardware changes may be able to detect the DVD player 
and fix this problem.

6PicVideo watermarks are displayed over video imagesChecked

Videos are overlaid by a "PICVideo M-JPEG 3, www.accusoft.com" or a 
"PICVIDEO, WWW.JPG.COM" watermark.
Remove PicVideo codecNot Run

Remove the PicVideo codec that is placing this watermark on my 
videos.

6Reset Windows Media PlayerChecked

Windows Media Player may not be set up correctly and may not run as 
expected.
Reset and run Windows Media Player setupNot Run

Windows Media Player may have to run the first time setup to enable 
you to correct some settings.


Detection details

Collection information
Computer Name: LENOVO
Windows Version:5.1
Architecture:x86
Time:6/26/2013 7:26:20 PM

Publisher details

Windows Media Player Troubleshooter
Automatically repair Windows Media Player problems when the player doesn&#8217;t 
start, streaming doesn&#8217;t work or when you cannot browse or search for 
media.
Package Version:1.3
Publisher:Microsoft Corporation



Thanks Sarah


----------



## Cookiegal (Aug 27, 2003)

It sounds like that helped a lot. I don't think we're going to get it any better than that.


----------



## sarahmuriel (Feb 1, 2004)

Sorry it took me so long, family issues again and then when I tried to go the the site, by using the link on the emails that were sent I keep on getting error messages and would not let me get to the site. When I went directly to the site and pulled it up, no problem, but when I tried to login it would take me again to the error message. I also had issues with Eset, it was not in the toolbar, even thou I was able to pull it up. Rebooted the system and all the problems disappeared. Internet is a little goofy lately. Ok, I guess we have done the best for this old computer. If you think of something else let me know. Using the mute button on the sound as when I rebooted the system it had the same sound issues again.

Thanks 
Sarah


----------



## Cookiegal (Aug 27, 2003)

That's odd that it was better and then went back to the way it was.

It might be a good idea to back up everything important like documents and photos and reformat and reload Windows to start fresh or reset to factory settings if that's an option.


----------



## sarahmuriel (Feb 1, 2004)

I would love to reset factory settings. I don't think I have made any changes but that sounds great. Where do I go in my computer to reset the whole thing. Would I lose date on disk C. I can transfer all of that to any of the other drives ..

THanks Sarah


----------



## Cookiegal (Aug 27, 2003)

Yes, you would lose all documents, photos and programs that you've installed since you got the computer so you'd have to back those up to an external drive or CDs.

It resets it back to the way it was when you first bought it.

What is the make and model of the computer?


----------



## sarahmuriel (Feb 1, 2004)

I have a Lenovo 3000 H200 57099437. Can I transfer some of the program folder into my secondary drives and then transfer again to Drive C when I finish resetting it?


----------



## Cookiegal (Aug 27, 2003)

I'm still trying to find the instructions for your particular model but I think there's a bit more to the model number. It seems it should start with a letter like some letters or a combination of letters and number.

Unfortunately, you can't transfer programs that way. They have to be reinstalled using their original media.


----------



## sarahmuriel (Feb 1, 2004)

The Users Guide for my desktop says Lenovo 3000 H Users Guide.

http://support.lenovo.com/en_IN/research/hints-or-tips/detail.page?DocID=HT072972

http://www.overstock.com/Electronics/Lenovo-3000-H200-Desktop/4097837/product.html

The only difference from the one shown on Overstock is that mine does not have slots for SDHD or any other of those.

The hard drive 160GB SATA H
Memory 1GB DDR2
Processor Intel Atom 230
Sarah


----------



## Cookiegal (Aug 27, 2003)

If you have the user's manual does it say anything in there about the Lenovo Rescue System?

It should have that and this is what they say it does:

Lenovo Rescue System provides OneKey recovery and OneKey Antivirus without booting into Windows

http://support.lenovo.com/en_US/downloads/detail.page?DocID=HT069555

But this is not my area of expertise so perhaps you should start a new thread for assistance with resetting the computer back to factory settings.


----------



## sarahmuriel (Feb 1, 2004)

system performing really bad and slow. This morning the desktop would not go farther than the screen where it gives you the option to tap enter to go into Bios. Had to jump some ropes to get it to start. will be posting in another subject, thou I have the instructions in the manual about recovering factory settings.

New post in here http://forums.techguy.org/18-all-other-software/


----------



## Cookiegal (Aug 27, 2003)

:up:


----------



## sarahmuriel (Feb 1, 2004)

Thanks for all your help Cookie, it was a lost cause, decided to buy a new computer, the old one had no fighting spirit left. 

Sarah


----------



## Cookiegal (Aug 27, 2003)

You're welcome Sarah but I'm sorry it turned out that way.


----------

