BleepingComputer.com: Search engine redirect issues

Frequently when I attempt to click on a link from Google, I am redirected to some sort of ad page. I have tried scanning with Malwarebytes, Adaware and Spybot, but so far I've had no luck. Here's my Root Repeal Log:



ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/11/14 16:28
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF35CA000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7BB5000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF018F000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\System Volume Information\_restore{05FE1E09-7CB8-4984-9D07-B2D95CE44CE7}\RP1968\A0305304.rbf:{F344058A-7158-D71F-21AA-C31D6B24AD2F}
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\All Users\Application Data\avg9\Log\avgrs.log
Status: Locked to the Windows API!

SSDT
-------------------
#: 041 Function Name: NtCreateKey
Status: Hooked by "Lbd.sys" at address 0xf76a987e

#: 247 Function Name: NtSetValueKey
Status: Hooked by "Lbd.sys" at address 0xf76a9bfe

==EOF==



I can't get DDS to run on my computer for some reason.

Hello!
My name is Sam and I will be helping you.

In order to see what's going on with your computer I'll ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.

Please download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Important!
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.
Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.


Make sure that you save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please copy and paste the contents of C:\ComboFix.txt in your next reply.

Hey there! Thanks for the help. I tried running ComboFix.exe, but I ended up getting the following error message:

Date error: 2009-11-16
Check your settings




How do I fix this?

We need to create an OTL Report

• Please download OTL from here
  
• Save it to your desktop.
  
• Double click on the icon on your desktop.
  
• Click the "Scan All Users" checkbox.
  
• Push the "Run Scan" button.
  
• The scan should take just a few minutes.
  
• Copy the log that opens up and paste it back here in your next reply.

OTL logfile created on: 11/17/2009 11:32:44 AM - Run 1
OTL by OldTimer - Version 3.1.6.0 Folder = C:\Documents and Settings\ME\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

991.48 Mb Total Physical Memory | 402.91 Mb Available Physical Memory | 40.64% Memory free
1.58 Gb Paging File | 1.15 Gb Available in Paging File | 72.26% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.30 Gb Total Space | 73.53 Gb Free Space | 51.31% Space Free | Partition Type: NTFS
Drive D: | 5.74 Gb Total Space | 0.87 Gb Free Space | 15.15% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MARS
Current User Name: ME
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009/11/17 11:22:52 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
PRC - [2009/11/14 17:00:25 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/11/14 17:00:25 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009/11/12 12:02:35 | 02,020,120 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2009/11/12 12:02:32 | 00,600,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2009/11/10 21:38:42 | 01,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2009/11/10 21:38:41 | 00,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2009/11/10 21:38:41 | 00,502,040 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2009/11/10 21:38:36 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2009/10/31 17:50:25 | 00,788,368 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2009/09/21 15:36:12 | 00,305,440 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/09/21 15:36:02 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/05/29 12:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/02/06 05:10:02 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/10/10 05:45:26 | 00,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2008/08/22 02:31:42 | 00,570,880 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2008/04/13 19:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/13 11:20:22 | 00,097,432 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
PRC - [2007/04/03 20:50:00 | 01,603,152 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2006/10/18 21:46:20 | 00,064,000 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmplayer.exe
PRC - [2005/04/10 12:31:43 | 00,180,269 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2004/05/14 17:47:18 | 00,067,072 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2004/05/12 18:22:52 | 00,249,856 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\system32\Keyhook.exe
PRC - [2004/02/24 13:05:58 | 00,508,416 | ---- | M] (Chicony) -- C:\WINDOWS\mHotkey.exe
PRC - [2004/02/03 16:15:54 | 05,794,816 | ---- | M] (Chicony) -- C:\WINDOWS\CNYHKey.exe
PRC - [2003/06/20 02:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
PRC - [2003/06/07 05:32:32 | 00,050,688 | ---- | M] (Microsoft® Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe


========== Modules (SafeList) ==========

MOD - [2009/11/17 11:22:52 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
MOD - [2008/04/13 19:12:51 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
MOD - [2008/04/13 19:12:00 | 00,025,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mslbui.dll
MOD - [2008/04/13 19:11:53 | 00,185,344 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\framedyn.dll
MOD - [2003/05/27 16:13:02 | 00,024,576 | ---- | M] () -- C:\WINDOWS\HKCYDLL.dll


========== Win32 Services (SafeList) ==========

SRV - File not found -- -- (rpcapd)
SRV - File not found -- -- (McProxy)
SRV - [2009/11/14 17:00:25 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/11/11 09:07:49 | 00,061,952 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\SP\sp.dll -- (SPService)
SRV - [2009/11/10 21:38:36 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2009/10/31 17:50:24 | 01,179,232 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009/09/23 15:37:30 | 00,051,168 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper)
SRV - [2009/09/21 15:36:02 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/05/29 12:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/04/02 04:38:41 | 00,183,280 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2009/01/09 10:31:16 | 02,482,848 | ---- | M] (McAfee, Inc.) -- c:\program files\common files\mcafee\mna\mcnasvc.exe -- (McNASvc)
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/10/10 05:45:26 | 00,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2008/08/22 02:31:42 | 00,570,880 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2008/07/29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)
SRV - [2008/07/29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)
SRV - [2008/07/29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008/07/25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/07/25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state)
SRV - [2008/04/13 19:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll -- (helpsvc)
SRV - [2007/04/13 11:20:22 | 00,097,432 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc)
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003/07/28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/20 02:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
SRV - [2001/11/12 12:31:48 | 00,020,480 | ---- | M] (X10) -- C:\Program Files\Common Files\X10\Common\X10nets.exe -- (x10nets)


========== Driver Services (SafeList) ==========

DRV - [2009/11/10 21:39:19 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2009/11/10 21:39:12 | 00,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2009/11/10 21:39:10 | 00,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2009/10/21 17:53:51 | 00,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/10/21 17:53:43 | 00,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
DRV - [2009/09/23 07:55:23 | 00,064,288 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2009/08/28 18:42:52 | 00,040,448 | ---- | M] (Apple, Inc.) -- C:\WINDOWS\system32\drivers\usbaapl.sys -- (USBAAPL)
DRV - [2009/05/18 13:17:00 | 00,026,600 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2008/11/15 19:25:30 | 00,013,440 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\system32\drivers\USBCRFT.SYS -- (CardReaderFilter)
DRV - [2008/10/23 12:08:54 | 00,120,136 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\drivers\Mpfp.sys -- (MPFP)
DRV - [2008/05/28 09:33:38 | 00,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2008/04/13 13:53:09 | 00,040,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2007/11/13 05:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2007/03/07 18:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2004/08/04 07:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
DRV - [2004/08/03 17:31:36 | 00,032,768 | ---- | M] (SiS Corporation) -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC)
DRV - [2004/07/26 13:32:26 | 00,666,624 | ---- | M] (Cisco-Linksys, LLC.) -- C:\WINDOWS\system32\drivers\LSPMUSBX.sys -- (PRISM_USB)
DRV - [2004/07/06 14:37:44 | 00,012,416 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2004/07/06 14:36:52 | 00,217,600 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
DRV - [2004/05/15 01:24:10 | 00,622,172 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM)
DRV - [2004/02/24 13:08:52 | 00,400,384 | ---- | M] (Sensaura) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)
DRV - [2003/12/19 16:13:30 | 00,011,672 | ---- | M] (Chicony) -- C:\WINDOWS\system32\drivers\UKBFLT.sys -- (UKBFLT)
DRV - [2003/12/05 11:46:36 | 00,010,368 | ---- | M] (Padus, Inc.) -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2003/09/10 20:36:34 | 00,670,203 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\ctxs51.sys -- (Intels51)
DRV - [2003/08/07 09:36:48 | 00,362,688 | ---- | M] (Intersil Americas Inc.) -- C:\WINDOWS\system32\drivers\PRISMA00.sys -- (PRISM_A00)
DRV - [2003/07/18 06:58:20 | 00,036,992 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys -- (SISAGP)
DRV - [2003/06/12 08:47:42 | 00,024,704 | ---- | M] (Philips Semiconductors) -- C:\WINDOWS\system32\drivers\PhTVTune.sys -- (PhTVTune)
DRV - [2003/06/05 08:04:22 | 00,350,752 | ---- | M] (Philips Semiconductors) -- C:\WINDOWS\system32\drivers\Cap7134.sys -- (Cap7134)
DRV - [2001/11/14 17:07:42 | 00,010,761 | ---- | M] (X10 Wireless Technology, Inc.) -- C:\WINDOWS\system32\drivers\x10uif.sys -- (X10UIF)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/index.html
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://twitter.com/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.701
FF - prefs.js..extensions.enabledItems: avg@igeared:2.710.016.005
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {27c60876-b5c9-4335-b4f3-52b26782220c}:0.9.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000006
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.14
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.5
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p="


FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2009/08/27 22:23:05 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/07/01 00:32:35 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2009/11/10 21:38:56 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2009/11/10 21:38:36 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/11/14 17:00:27 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/11/06 16:20:47 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/11/08 19:53:35 | 00,000,000 | ---D | M]

[2008/06/18 14:06:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Extensions
[2008/06/18 14:06:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/11/15 09:28:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions
[2009/07/01 02:30:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/06/05 15:27:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}
[2009/01/14 05:30:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/11/08 19:13:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/10/16 12:42:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2009/08/13 11:53:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2008/04/14 22:08:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(2)
[2009/10/29 00:40:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/03/19 16:05:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\moveplayer@movenetworks.com
[2007/07/03 10:37:47 | 00,002,386 | ---- | M] () -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\searchplugins\siteadvisor.xml
[2009/09/17 22:26:42 | 00,004,153 | ---- | M] () -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\searchplugins\youtube.xml
[2009/11/15 09:28:21 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/11/06 16:20:38 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/12/02 09:14:35 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2009/11/14 17:00:46 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2009/11/06 16:20:38 | 00,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll
[2009/11/06 16:20:38 | 00,137,176 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll
[2004/05/07 13:31:40 | 00,348,160 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\components\MSVCR71.DLL
[2007/04/10 16:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
[2009/11/14 17:00:25 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
[2008/11/17 18:44:17 | 00,279,888 | ---- | M] (Musicnotes, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npmusicn.dll
[2009/11/06 16:20:41 | 00,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
[2006/12/18 03:18:30 | 00,077,824 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
[2005/04/27 15:10:49 | 00,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\Mozilla Firefox\plugins\npracplug.dll
[2005/08/09 13:42:53 | 00,057,344 | ---- | M] (America Online, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npunagi2.dll
[2007/03/09 18:16:44 | 00,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
[2009/09/23 15:37:30 | 00,032,448 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
[2009/10/29 00:38:45 | 00,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml
[2009/10/29 00:38:45 | 00,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml
[2009/11/10 21:43:32 | 00,002,274 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\avg_igeared.xml
[2009/10/29 00:38:45 | 00,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml
[2009/10/29 00:38:45 | 00,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
[2009/10/29 00:38:45 | 00,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2009/10/29 00:38:45 | 00,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml
[2009/10/29 00:38:45 | 00,000,792 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: (526 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (Winamp Toolbar BHO) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\mHotkey.exe (Chicony)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [ledpointer] C:\WINDOWS\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\Keyhook.exe (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe (Silicon Integrated Systems Corp.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\nbj.exe (Ahead Software AG)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Wedding%20Dash%202/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Wedding%20Dash%202/Images/armhelper.ocx (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 24.92.226.40 24.92.226.41
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\WRNotifier: DllName - WRLogonNTF.dll - C:\WINDOWS\System32\WRLogonNtf.dll (Webroot Software, Inc.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\brastk.exe: Debugger - svchost.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - Reg Error: Key error. File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/24 08:10:44 | 00,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (SsiEfr.e) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/11/17 11:22:51 | 00,529,408 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
[2009/11/16 10:41:01 | 00,000,000 | --SD | C] -- C:\ComboFix
[2009/11/16 09:56:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/11/16 09:55:49 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/11/16 09:42:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\3315e
[2009/11/16 09:26:41 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\46f0070
[2009/11/14 20:03:35 | 01,839,984 | ---- | C] (Trend Micro) -- C:\Documents and Settings\ME\Desktop\HousecallLauncher.exe
[2009/11/14 17:00:44 | 00,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/11/14 17:00:44 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/11/14 17:00:44 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/11/14 17:00:44 | 00,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2009/11/14 11:51:06 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\ME\Recent
[2009/11/10 21:39:31 | 00,000,000 | -H-D | C] -- C:\$AVG
[2009/11/10 21:39:19 | 00,360,584 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/11/10 21:39:19 | 00,012,464 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/11/10 21:39:12 | 00,333,192 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/11/10 21:39:10 | 00,028,424 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/11/10 21:38:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\Avg
[2009/11/10 21:38:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2009/11/10 21:38:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg9
[2009/11/08 16:20:08 | 00,078,336 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\Agent.OMZ.Fix.exe
[2009/11/08 16:20:07 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.C.exe
[2009/11/08 16:20:07 | 00,080,384 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\o4Patch.exe
[2009/11/08 16:20:06 | 00,082,432 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\404Fix.exe
[2009/11/08 16:20:05 | 00,087,552 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\VACFix.exe
[2009/11/08 16:20:04 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.exe
[2009/11/08 16:20:03 | 00,289,144 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\VCCLSID.exe
[2009/11/08 16:20:02 | 00,288,417 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\SrchSTS.exe
[2009/11/08 16:20:02 | 00,079,360 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swxcacls.exe
[2009/11/08 16:20:00 | 00,135,168 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swreg.exe
[2009/11/08 16:19:59 | 00,053,248 | ---- | C] (http://www.beyondlogic.org) -- C:\WINDOWS\System32\Process.exe
[2009/10/31 17:50:39 | 00,093,360 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2009/10/29 00:40:16 | 00,000,000 | ---D | C] -- C:\Program Files\NOS
[2009/10/28 23:27:24 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2009/10/28 22:56:03 | 00,000,000 | ---D | C] -- C:\Program Files\AVG
[2009/10/28 19:47:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
[2009/10/27 19:02:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ME\Local Settings\Application Data\Microsoft Corporation
[2009/10/27 19:01:50 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Windows 7 Upgrade Advisor
[2009/10/25 23:48:52 | 00,000,000 | ---D | C] -- C:\Program Files\IObit
[2009/10/21 17:48:30 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2009/10/21 08:10:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SP
[2006/04/29 12:10:38 | 00,774,144 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RngInterstitial.dll
[2001/06/19 15:34:36 | 00,040,960 | ---- | C] (Jetsoft Development Company) -- C:\Program Files\ACMonitor_X83.exe
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[26 C:\Documents and Settings\ME\My Documents\*.tmp files -> C:\Documents and Settings\ME\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009/11/17 11:23:15 | 14,820,888 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\111709wo.mp3
[2009/11/17 11:22:52 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
[2009/11/17 11:14:11 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2009/11/17 08:13:03 | 45,312,087 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/11/17 08:12:40 | 00,095,054 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/11/16 23:44:23 | 00,076,755 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\untitled.JPG
[2009/11/16 23:38:24 | 00,038,798 | ---- | M] () -- C:\Documents and Settings\ME\Application Data\wklnhst.dat
[2009/11/16 23:38:21 | 00,046,592 | ---- | M] () -- C:\Documents and Settings\ME\My Documents\novel.doc
[2009/11/16 22:00:04 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/11/16 11:57:21 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/11/16 11:55:04 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/11/16 11:54:13 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/11/16 11:54:05 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/11/16 11:54:04 | 10,397,16352 | -HS- | M] () -- C:\hiberfil.sys
[2009/11/16 11:52:42 | 11,534,336 | ---- | M] () -- C:\Documents and Settings\ME\ntuser.dat
[2009/11/16 11:52:42 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\ME\ntuser.ini
[2009/11/16 09:42:24 | 00,001,670 | ---- | M] () -- C:\System Defender.lnk
[2009/11/16 09:26:59 | 00,000,526 | RHS- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/11/15 01:00:00 | 00,000,368 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job
[2009/11/14 20:03:43 | 01,839,984 | ---- | M] (Trend Micro) -- C:\Documents and Settings\ME\Desktop\HousecallLauncher.exe
[2009/11/14 20:00:59 | 00,000,202 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/11/14 17:00:25 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2009/11/14 17:00:25 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/11/14 17:00:25 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/11/14 17:00:25 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/11/14 17:00:25 | 00,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2009/11/11 03:24:15 | 00,284,520 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/11/11 01:04:31 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\ME\My Documents\~$novel.doc
[2009/11/10 21:39:20 | 00,001,517 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/11/10 21:39:19 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/11/10 21:39:19 | 00,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/11/10 21:39:12 | 00,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/11/10 21:39:10 | 00,113,461 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2009/11/10 21:39:10 | 00,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/11/10 21:38:59 | 06,061,540 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/11/10 21:38:59 | 00,492,629 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/11/08 20:00:08 | 00,024,064 | ---- | M] () -- C:\Documents and Settings\ME\My Documents\movies seen 2009.doc
[2009/11/08 16:20:56 | 00,004,604 | ---- | M] () -- C:\WINDOWS\System32\tmp.reg
[2009/11/05 12:36:21 | 26,768,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/11/02 15:17:08 | 00,467,064 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/11/02 15:17:08 | 00,082,068 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/11/01 00:00:00 | 00,000,370 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job
[2009/10/31 17:50:36 | 00,093,360 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2009/10/31 11:21:12 | 21,887,832 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\A Christmas Carol.mp3
[2009/10/30 18:09:40 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/10/28 23:27:26 | 00,001,558 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\CCleaner.lnk
[2009/10/28 21:19:20 | 00,777,480 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\avgremover_en.exe
[2009/10/28 21:06:25 | 00,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009/10/24 21:18:44 | 00,182,272 | ---- | M] () -- C:\Documents and Settings\ME\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/24 19:24:14 | 00,031,232 | ---- | M] () -- C:\Documents and Settings\ME\My Documents\week 5.doc
[2009/10/24 18:24:34 | 00,001,281 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/10/24 14:23:53 | 00,001,612 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/10/24 12:48:04 | 00,016,384 | ---- | M] () -- C:\Documents and Settings\ME\My Documents\scors.xls
[2009/10/22 04:19:04 | 05,939,712 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mshtml.dll
[2009/10/22 04:19:04 | 05,939,712 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2009/10/22 01:06:15 | 00,000,036 | ---- | M] () -- C:\Documents and Settings\ME\Local Settings\Application Data\housecall.guid.cache
[2009/10/21 21:28:19 | 00,000,943 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\Spybot - Search & Destroy.lnk
[2009/10/21 17:48:25 | 00,000,877 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2009/10/18 18:59:59 | 00,000,097 | ---- | M] () -- C:\WINDOWS\System32\wwp.htm
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[26 C:\Documents and Settings\ME\My Documents\*.tmp files -> C:\Documents and Settings\ME\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/11/17 11:22:18 | 14,820,888 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\111709wo.mp3
[2009/11/17 05:59:48 | 00,022,016 | ---- | C] () -- C:\WINDOWS\System32\tdlwsp.dll
[2009/11/16 23:43:20 | 00,076,755 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\untitled.JPG
[2009/11/16 09:42:23 | 00,001,670 | ---- | C] () -- C:\System Defender.lnk
[2009/11/11 01:04:31 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\ME\My Documents\~$novel.doc
[2009/11/10 21:39:20 | 00,001,517 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/11/10 21:39:10 | 00,113,461 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2009/11/10 21:38:59 | 45,312,087 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/11/10 21:38:59 | 06,061,540 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/11/10 21:38:59 | 00,492,629 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/11/10 21:38:59 | 00,095,054 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/11/09 10:42:12 | 11,534,336 | ---- | C] () -- C:\Documents and Settings\ME\ntuser.dat
[2009/11/08 17:50:17 | 10,397,16352 | -HS- | C] () -- C:\hiberfil.sys
[2009/11/08 16:20:56 | 00,004,604 | ---- | C] () -- C:\WINDOWS\System32\tmp.reg
[2009/11/08 16:20:04 | 00,075,776 | ---- | C] () -- C:\WINDOWS\System32\WS2Fix.exe
[2009/11/08 16:20:02 | 00,051,200 | ---- | C] () -- C:\WINDOWS\System32\dumphive.exe
[2009/11/03 21:19:36 | 00,024,064 | ---- | C] () -- C:\Documents and Settings\ME\My Documents\movies seen 2009.doc
[2009/11/01 15:23:26 | 00,046,592 | ---- | C] () -- C:\Documents and Settings\ME\My Documents\novel.doc
[2009/10/30 20:10:40 | 21,887,832 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\A Christmas Carol.mp3
[2009/10/28 23:27:26 | 00,001,558 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\CCleaner.lnk
[2009/10/28 21:19:16 | 00,777,480 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\avgremover_en.exe
[2009/10/24 19:24:13 | 00,031,232 | ---- | C] () -- C:\Documents and Settings\ME\My Documents\week 5.doc
[2009/10/22 01:06:15 | 00,000,036 | ---- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\housecall.guid.cache
[2009/10/21 21:28:19 | 00,000,943 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\Spybot - Search & Destroy.lnk
[2009/10/21 17:48:25 | 00,000,877 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2009/10/18 18:59:59 | 00,000,097 | ---- | C] () -- C:\WINDOWS\System32\wwp.htm
[2009/01/12 18:40:36 | 00,003,457 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\profiles.xml
[2008/08/22 02:31:42 | 00,141,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2008/05/23 23:58:47 | 02,646,422 | -H-- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\IconCache.db
[2008/04/18 13:01:34 | 00,000,322 | ---- | C] () -- C:\WINDOWS\Xtarot.INI
[2008/04/08 21:49:11 | 00,000,000 | ---- | C] () -- C:\Program Files\temp01
[2008/03/10 22:55:38 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2007/08/28 23:36:37 | 00,000,030 | ---- | C] () -- C:\WINDOWS\ACMonitor_X83.ini
[2007/08/28 23:30:28 | 00,004,672 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.DLL
[2007/08/10 18:22:16 | 00,001,210 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\error.log
[2007/08/10 18:22:16 | 00,000,015 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\config.tcf
[2007/06/10 22:14:43 | 00,000,022 | ---- | C] () -- C:\WINDOWS\iexplore.ini
[2007/03/23 05:51:26 | 00,000,227 | ---- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2007/03/23 05:48:32 | 00,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2007/02/02 12:40:05 | 00,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2007/01/28 14:30:39 | 00,468,480 | ---- | C] () -- C:\WINDOWS\System32\NMDll.dll
[2007/01/28 14:30:38 | 00,208,896 | ---- | C] () -- C:\WINDOWS\System32\HDBHO.dll
[2007/01/28 14:30:37 | 00,020,480 | ---- | C] () -- C:\WINDOWS\yhl.dll
[2007/01/28 14:30:37 | 00,007,168 | ---- | C] () -- C:\WINDOWS\lq.dll
[2007/01/24 01:19:06 | 00,000,063 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2006/08/25 23:26:55 | 00,591,890 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2006/08/25 23:26:54 | 00,856,064 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/08/25 23:26:54 | 00,217,088 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/08/25 23:26:51 | 00,005,120 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2006/08/25 23:26:51 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2006/08/22 14:58:28 | 00,079,681 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
[2006/08/22 14:57:22 | 00,005,661 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
[2006/08/22 14:56:20 | 00,118,428 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\Update_HP_RedboxHprblog_HPSU.log
[2006/06/29 14:58:52 | 00,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/06/29 14:53:56 | 00,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 00,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/04/18 15:39:28 | 00,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/03/26 23:28:27 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\cygz.dll
[2005/11/24 15:43:46 | 00,001,783 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/11/16 15:33:23 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
[2005/11/16 15:33:23 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
[2005/10/25 18:38:42 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/10/20 19:01:03 | 00,005,697 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2005/10/20 19:00:37 | 00,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2005/08/12 16:57:09 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/06/03 22:10:53 | 00,000,823 | ---- | C] () -- C:\WINDOWS\tsc.ini
[2005/06/03 22:10:52 | 00,071,749 | ---- | C] () -- C:\WINDOWS\hcextoutput.dll
[2005/06/03 22:10:24 | 00,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2005/05/17 22:40:31 | 00,000,082 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\Ad Annihilator.aap
[2005/05/10 15:07:26 | 00,076,960 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\GDIPFONTCACHEV1.DAT
[2005/03/16 23:35:04 | 00,000,022 | ---- | C] () -- C:\WINDOWS\Kyor.ini
[2005/01/24 11:24:17 | 00,038,798 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\wklnhst.dat
[2005/01/23 21:11:16 | 03,423,744 | ---- | C] () -- C:\WINDOWS\System32\libfilefmt-1.1.0.dll
[2005/01/23 21:11:16 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\libavi-dd-1.2.0.dll
[2005/01/23 21:11:15 | 00,706,048 | ---- | C] () -- C:\WINDOWS\System32\libmcl-3.1.1.dll
[2005/01/23 19:24:15 | 00,012,462 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2005/01/23 18:34:31 | 00,182,272 | ---- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/01/23 14:45:14 | 00,000,141 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/01/23 14:38:19 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\ME\Application Data\desktop.ini
[2005/01/23 14:38:18 | 00,085,904 | ---- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2004/09/08 18:58:04 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/09/08 18:25:46 | 00,000,202 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2004/09/08 13:28:53 | 00,000,004 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2004/08/26 23:39:21 | 00,000,015 | ---- | C] () -- C:\WINDOWS\NASBA.ini
[2004/08/24 07:01:17 | 00,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/24 05:01:06 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/08/23 10:32:20 | 00,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2004/08/23 10:32:20 | 00,049,152 | ---- | C] () -- C:\WINDOWS\CNYUSB.dll
[2004/08/23 10:32:20 | 00,024,576 | ---- | C] () -- C:\WINDOWS\HKCYDLL.dll
[2004/08/23 10:32:20 | 00,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll
[2004/08/23 10:32:20 | 00,000,360 | ---- | C] () -- C:\WINDOWS\CNYHKey.ini
[2004/08/23 08:55:48 | 00,008,632 | ---- | C] () -- C:\WINDOWS\PRISMDOM.ini
[2004/08/23 08:33:37 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/22 17:10:03 | 00,000,266 | ---- | C] () -- C:\WINDOWS\Dit.INI
[2004/08/22 17:04:24 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/08/22 17:00:40 | 00,108,021 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004/08/22 16:59:11 | 00,099,597 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2004/08/22 16:57:31 | 00,032,768 | ---- | C] () -- C:\WINDOWS\SIS_LIB.DLL
[2004/08/22 15:44:00 | 00,000,814 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/08/22 15:43:43 | 00,001,281 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/22 15:43:39 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2004/08/22 08:49:47 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2002/03/21 14:39:02 | 00,073,728 | R--- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2002/03/20 21:01:06 | 00,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll
[2001/10/25 13:20:08 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\LXASBCE.DLL
[2001/10/25 13:20:08 | 00,000,643 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI
[1999/07/23 12:46:48 | 00,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[1999/07/23 09:53:20 | 00,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll
[1999/04/20 02:15:00 | 00,022,016 | ---- | C] () -- C:\WINDOWS\unvise32.dll
[1999/01/22 13:46:58 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

========== Alternate Data Streams ==========

@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D43DBBD1
@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:94A6C632
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\ME\Desktop\angry bucket.3g2:SummaryInformation
@Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6F1F66C0
@Alternate Data Stream - 164 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70D0A7CC
@Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D37AE80B
@Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2C321309
@Alternate Data Stream - 157 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CAFA2B66
@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:015DC393
@Alternate Data Stream - 155 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38D53DB8
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9A953997
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6DD93FF7
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D251621C
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0127DBDE
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BC9021B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B4630A5
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D20FFA63
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:701AFF06
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D52AB7A
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:148EE14E
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0EDAD4
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CBCF563D
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5867D280
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:82ED8454
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0EC44AEB
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FC5A6A39
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DD874E14
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D7FCCD3
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A3E22AF0
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29BCDA07
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DA3C6C07
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6CEC50B4
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30C46519
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BB0256E7
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A696643D
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DD623B3
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:182D85B1
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:00C31200
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B132D3E
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:50631D57
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4F636E25
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8AB6C1D7
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:56486BDA
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA42DF8E
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6E9EB6C
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:949483BD
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:59D05D9A
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E903DEB
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B12FF3F2
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA24D1FF
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:615435BE
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B85C37B
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CB8D545
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0A03CEDC
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7FC64998
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D066AD2
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3064D21D
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01C1407E
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D18D7C38
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05816AFA
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85C0059D
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:831C6B2D
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0768CD
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:95B7F1EC
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85630A39
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5216CD26
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2B99FE60
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3CD562B4
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:20DB61D6
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:077CC761
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A057B5F9
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7B212553
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6677D85A
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4C49306C
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:18897B1D
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F69BB936
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D7DA89B1
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C70C5141
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9FE30AB2
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:957E9765
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7DFDF9DF
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35759C73
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1D6686D8
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:09161C63
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AEC895D8
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA8B212D
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DF0BC727
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C7D54A10
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:708BB0FA
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6C235A19
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3EA7510F
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:132EDADA
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E1982A23
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:90E3641D
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EB603FE4
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C90C4DBA
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5F1019FF
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D10517E
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:54997B77
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:435657D8
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5F8E280
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEE4A457
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2BAAE818
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:27EEEB5C
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E84CA8F2
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:663B62CA
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3B3A35EC
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5AFE07D
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68FB0053
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B835A22
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1EBBD65A
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A0C7D68A
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E71141D2
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:89123481
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:74699137
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5E1404CE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A42A9F39
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8643C5BE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C270C64
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1C9565AC
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:77846FFE
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2ABEB9EB
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:814B9485
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:13B137AF
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F6BFFC4A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ADE16379
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A561576B
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:953FDC1A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:657E1DF1
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E6B8D68
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AB0465FA
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A69F57F3
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9857FAE3
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:41099CE9
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BDF08FAF
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8247A199
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:877DEA57
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:780A453A
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:753B0F80
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:288A91F8
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:052A05A1
< End of report >

Run OTL.exe

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  SRV - [2009/11/11 09:07:49 | 00,061,952 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\SP\sp.dll -- (SPService)
  O1 - Hosts: 74.125.45.100 4-open-davinci.com
  O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
  O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
  O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
  O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
  O1 - Hosts: 74.125.45.100 secure-plus-payments.com
  O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
  O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
  O1 - Hosts: 74.125.45.100 www.getavplusnow.com
  O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
  O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
  O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
  O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
  [2009/11/16 09:42:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\3315e
  [2009/11/16 09:26:41 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\46f0070
  [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  [26 C:\Documents and Settings\ME\My Documents\*.tmp files -> C:\Documents and Settings\ME\My Documents\*.tmp -> ]
  [2009/11/17 05:59:48 | 00,022,016 | ---- | C] () -- C:\WINDOWS\System32\tdlwsp.dll
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

  
  
  
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot when it is done
  
• You will get a log that shows the results of the fix. Please post it.
  
• Then also run and post a new OTL log.

======================



Please update Malwarebytes and run a full scan.

• Open Malwarebytes and select the Update tab.
  
• Click on the Check for Updates button and allow the program to download the latest updates.
  
• Once you have the latest updates, select the Scanner tab.
  
• Select "Perform full scan" and click the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.
  
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

The first time I attempted the fix I got an error message. The second time, it produced this log:
--------------------------------------------------------------------------------------------------------------------
All processes killed
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 4-open-davinci.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 privatesecuredpayments.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 getantivirusplusnow.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 secure-plus-payments.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 www.getavplusnow.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com> in the current context!
Error: Unable to interpret <O1 - Hosts: 74.125.45.100 paysoftbillsolution.com> in the current context!
Error: Unable to interpret <[2009/11/16 09:42:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\3315e> in the current context!
Error: Unable to interpret <[2009/11/16 09:26:41 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\46f0070> in the current context!
Error: Unable to interpret <[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]> in the current context!
Error: Unable to interpret <[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]> in the current context!
Error: Unable to interpret <[26 C:\Documents and Settings\ME\My Documents\*.tmp files -> C:\Documents and Settings\ME\My Documents\*.tmp -> ]> in the current context!
Error: Unable to interpret <[2009/11/17 05:59:48 | 00,022,016 | ---- | C] () -- C:\WINDOWS\System32\tdlwsp.dll> in the current context!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: ME
->Temp folder emptied: 29549 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 29436326 bytes
->Apple Safari cache emptied: 0 bytes

User: ME.MARS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Owner

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 28.20 mb


OTL by OldTimer - Version 3.1.6.0 log created on 11182009_182602

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
----------------------------------------------------------------------------------------

I also ran a scan using Malwarebytes. Here is the log:
--------------------------------------------------------------------------------------------
Malwarebytes' Anti-Malware 1.41
Database version: 3195
Windows 5.1.2600 Service Pack 3

11/18/2009 8:02:40 PM
mbam-log-2009-11-18 (20-02-40).txt

Scan type: Full Scan (C:\|)
Objects scanned: 219700
Time elapsed: 1 hour(s), 12 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{05FE1E09-7CB8-4984-9D07-B2D95CE44CE7}\RP1976\A0305974.dll (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdlcmd.dll (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\oemlinkicon.ico (Malware.Trace) -> Quarantined and deleted successfully.

In the fix code, make sure you include the colon at the very beginning.

:OTL

Yep, I did. I still got this error message:

Unable to create folder: C:\WINDOWS\System 32\drivers\etc.hosts

Ok, run this fix through OTL.

:OTL
SRV - [2009/11/11 09:07:49 | 00,061,952 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\SP\sp.dll -- (SPService)
[2009/11/16 09:42:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\3315e
[2009/11/16 09:26:41 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\46f0070
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[26 C:\Documents and Settings\ME\My Documents\*.tmp files -> C:\Documents and Settings\ME\My Documents\*.tmp -> ]
[2009/11/17 05:59:48 | 00,022,016 | ---- | C] () -- C:\WINDOWS\System32\tdlwsp.dll

:Commands
[Reboot]

Please post the log that shows the results of the fix.

========== OTL ==========
No service named SPService was found to stop!
Unable to stop service SPService!
File C:\Documents and Settings\All Users\Application Data\SP\sp.dll not found.
File move failed. C:\Documents and Settings\All Users\Application Data\3315e\ scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\All Users\46f0070\ scheduled to be moved on reboot.
File/Folder C:\WINDOWS\System32\*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
File/Folder C:\Documents and Settings\ME\My Documents\*.tmp not found.
File C:\WINDOWS\System32\tdlwsp.dll not found.
========== COMMANDS ==========

OTL by OldTimer - Version 3.1.6.0 log created on 11202009_163932

Files\Folders moved on Reboot...
Folder move failed. C:\Documents and Settings\All Users\Application Data\3315e\ scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\All Users\46f0070\ scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Run OTL and copy this text into the Custom scans box.

netsvcs
%systemdrive%\*.exe
%SYSTEMDRIVE%\eventlog.dll /s /md5
%SYSTEMDRIVE%\nvstor.sys /s /md5
%SYSTEMDRIVE%\atapi.sys /s /md5
%SYSTEMDRIVE%\viasraid.sys /s /md5
%SYSTEMDRIVE%\AGP440.sys /s /md5
%SYSTEMDRIVE%\vaxscsi.sys /s /md5
%SYSTEMDRIVE%\nvatabus.sys /s /md5
%SYSTEMDRIVE%\viamraid.sys /s /md5
%SYSTEMDRIVE%\nvata.sys /s /md5
%SYSTEMDRIVE%\tdl*.dll
CREATERESTOREPOINT


Click the Quick Scan button.
Copy and paste the log that is created.

OTL logfile created on: 11/21/2009 1:45:39 PM - Run 5
OTL by OldTimer - Version 3.1.6.0 Folder = C:\Documents and Settings\ME\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

991.48 Mb Total Physical Memory | 333.06 Mb Available Physical Memory | 33.59% Memory free
1.58 Gb Paging File | 1.07 Gb Available in Paging File | 67.82% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.30 Gb Total Space | 74.29 Gb Free Space | 51.85% Space Free | Partition Type: NTFS
Drive D: | 5.74 Gb Total Space | 0.87 Gb Free Space | 15.14% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MARS
Current User Name: ME
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009/11/18 18:50:52 | 00,788,880 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2009/11/18 18:50:49 | 01,184,912 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009/11/17 11:22:52 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
PRC - [2009/11/14 17:00:25 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/11/14 17:00:25 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009/11/12 12:02:35 | 02,020,120 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2009/11/12 12:02:32 | 00,600,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2009/11/10 21:38:42 | 01,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2009/11/10 21:38:41 | 00,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2009/11/10 21:38:41 | 00,502,040 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2009/11/10 21:38:36 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2009/11/06 16:20:39 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/05/29 12:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/02/06 05:10:02 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/10/10 05:45:26 | 00,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2008/08/22 02:31:42 | 00,570,880 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2008/04/13 19:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/13 11:20:22 | 00,097,432 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
PRC - [2007/04/03 20:50:00 | 01,603,152 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2005/04/10 12:31:43 | 00,180,269 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2004/08/04 07:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
PRC - [2004/05/14 17:47:18 | 00,067,072 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2004/05/12 18:22:52 | 00,249,856 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\system32\Keyhook.exe
PRC - [2004/02/24 13:05:58 | 00,508,416 | ---- | M] (Chicony) -- C:\WINDOWS\mHotkey.exe
PRC - [2004/02/03 16:15:54 | 05,794,816 | ---- | M] (Chicony) -- C:\WINDOWS\CNYHKey.exe
PRC - [2003/06/20 02:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
PRC - [2003/06/07 05:32:32 | 00,050,688 | ---- | M] (Microsoft® Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe


========== Modules (SafeList) ==========

MOD - [2009/11/17 11:22:52 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
MOD - [2008/04/13 19:12:51 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
MOD - [2008/04/13 19:12:00 | 00,025,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mslbui.dll
MOD - [2008/04/13 19:11:53 | 00,185,344 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\framedyn.dll
MOD - [2003/05/27 16:13:02 | 00,024,576 | ---- | M] () -- C:\WINDOWS\HKCYDLL.dll


========== Win32 Services (SafeList) ==========

SRV - File not found -- -- (rpcapd)
SRV - File not found -- -- (McProxy)
SRV - [2009/11/18 18:50:49 | 01,184,912 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009/11/14 17:00:25 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/11/10 21:38:36 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2009/09/23 15:37:30 | 00,051,168 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper)
SRV - [2009/09/21 15:36:02 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/05/29 12:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/04/02 04:38:41 | 00,183,280 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2009/01/09 10:31:16 | 02,482,848 | ---- | M] (McAfee, Inc.) -- c:\program files\common files\mcafee\mna\mcnasvc.exe -- (McNASvc)
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/10/10 05:45:26 | 00,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2008/08/22 02:31:42 | 00,570,880 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2008/07/29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)
SRV - [2008/07/29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)
SRV - [2008/07/29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008/07/25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/07/25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state)
SRV - [2008/04/13 19:12:36 | 00,063,488 | RHS- | M] () -- C:\WINDOWS\System32\acleditr.exe -- (RpcLocatorWZCSVC)
SRV - [2008/04/13 19:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll -- (helpsvc)
SRV - [2007/04/13 11:20:22 | 00,097,432 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc)
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003/07/28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/20 02:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
SRV - [2001/11/12 12:31:48 | 00,020,480 | ---- | M] (X10) -- C:\Program Files\Common Files\X10\Common\X10nets.exe -- (x10nets)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/index.html
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://twitter.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.701
FF - prefs.js..extensions.enabledItems: avg@igeared:2.710.016.005
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {27c60876-b5c9-4335-b4f3-52b26782220c}:0.9.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000006
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.15
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.5
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p="


FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2009/08/27 22:23:05 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/07/01 00:32:35 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2009/11/10 21:38:56 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2009/11/10 21:38:36 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/11/14 17:00:27 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/11/06 16:20:47 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/11/08 19:53:35 | 00,000,000 | ---D | M]

[2008/06/18 14:06:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Extensions
[2008/06/18 14:06:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/11/20 19:47:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions
[2009/07/01 02:30:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/06/05 15:27:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}
[2009/01/14 05:30:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/11/18 15:30:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/11/20 19:47:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2009/08/13 11:53:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2008/04/14 22:08:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(2)
[2009/10/29 00:40:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/03/19 16:05:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\moveplayer@movenetworks.com
[2007/07/03 10:37:47 | 00,002,386 | ---- | M] () -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\searchplugins\siteadvisor.xml
[2009/09/17 22:26:42 | 00,004,153 | ---- | M] () -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\searchplugins\youtube.xml
[2009/11/20 19:47:52 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/11/06 16:20:38 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/12/02 09:14:35 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2009/11/14 17:00:46 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2009/11/06 16:20:38 | 00,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll
[2009/11/06 16:20:38 | 00,137,176 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll
[2004/05/07 13:31:40 | 00,348,160 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\components\MSVCR71.DLL
[2007/04/10 16:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
[2009/11/14 17:00:25 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
[2008/11/17 18:44:17 | 00,279,888 | ---- | M] (Musicnotes, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npmusicn.dll
[2009/11/06 16:20:41 | 00,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
[2006/12/18 03:18:30 | 00,077,824 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
[2005/04/27 15:10:49 | 00,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\Mozilla Firefox\plugins\npracplug.dll
[2005/08/09 13:42:53 | 00,057,344 | ---- | M] (America Online, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npunagi2.dll
[2007/03/09 18:16:44 | 00,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
[2009/09/23 15:37:30 | 00,032,448 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
[2009/10/29 00:38:45 | 00,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml
[2009/10/29 00:38:45 | 00,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml
[2009/11/10 21:43:32 | 00,002,274 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\avg_igeared.xml
[2009/10/29 00:38:45 | 00,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml
[2009/10/29 00:38:45 | 00,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
[2009/10/29 00:38:45 | 00,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2009/10/29 00:38:45 | 00,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml
[2009/10/29 00:38:45 | 00,000,792 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: (526 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (Winamp Toolbar BHO) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\mHotkey.exe (Chicony)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [ledpointer] C:\WINDOWS\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
O4 - HKLM..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\Keyhook.exe (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe (Silicon Integrated Systems Corp.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\RunOnce: [AOLRebootNeeded] C:\WINDOWS\System32\regsvr32.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Wedding%20Dash%202/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Wedding%20Dash%202/Images/armhelper.ocx (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 24.92.226.40 24.92.226.41
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\WRNotifier: DllName - WRLogonNTF.dll - C:\WINDOWS\System32\WRLogonNtf.dll (Webroot Software, Inc.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\brastk.exe: Debugger - svchost.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - Reg Error: Key error. File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/24 08:10:44 | 00,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (SsiEfr.e) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

NetSvcs: Ias - C:\WINDOWS\system32\ias [2004/08/22 15:56:03 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: helpsvc - C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (58268880706994176)

========== Files/Folders - Created Within 14 Days ==========

[2009/11/21 13:13:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ME\Application Data\Leadertech
[2009/11/18 15:26:12 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/11/17 11:22:51 | 00,529,408 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
[2009/11/16 10:41:01 | 00,000,000 | --SD | C] -- C:\ComboFix
[2009/11/16 09:56:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/11/16 09:55:49 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/11/16 09:42:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\3315e
[2009/11/16 09:26:41 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\46f0070
[2009/11/14 20:03:35 | 01,839,984 | ---- | C] (Trend Micro) -- C:\Documents and Settings\ME\Desktop\HousecallLauncher.exe
[2009/11/14 11:51:06 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\ME\Recent
[2009/11/10 21:39:31 | 00,000,000 | -H-D | C] -- C:\$AVG
[2009/11/10 21:39:19 | 00,360,584 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/11/10 21:39:19 | 00,012,464 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/11/10 21:39:12 | 00,333,192 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/11/10 21:39:10 | 00,028,424 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/11/10 21:38:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\Avg
[2009/11/10 21:38:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2009/11/10 21:38:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg9
[2009/11/08 16:20:08 | 00,078,336 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\Agent.OMZ.Fix.exe
[2009/11/08 16:20:07 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.C.exe
[2009/11/08 16:20:07 | 00,080,384 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\o4Patch.exe
[2009/11/08 16:20:06 | 00,082,432 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\404Fix.exe
[2009/11/08 16:20:05 | 00,087,552 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\VACFix.exe
[2009/11/08 16:20:04 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.exe
[2009/11/08 16:20:03 | 00,289,144 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\VCCLSID.exe
[2009/11/08 16:20:02 | 00,288,417 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\SrchSTS.exe
[2009/11/08 16:20:02 | 00,079,360 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swxcacls.exe
[2009/11/08 16:20:00 | 00,135,168 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swreg.exe
[2009/11/08 16:19:59 | 00,053,248 | ---- | C] (http://www.beyondlogic.org) -- C:\WINDOWS\System32\Process.exe
[2006/04/29 12:10:38 | 00,774,144 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RngInterstitial.dll
[2001/06/19 15:34:36 | 00,040,960 | ---- | C] (Jetsoft Development Company) -- C:\Program Files\ACMonitor_X83.exe

========== Files - Modified Within 14 Days ==========

[2009/11/21 13:07:10 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/11/21 13:05:46 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/11/21 13:05:18 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2009/11/21 13:04:58 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/11/21 13:04:51 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/11/21 13:04:49 | 10,397,16352 | -HS- | M] () -- C:\hiberfil.sys
[2009/11/21 13:03:52 | 11,534,336 | ---- | M] () -- C:\Documents and Settings\ME\ntuser.dat
[2009/11/21 13:03:52 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\ME\ntuser.ini
[2009/11/21 11:54:58 | 00,038,798 | ---- | M] () -- C:\Documents and Settings\ME\Application Data\wklnhst.dat
[2009/11/21 11:18:14 | 00,000,145 | --S- | M] () -- C:\WINDOWS\System32\4223501170.dat
[2009/11/21 08:45:23 | 45,542,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/11/21 08:45:01 | 00,098,480 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/11/19 23:13:45 | 00,045,056 | ---- | M] () -- C:\Documents and Settings\ME\My Documents\novel.doc
[2009/11/18 20:17:00 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/11/17 11:22:52 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
[2009/11/16 23:44:23 | 00,076,755 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\untitled.JPG
[2009/11/16 22:00:04 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/11/16 09:42:24 | 00,001,670 | ---- | M] () -- C:\System Defender.lnk
[2009/11/16 09:26:59 | 00,000,526 | RHS- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221904.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215056.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215054.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215053.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215052.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215051.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215050.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215049.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215048.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215047.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215046.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215044.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215043.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225520.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225519.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225518.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225507.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225506.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225505.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225504.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225453.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225452.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225451.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225450.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225441.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225439.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225437.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225436.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225432.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225428.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221927.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221922.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221921.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221920.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221919.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221918.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221914.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221911.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221910.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/11/15 01:00:00 | 00,000,368 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job
[2009/11/14 20:03:43 | 01,839,984 | ---- | M] (Trend Micro) -- C:\Documents and Settings\ME\Desktop\HousecallLauncher.exe
[2009/11/11 03:24:15 | 00,284,520 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/11/11 01:04:31 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\ME\My Documents\~$novel.doc
[2009/11/10 21:39:20 | 00,001,517 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/11/10 21:39:19 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/11/10 21:39:19 | 00,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/11/10 21:39:12 | 00,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/11/10 21:39:10 | 00,113,461 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2009/11/10 21:39:10 | 00,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/11/10 21:38:59 | 06,061,540 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/11/10 21:38:59 | 00,492,629 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/11/08 20:00:08 | 00,024,064 | ---- | M] () -- C:\Documents and Settings\ME\My Documents\movies seen 2009.doc
[2009/11/08 16:20:56 | 00,004,604 | ---- | M] () -- C:\WINDOWS\System32\tmp.reg

========== Files Created - No Company Name ==========

[2009/11/21 13:40:38 | 00,015,872 | ---- | C] () -- C:\WINDOWS\System32\tdlcmd.dll
[2009/11/21 13:04:49 | 10,397,16352 | -HS- | C] () -- C:\hiberfil.sys
[2009/11/21 11:16:19 | 00,000,145 | --S- | C] () -- C:\WINDOWS\System32\4223501170.dat
[2009/11/16 23:43:20 | 00,076,755 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\untitled.JPG
[2009/11/16 09:42:23 | 00,001,670 | ---- | C] () -- C:\System Defender.lnk
[2009/11/11 01:04:31 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\ME\My Documents\~$novel.doc
[2009/11/10 21:39:20 | 00,001,517 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/11/10 21:39:10 | 00,113,461 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2009/11/10 21:38:59 | 45,542,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/11/10 21:38:59 | 06,061,540 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/11/10 21:38:59 | 00,492,629 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/11/10 21:38:59 | 00,098,480 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/11/09 10:42:12 | 11,534,336 | ---- | C] () -- C:\Documents and Settings\ME\ntuser.dat
[2009/11/08 16:20:56 | 00,004,604 | ---- | C] () -- C:\WINDOWS\System32\tmp.reg
[2009/11/08 16:20:04 | 00,075,776 | ---- | C] () -- C:\WINDOWS\System32\WS2Fix.exe
[2009/11/08 16:20:02 | 00,051,200 | ---- | C] () -- C:\WINDOWS\System32\dumphive.exe
[2009/10/22 01:06:15 | 00,000,036 | ---- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\housecall.guid.cache
[2009/01/12 18:40:36 | 00,003,457 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\profiles.xml
[2008/08/22 02:31:42 | 00,141,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2008/05/23 23:58:47 | 02,646,422 | -H-- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\IconCache.db
[2008/04/18 13:01:34 | 00,000,322 | ---- | C] () -- C:\WINDOWS\Xtarot.INI
[2008/04/08 21:49:11 | 00,000,000 | ---- | C] () -- C:\Program Files\temp01
[2008/03/10 22:55:38 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2007/08/28 23:36:37 | 00,000,030 | ---- | C] () -- C:\WINDOWS\ACMonitor_X83.ini
[2007/08/28 23:30:28 | 00,004,672 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.DLL
[2007/08/10 18:22:16 | 00,001,210 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\error.log
[2007/08/10 18:22:16 | 00,000,015 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\config.tcf
[2007/06/10 22:14:43 | 00,000,022 | ---- | C] () -- C:\WINDOWS\iexplore.ini
[2007/03/23 05:51:26 | 00,000,227 | ---- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2007/03/23 05:48:32 | 00,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2007/02/02 12:40:05 | 00,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2007/01/28 14:30:39 | 00,468,480 | ---- | C] () -- C:\WINDOWS\System32\NMDll.dll
[2007/01/28 14:30:38 | 00,208,896 | ---- | C] () -- C:\WINDOWS\System32\HDBHO.dll
[2007/01/28 14:30:37 | 00,020,480 | ---- | C] () -- C:\WINDOWS\yhl.dll
[2007/01/28 14:30:37 | 00,007,168 | ---- | C] () -- C:\WINDOWS\lq.dll
[2007/01/24 01:19:06 | 00,000,063 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2006/08/25 23:26:55 | 00,591,890 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2006/08/25 23:26:54 | 00,856,064 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/08/25 23:26:54 | 00,217,088 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/08/25 23:26:51 | 00,005,120 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2006/08/25 23:26:51 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2006/08/22 14:58:28 | 00,079,681 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
[2006/08/22 14:57:22 | 00,005,661 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
[2006/08/22 14:56:20 | 00,118,428 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\Update_HP_RedboxHprblog_HPSU.log
[2006/06/29 14:58:52 | 00,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/06/29 14:53:56 | 00,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 00,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/04/18 15:39:28 | 00,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/03/26 23:28:27 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\cygz.dll
[2005/11/24 15:43:46 | 00,001,783 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/11/16 15:33:23 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
[2005/11/16 15:33:23 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
[2005/10/25 18:38:42 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/10/20 19:01:03 | 00,005,697 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2005/10/20 19:00:37 | 00,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2005/08/12 16:57:09 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/06/03 22:10:53 | 00,000,823 | ---- | C] () -- C:\WINDOWS\tsc.ini
[2005/06/03 22:10:52 | 00,071,749 | ---- | C] () -- C:\WINDOWS\hcextoutput.dll
[2005/06/03 22:10:24 | 00,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2005/05/17 22:40:31 | 00,000,082 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\Ad Annihilator.aap
[2005/05/10 15:07:26 | 00,076,960 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\GDIPFONTCACHEV1.DAT
[2005/03/16 23:35:04 | 00,000,022 | ---- | C] () -- C:\WINDOWS\Kyor.ini
[2005/01/24 11:24:17 | 00,038,798 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\wklnhst.dat
[2005/01/23 21:11:16 | 03,423,744 | ---- | C] () -- C:\WINDOWS\System32\libfilefmt-1.1.0.dll
[2005/01/23 21:11:16 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\libavi-dd-1.2.0.dll
[2005/01/23 21:11:15 | 00,706,048 | ---- | C] () -- C:\WINDOWS\System32\libmcl-3.1.1.dll
[2005/01/23 19:24:15 | 00,012,462 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2005/01/23 18:34:31 | 00,182,272 | ---- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/01/23 14:45:14 | 00,000,141 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/01/23 14:38:19 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\ME\Application Data\desktop.ini
[2005/01/23 14:38:18 | 00,085,904 | ---- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2004/09/08 18:58:04 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/09/08 13:28:53 | 00,000,004 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2004/08/26 23:39:21 | 00,000,015 | ---- | C] () -- C:\WINDOWS\NASBA.ini
[2004/08/24 07:01:17 | 00,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/24 05:01:06 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/08/23 10:32:20 | 00,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2004/08/23 10:32:20 | 00,049,152 | ---- | C] () -- C:\WINDOWS\CNYUSB.dll
[2004/08/23 10:32:20 | 00,024,576 | ---- | C] () -- C:\WINDOWS\HKCYDLL.dll
[2004/08/23 10:32:20 | 00,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll
[2004/08/23 10:32:20 | 00,000,360 | ---- | C] () -- C:\WINDOWS\CNYHKey.ini
[2004/08/23 08:55:48 | 00,008,632 | ---- | C] () -- C:\WINDOWS\PRISMDOM.ini
[2004/08/23 08:33:37 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/22 17:10:03 | 00,000,266 | ---- | C] () -- C:\WINDOWS\Dit.INI
[2004/08/22 17:04:24 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/08/22 17:00:40 | 00,108,021 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004/08/22 16:59:11 | 00,099,597 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2004/08/22 16:57:31 | 00,032,768 | ---- | C] () -- C:\WINDOWS\SIS_LIB.DLL
[2004/08/22 15:44:00 | 00,000,814 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/08/22 15:43:43 | 00,001,281 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/22 15:43:39 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2004/08/22 08:49:47 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2002/03/21 14:39:02 | 00,073,728 | R--- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2002/03/20 21:01:06 | 00,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll
[2001/10/25 13:20:08 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\LXASBCE.DLL
[2001/10/25 13:20:08 | 00,000,643 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI
[1999/07/23 12:46:48 | 00,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[1999/07/23 09:53:20 | 00,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll
[1999/04/20 02:15:00 | 00,022,016 | ---- | C] () -- C:\WINDOWS\unvise32.dll
[1999/01/22 13:46:58 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2009/11/16 11:52:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\3315e
[2006/08/17 20:12:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2008/12/02 21:59:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Auslogics
[2009/11/14 20:02:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2009/11/21 08:37:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2007/12/28 22:42:08 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/07/01 12:12:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJPLM
[2006/03/07 23:14:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2008/11/19 18:13:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Musicnotes
[2004/08/24 08:10:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2007/06/24 22:33:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2007/06/18 12:12:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NannyMania
[2006/09/15 20:09:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/08/05 23:39:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NeoEdge Networks
[2009/03/07 16:50:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst
[2008/04/16 11:28:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2009/03/22 22:39:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2009/01/17 14:47:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2008/08/22 02:26:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\services
[2009/01/07 18:22:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Shockwave
[2009/11/18 15:26:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SP
[2009/10/25 19:14:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
[2009/10/14 22:55:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/17 14:25:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2008/06/26 22:08:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Valusoft
[2005/09/30 19:39:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/06/27 15:07:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2007/02/18 20:34:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Yahoo
[2009/03/14 13:46:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/08/28 00:54:27 | 00,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
[2009/09/28 21:09:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/28 11:24:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/10/21 17:48:39 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2009/01/12 19:23:23 | 00,000,000 | -HSD | M] -- C:\Documents and Settings\ME\Application Data\.#
[2005/05/10 15:31:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\ACD Systems
[2005/09/30 19:39:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Aim
[2008/06/27 15:14:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Canon
[2007/06/19 09:51:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\ieSpell
[2007/03/23 06:14:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Image Zone Express
[2009/11/21 13:13:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Leadertech
[2008/08/21 15:10:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\My Games
[2009/07/01 00:59:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\OfficeUpdate12
[2008/07/21 13:14:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Sibelius Software
[2009/11/19 19:25:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Spyware Terminator
[2009/08/17 14:26:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\TuneUp Software
[2009/11/21 13:07:10 | 00,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2004/08/04 07:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/11/15 01:00:00 | 00,000,368 | ---- | M] () -- C:\WINDOWS\Tasks\McDefragTask.job
[2009/11/01 00:00:00 | 00,000,370 | ---- | M] () -- C:\WINDOWS\Tasks\McQcTask.job
[2009/11/21 13:04:58 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========



========== Custom Scans ==========


< %systemdrive%\*.exe >

< %SYSTEMDRIVE%\eventlog.dll /s /md5 >
[2004/08/04 07:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2008/04/13 19:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

< %SYSTEMDRIVE%\nvstor.sys /s /md5 >

< %SYSTEMDRIVE%\atapi.sys /s /md5 >
[2004/08/04 07:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008/04/13 13:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5 -- C:\WINDOWS\system32\drivers\atapi.sys

< %SYSTEMDRIVE%\viasraid.sys /s /md5 >

< %SYSTEMDRIVE%\AGP440.sys /s /md5 >
[2004/08/03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2008/04/13 13:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< %SYSTEMDRIVE%\vaxscsi.sys /s /md5 >

< %SYSTEMDRIVE%\nvatabus.sys /s /md5 >

< %SYSTEMDRIVE%\viamraid.sys /s /md5 >

< %SYSTEMDRIVE%\nvata.sys /s /md5 >

< %SYSTEMDRIVE%\tdl*.dll >

========== Alternate Data Streams ==========

@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D43DBBD1
@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:94A6C632
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\ME\Desktop\angry bucket.3g2: SummaryInformation
@Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6F1F66C0
@Alternate Data Stream - 164 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70D0A7CC
@Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D37AE80B
@Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2C321309
@Alternate Data Stream - 157 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CAFA2B66
@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:015DC393
@Alternate Data Stream - 155 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38D53DB8
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9A953997
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6DD93FF7
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D251621C
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0127DBDE
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BC9021B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B4630A5
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D20FFA63
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:701AFF06
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D52AB7A
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:148EE14E
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0EDAD4
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CBCF563D
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5867D280
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:82ED8454
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0EC44AEB
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FC5A6A39
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DD874E14
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D7FCCD3
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A3E22AF0
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29BCDA07
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DA3C6C07
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6CEC50B4
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30C46519
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BB0256E7
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A696643D
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DD623B3
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:182D85B1
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:00C31200
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B132D3E
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:50631D57
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4F636E25
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8AB6C1D7
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:56486BDA
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA42DF8E
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6E9EB6C
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:949483BD
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:59D05D9A
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E903DEB
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B12FF3F2
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA24D1FF
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:615435BE
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B85C37B
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CB8D545
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0A03CEDC
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7FC64998
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D066AD2
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3064D21D
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01C1407E
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D18D7C38
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05816AFA
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85C0059D
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:831C6B2D
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0768CD
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:95B7F1EC
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85630A39
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5216CD26
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2B99FE60
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3CD562B4
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:20DB61D6
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:077CC761
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A057B5F9
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7B212553
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6677D85A
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4C49306C
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:18897B1D
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F69BB936
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D7DA89B1
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C70C5141
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9FE30AB2
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:957E9765
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7DFDF9DF
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35759C73
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1D6686D8
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:09161C63
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AEC895D8
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA8B212D
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DF0BC727
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C7D54A10
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:708BB0FA
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6C235A19
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3EA7510F
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:132EDADA
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E1982A23
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:90E3641D
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EB603FE4
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C90C4DBA
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5F1019FF
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D10517E
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:54997B77
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:435657D8
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5F8E280
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEE4A457
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2BAAE818
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:27EEEB5C
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E84CA8F2
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:663B62CA
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3B3A35EC
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5AFE07D
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68FB0053
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B835A22
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1EBBD65A
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A0C7D68A
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E71141D2
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:89123481
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:74699137
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5E1404CE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A42A9F39
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8643C5BE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C270C64
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1C9565AC
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:77846FFE
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2ABEB9EB
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:814B9485
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:13B137AF
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F6BFFC4A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ADE16379
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A561576B
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:953FDC1A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:657E1DF1
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E6B8D68
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AB0465FA
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A69F57F3
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9857FAE3
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:41099CE9
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BDF08FAF
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8247A199
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:877DEA57
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:780A453A
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:753B0F80
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:288A91F8
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:052A05A1
< End of report >

Please disable your antivirus program.

• Download The Avenger by Swandog46 from here.
  
• Unzip/extract it to a folder on your desktop.
  
• Double click on avenger.exe to run The Avenger.
  
• Click OK.
  
• Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  
• Copy all of the text in the below code box to the clipboard by highlighting it and then pressing Ctrl+C.
  
  

  Files to move:
  C:\WINDOWS\ServicePackFiles\i386\atapi.sys | C:\WINDOWS\system32\drivers\atapi.sys
  
  Files to delete:
  C:\WINDOWS\System32\tdlcmd.dll
  
  Folders to delete:
  C:\Documents and Settings\All Users\Application Data\3315e
  C:\Documents and Settings\All Users\46f0070

  
  
  
• In the avenger window, click the Paste Script from Clipboard, button.
  
• Click the Execute button.
  
• You will be asked Are you sure you want to execute the current script?.
  
• Click Yes.
  
• You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  
• Click Yes.
  
• Your PC will now be rebooted.
  
• Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
  
• After your PC has completed the necessary reboots, a log should automatically open. If it does not automatically open, then the log can be found at %systemdrive%\avenger.txt (typically C:\avenger.txt).

=========================


Run OTL and copy this text into the Custom scans box.


:OTL
@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D43DBBD1
@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:94A6C632
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\ME\Desktop\angry bucket.3g2: SummaryInformation
@Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6F1F66C0
@Alternate Data Stream - 164 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70D0A7CC
@Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D37AE80B
@Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2C321309
@Alternate Data Stream - 157 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CAFA2B66
@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:015DC393
@Alternate Data Stream - 155 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38D53DB8
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9A953997
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6DD93FF7
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D251621C
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0127DBDE
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BC9021B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B4630A5
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D20FFA63
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:701AFF06
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D52AB7A
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:148EE14E
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0EDAD4
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CBCF563D
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5867D280
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:82ED8454
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0EC44AEB
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FC5A6A39
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DD874E14
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D7FCCD3
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A3E22AF0
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29BCDA07
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DA3C6C07
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6CEC50B4
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30C46519
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BB0256E7
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A696643D
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DD623B3
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:182D85B1
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:00C31200
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B132D3E
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:50631D57
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4F636E25
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8AB6C1D7
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:56486BDA
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA42DF8E
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6E9EB6C
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:949483BD
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:59D05D9A
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E903DEB
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B12FF3F2
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA24D1FF
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:615435BE
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B85C37B
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CB8D545
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0A03CEDC
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7FC64998
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D066AD2
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3064D21D
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01C1407E
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D18D7C38
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05816AFA
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85C0059D
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:831C6B2D
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0768CD
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:95B7F1EC
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85630A39
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5216CD26
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2B99FE60
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3CD562B4
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:20DB61D6
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:077CC761
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A057B5F9
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7B212553
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6677D85A
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4C49306C
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:18897B1D
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F69BB936
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D7DA89B1
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C70C5141
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9FE30AB2
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:957E9765
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7DFDF9DF
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35759C73
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1D6686D8
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:09161C63
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AEC895D8
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA8B212D
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DF0BC727
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C7D54A10
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:708BB0FA
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6C235A19
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3EA7510F
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:132EDADA
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E1982A23
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:90E3641D
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EB603FE4
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C90C4DBA
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5F1019FF
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D10517E
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:54997B77
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:435657D8
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5F8E280
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEE4A457
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2BAAE818
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:27EEEB5C
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E84CA8F2
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:663B62CA
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3B3A35EC
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5AFE07D
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68FB0053
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B835A22
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1EBBD65A
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A0C7D68A
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E71141D2
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:89123481
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:74699137
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5E1404CE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A42A9F39
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8643C5BE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C270C64
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1C9565AC
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:77846FFE
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2ABEB9EB
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:814B9485
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:13B137AF
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F6BFFC4A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ADE16379
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A561576B
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:953FDC1A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:657E1DF1
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E6B8D68
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AB0465FA
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A69F57F3
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9857FAE3
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:41099CE9
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BDF08FAF
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8247A199
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:877DEA57
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:780A453A
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:753B0F80
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:288A91F8
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:052A05A1

%SYSTEMDRIVE%\atapi.sys /s /md5
CREATERESTOREPOINT


Click the Quick Scan button.
Copy and paste the log that is created.

OTL logfile created on: 11/21/2009 7:27:56 PM - Run 6
OTL by OldTimer - Version 3.1.6.0 Folder = C:\Documents and Settings\ME\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

991.48 Mb Total Physical Memory | 444.88 Mb Available Physical Memory | 44.87% Memory free
1.58 Gb Paging File | 1.18 Gb Available in Paging File | 74.47% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.30 Gb Total Space | 74.28 Gb Free Space | 51.84% Space Free | Partition Type: NTFS
Drive D: | 5.74 Gb Total Space | 0.87 Gb Free Space | 15.14% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MARS
Current User Name: ME
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009/11/21 18:50:37 | 00,788,880 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2009/11/21 18:50:35 | 01,184,912 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009/11/17 11:22:52 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
PRC - [2009/11/14 17:00:25 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/11/14 17:00:25 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009/11/12 12:02:35 | 02,020,120 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2009/11/12 12:02:32 | 00,600,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2009/11/10 21:38:42 | 01,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2009/11/10 21:38:41 | 00,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2009/11/10 21:38:41 | 00,502,040 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2009/11/10 21:38:36 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2009/05/29 12:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/02/06 05:10:02 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/10/10 05:45:26 | 00,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2008/08/22 02:31:42 | 00,570,880 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2008/04/13 19:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/13 11:20:22 | 00,097,432 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
PRC - [2007/04/03 20:50:00 | 01,603,152 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2005/04/10 12:31:43 | 00,180,269 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2004/08/04 07:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
PRC - [2004/05/14 17:47:18 | 00,067,072 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2004/05/12 18:22:52 | 00,249,856 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\system32\Keyhook.exe
PRC - [2004/02/24 13:05:58 | 00,508,416 | ---- | M] (Chicony) -- C:\WINDOWS\mHotkey.exe
PRC - [2004/02/03 16:15:54 | 05,794,816 | ---- | M] (Chicony) -- C:\WINDOWS\CNYHKey.exe
PRC - [2003/06/20 02:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
PRC - [2003/06/07 05:32:32 | 00,050,688 | ---- | M] (Microsoft® Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe


========== Modules (SafeList) ==========

MOD - [2009/11/17 11:22:52 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
MOD - [2008/04/13 19:12:51 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
MOD - [2008/04/13 19:12:00 | 00,025,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mslbui.dll
MOD - [2008/04/13 19:11:53 | 00,185,344 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\framedyn.dll
MOD - [2003/05/27 16:13:02 | 00,024,576 | ---- | M] () -- C:\WINDOWS\HKCYDLL.dll


========== Win32 Services (SafeList) ==========

SRV - File not found -- -- (rpcapd)
SRV - File not found -- -- (McProxy)
SRV - [2009/11/21 18:50:35 | 01,184,912 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009/11/14 17:00:25 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/11/10 21:38:36 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2009/09/23 15:37:30 | 00,051,168 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper)
SRV - [2009/09/21 15:36:02 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/05/29 12:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/04/02 04:38:41 | 00,183,280 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2009/01/09 10:31:16 | 02,482,848 | ---- | M] (McAfee, Inc.) -- c:\program files\common files\mcafee\mna\mcnasvc.exe -- (McNASvc)
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/10/10 05:45:26 | 00,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2008/08/22 02:31:42 | 00,570,880 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2008/07/29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)
SRV - [2008/07/29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)
SRV - [2008/07/29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008/07/25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/07/25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state)
SRV - [2008/04/13 19:12:36 | 00,063,488 | RHS- | M] () -- C:\WINDOWS\System32\acleditr.exe -- (RpcLocatorWZCSVC)
SRV - [2008/04/13 19:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll -- (helpsvc)
SRV - [2007/04/13 11:20:22 | 00,097,432 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc)
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003/07/28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/20 02:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
SRV - [2001/11/12 12:31:48 | 00,020,480 | ---- | M] (X10) -- C:\Program Files\Common Files\X10\Common\X10nets.exe -- (x10nets)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.medionusa.com
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.medionusa.com
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.medionusa.com

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.medionusa.com

IE - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/index.html
IE - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\S-1-5-21-2381351430-2032157628-210145101-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\S-1-5-21-2381351430-2032157628-210145101-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://twitter.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.701
FF - prefs.js..extensions.enabledItems: avg@igeared:2.710.016.005
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {27c60876-b5c9-4335-b4f3-52b26782220c}:0.9.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000006
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.15
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.5
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p="


FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2009/08/27 22:23:05 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/07/01 00:32:35 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2009/11/10 21:38:56 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2009/11/10 21:38:36 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/11/14 17:00:27 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/11/06 16:20:47 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/11/08 19:53:35 | 00,000,000 | ---D | M]

[2008/06/18 14:06:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Extensions
[2008/06/18 14:06:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/11/21 18:53:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions
[2009/07/01 02:30:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/06/05 15:27:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}
[2009/01/14 05:30:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/11/18 15:30:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/11/20 19:47:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2009/08/13 11:53:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2008/04/14 22:08:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(2)
[2009/10/29 00:40:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/03/19 16:05:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\extensions\moveplayer@movenetworks.com
[2007/07/03 10:37:47 | 00,002,386 | ---- | M] () -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\searchplugins\siteadvisor.xml
[2009/09/17 22:26:42 | 00,004,153 | ---- | M] () -- C:\Documents and Settings\ME\Application Data\Mozilla\Firefox\Profiles\so1xoxmy.default\searchplugins\youtube.xml
[2009/11/21 18:53:32 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/11/06 16:20:38 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/12/02 09:14:35 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2009/11/14 17:00:46 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2009/11/06 16:20:38 | 00,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll
[2009/11/06 16:20:38 | 00,137,176 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll
[2004/05/07 13:31:40 | 00,348,160 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\components\MSVCR71.DLL
[2007/04/10 16:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
[2009/11/14 17:00:25 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
[2008/11/17 18:44:17 | 00,279,888 | ---- | M] (Musicnotes, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npmusicn.dll
[2009/11/06 16:20:41 | 00,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
[2006/12/18 03:18:30 | 00,077,824 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
[2009/09/28 21:06:25 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
[2005/04/27 15:10:49 | 00,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\Mozilla Firefox\plugins\npracplug.dll
[2005/08/09 13:42:53 | 00,057,344 | ---- | M] (America Online, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npunagi2.dll
[2007/03/09 18:16:44 | 00,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
[2009/09/23 15:37:30 | 00,032,448 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
[2009/10/29 00:38:45 | 00,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml
[2009/10/29 00:38:45 | 00,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml
[2009/11/10 21:43:32 | 00,002,274 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\avg_igeared.xml
[2009/10/29 00:38:45 | 00,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml
[2009/10/29 00:38:45 | 00,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
[2009/10/29 00:38:45 | 00,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2009/10/29 00:38:45 | 00,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml
[2009/10/29 00:38:45 | 00,000,792 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: (526 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (Winamp Toolbar BHO) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\mHotkey.exe (Chicony)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [ledpointer] C:\WINDOWS\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
O4 - HKLM..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\Keyhook.exe (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe (Silicon Integrated Systems Corp.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-2381351430-2032157628-210145101-1007\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Wedding%20Dash%202/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Wedding%20Dash%202/Images/armhelper.ocx (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 24.92.226.40 24.92.226.41
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\WRNotifier: DllName - WRLogonNTF.dll - C:\WINDOWS\System32\WRLogonNtf.dll (Webroot Software, Inc.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\brastk.exe: Debugger - svchost.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - Reg Error: Key error. File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/24 08:10:44 | 00,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (SsiEfr.e) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (71498204612395008)

========== Files/Folders - Created Within 14 Days ==========

[2009/11/21 19:18:32 | 00,000,000 | ---D | C] -- C:\Avenger
[2009/11/21 13:13:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ME\Application Data\Leadertech
[2009/11/18 15:26:12 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/11/17 11:22:51 | 00,529,408 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
[2009/11/16 10:41:01 | 00,000,000 | --SD | C] -- C:\ComboFix
[2009/11/16 09:56:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/11/16 09:55:49 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/11/14 20:03:35 | 01,839,984 | ---- | C] (Trend Micro) -- C:\Documents and Settings\ME\Desktop\HousecallLauncher.exe
[2009/11/14 11:51:06 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\ME\Recent
[2009/11/10 21:39:31 | 00,000,000 | -H-D | C] -- C:\$AVG
[2009/11/10 21:39:19 | 00,360,584 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/11/10 21:39:19 | 00,012,464 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/11/10 21:39:12 | 00,333,192 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/11/10 21:39:10 | 00,028,424 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/11/10 21:38:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\Avg
[2009/11/10 21:38:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2009/11/10 21:38:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg9
[2009/11/08 16:20:08 | 00,078,336 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\Agent.OMZ.Fix.exe
[2009/11/08 16:20:07 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.C.exe
[2009/11/08 16:20:07 | 00,080,384 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\o4Patch.exe
[2009/11/08 16:20:06 | 00,082,432 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\404Fix.exe
[2009/11/08 16:20:05 | 00,087,552 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\VACFix.exe
[2009/11/08 16:20:04 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.exe
[2009/11/08 16:20:03 | 00,289,144 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\VCCLSID.exe
[2009/11/08 16:20:02 | 00,288,417 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\SrchSTS.exe
[2009/11/08 16:20:02 | 00,079,360 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swxcacls.exe
[2009/11/08 16:20:00 | 00,135,168 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swreg.exe
[2009/11/08 16:19:59 | 00,053,248 | ---- | C] (http://www.beyondlogic.org) -- C:\WINDOWS\System32\Process.exe
[2006/04/29 12:10:38 | 00,774,144 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RngInterstitial.dll
[2001/06/19 15:34:36 | 00,040,960 | ---- | C] (Jetsoft Development Company) -- C:\Program Files\ACMonitor_X83.exe

========== Files - Modified Within 14 Days ==========

[2009/11/21 19:24:31 | 00,176,374 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\error.jpg
[2009/11/21 19:24:11 | 00,015,872 | ---- | M] () -- C:\WINDOWS\System32\tdlcmd.dll
[2009/11/21 19:21:38 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/11/21 19:21:13 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/11/21 19:19:32 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2009/11/21 19:19:12 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/11/21 19:19:03 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/11/21 19:19:01 | 10,397,16352 | -HS- | M] () -- C:\hiberfil.sys
[2009/11/21 19:18:05 | 11,534,336 | ---- | M] () -- C:\Documents and Settings\ME\ntuser.dat
[2009/11/21 19:18:05 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\ME\ntuser.ini
[2009/11/21 18:55:06 | 00,724,952 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\avenger.zip
[2009/11/21 18:46:29 | 45,554,936 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/11/21 11:54:58 | 00,038,798 | ---- | M] () -- C:\Documents and Settings\ME\Application Data\wklnhst.dat
[2009/11/21 11:18:14 | 00,000,145 | --S- | M] () -- C:\WINDOWS\System32\4223501170.dat
[2009/11/21 08:45:01 | 00,098,480 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/11/19 23:13:45 | 00,045,056 | ---- | M] () -- C:\Documents and Settings\ME\My Documents\novel.doc
[2009/11/18 20:17:00 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/11/17 11:22:52 | 00,529,408 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ME\Desktop\OTL.exe
[2009/11/16 23:44:23 | 00,076,755 | ---- | M] () -- C:\Documents and Settings\ME\Desktop\untitled.JPG
[2009/11/16 22:00:04 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/11/16 09:42:24 | 00,001,670 | ---- | M] () -- C:\System Defender.lnk
[2009/11/16 09:26:59 | 00,000,526 | RHS- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221904.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215056.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215054.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215053.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215052.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215051.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215050.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215049.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215048.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215047.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215046.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215044.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091120-215043.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225520.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225519.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225518.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225507.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225506.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225505.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225504.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225453.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225452.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225451.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225450.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225441.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225439.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225437.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225436.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225432.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-225428.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221927.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221922.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221921.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221920.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221919.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221918.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221914.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221911.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20091118-221910.backup
[2009/11/16 09:26:59 | 00,000,526 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/11/15 01:00:00 | 00,000,368 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job
[2009/11/14 20:03:43 | 01,839,984 | ---- | M] (Trend Micro) -- C:\Documents and Settings\ME\Desktop\HousecallLauncher.exe
[2009/11/11 03:24:15 | 00,284,520 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/11/11 01:04:31 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\ME\My Documents\~$novel.doc
[2009/11/10 21:39:20 | 00,001,517 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/11/10 21:39:19 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/11/10 21:39:19 | 00,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/11/10 21:39:12 | 00,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/11/10 21:39:10 | 00,113,461 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2009/11/10 21:39:10 | 00,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/11/10 21:38:59 | 06,061,540 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/11/10 21:38:59 | 00,492,629 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/11/08 20:00:08 | 00,024,064 | ---- | M] () -- C:\Documents and Settings\ME\My Documents\movies seen 2009.doc
[2009/11/08 16:20:56 | 00,004,604 | ---- | M] () -- C:\WINDOWS\System32\tmp.reg

========== Files Created - No Company Name ==========

[2009/11/21 19:24:29 | 00,176,374 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\error.jpg
[2009/11/21 19:24:10 | 00,015,872 | ---- | C] () -- C:\WINDOWS\System32\tdlcmd.dll
[2009/11/21 18:56:00 | 00,731,136 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\avenger.exe
[2009/11/21 18:55:05 | 00,724,952 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\avenger.zip
[2009/11/21 13:04:49 | 10,397,16352 | -HS- | C] () -- C:\hiberfil.sys
[2009/11/21 11:16:19 | 00,000,145 | --S- | C] () -- C:\WINDOWS\System32\4223501170.dat
[2009/11/16 23:43:20 | 00,076,755 | ---- | C] () -- C:\Documents and Settings\ME\Desktop\untitled.JPG
[2009/11/16 09:42:23 | 00,001,670 | ---- | C] () -- C:\System Defender.lnk
[2009/11/11 01:04:31 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\ME\My Documents\~$novel.doc
[2009/11/10 21:39:20 | 00,001,517 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/11/10 21:39:10 | 00,113,461 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2009/11/10 21:38:59 | 45,554,936 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/11/10 21:38:59 | 06,061,540 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/11/10 21:38:59 | 00,492,629 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/11/10 21:38:59 | 00,098,480 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/11/09 10:42:12 | 11,534,336 | ---- | C] () -- C:\Documents and Settings\ME\ntuser.dat
[2009/11/08 16:20:56 | 00,004,604 | ---- | C] () -- C:\WINDOWS\System32\tmp.reg
[2009/11/08 16:20:04 | 00,075,776 | ---- | C] () -- C:\WINDOWS\System32\WS2Fix.exe
[2009/11/08 16:20:02 | 00,051,200 | ---- | C] () -- C:\WINDOWS\System32\dumphive.exe
[2009/10/22 01:06:15 | 00,000,036 | ---- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\housecall.guid.cache
[2009/01/12 18:40:36 | 00,003,457 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\profiles.xml
[2008/08/22 02:31:42 | 00,141,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2008/05/23 23:58:47 | 02,646,422 | -H-- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\IconCache.db
[2008/04/18 13:01:34 | 00,000,322 | ---- | C] () -- C:\WINDOWS\Xtarot.INI
[2008/04/08 21:49:11 | 00,000,000 | ---- | C] () -- C:\Program Files\temp01
[2008/03/10 22:55:38 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2007/08/28 23:36:37 | 00,000,030 | ---- | C] () -- C:\WINDOWS\ACMonitor_X83.ini
[2007/08/28 23:30:28 | 00,004,672 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.DLL
[2007/08/10 18:22:16 | 00,001,210 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\error.log
[2007/08/10 18:22:16 | 00,000,015 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\config.tcf
[2007/06/10 22:14:43 | 00,000,022 | ---- | C] () -- C:\WINDOWS\iexplore.ini
[2007/03/23 05:51:26 | 00,000,227 | ---- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2007/03/23 05:48:32 | 00,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2007/02/02 12:40:05 | 00,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2007/01/28 14:30:39 | 00,468,480 | ---- | C] () -- C:\WINDOWS\System32\NMDll.dll
[2007/01/28 14:30:38 | 00,208,896 | ---- | C] () -- C:\WINDOWS\System32\HDBHO.dll
[2007/01/28 14:30:37 | 00,020,480 | ---- | C] () -- C:\WINDOWS\yhl.dll
[2007/01/28 14:30:37 | 00,007,168 | ---- | C] () -- C:\WINDOWS\lq.dll
[2007/01/24 01:19:06 | 00,000,063 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2006/08/25 23:26:55 | 00,591,890 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2006/08/25 23:26:54 | 00,856,064 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/08/25 23:26:54 | 00,217,088 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/08/25 23:26:51 | 00,005,120 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2006/08/25 23:26:51 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2006/08/22 14:58:28 | 00,079,681 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
[2006/08/22 14:57:22 | 00,005,661 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
[2006/08/22 14:56:20 | 00,118,428 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\Update_HP_RedboxHprblog_HPSU.log
[2006/06/29 14:58:52 | 00,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/06/29 14:53:56 | 00,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 00,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/04/18 15:39:28 | 00,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/03/26 23:28:27 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\cygz.dll
[2005/11/24 15:43:46 | 00,001,783 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/11/16 15:33:23 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
[2005/11/16 15:33:23 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
[2005/10/25 18:38:42 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/10/20 19:01:03 | 00,005,697 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2005/10/20 19:00:37 | 00,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2005/08/12 16:57:09 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/06/03 22:10:53 | 00,000,823 | ---- | C] () -- C:\WINDOWS\tsc.ini
[2005/06/03 22:10:52 | 00,071,749 | ---- | C] () -- C:\WINDOWS\hcextoutput.dll
[2005/06/03 22:10:24 | 00,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2005/05/17 22:40:31 | 00,000,082 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\Ad Annihilator.aap
[2005/05/10 15:07:26 | 00,076,960 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\GDIPFONTCACHEV1.DAT
[2005/03/16 23:35:04 | 00,000,022 | ---- | C] () -- C:\WINDOWS\Kyor.ini
[2005/01/24 11:24:17 | 00,038,798 | ---- | C] () -- C:\Documents and Settings\ME\Application Data\wklnhst.dat
[2005/01/23 21:11:16 | 03,423,744 | ---- | C] () -- C:\WINDOWS\System32\libfilefmt-1.1.0.dll
[2005/01/23 21:11:16 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\libavi-dd-1.2.0.dll
[2005/01/23 21:11:15 | 00,706,048 | ---- | C] () -- C:\WINDOWS\System32\libmcl-3.1.1.dll
[2005/01/23 19:24:15 | 00,012,462 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2005/01/23 18:34:31 | 00,182,272 | ---- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/01/23 14:45:14 | 00,000,141 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/01/23 14:38:19 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\ME\Application Data\desktop.ini
[2005/01/23 14:38:18 | 00,085,904 | ---- | C] () -- C:\Documents and Settings\ME\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2004/09/08 18:58:04 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/09/08 13:28:53 | 00,000,004 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2004/08/26 23:39:21 | 00,000,015 | ---- | C] () -- C:\WINDOWS\NASBA.ini
[2004/08/24 07:01:17 | 00,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/24 05:01:06 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/08/23 10:32:20 | 00,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2004/08/23 10:32:20 | 00,049,152 | ---- | C] () -- C:\WINDOWS\CNYUSB.dll
[2004/08/23 10:32:20 | 00,024,576 | ---- | C] () -- C:\WINDOWS\HKCYDLL.dll
[2004/08/23 10:32:20 | 00,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll
[2004/08/23 10:32:20 | 00,000,360 | ---- | C] () -- C:\WINDOWS\CNYHKey.ini
[2004/08/23 08:55:48 | 00,008,632 | ---- | C] () -- C:\WINDOWS\PRISMDOM.ini
[2004/08/23 08:33:37 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/22 17:10:03 | 00,000,266 | ---- | C] () -- C:\WINDOWS\Dit.INI
[2004/08/22 17:04:24 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/08/22 17:00:40 | 00,108,021 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004/08/22 16:59:11 | 00,099,597 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2004/08/22 16:57:31 | 00,032,768 | ---- | C] () -- C:\WINDOWS\SIS_LIB.DLL
[2004/08/22 15:44:00 | 00,000,814 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/08/22 15:43:43 | 00,001,281 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/22 15:43:39 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2004/08/22 08:49:47 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2002/03/21 14:39:02 | 00,073,728 | R--- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2002/03/20 21:01:06 | 00,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2002/03/20 21:00:20 | 00,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll
[2001/10/25 13:20:08 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\LXASBCE.DLL
[2001/10/25 13:20:08 | 00,000,643 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI
[1999/07/23 12:46:48 | 00,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[1999/07/23 09:53:20 | 00,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll
[1999/04/20 02:15:00 | 00,022,016 | ---- | C] () -- C:\WINDOWS\unvise32.dll
[1999/01/22 13:46:58 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2006/08/17 20:12:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2008/12/02 21:59:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Auslogics
[2009/11/14 20:02:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2009/11/21 08:37:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2007/12/28 22:42:08 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/07/01 12:12:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJPLM
[2006/03/07 23:14:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2008/11/19 18:13:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Musicnotes
[2004/08/24 08:10:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2007/06/24 22:33:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2007/06/18 12:12:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NannyMania
[2006/09/15 20:09:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/08/05 23:39:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NeoEdge Networks
[2009/03/07 16:50:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst
[2008/04/16 11:28:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2009/03/22 22:39:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2009/01/17 14:47:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2008/08/22 02:26:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\services
[2009/01/07 18:22:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Shockwave
[2009/11/18 15:26:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SP
[2009/10/25 19:14:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
[2009/10/14 22:55:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/17 14:25:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2008/06/26 22:08:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Valusoft
[2005/09/30 19:39:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/06/27 15:07:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2007/02/18 20:34:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Yahoo
[2009/03/14 13:46:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/08/28 00:54:27 | 00,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
[2009/09/28 21:09:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/28 11:24:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/10/21 17:48:39 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2009/01/12 19:23:23 | 00,000,000 | -HSD | M] -- C:\Documents and Settings\ME\Application Data\.#
[2005/05/10 15:31:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\ACD Systems
[2005/09/30 19:39:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Aim
[2008/06/27 15:14:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Canon
[2007/06/19 09:51:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\ieSpell
[2007/03/23 06:14:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Image Zone Express
[2009/11/21 13:13:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Leadertech
[2008/08/21 15:10:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\My Games
[2009/07/01 00:59:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\OfficeUpdate12
[2008/07/21 13:14:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Sibelius Software
[2009/11/19 19:25:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\Spyware Terminator
[2009/08/17 14:26:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ME\Application Data\TuneUp Software
[2009/07/11 23:49:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\SACore
[2005/02/25 22:08:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\X10 Commander
[2009/11/21 19:21:38 | 00,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2004/08/04 07:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/11/15 01:00:00 | 00,000,368 | ---- | M] () -- C:\WINDOWS\Tasks\McDefragTask.job
[2009/11/01 00:00:00 | 00,000,370 | ---- | M] () -- C:\WINDOWS\Tasks\McQcTask.job
[2009/11/21 19:19:12 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========



========== Custom Scans ==========


< :OTL >

< @Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D43DBBD1 >

< @Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:94A6C632 >

< @Alternate Data Stream - 88 bytes -> C:\Documents and Settings\ME\Desktop\angry bucket.3g2: SummaryInformation >

< @Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6F1F66C0 >

< @Alternate Data Stream - 164 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70D0A7CC >

< @Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D37AE80B >

< @Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2C321309 >

< @Alternate Data Stream - 157 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CAFA2B66 >

< @Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:015DC393 >

< @Alternate Data Stream - 155 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38D53DB8 >

< @Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9A953997 >

< @Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6DD93FF7 >

< @Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D251621C >

< @Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0127DBDE >

< @Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BC9021B2 >

< @Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B4630A5 >

< @Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D20FFA63 >

< @Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:701AFF06 >

< @Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D52AB7A >

< @Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:148EE14E >

< @Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0EDAD4 >

< @Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CBCF563D >

< @Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5867D280 >

< @Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:82ED8454 >

< @Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0EC44AEB >

< @Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FC5A6A39 >

< @Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DD874E14 >

< @Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D7FCCD3 >

< @Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A3E22AF0 >

< @Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29BCDA07 >

< @Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DA3C6C07 >

< @Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6CEC50B4 >

< @Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30C46519 >

< @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BB0256E7 >

< @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A696643D >

< @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DD623B3 >

< @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:182D85B1 >

< @Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:00C31200 >

< @Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B132D3E >

< @Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:50631D57 >

< @Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4F636E25 >

< @Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8AB6C1D7 >

< @Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:56486BDA >

< @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA42DF8E >

< @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6E9EB6C >

< @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:949483BD >

< @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:59D05D9A >

< @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E903DEB >

< @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B12FF3F2 >

< @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA24D1FF >

< @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:615435BE >

< @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B85C37B >

< @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CB8D545 >

< @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0A03CEDC >

< @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7FC64998 >

< @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D066AD2 >

< @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3064D21D >

< @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01C1407E >

< @Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D18D7C38 >

< @Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05816AFA >

< @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85C0059D >

< @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:831C6B2D >

< @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0768CD >

< @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:95B7F1EC >

< @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85630A39 >

< @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5216CD26 >

< @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2B99FE60 >

< @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3CD562B4 >

< @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:20DB61D6 >

< @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:077CC761 >

< @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A057B5F9 >

< @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7B212553 >

< @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6677D85A >

< @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4C49306C >

< @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:18897B1D >

< @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F69BB936 >

< @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D7DA89B1 >

< @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C70C5141 >

< @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9FE30AB2 >

< @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:957E9765 >

< @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7DFDF9DF >

< @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35759C73 >

< @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1D6686D8 >

< @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:09161C63 >

< @Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AEC895D8 >

< @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA8B212D >

< @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DF0BC727 >

< @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C7D54A10 >

< @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:708BB0FA >

< @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6C235A19 >

< @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3EA7510F >

< @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:132EDADA >

< @Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E1982A23 >

< @Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:90E3641D >

< @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EB603FE4 >

< @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C90C4DBA >

< @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5F1019FF >

< @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D10517E >

< @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:54997B77 >

< @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:435657D8 >

< @Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5F8E280 >

< @Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEE4A457 >

< @Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2BAAE818 >

< @Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:27EEEB5C >

< @Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E84CA8F2 >

< @Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:663B62CA >

< @Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3B3A35EC >

< @Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5AFE07D >

< @Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68FB0053 >

< @Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B835A22 >

< @Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1EBBD65A >

< @Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A0C7D68A >

< @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E71141D2 >

< @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:89123481 >

< @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:74699137 >

< @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5E1404CE >

< @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A42A9F39 >

< @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8643C5BE >

< @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C270C64 >

< @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1C9565AC >

< @Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:77846FFE >

< @Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2ABEB9EB >

< @Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:814B9485 >

< @Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:13B137AF >

< @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F6BFFC4A >

< @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ADE16379 >

< @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A561576B >

< @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:953FDC1A >

< @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:657E1DF1 >

< @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E6B8D68 >

< @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AB0465FA >

< @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A69F57F3 >

< @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9857FAE3 >

< @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:41099CE9 >

< @Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BDF08FAF >

< @Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8247A199 >

< @Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:877DEA57 >

< @Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:780A453A >

< @Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:753B0F80 >

< @Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:288A91F8 >

< @Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:052A05A1 >

< >

< %SYSTEMDRIVE%\atapi.sys /s /md5 >
[2004/08/04 07:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008/04/13 13:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5 -- C:\WINDOWS\system32\drivers\atapi.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D43DBBD1
@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:94A6C632
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\ME\Desktop\angry bucket.3g2:SummaryInformation
@Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6F1F66C0
@Alternate Data Stream - 164 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70D0A7CC
@Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D37AE80B
@Alternate Data Stream - 161 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2C321309
@Alternate Data Stream - 157 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CAFA2B66
@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:015DC393
@Alternate Data Stream - 155 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38D53DB8
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9A953997
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6DD93FF7
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D251621C
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0127DBDE
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BC9021B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B4630A5
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D20FFA63
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:701AFF06
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D52AB7A
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:148EE14E
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0EDAD4
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CBCF563D
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5867D280
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:82ED8454
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0EC44AEB
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FC5A6A39
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DD874E14
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D7FCCD3
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A3E22AF0
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29BCDA07
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DA3C6C07
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6CEC50B4
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30C46519
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BB0256E7
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A696643D
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DD623B3
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:182D85B1
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:00C31200
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B132D3E
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:50631D57
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4F636E25
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8AB6C1D7
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:56486BDA
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA42DF8E
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6E9EB6C
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:949483BD
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:59D05D9A
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E903DEB
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B12FF3F2
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA24D1FF
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:615435BE
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B85C37B
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CB8D545
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0A03CEDC
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7FC64998
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D066AD2
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3064D21D
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01C1407E
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D18D7C38
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05816AFA
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85C0059D
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:831C6B2D
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD0768CD
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:95B7F1EC
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:85630A39
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5216CD26
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2B99FE60
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3CD562B4
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:20DB61D6
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:077CC761
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A057B5F9
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7B212553
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6677D85A
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4C49306C
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:18897B1D
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F69BB936
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D7DA89B1
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C70C5141
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9FE30AB2
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:957E9765
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7DFDF9DF
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35759C73
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1D6686D8
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:09161C63
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AEC895D8
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA8B212D
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DF0BC727
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C7D54A10
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:708BB0FA
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6C235A19
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3EA7510F
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:132EDADA
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E1982A23
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:90E3641D
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EB603FE4
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C90C4DBA
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5F1019FF
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D10517E
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:54997B77
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:435657D8
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5F8E280
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEE4A457
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2BAAE818
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:27EEEB5C
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E84CA8F2
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:663B62CA
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3B3A35EC
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E5AFE07D
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68FB0053
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B835A22
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1EBBD65A
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A0C7D68A
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E71141D2
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:89123481
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:74699137
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5E1404CE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A42A9F39
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8643C5BE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C270C64
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1C9565AC
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:77846FFE
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2ABEB9EB
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:814B9485
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:13B137AF
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F6BFFC4A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ADE16379
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A561576B
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:953FDC1A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:657E1DF1
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4E6B8D68
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AB0465FA
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A69F57F3
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9857FAE3
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:41099CE9
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BDF08FAF
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8247A199
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:877DEA57
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:780A453A
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:753B0F80
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:288A91F8
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:052A05A1
< End of report >