2011/02/03 09:33:37.0472 3756 TDSS rootkit removing tool 2.4.16.0 Feb 1 2011 10:34:03
2011/02/03 09:33:39.0485 3756 ================================================================================
2011/02/03 09:33:39.0485 3756 SystemInfo:
2011/02/03 09:33:39.0485 3756
2011/02/03 09:33:39.0485 3756 OS Version: 6.0.6001 ServicePack: 1.0
2011/02/03 09:33:39.0485 3756 Product type: Workstation
2011/02/03 09:33:39.0485 3756 ComputerName: UNSETH-PC
2011/02/03 09:33:39.0485 3756 UserName: unseth
2011/02/03 09:33:39.0485 3756 Windows directory: C:\Windows
2011/02/03 09:33:39.0485 3756 System windows directory: C:\Windows
2011/02/03 09:33:39.0485 3756 Running under WOW64
2011/02/03 09:33:39.0485 3756 Processor architecture: Intel x64
2011/02/03 09:33:39.0485 3756 Number of processors: 4
2011/02/03 09:33:39.0485 3756 Page size: 0x1000
2011/02/03 09:33:39.0485 3756 Boot type: Normal boot
2011/02/03 09:33:39.0485 3756 ================================================================================
2011/02/03 09:33:39.0844 3756 Initialize success
2011/02/03 09:33:57.0750 4496 ================================================================================
2011/02/03 09:33:57.0750 4496 Scan started
2011/02/03 09:33:57.0750 4496 Mode: Manual;
2011/02/03 09:33:57.0750 4496 ================================================================================
2011/02/03 09:33:58.0562 4496 ACPI (8c99ed256a889d647935a97c543b7b85) C:\Windows\system32\drivers\acpi.sys
2011/02/03 09:33:58.0655 4496 adp94xx (f14215e37cf124104575073f782111d2) C:\Windows\system32\drivers\adp94xx.sys
2011/02/03 09:33:58.0718 4496 adpahci (7d05a75e3066861a6610f7ee04ff085c) C:\Windows\system32\drivers\adpahci.sys
2011/02/03 09:33:58.0764 4496 adpu160m (820a201fe08a0c345b3bedbc30e1a77c) C:\Windows\system32\drivers\adpu160m.sys
2011/02/03 09:33:58.0796 4496 adpu320 (9b4ab6854559dc168fbb4c24fc52e794) C:\Windows\system32\drivers\adpu320.sys
2011/02/03 09:33:59.0045 4496 AFD (db37041ab857abc7e179e856d8e1582c) C:\Windows\system32\drivers\afd.sys
2011/02/03 09:33:59.0139 4496 AgereSoftModem (385471f8147e1bd6a08c031e3aad3910) C:\Windows\system32\DRIVERS\agrsm64.sys
2011/02/03 09:33:59.0186 4496 agp440 (f6f6793b7f17b550ecfdbd3b229173f7) C:\Windows\system32\drivers\agp440.sys
2011/02/03 09:33:59.0295 4496 aic78xx (222cb641b4b8a1d1126f8033f9fd6a00) C:\Windows\system32\drivers\djsvs.sys
2011/02/03 09:33:59.0326 4496 aliide (157d0898d4b73f075ce9fa26b482df98) C:\Windows\system32\drivers\aliide.sys
2011/02/03 09:33:59.0342 4496 amdide (970fa5059e61e30d25307b99903e991e) C:\Windows\system32\drivers\amdide.sys
2011/02/03 09:33:59.0388 4496 AmdK8 (cdc3632a3a5ea4dbb83e46076a3165a1) C:\Windows\system32\drivers\amdk8.sys
2011/02/03 09:33:59.0498 4496 arc (ba8417d4765f3988ff921f30f630e303) C:\Windows\system32\drivers\arc.sys
2011/02/03 09:33:59.0622 4496 arcsas (9d41c435619733b34cc16a511e644b11) C:\Windows\system32\drivers\arcsas.sys
2011/02/03 09:33:59.0700 4496 aswFsBlk (6923740db573b46fdda13e1df412c577) C:\Windows\system32\drivers\aswFsBlk.sys
2011/02/03 09:33:59.0732 4496 aswMonFlt (de001b988b58bfd453f667842655b22e) C:\Windows\system32\drivers\aswMonFlt.sys
2011/02/03 09:33:59.0841 4496 aswRdr (e0d1002d7fa65dd023788b17f714e682) C:\Windows\system32\drivers\aswRdr.sys
2011/02/03 09:33:59.0966 4496 aswSP (c3eafdc0f533425614430a112ba71e9a) C:\Windows\system32\drivers\aswSP.sys
2011/02/03 09:34:00.0184 4496 aswTdi (0226ffbc420d8fb67ba3b9dbdd1f2dca) C:\Windows\system32\drivers\aswTdi.sys
2011/02/03 09:34:00.0402 4496 AsyncMac (22d13ff3dafec2a80634752b1eaa2de6) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/02/03 09:34:00.0434 4496 atapi (62bd869afa2bf2e30f9d3ff428c87d5c) C:\Windows\system32\drivers\atapi.sys
2011/02/03 09:34:00.0590 4496 atikmdag (0746ea434a4693251c7d3be3cccc77d6) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/02/03 09:34:00.0730 4496 AtiPcie (db0d3de15edc96e7529fc0d3f7760894) C:\Windows\system32\DRIVERS\AtiPcie.sys
2011/02/03 09:34:01.0042 4496 blbdrive (79feeb40056683f8f61398d81dda65d2) C:\Windows\system32\drivers\blbdrive.sys
2011/02/03 09:34:01.0073 4496 bowser (8b2b19031d0aeade6e1b933df1acba7e) C:\Windows\system32\DRIVERS\bowser.sys
2011/02/03 09:34:01.0120 4496 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\brfiltlo.sys
2011/02/03 09:34:01.0136 4496 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\brfiltup.sys
2011/02/03 09:34:01.0182 4496 Brserid (f0f0ba4d815be446aa6a4583ca3bca9b) C:\Windows\system32\drivers\brserid.sys
2011/02/03 09:34:01.0198 4496 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\system32\drivers\brserwdm.sys
2011/02/03 09:34:01.0214 4496 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\system32\drivers\brusbmdm.sys
2011/02/03 09:34:01.0245 4496 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\system32\drivers\brusbser.sys
2011/02/03 09:34:01.0260 4496 BTHMODEM (e0777b34e05f8a82a21856efc900c29f) C:\Windows\system32\drivers\bthmodem.sys
2011/02/03 09:34:01.0307 4496 cdfs (b4d787db8d30793a4d4df9feed18f136) C:\Windows\system32\DRIVERS\cdfs.sys
2011/02/03 09:34:01.0338 4496 cdrom (3b2fb35363423ed60c8fbf15fc8680bd) C:\Windows\system32\DRIVERS\cdrom.sys
2011/02/03 09:34:01.0370 4496 circlass (02ea568d498bbdd4ba55bf3fce34d456) C:\Windows\system32\drivers\circlass.sys
2011/02/03 09:34:01.0401 4496 CLFS (caeda2572b7042b11062f327f099251d) C:\Windows\system32\CLFS.sys
2011/02/03 09:34:01.0541 4496 cmdide (e5d5499a1c50a54b5161296b6afe6192) C:\Windows\system32\drivers\cmdide.sys
2011/02/03 09:34:01.0588 4496 COH_Mon (4ac0614de43f8787ec1556560c752af8) C:\Windows\system32\Drivers\COH_Mon.sys
2011/02/03 09:34:01.0619 4496 Compbatt (7fb8ad01db0eabe60c8a861531a8f431) C:\Windows\system32\drivers\compbatt.sys
2011/02/03 09:34:01.0650 4496 crcdisk (a8585b6412253803ce8efcbd6d6dc15c) C:\Windows\system32\drivers\crcdisk.sys
2011/02/03 09:34:01.0697 4496 DfsC (bd4acc56e477ad7419cbe90fceeb621b) C:\Windows\system32\Drivers\dfsc.sys
2011/02/03 09:34:01.0744 4496 disk (2dc415fc05fb8a079f896cbbacb19324) C:\Windows\system32\drivers\disk.sys
2011/02/03 09:34:02.0009 4496 drmkaud (f1a78a98cfc2ee02144c6bec945447e6) C:\Windows\system32\drivers\drmkaud.sys
2011/02/03 09:34:02.0150 4496 DXGKrnl (412964040ce920ff83aff6b5b551bf99) C:\Windows\System32\drivers\dxgkrnl.sys
2011/02/03 09:34:02.0274 4496 E1G60 (264cee7b031a9d6c827f3d0cb031f2fe) C:\Windows\system32\DRIVERS\E1G6032E.sys
2011/02/03 09:34:02.0306 4496 Ecache (7343d950a34a95dcb7441642e3e6beef) C:\Windows\system32\drivers\ecache.sys
2011/02/03 09:34:02.0384 4496 eeCtrl (066108ae4c35835081598827a1a7d08d) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
2011/02/03 09:34:02.0633 4496 elxstor (c4636d6e10469404ab5308d9fd45ed07) C:\Windows\system32\drivers\elxstor.sys
2011/02/03 09:34:02.0728 4496 EraserUtilRebootDrv (12866876e3851f1e5d462b2a83e25578) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
2011/02/03 09:34:02.0991 4496 ErrDev (bc3a58e938bb277e46bf4b3003b01abd) C:\Windows\system32\drivers\errdev.sys
2011/02/03 09:34:03.0245 4496 exfat (2a546b9a84658b0554b1ec35cd9adaf5) C:\Windows\system32\drivers\exfat.sys
2011/02/03 09:34:03.0273 4496 fastfat (fe731d345ed9eeabbc72a59b35941834) C:\Windows\system32\drivers\fastfat.sys
2011/02/03 09:34:03.0306 4496 fdc (81b79b6df71fa1d2c6d688d830616e39) C:\Windows\system32\DRIVERS\fdc.sys
2011/02/03 09:34:03.0335 4496 FileInfo (457b7d1d533e4bd62a99aed9c7bb4c59) C:\Windows\system32\drivers\fileinfo.sys
2011/02/03 09:34:03.0357 4496 Filetrace (d421327fd6efccaf884a54c58e1b0d7f) C:\Windows\system32\drivers\filetrace.sys
2011/02/03 09:34:03.0380 4496 flpydisk (230923ea2b80f79b0f88d90f87b87ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/02/03 09:34:03.0414 4496 FltMgr (7dacf1a3a4219575070c6dc7c957428a) C:\Windows\system32\drivers\fltmgr.sys
2011/02/03 09:34:03.0441 4496 Fs_Rec (29d99e860a1ca0a03c6a733fdd0da703) C:\Windows\system32\drivers\Fs_Rec.sys
2011/02/03 09:34:03.0466 4496 gagp30kx (c8e416668d3dc2be3d4fe4c79224997f) C:\Windows\system32\drivers\gagp30kx.sys
2011/02/03 09:34:03.0519 4496 GEARAspiWDM (cb121f1009623e83ebcc2c4dcef6d3fe) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2011/02/03 09:34:03.0791 4496 HdAudAddService (df45f8142dc6df9d18c39b3effbd0409) C:\Windows\system32\drivers\HdAudio.sys
2011/02/03 09:34:04.0010 4496 HDAudBus (0c0d0f8a3ff09ecc81963d09ec6a0a84) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/02/03 09:34:04.0232 4496 HidBth (b4881c84a180e75b8c25dc1d726c375f) C:\Windows\system32\drivers\hidbth.sys
2011/02/03 09:34:04.0450 4496 HidIr (4e77a77e2c986e8f88f996bb3e1ad829) C:\Windows\system32\drivers\hidir.sys
2011/02/03 09:34:04.0493 4496 HidUsb (128e2da8483fdd4dd0c7b3f9abd6f323) C:\Windows\system32\DRIVERS\hidusb.sys
2011/02/03 09:34:04.0570 4496 HpCISSs (d7109a1e6bd2dfdbcba72a6bc626a13b) C:\Windows\system32\drivers\hpcisss.sys
2011/02/03 09:34:04.0623 4496 HTTP (e690736da6c543f5d99c8fa27bea31db) C:\Windows\system32\drivers\HTTP.sys
2011/02/03 09:34:04.0659 4496 i2omp (da94c854cea5fac549d4e1f6e88349e8) C:\Windows\system32\drivers\i2omp.sys
2011/02/03 09:34:04.0684 4496 i8042prt (cbb597659a2713ce0c9cc20c88c7591f) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/02/03 09:34:04.0713 4496 iaStorV (3e3bf3627d886736d0b4e90054f929f6) C:\Windows\system32\drivers\iastorv.sys
2011/02/03 09:34:04.0795 4496 IDSvia64 (4e5201e6ef84b798ebd40c32be088d7a) C:\PROGRA~3\Symantec\DEFINI~1\SymcData\ipsdefs\20110126.001\IDSvia64.sys
2011/02/03 09:34:05.0054 4496 iirsp (8c3951ad2fe886ef76c7b5027c3125d3) C:\Windows\system32\drivers\iirsp.sys
2011/02/03 09:34:05.0211 4496 int15 (8c7fa71cb1ebcd3ede8958d27b1bf0b4) C:\Windows\SysWOW64\drivers\int15_64.sys
2011/02/03 09:34:05.0419 4496 IntcAzAudAddService (6fdf709500c20362ffc5057f0d1e0c8d) C:\Windows\system32\drivers\RTKVHD64.sys
2011/02/03 09:34:05.0462 4496 intelide (df797a12176f11b2d301c5b234bb200e) C:\Windows\system32\drivers\intelide.sys
2011/02/03 09:34:05.0480 4496 intelppm (bfd84af32fa1bad6231c4585cb469630) C:\Windows\system32\DRIVERS\intelppm.sys
2011/02/03 09:34:05.0516 4496 IpFilterDriver (99b821f5bebd6a3cc3fe564f802ae0fd) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/02/03 09:34:05.0642 4496 IPMIDRV (9c2ee2e6e5a7203bfae15c299475ec67) C:\Windows\system32\drivers\ipmidrv.sys
2011/02/03 09:34:05.0667 4496 IPNAT (b7e6212f581ea5f6ab0c3a6ceeeb89be) C:\Windows\system32\DRIVERS\ipnat.sys
2011/02/03 09:34:05.0688 4496 IRENUM (8c42ca155343a2f11d29feca67faa88d) C:\Windows\system32\drivers\irenum.sys
2011/02/03 09:34:05.0723 4496 isapnp (0672bfcedc6fc468a2b0500d81437f4f) C:\Windows\system32\drivers\isapnp.sys
2011/02/03 09:34:05.0894 4496 iScsiPrt (49e4ccbf74783fce5d2cc1ff6480e1f4) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/02/03 09:34:06.0003 4496 iteatapi (63c766cdc609ff8206cb447a65abba4a) C:\Windows\system32\drivers\iteatapi.sys
2011/02/03 09:34:06.0105 4496 iteraid (1281fe73b17664631d12f643cbea3f59) C:\Windows\system32\drivers\iteraid.sys
2011/02/03 09:34:06.0128 4496 kbdclass (423696f3ba6472dd17699209b933bc26) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/02/03 09:34:06.0151 4496 kbdhid (bf8783a5066cfecf45095459e8010fa7) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/02/03 09:34:06.0217 4496 KSecDD (ccdcce6224e1e207e953af826b98a9d9) C:\Windows\system32\Drivers\ksecdd.sys
2011/02/03 09:34:06.0262 4496 ksthunk (1d419cf43db29396ecd7113d129d94eb) C:\Windows\system32\drivers\ksthunk.sys
2011/02/03 09:34:06.0325 4496 lltdio (96ece2659b6654c10a0c310ae3a6d02c) C:\Windows\system32\DRIVERS\lltdio.sys
2011/02/03 09:34:06.0372 4496 LSI_FC (acbe1af32d3123e330a07bfbc5ec4a9b) C:\Windows\system32\drivers\lsi_fc.sys
2011/02/03 09:34:06.0391 4496 LSI_SAS (799ffb2fc4729fa46d2157c0065b3525) C:\Windows\system32\drivers\lsi_sas.sys
2011/02/03 09:34:06.0419 4496 LSI_SCSI (f445ff1daad8a226366bfaf42551226b) C:\Windows\system32\drivers\lsi_scsi.sys
2011/02/03 09:34:06.0438 4496 luafv (52f87b9cc8932c2a7375c3b2a9be5e3e) C:\Windows\system32\drivers\luafv.sys
2011/02/03 09:34:06.0480 4496 megasas (5c5cd6aaced32fb26c3fb34b3dcf972f) C:\Windows\system32\drivers\megasas.sys
2011/02/03 09:34:06.0518 4496 MegaSR (859bc2436b076c77c159ed694acfe8f8) C:\Windows\system32\drivers\megasr.sys
2011/02/03 09:34:06.0548 4496 Modem (59848d5cc74606f0ee7557983bb73c2e) C:\Windows\system32\drivers\modem.sys
2011/02/03 09:34:06.0579 4496 monitor (c247cc2a57e0a0c8c6dccf7807b3e9e5) C:\Windows\system32\DRIVERS\monitor.sys
2011/02/03 09:34:06.0601 4496 mouclass (9367304e5e412b120cf5f4ea14e4e4f1) C:\Windows\system32\DRIVERS\mouclass.sys
2011/02/03 09:34:06.0623 4496 mouhid (c2c2bd5c5ce5aaf786ddd74b75d2ac69) C:\Windows\system32\DRIVERS\mouhid.sys
2011/02/03 09:34:06.0646 4496 MountMgr (11bc9b1e8801b01f7f6adb9ead30019b) C:\Windows\system32\drivers\mountmgr.sys
2011/02/03 09:34:06.0683 4496 mpio (f8276eb8698142884498a528dfea8478) C:\Windows\system32\drivers\mpio.sys
2011/02/03 09:34:06.0702 4496 mpsdrv (c92b9abdb65a5991e00c28f13491dba2) C:\Windows\system32\drivers\mpsdrv.sys
2011/02/03 09:34:06.0728 4496 Mraid35x (3c200630a89ef2c0864d515b7a75802e) C:\Windows\system32\drivers\mraid35x.sys
2011/02/03 09:34:06.0847 4496 MRxDAV (fe2706c15f8345c342820e4e4583fea0) C:\Windows\system32\drivers\mrxdav.sys
2011/02/03 09:34:06.0935 4496 mrxsmb (937512d4321b4f5218ad5a0aebf2b5cc) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/02/03 09:34:06.0995 4496 mrxsmb10 (152b673b3984356390e7baa4199f1114) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/02/03 09:34:07.0075 4496 mrxsmb20 (65e45c26ba6fd66cd2889913f73823ef) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/02/03 09:34:07.0108 4496 msahci (1ac860612b85d8e85ee257d372e39f4d) C:\Windows\system32\drivers\msahci.sys
2011/02/03 09:34:07.0127 4496 msdsm (264bbb4aaf312a485f0e44b65a6b7202) C:\Windows\system32\drivers\msdsm.sys
2011/02/03 09:34:07.0164 4496 Msfs (704f59bfc4512d2bb0146aec31b10a7c) C:\Windows\system32\drivers\Msfs.sys
2011/02/03 09:34:07.0191 4496 msisadrv (00ebc952961664780d43dca157e79b27) C:\Windows\system32\drivers\msisadrv.sys
2011/02/03 09:34:07.0235 4496 MSKSSRV (0ea73e498f53b96d83dbfca074ad4cf8) C:\Windows\system32\drivers\MSKSSRV.sys
2011/02/03 09:34:07.0252 4496 MSPCLOCK (52e59b7e992a58e740aa63f57edbae8b) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/02/03 09:34:07.0275 4496 MSPQM (49084a75bae043ae02d5b44d02991bb2) C:\Windows\system32\drivers\MSPQM.sys
2011/02/03 09:34:07.0309 4496 MsRPC (b8e32e6103fbba9fbb1d0c11ff0d13b5) C:\Windows\system32\drivers\MsRPC.sys
2011/02/03 09:34:07.0334 4496 mssmbios (855796e59df77ea93af46f20155bf55b) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/02/03 09:34:07.0355 4496 MSTEE (86d632d75d05d5b7c7c043fa3564ae86) C:\Windows\system32\drivers\MSTEE.sys
2011/02/03 09:34:07.0378 4496 Mup (ddf133501f68d6988a0f55dfa88637b4) C:\Windows\system32\Drivers\mup.sys
2011/02/03 09:34:07.0440 4496 NativeWifiP (73b99c98fa3a2ed1566e02d6fe1913a5) C:\Windows\system32\DRIVERS\nwifi.sys
2011/02/03 09:34:07.0526 4496 NAVENG (7be93dbb02b66e72872ff76d8a92e662) C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20110202.022\ENG64.SYS
2011/02/03 09:34:07.0590 4496 NAVEX15 (be99edbba322ca59b3f2fe17b9bf987a) C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20110202.022\EX64.SYS
2011/02/03 09:34:07.0860 4496 NDIS (2a2ee457af36c5c9a6808c768bd3a12b) C:\Windows\system32\drivers\ndis.sys
2011/02/03 09:34:08.0052 4496 NdisTapi (64df698a425478e321981431ac171334) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/02/03 09:34:08.0074 4496 Ndisuio (8baa43196d7b5bb972c9a6b2bbf61a19) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/02/03 09:34:08.0097 4496 NdisWan (52e3e8e35101399be9b2938c992aa087) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/02/03 09:34:08.0117 4496 NDProxy (9cb77ed7cb72850253e973a2d6afdf49) C:\Windows\system32\drivers\NDProxy.sys
2011/02/03 09:34:08.0153 4496 NetBIOS (a499294f5029a7862adc115bda7371ce) C:\Windows\system32\DRIVERS\netbios.sys
2011/02/03 09:34:08.0173 4496 netbt (7a29ca243a629230799754162d80120f) C:\Windows\system32\DRIVERS\netbt.sys
2011/02/03 09:34:08.0222 4496 nfrd960 (4ac08bd6af2df42e0c3196d826c8aea7) C:\Windows\system32\drivers\nfrd960.sys
2011/02/03 09:34:08.0245 4496 Npfs (b06154e2a2c91e9be5599fca53bc4cd0) C:\Windows\system32\drivers\Npfs.sys
2011/02/03 09:34:08.0274 4496 nsiproxy (1523af19ee8b030ba682f7a53537eaeb) C:\Windows\system32\drivers\nsiproxy.sys
2011/02/03 09:34:08.0333 4496 Ntfs (fe86ba5ac3b50e2ca911e9c60c07b638) C:\Windows\system32\drivers\Ntfs.sys
2011/02/03 09:34:08.0361 4496 Null (dd5d684975352b85b52e3fd5347c20cb) C:\Windows\system32\drivers\Null.sys
2011/02/03 09:34:08.0384 4496 nvraid (2c040b7ada5b06f6facadac8514aa034) C:\Windows\system32\drivers\nvraid.sys
2011/02/03 09:34:08.0405 4496 nvstor (f7ea0fe82842d05eda3efdd376dbfdba) C:\Windows\system32\drivers\nvstor.sys
2011/02/03 09:34:08.0433 4496 nv_agp (19067ca93075ef4823e3938a686f532f) C:\Windows\system32\drivers\nv_agp.sys
2011/02/03 09:34:08.0519 4496 ohci1394 (1b30103fde512915a9214b108b6e7a9c) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/02/03 09:34:08.0655 4496 Parport (4c6a7fd04ddf4db88791048382e3edb1) C:\Windows\system32\DRIVERS\parport.sys
2011/02/03 09:34:08.0683 4496 partmgr (5ab40c36894f4c06bdab0c9a2fba282d) C:\Windows\system32\drivers\partmgr.sys
2011/02/03 09:34:08.0713 4496 pci (2a5b2a51559066ea84742909b5b2cd69) C:\Windows\system32\drivers\pci.sys
2011/02/03 09:34:08.0733 4496 pciide (4423e6d4d20c5d9ae27608bbe55347f7) C:\Windows\system32\drivers\pciide.sys
2011/02/03 09:34:08.0785 4496 pcmcia (037661f3d7c507c9993b7010ceee6288) C:\Windows\system32\drivers\pcmcia.sys
2011/02/03 09:34:08.0812 4496 PEAUTH (58865916f53592a61549b04941bfd80d) C:\Windows\system32\drivers\peauth.sys
2011/02/03 09:34:08.0994 4496 PptpMiniport (f5739f2c6db2534c384ad5150808e8f5) C:\Windows\system32\DRIVERS\raspptp.sys
2011/02/03 09:34:09.0013 4496 Processor (5080e59ecee0bc923f14018803aa7a01) C:\Windows\system32\DRIVERS\processr.sys
2011/02/03 09:34:09.0054 4496 PSched (0e0e205a296095fe4c631e6a4775ad6c) C:\Windows\system32\DRIVERS\pacer.sys
2011/02/03 09:34:09.0093 4496 ql2300 (0b83f4e681062f3839be2ec1d98fd94a) C:\Windows\system32\drivers\ql2300.sys
2011/02/03 09:34:09.0120 4496 ql40xx (e1c80f8d4d1e39ef9595809c1369bf2a) C:\Windows\system32\drivers\ql40xx.sys
2011/02/03 09:34:09.0149 4496 QWAVEdrv (e8d76edab77ec9c634c27b8eac33adc5) C:\Windows\system32\drivers\qwavedrv.sys
2011/02/03 09:34:09.0170 4496 RasAcd (1013b3b663a56d3ddd784f581c1bd005) C:\Windows\system32\DRIVERS\rasacd.sys
2011/02/03 09:34:09.0208 4496 Rasl2tp (3b9085f91ef00abd15a6f36570e90e12) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/02/03 09:34:09.0235 4496 RasPppoe (2ce1703c27196094fb6e4c6e439f2c21) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/02/03 09:34:09.0270 4496 RasSstp (fcd04fa67e8b40fa0ad361dd38593942) C:\Windows\system32\DRIVERS\rassstp.sys
2011/02/03 09:34:09.0293 4496 rdbss (33fa5b6136d92ee0f53f021c79091300) C:\Windows\system32\DRIVERS\rdbss.sys
2011/02/03 09:34:09.0312 4496 RDPCDD (603900cc05f6be65ccbf373800af3716) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/02/03 09:34:09.0351 4496 rdpdr (c045d1fb111c28df0d1be8d4bda22c06) C:\Windows\system32\drivers\rdpdr.sys
2011/02/03 09:34:09.0370 4496 RDPENCDD (cab9421daf3d97b33d0d055858e2c3ab) C:\Windows\system32\drivers\rdpencdd.sys
2011/02/03 09:34:09.0400 4496 RDPWD (7747082f672aa2846235c9cea42e2e72) C:\Windows\system32\drivers\RDPWD.sys
2011/02/03 09:34:09.0671 4496 rspndr (22a9cb08b1a6707c1550c6bf099aae73) C:\Windows\system32\DRIVERS\rspndr.sys
2011/02/03 09:34:09.0960 4496 RTSTOR (b6b74a05f4da0231d5d275568a104f89) C:\Windows\system32\drivers\RTSTOR64.SYS
2011/02/03 09:34:09.0984 4496 sbp2port (cd9c693589c60ad59bbbcfb0e524e01b) C:\Windows\system32\drivers\sbp2port.sys
2011/02/03 09:34:10.0043 4496 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/02/03 09:34:10.0071 4496 Serenum (2449316316411d65bd2c761a6ffb2ce2) C:\Windows\system32\DRIVERS\serenum.sys
2011/02/03 09:34:10.0107 4496 Serial (4b438170be2fc8e0bd35ee87a960f84f) C:\Windows\system32\DRIVERS\serial.sys
2011/02/03 09:34:10.0125 4496 sermouse (a842f04833684bceea7336211be478df) C:\Windows\system32\drivers\sermouse.sys
2011/02/03 09:34:10.0169 4496 sffdisk (14d4b4465193a87c127933978e8c4106) C:\Windows\system32\drivers\sffdisk.sys
2011/02/03 09:34:10.0191 4496 sffp_mmc (7073aee3f82f3d598e3825962aa98ab2) C:\Windows\system32\drivers\sffp_mmc.sys
2011/02/03 09:34:10.0213 4496 sffp_sd (35e59ebe4a01a0532ed67975161c7b82) C:\Windows\system32\drivers\sffp_sd.sys
2011/02/03 09:34:10.0235 4496 sfloppy (6b7838c94135768bd455cbdc23e39e5f) C:\Windows\system32\drivers\sfloppy.sys
2011/02/03 09:34:10.0268 4496 SiSRaid2 (7a5de502aeb719d4594c6471060a78b3) C:\Windows\system32\drivers\sisraid2.sys
2011/02/03 09:34:10.0295 4496 SiSRaid4 (3a2f769fab9582bc720e11ea1dfb184d) C:\Windows\system32\drivers\sisraid4.sys
2011/02/03 09:34:10.0325 4496 Smb (41eb2e8e005feedcafce301983eff932) C:\Windows\system32\DRIVERS\smb.sys
2011/02/03 09:34:10.0367 4496 spldr (f9cb0672162f7f04248e2b82c1ff4617) C:\Windows\system32\drivers\spldr.sys
2011/02/03 09:34:10.0405 4496 SRTSP (7e4cc24a23262a84ae99dbffef69a6b0) C:\Windows\system32\Drivers\SRTSP64.SYS
2011/02/03 09:34:10.0433 4496 SRTSPL (8b1dedeba049a3e1daf8219eec87eb00) C:\Windows\system32\Drivers\SRTSPL64.SYS
2011/02/03 09:34:10.0455 4496 SRTSPX (3db35652e4460da6730bb44908fa39cb) C:\Windows\system32\Drivers\SRTSPX64.SYS
2011/02/03 09:34:10.0505 4496 srv (4adb9a620ff071ee7d17487a87861659) C:\Windows\system32\DRIVERS\srv.sys
2011/02/03 09:34:10.0536 4496 srv2 (2aea7a85ceb33abb332d35617990f50b) C:\Windows\system32\DRIVERS\srv2.sys
2011/02/03 09:34:10.0570 4496 srvnet (a93df8babf7c7b9637a76e0eae5744b7) C:\Windows\system32\DRIVERS\srvnet.sys
2011/02/03 09:34:10.0624 4496 swenum (8a851ca908b8b974f89c50d2e18d4f0c) C:\Windows\system32\DRIVERS\swenum.sys
2011/02/03 09:34:10.0653 4496 Symc8xx (2f26a2c6fc96b29beff5d8ed74e6625b) C:\Windows\system32\drivers\symc8xx.sys
2011/02/03 09:34:10.0702 4496 SYMDNS (002e73df2a07785e93943eefc16edb57) C:\Windows\System32\Drivers\SYMDNS.SYS
2011/02/03 09:34:10.0721 4496 SymEvent (209d2e4c78026eba547121e73dd82ebe) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2011/02/03 09:34:10.0745 4496 SYMFW (c785ca33d3dbcdf604e58c3a2eb1818a) C:\Windows\System32\Drivers\SYMFW.SYS
2011/02/03 09:34:10.0779 4496 SymIM (f78828b90bd5bb5bcd8500f9b08ba76f) C:\Windows\system32\DRIVERS\SymIMv.sys
2011/02/03 09:34:10.0806 4496 SYMNDISV (8357806b06b514f6edf9d10cfdce2853) C:\Windows\System32\Drivers\SYMNDISV.SYS
2011/02/03 09:34:10.0859 4496 SYMREDRV (e05fbad45a96fb25f58bb0a9538a337e) C:\Windows\System32\Drivers\SYMREDRV.SYS
2011/02/03 09:34:10.0887 4496 SYMTDI (a30def26951b77788a71b1033d275e65) C:\Windows\System32\Drivers\SYMTDI.SYS
2011/02/03 09:34:10.0924 4496 Sym_hi (a909667976d3bccd1df813fed517d837) C:\Windows\system32\drivers\sym_hi.sys
2011/02/03 09:34:10.0942 4496 Sym_u3 (36887b56ec2d98b9c362f6ae4de5b7b0) C:\Windows\system32\drivers\sym_u3.sys
2011/02/03 09:34:11.0021 4496 Tcpip (7d86275fb640011b372fd566c0eafa8d) C:\Windows\system32\drivers\tcpip.sys
2011/02/03 09:34:11.0080 4496 Tcpip6 (7d86275fb640011b372fd566c0eafa8d) C:\Windows\system32\DRIVERS\tcpip.sys
2011/02/03 09:34:11.0125 4496 tcpipreg (c29d4b3b08ad0b7e8564814e4ff6a57b) C:\Windows\system32\drivers\tcpipreg.sys
2011/02/03 09:34:11.0143 4496 TDPIPE (1d8bf4aaa5fb7a2761475781dc1195bc) C:\Windows\system32\drivers\tdpipe.sys
2011/02/03 09:34:11.0165 4496 TDTCP (7f7e00cdf609df657f4cda02dd1c9bb1) C:\Windows\system32\drivers\tdtcp.sys
2011/02/03 09:34:11.0187 4496 tdx (8c39c72e0e853de04748c0337d9b9216) C:\Windows\system32\DRIVERS\tdx.sys
2011/02/03 09:34:11.0213 4496 TermDD (3f0ebf6ee609f2a276c0d5faf244ec90) C:\Windows\system32\DRIVERS\termdd.sys
2011/02/03 09:34:11.0264 4496 tssecsrv (9e5409cd17c8bef193aad498f3bc2cb8) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/02/03 09:34:11.0293 4496 tunnel (f6a4fba7c03ac2efd00f3301c0c1e067) C:\Windows\system32\DRIVERS\tunnel.sys
2011/02/03 09:34:11.0318 4496 uagp35 (fec266ef401966311744bd0f359f7f56) C:\Windows\system32\drivers\uagp35.sys
2011/02/03 09:34:11.0347 4496 udfs (eca6629e33f122afff18a2ab7c3eb033) C:\Windows\system32\DRIVERS\udfs.sys
2011/02/03 09:34:11.0383 4496 uliagpkx (4ec9447ac3ab462647f60e547208ca00) C:\Windows\system32\drivers\uliagpkx.sys
2011/02/03 09:34:11.0414 4496 uliahci (697f0446134cdc8f99e69306184fbbb4) C:\Windows\system32\drivers\uliahci.sys
2011/02/03 09:34:11.0435 4496 UlSata (31707f09846056651ea2c37858f5ddb0) C:\Windows\system32\drivers\ulsata.sys
2011/02/03 09:34:11.0463 4496 ulsata2 (85e5e43ed5b48c8376281bab519271b7) C:\Windows\system32\drivers\ulsata2.sys
2011/02/03 09:34:11.0482 4496 umbus (46e9a994c4fed537dd951f60b86ad3f4) C:\Windows\system32\DRIVERS\umbus.sys
2011/02/03 09:34:11.0546 4496 usbccgp (07e3498fc60834219d2356293da0fecc) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/02/03 09:34:11.0585 4496 usbcir (9247f7e0b65852c1f6631480984d6ed2) C:\Windows\system32\drivers\usbcir.sys
2011/02/03 09:34:11.0609 4496 usbehci (da6d8d8ed0a53c63ac6f4bd40fe83fbe) C:\Windows\system32\DRIVERS\usbehci.sys
2011/02/03 09:34:11.0640 4496 usbhub (99045369ae3216216573d0775fd7ed56) C:\Windows\system32\DRIVERS\usbhub.sys
2011/02/03 09:34:11.0659 4496 usbohci (540b622da0949695c40cdc9d5d497a8b) C:\Windows\system32\DRIVERS\usbohci.sys
2011/02/03 09:34:11.0688 4496 usbprint (acfee697af477021bb3ec78c5431fed2) C:\Windows\system32\drivers\usbprint.sys
2011/02/03 09:34:11.0723 4496 USBSTOR (586d9876a4945779c8eea926c0d16889) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/02/03 09:34:11.0743 4496 usbuhci (b2872cbf9f47316abd0e0c74a1aba507) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/02/03 09:34:11.0776 4496 vga (916b94bcf1e09873fff2d5fb11767bbc) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/02/03 09:34:11.0798 4496 VgaSave (b83ab16b51feda65dd81b8c59d114d63) C:\Windows\System32\drivers\vga.sys
2011/02/03 09:34:11.0822 4496 viaide (8294b6c3fdb6c33f24e150de647ecdaa) C:\Windows\system32\drivers\viaide.sys
2011/02/03 09:34:11.0862 4496 volmgr (793d9b32a1c462c91f6f70358283ac97) C:\Windows\system32\drivers\volmgr.sys
2011/02/03 09:34:11.0888 4496 volmgrx (5aa217da5dc4ff5b9ac9ab86563b3223) C:\Windows\system32\drivers\volmgrx.sys
2011/02/03 09:34:11.0918 4496 volsnap (de4307412d98050239026e56a7dff3c0) C:\Windows\system32\drivers\volsnap.sys
2011/02/03 09:34:11.0939 4496 vsmraid (a68f455ed2673835209318dd61bfbb0e) C:\Windows\system32\drivers\vsmraid.sys
2011/02/03 09:34:11.0985 4496 WacomPen (fef8fe5923fead2cee4dfabfce3393a7) C:\Windows\system32\drivers\wacompen.sys
2011/02/03 09:34:12.0013 4496 Wanarp (aea75207e443c8623c36b8d03596f84f) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/03 09:34:12.0029 4496 Wanarpv6 (aea75207e443c8623c36b8d03596f84f) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/03 09:34:12.0065 4496 Wd (0c17a0816f65b89e362e682ad5e7266e) C:\Windows\system32\drivers\wd.sys
2011/02/03 09:34:12.0103 4496 Wdf01000 (d02e7e4567da1e7582fbf6a91144b0df) C:\Windows\system32\drivers\Wdf01000.sys
2011/02/03 09:34:12.0203 4496 WmiAcpi (e18aebaaa5a773fe11aa2c70f65320f5) C:\Windows\system32\drivers\wmiacpi.sys
2011/02/03 09:34:12.0258 4496 ws2ifsl (8a900348370e359b6bff6a550e4649e1) C:\Windows\system32\drivers\ws2ifsl.sys
2011/02/03 09:34:12.0314 4496 WUDFRd (501a65252617b495c0f1832f908d54d8) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/02/03 09:34:12.0383 4496 yukonx64 (b681cadb266b151061e7baa82b0d77b7) C:\Windows\system32\DRIVERS\yk60x64.sys
2011/02/03 09:34:12.0415 4496 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/02/03 09:34:12.0420 4496 ================================================================================
2011/02/03 09:34:12.0420 4496 Scan finished
2011/02/03 09:34:12.0420 4496 ================================================================================
2011/02/03 09:34:12.0435 3784 Detected object count: 1
2011/02/03 09:34:51.0685 3784 \HardDisk0 - will be cured after reboot
2011/02/03 09:34:51.0685 3784 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/02/03 09:35:16.0442 3600 Deinitialize success
MBRCheck, version 1.2.3
© 2010, AD
Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 64-bit
Base Board Manufacturer: Gateway
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: Gateway
System Product Name: DX4200-09
Logical Drives Mask: 0x000000fc
Kernel Drivers (total 156):
0x02418000 \SystemRoot\system32\ntoskrnl.exe
0x02930000 \SystemRoot\system32\hal.dll
0x00609000 \SystemRoot\system32\kdcom.dll
0x00613000 \SystemRoot\system32\PSHED.dll
0x00627000 \SystemRoot\system32\CLFS.SYS
0x00684000 \SystemRoot\system32\CI.dll
0x00809000 \SystemRoot\system32\drivers\Wdf01000.sys
0x008E3000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x008F1000 \SystemRoot\system32\drivers\acpi.sys
0x00947000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00950000 \SystemRoot\system32\drivers\msisadrv.sys
0x0095A000 \SystemRoot\system32\drivers\pci.sys
0x0098A000 \SystemRoot\System32\drivers\partmgr.sys
0x0099F000 \SystemRoot\system32\drivers\volmgr.sys
0x00736000 \SystemRoot\System32\drivers\volmgrx.sys
0x009B3000 \SystemRoot\system32\drivers\pciide.sys
0x009BA000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x009CA000 \SystemRoot\System32\drivers\mountmgr.sys
0x009DD000 \SystemRoot\system32\drivers\atapi.sys
0x0079C000 \SystemRoot\system32\drivers\ataport.SYS
0x00A04000 \SystemRoot\system32\drivers\fltmgr.sys
0x00A4A000 \SystemRoot\system32\drivers\fileinfo.sys
0x00A5E000 \SystemRoot\System32\Drivers\ksecdd.sys
0x00C04000 \SystemRoot\system32\drivers\ndis.sys
0x00AE5000 \SystemRoot\system32\drivers\msrpc.sys
0x00B35000 \SystemRoot\system32\drivers\NETIO.SYS
0x00E0D000 \SystemRoot\System32\drivers\tcpip.sys
0x00F81000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x0100E000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01192000 \SystemRoot\system32\drivers\volsnap.sys
0x011D6000 \SystemRoot\System32\Drivers\spldr.sys
0x011DE000 \SystemRoot\System32\Drivers\mup.sys
0x00FAD000 \SystemRoot\System32\drivers\ecache.sys
0x00FD9000 \SystemRoot\system32\drivers\disk.sys
0x00DC7000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x011F0000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x01000000 \SystemRoot\system32\drivers\crcdisk.sys
0x00DF3000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x00B8D000 \SystemRoot\system32\DRIVERS\processr.sys
0x04602000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x04C60000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x04D3F000 \SystemRoot\System32\drivers\watchdog.sys
0x04D4E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04D61000 \SystemRoot\system32\DRIVERS\yk60x64.sys
0x04DC6000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x04DD8000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x00BA0000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x04DE8000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0x04DF1000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x02004000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x0204A000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x0205B000 \SystemRoot\system32\DRIVERS\parport.sys
0x02077000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x0208D000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x0209B000 \SystemRoot\system32\DRIVERS\serial.sys
0x020B8000 \SystemRoot\system32\DRIVERS\serenum.sys
0x020C4000 \SystemRoot\system32\DRIVERS\agrsm64.sys
0x02000000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x00BBC000 \SystemRoot\system32\drivers\modem.sys
0x007C0000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x04E06000 \SystemRoot\system32\DRIVERS\storport.sys
0x04E63000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x04E70000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04E93000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04E9F000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x04ED0000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x04EE0000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04EFE000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x04F16000 \SystemRoot\system32\DRIVERS\termdd.sys
0x04F28000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x04F34000 \SystemRoot\system32\DRIVERS\swenum.sys
0x04F36000 \SystemRoot\system32\DRIVERS\ks.sys
0x04F6A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x04F75000 \SystemRoot\system32\DRIVERS\umbus.sys
0x04F85000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04FCC000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x05A02000 \SystemRoot\system32\drivers\HdAudio.sys
0x05A4B000 \SystemRoot\system32\drivers\portcls.sys
0x05A86000 \SystemRoot\system32\drivers\drmk.sys
0x05AA9000 \SystemRoot\system32\drivers\ksthunk.sys
0x05C0A000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x05D77000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x05D81000 \SystemRoot\System32\Drivers\Null.SYS
0x05D8A000 \SystemRoot\System32\drivers\vga.sys
0x05D98000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x05DBD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x05DC6000 \SystemRoot\system32\drivers\rdpencdd.sys
0x05DCF000 \SystemRoot\System32\Drivers\Msfs.SYS
0x05DDA000 \SystemRoot\System32\Drivers\Npfs.SYS
0x05DEB000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x05AAF000 \SystemRoot\system32\DRIVERS\tdx.sys
0x05ACC000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x05ADC000 \SystemRoot\System32\Drivers\SYMTDI.SYS
0x05B25000 \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
0x05B5B000 \SystemRoot\system32\DRIVERS\smb.sys
0x05B76000 \SystemRoot\system32\drivers\afd.sys
0x05DF4000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x05E08000 \SystemRoot\System32\DRIVERS\netbt.sys
0x05E4C000 \SystemRoot\system32\DRIVERS\pacer.sys
0x05E6A000 \SystemRoot\system32\DRIVERS\SymIMv.sys
0x05E74000 \SystemRoot\system32\DRIVERS\netbios.sys
0x05E83000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x05E9E000 \SystemRoot\System32\Drivers\SRTSPX64.SYS
0x05EB2000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x05F00000 \SystemRoot\system32\drivers\nsiproxy.sys
0x05F0C000 \??\C:\PROGRA~3\Symantec\DEFINI~1\SymcData\ipsdefs\20110126.001\IDSvia64.sys
0x05F72000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x05F7B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x05F8D000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x0600E000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
0x06084000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x0608F000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0x060B4000 \SystemRoot\System32\Drivers\dfsc.sys
0x060D1000 \SystemRoot\System32\Drivers\aswSP.SYS
0x0611A000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x06136000 \SystemRoot\system32\drivers\RTSTOR64.SYS
0x0614A000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x06166000 \SystemRoot\System32\Drivers\crashdmp.sys
0x06174000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x06180000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x00010000 \SystemRoot\System32\win32k.sys
0x06188000 \SystemRoot\System32\drivers\Dxapi.sys
0x06194000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00490000 \SystemRoot\System32\TSDDD.dll
0x006D0000 \SystemRoot\System32\cdd.dll
0x061A7000 \SystemRoot\system32\drivers\luafv.sys
0x05F95000 \??\C:\Windows\system32\drivers\aswMonFlt.sys
0x061C9000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0x061D2000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x00BCB000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x061E6000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x05FCF000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x07809000 \SystemRoot\system32\drivers\spsys.sys
0x078A3000 \SystemRoot\system32\drivers\HTTP.sys
0x07942000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x0796A000 \SystemRoot\system32\DRIVERS\bowser.sys
0x07988000 \SystemRoot\System32\drivers\mpsdrv.sys
0x079A2000 \SystemRoot\system32\drivers\mrxdav.sys
0x079C9000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x07E09000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x07E52000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x07E71000 \SystemRoot\System32\DRIVERS\srv2.sys
0x07EA3000 \SystemRoot\System32\DRIVERS\srv.sys
0x07F3A000 \SystemRoot\System32\Drivers\SYMREDRV.SYS
0x07F45000 \SystemRoot\System32\Drivers\SYMDNS.SYS
0x07F4E000 \SystemRoot\System32\Drivers\SYMNDISV.SYS
0x07F5C000 \SystemRoot\System32\Drivers\SYMFW.SYS
0x0880B000 \SystemRoot\system32\drivers\peauth.sys
0x088C1000 \SystemRoot\System32\Drivers\secdrv.SYS
0x088CC000 \SystemRoot\System32\drivers\tcpipreg.sys
0x088DB000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x088FB000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0x08911000 \SystemRoot\System32\Drivers\SRTSP64.SYS
0x08C00000 \??\C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20110202.022\EX64.SYS
0x08DBA000 \??\C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20110202.022\ENG64.SYS
0x77560000 \Windows\System32\ntdll.dll
Processes (total 67):
0 System Idle Process
4 System
468 C:\Windows\System32\smss.exe
552 csrss.exe
600 C:\Windows\System32\wininit.exe
620 csrss.exe
652 C:\Windows\System32\services.exe
664 C:\Windows\System32\lsass.exe
672 C:\Windows\System32\lsm.exe
780 C:\Windows\System32\winlogon.exe
868 C:\Windows\System32\svchost.exe
944 C:\Windows\System32\svchost.exe
1008 C:\Windows\System32\svchost.exe
296 C:\Windows\System32\Ati2evxx.exe
480 C:\Windows\System32\svchost.exe
524 C:\Windows\System32\svchost.exe
532 C:\Windows\System32\svchost.exe
1064 C:\Windows\System32\audiodg.exe
1096 C:\Windows\System32\svchost.exe
1112 C:\Windows\System32\SLsvc.exe
1172 C:\Windows\System32\svchost.exe
1312 C:\Windows\System32\svchost.exe
1404 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1416 C:\Windows\System32\Ati2evxx.exe
1868 C:\Windows\System32\spoolsv.exe
1892 C:\Program Files (x86)\Common Files\Symantec Shared\CCSVCHST.EXE
1320 C:\Windows\System32\svchost.exe
2208 C:\Windows\System32\taskeng.exe
2484 C:\Windows\System32\agr64svc.exe
2520 C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe
2668 C:\Windows\System32\svchost.exe
2712 C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2768 C:\Windows\System32\svchost.exe
2796 C:\Windows\System32\svchost.exe
2856 C:\Windows\System32\SearchIndexer.exe
2948 C:\Windows\System32\rundll32.exe
2968 WUDFHost.exe
2200 C:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe
3208 C:\Windows\System32\taskeng.exe
3216 C:\Windows\System32\dwm.exe
3304 C:\Windows\System32\taskeng.exe
3352 C:\Windows\explorer.exe
3396 C:\Windows\mHotkey.exe
3608 C:\Program Files\Windows Defender\MSASCui.exe
3616 C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
3636 C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
3776 C:\Program Files (x86)\Java\jre1.6.0_05\bin\jusched.exe
3784 C:\Program Files (x86)\Common Files\Symantec Shared\CCSVCHST.EXE
3792 C:\Program Files (x86)\Adobe\Reader 8.0\Reader\reader_sl.exe
3820 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
3836 C:\Windows\CNYHKey.exe
3844 C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe
3864 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
4024 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
3096 C:\Windows\ModLEDKey.exe
2784 C:\Windows\ChiFuncExt.exe
4612 C:\PROGRA~2\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
4716 WmiPrvSE.exe
4760 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
4252 WmiPrvSE.exe
3560 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
3180 C:\Windows\servicing\TrustedInstaller.exe
4388 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
4552 C:\Windows\System32\SearchProtocolHost.exe
5000 C:\Windows\System32\SearchFilterHost.exe
4396 C:\Windows\System32\wbem\WMIADAP.exe
5076 C:\Users\unseth\Downloads\MBRCheck.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`71200000 (NTFS)
PhysicalDrive0 Model Number: WDCWD6400AAKS-00A7B2, Rev: 01.03B01
Size Device Name MBR Status
--------------------------------------------
596 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 53902D02D6A9EDB1C16B4443A248CC81F6527D29
Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Done!
OTL logfile created on: 2/3/2011 9:43:41 AM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\unseth\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 55.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 586.40 Gb Total Space | 537.41 Gb Free Space | 91.64% Space Free | Partition Type: NTFS
Drive D: | 461.55 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: UNSETH-PC | User Name: unseth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ========== PRC - [2011/02/03 09:42:55 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\unseth\Downloads\OTL.exe
PRC - [2011/02/02 11:57:55 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2011/01/13 02:47:34 | 003,396,624 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/01/13 02:47:33 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011/01/07 21:35:52 | 000,991,800 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2010/01/15 06:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2008/11/03 15:31:05 | 001,245,064 | ---- | M] () -- C:\Program Files (x86)\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2008/10/17 17:52:10 | 000,149,352 | ---- | M] (Symantec Corporation) -- c:\Program Files (x86)\Common Files\Symantec Shared\CCSVCHST.EXE
PRC - [2008/05/30 12:50:28 | 000,581,120 | ---- | M] () -- C:\Windows\mHotkey.exe
PRC - [2008/05/21 16:36:36 | 000,053,248 | ---- | M] (IOI) -- C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe
PRC - [2008/04/24 16:18:48 | 000,057,344 | ---- | M] (Chicony) -- C:\Windows\ChiFuncExt.exe
PRC - [2008/04/24 15:44:28 | 000,354,304 | ---- | M] (Creative) -- C:\Windows\CNYHKey.exe
PRC - [2008/02/22 06:25:21 | 000,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Java\jre1.6.0_05\bin\jusched.exe
PRC - [2008/02/20 17:02:00 | 000,238,968 | ---- | M] (Symantec Corporation) -- c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2008/01/12 00:16:38 | 000,039,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Reader 8.0\Reader\reader_sl.exe
PRC - [2007/01/08 16:51:56 | 000,053,248 | ---- | M] (Chicony) -- C:\Windows\ModLEDKey.exe
========== Modules (SafeList) ========== MOD - [2011/02/03 09:42:55 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\unseth\Downloads\OTL.exe
MOD - [2011/01/13 02:47:35 | 000,189,728 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2010/08/31 09:39:57 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll
========== Win32 Services (SafeList) ========== SRV:
64bit: - [2011/01/13 02:47:33 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV:
64bit: - [2008/07/22 08:12:08 | 000,902,656 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\Ati2evxx.exe -- (Ati External Event Utility)
SRV:
64bit: - [2008/06/11 13:18:30 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe -- (ETService)
SRV:
64bit: - [2008/01/20 20:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:
64bit: - [2007/12/10 21:11:30 | 000,015,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\agr64svc.exe -- (AgereModemAudio)
SRV:
64bit: - [2006/11/02 05:16:05 | 000,046,592 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\rundll32.exe -- (yksvc)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/15 06:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2008/11/03 15:31:05 | 001,245,064 | ---- | M] () [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2008/10/17 17:52:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- c:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (LiveUpdate Notice)
SRV - [2008/10/17 17:52:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- c:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)
SRV - [2008/10/17 17:52:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- c:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2008/10/17 17:52:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- c:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2008/09/05 13:52:32 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- c:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
SRV - [2008/07/27 12:03:13 | 000,069,632 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/05/05 16:25:46 | 000,165,416 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2008/02/20 17:02:00 | 000,238,968 | ---- | M] (Symantec Corporation) [Auto | Running] -- c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2007/08/21 04:22:00 | 000,267,096 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Symantec Shared\VAScanner\comHost.exe -- (comHost)
========== Driver Services (SafeList) ========== DRV:
64bit: - [2011/02/02 14:30:37 | 000,172,080 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:
64bit: - [2011/01/13 02:37:23 | 000,062,032 | ---- | M] () [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:
64bit: - [2009/02/19 15:31:42 | 000,028,720 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\SymIMv.sys -- (SymIM)
DRV:
64bit: - [2009/02/19 15:31:18 | 000,047,664 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SYMNDISV.SYS -- (SYMNDISV)
DRV:
64bit: - [2009/02/19 15:31:00 | 000,266,800 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV:
64bit: - [2009/02/19 15:30:58 | 000,145,456 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SYMFW.SYS -- (SYMFW)
DRV:
64bit: - [2009/02/19 15:30:58 | 000,028,720 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV:
64bit: - [2009/02/19 15:30:58 | 000,016,432 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SYMDNS.SYS -- (SYMDNS)
DRV:
64bit: - [2008/08/05 02:03:00 | 000,392,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\yk60x64.sys -- (yukonx64)
DRV:
64bit: - [2008/07/30 19:55:06 | 000,025,424 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\COH_Mon.sys -- (COH_Mon)
DRV:
64bit: - [2008/07/22 08:58:24 | 004,647,936 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (atikmdag)
DRV:
64bit: - [2008/06/05 21:21:44 | 000,066,048 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTSTOR64.SYS -- (RTSTOR)
DRV:
64bit: - [2008/04/27 19:25:06 | 000,016,400 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV:
64bit: - [2008/04/17 15:12:54 | 000,019,304 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:
64bit: - [2008/03/05 00:22:34 | 001,253,376 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\agrsm64.sys -- (AgereSoftModem)
DRV:
64bit: - [2008/01/30 20:51:00 | 000,476,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SRTSPL64.SYS -- (SRTSPL)
DRV:
64bit: - [2008/01/30 20:51:00 | 000,440,880 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SRTSP64.SYS -- (SRTSP)
DRV:
64bit: - [2008/01/30 20:51:00 | 000,032,304 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\SRTSPX64.SYS -- (SRTSPX)
DRV:
64bit: - [2006/09/18 15:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\Wbem\ntfs.mof -- (Ntfs)
DRV - [2011/01/18 13:17:46 | 001,791,096 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20110202.022\EX64.SYS -- (NAVEX15)
DRV - [2011/01/18 13:17:46 | 000,475,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2011/01/18 13:17:46 | 000,132,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/01/18 13:17:46 | 000,117,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20110202.022\ENG64.SYS -- (NAVENG)
DRV - [2011/01/07 00:14:06 | 000,392,752 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Symantec\Definitions\SymcData\ipsdefs\20110126.001\IDSviA64.sys -- (IDSvia64)
DRV - [2008/06/11 13:13:24 | 000,017,952 | ---- | M] (Acer, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\int15_64.sys -- (int15)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:
64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0211&m=dx4200-09IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0211&m=dx4200-09 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.msn.com/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
O1 HOSTS File: ([2006/09/18 15:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:
64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:
64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg64.dll (Google Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files (x86)\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O3:
64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files (x86)\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll (Symantec Corporation)
O3:
64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files (x86)\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll (Symantec Corporation)
O4:
64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [ccApp] c:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [LchDrvKey] C:\Windows\LchDrvKey.exe ()
O4 - HKLM..\Run: [LedKey] C:\Windows\CNYHKey.exe (Creative)
O4 - HKLM..\Run: [osCheck] c:\Program Files (x86)\Norton 360\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Smart Copy] C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe (IOI)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:
64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10}
http://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab (Windows Live OneCare safety scanner control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18:
64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:
64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O20:
64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img11.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img11.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2000/09/07 14:06:55 | 000,000,027 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{6a9c5691-2ef3-11e0-b1fb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{6a9c5691-2ef3-11e0-b1fb-806e6f6e6963}\Shell\AutoRun\command - "" = D:\CDExtra.exe -- [2002/11/26 10:20:18 | 002,580,052 | R--- | M] (Macromedia, Inc.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:
64bit: - HKLM\..comfile [open] -- "%1" %*
O35:
64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:
64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:
64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ========== [2011/02/02 22:43:08 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/02/02 22:43:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2011/02/02 20:26:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011/02/02 20:24:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2011/02/02 20:23:29 | 000,038,848 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2011/02/02 20:23:28 | 000,188,216 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2011/02/02 20:23:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Alwil Software
[2011/02/02 20:23:20 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2011/02/02 20:02:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live Safety Center
[2011/02/02 15:44:02 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2011/02/02 15:41:24 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Adobe
[2011/02/02 15:06:55 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Local\Microsoft Games
[2011/02/02 14:46:21 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011/02/02 14:35:06 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Google
[2011/02/02 14:35:06 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Local\Google
[2011/02/02 14:28:08 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Symantec
[2011/02/02 14:28:04 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2011/02/02 14:28:04 | 000,000,000 | ---D | C] -- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2011/02/02 14:27:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2011/02/02 14:27:09 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Local\Adobe
[2011/02/02 14:25:40 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2011/02/02 14:25:40 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2011/02/02 14:25:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2011/02/02 14:25:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee Security Scan
[2011/02/02 14:16:18 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Macromedia
[2011/02/02 12:04:21 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Power2Go
[2011/02/02 12:04:08 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2011/02/02 12:02:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gateway
[2011/02/02 12:01:29 | 000,017,952 | ---- | C] (Acer, Inc.) -- C:\Windows\SysWow64\drivers\int15_64.sys
[2011/02/02 12:01:29 | 000,015,392 | ---- | C] (Acer, Inc.) -- C:\Windows\SysWow64\drivers\int15.sys
[2011/02/02 12:01:09 | 000,000,000 | ---D | C] -- C:\Program Files\GATEWAY
[2011/02/02 12:00:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Copy
[2011/02/02 12:00:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IOI
[2011/02/02 11:59:21 | 000,354,304 | ---- | C] (Creative) -- C:\Windows\CNYHKey.exe
[2011/02/02 11:59:21 | 000,053,248 | ---- | C] (Chicony) -- C:\Windows\ModLEDKey.exe
[2011/02/02 11:59:20 | 000,057,344 | ---- | C] (Chicony) -- C:\Windows\ChiFuncExt.exe
[2011/02/02 11:59:00 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Symantec
[2011/02/02 11:58:58 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\InstallShield
[2011/02/02 11:58:57 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\ATI
[2011/02/02 11:58:57 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Local\ATI
[2011/02/02 11:58:57 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2011/02/02 11:58:46 | 000,000,000 | R--D | C] -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/02/02 11:58:46 | 000,000,000 | R--D | C] -- C:\Users\unseth\Searches
[2011/02/02 11:58:46 | 000,000,000 | R--D | C] -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/02/02 11:58:39 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Identities
[2011/02/02 11:58:37 | 000,000,000 | R--D | C] -- C:\Users\unseth\Contacts
[2011/02/02 11:58:36 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Local\VirtualStore
[2011/02/02 11:58:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Application Data
[2011/02/02 11:58:00 | 000,000,000 | ---D | C] -- C:\Program Files\eBay
[2011/02/02 11:57:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2011/02/02 11:57:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2011/02/02 11:55:16 | 000,000,000 | --SD | C] -- C:\Users\unseth\AppData\Roaming\Microsoft
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\Videos
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\Saved Games
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\Pictures
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\Music
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\Links
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\Favorites
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\Downloads
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\Documents
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\Desktop
[2011/02/02 11:55:16 | 000,000,000 | R--D | C] -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\AppData\Local\Temporary Internet Files
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\Templates
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\Start Menu
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\SendTo
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\Recent
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\PrintHood
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\NetHood
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\Documents\My Videos
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\Documents\My Pictures
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\Documents\My Music
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\My Documents
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\Local Settings
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\AppData\Local\History
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\Cookies
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\Application Data
[2011/02/02 11:55:16 | 000,000,000 | -HSD | C] -- C:\Users\unseth\AppData\Local\Application Data
[2011/02/02 11:55:16 | 000,000,000 | -H-D | C] -- C:\Users\unseth\AppData
[2011/02/02 11:55:16 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Local\Temp
[2011/02/02 11:55:16 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Local\Microsoft
[2011/02/02 11:55:16 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Media Center Programs
[2011/02/02 11:55:16 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink MediaShow
[2011/02/02 11:55:16 | 000,000,000 | ---D | C] -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink LabelPrint
[2011/02/02 11:46:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2011/02/02 11:46:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2011/02/02 11:45:11 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2011/02/02 11:44:28 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2011/02/02 11:39:49 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2011/02/02 11:38:27 | 000,054,824 | ---- | C] (Agere Systems) -- C:\Windows\agrsmdel.exe
[2011/02/02 11:38:27 | 000,029,184 | ---- | C] (Agere Systems) -- C:\Windows\agrdel64.exe
========== Files - Modified Within 30 Days ========== [2011/02/03 09:42:54 | 000,703,388 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/02/03 09:42:54 | 000,604,264 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/02/03 09:42:54 | 000,103,964 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/02/03 09:39:01 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/03 09:38:46 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/03 09:36:53 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\LogConfigTemp.xml
[2011/02/03 09:36:33 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/03 09:36:32 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/03 09:36:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/03 09:36:10 | 4025,671,680 | -HS- | M] () -- C:\hiberfil.sys
[2011/02/03 00:53:33 | 551,778,020 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/02/03 00:17:31 | 000,000,000 | ---- | M] () -- C:\Users\unseth\defogger_reenable
[2011/02/02 23:49:18 | 000,002,561 | ---- | M] () -- C:\Users\unseth\Desktop\HiJackThis.lnk
[2011/02/02 20:26:48 | 000,002,027 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011/02/02 20:26:48 | 000,002,011 | ---- | M] () -- C:\Users\unseth\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/02/02 20:24:27 | 000,001,798 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/02/02 20:24:20 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2011/02/02 19:17:38 | 000,000,970 | ---- | M] () -- C:\Users\unseth\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/02/02 18:42:49 | 000,000,975 | ---- | M] () -- C:\Users\unseth\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/02/02 18:32:05 | 000,313,928 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/02/02 14:30:37 | 000,172,080 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2011/02/02 14:30:37 | 000,010,655 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2011/02/02 14:30:37 | 000,000,855 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2011/02/02 14:25:39 | 000,001,773 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2011/02/02 14:25:39 | 000,001,771 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/02/02 12:04:28 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\Gateway_DX4200-09_1.0_PTG040X007907024B82703.MRK
[2011/02/02 11:57:23 | 000,112,780 | ---- | M] () -- C:\Windows\SysNative\log.xml
[2011/02/02 11:50:37 | 000,047,092 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2011/02/02 11:45:52 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2011/02/02 11:44:29 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2011/01/13 02:47:35 | 000,038,848 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2011/01/13 02:47:32 | 000,188,216 | ---- | M] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2011/01/13 02:47:23 | 000,237,168 | ---- | M] () -- C:\Windows\SysNative\aswBoot.exe
[2011/01/13 02:41:44 | 000,273,488 | ---- | M] () -- C:\Windows\SysNative\drivers\aswSP.sys
[2011/01/13 02:40:20 | 000,051,792 | ---- | M] () -- C:\Windows\SysNative\drivers\aswTdi.sys
[2011/01/13 02:37:34 | 000,029,264 | ---- | M] () -- C:\Windows\SysNative\drivers\aswRdr.sys
[2011/01/13 02:37:23 | 000,062,032 | ---- | M] () -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2011/01/13 02:37:12 | 000,020,560 | ---- | M] () -- C:\Windows\SysNative\drivers\aswFsBlk.sys
========== Files Created - No Company Name ========== [2011/02/03 00:17:31 | 000,000,000 | ---- | C] () -- C:\Users\unseth\defogger_reenable
[2011/02/02 22:43:08 | 000,002,561 | ---- | C] () -- C:\Users\unseth\Desktop\HiJackThis.lnk
[2011/02/02 22:03:44 | 4025,671,680 | -HS- | C] () -- C:\hiberfil.sys
[2011/02/02 20:26:48 | 000,002,027 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011/02/02 20:26:48 | 000,002,011 | ---- | C] () -- C:\Users\unseth\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/02/02 20:24:27 | 000,001,798 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/02/02 20:24:26 | 000,020,560 | ---- | C] () -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2011/02/02 20:24:25 | 000,273,488 | ---- | C] () -- C:\Windows\SysNative\drivers\aswSP.sys
[2011/02/02 20:24:23 | 000,029,264 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRdr.sys
[2011/02/02 20:24:22 | 000,051,792 | ---- | C] () -- C:\Windows\SysNative\drivers\aswTdi.sys
[2011/02/02 20:24:20 | 000,062,032 | ---- | C] () -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2011/02/02 20:24:19 | 000,237,168 | ---- | C] () -- C:\Windows\SysNative\aswBoot.exe
[2011/02/02 20:24:19 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2011/02/02 20:23:34 | 000,428,804 | ---- | C] () -- C:\Users\unseth\AppData\Local\dd_vcredistMSI79E3.txt
[2011/02/02 20:23:32 | 000,011,714 | ---- | C] () -- C:\Users\unseth\AppData\Local\dd_vcredistUI79E3.txt
[2011/02/02 18:58:45 | 001,942,856 | ---- | C] () -- C:\Windows\SysNative\dfshim.dll
[2011/02/02 18:58:45 | 000,444,752 | ---- | C] () -- C:\Windows\SysNative\mscoree.dll
[2011/02/02 18:58:45 | 000,320,352 | ---- | C] () -- C:\Windows\SysNative\PresentationHost.exe
[2011/02/02 18:58:45 | 000,109,912 | ---- | C] () -- C:\Windows\SysNative\PresentationHostProxy.dll
[2011/02/02 18:58:45 | 000,048,960 | ---- | C] () -- C:\Windows\SysNative\netfxperf.dll
[2011/02/02 18:50:17 | 000,000,970 | ---- | C] () -- C:\Users\unseth\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/02/02 17:06:25 | 000,316,416 | ---- | C] () -- C:\Windows\SysNative\msshsq.dll
[2011/02/02 16:06:26 | 000,049,160 | ---- | C] () -- C:\Windows\SysNative\infocardcpl.cpl
[2011/02/02 16:06:22 | 000,011,264 | ---- | C] () -- C:\Windows\SysNative\icardres.dll
[2011/02/02 16:06:20 | 001,383,936 | ---- | C] () -- C:\Windows\SysNative\icardagt.exe
[2011/02/02 16:06:20 | 001,168,928 | ---- | C] () -- C:\Windows\SysNative\PresentationNative_v0300.dll
[2011/02/02 16:06:20 | 000,167,432 | ---- | C] () -- C:\Windows\SysNative\infocardapi.dll
[2011/02/02 16:06:13 | 000,126,520 | ---- | C] () -- C:\Windows\SysNative\PresentationCFFRasterizerNative_v0300.dll
[2011/02/02 15:58:11 | 000,158,208 | ---- | C] () -- C:\Windows\SysNative\mscorier.dll
[2011/02/02 15:58:08 | 000,076,288 | ---- | C] () -- C:\Windows\SysNative\mscories.dll
[2011/02/02 15:55:08 | 000,270,720 | ---- | C] () -- C:\Windows\SysNative\MpSigStub.exe
[2011/02/02 15:52:48 | 000,032,768 | ---- | C] () -- C:\Windows\SysNative\nshhttp.dll
[2011/02/02 15:52:45 | 000,610,304 | ---- | C] () -- C:\Windows\SysNative\drivers\http.sys
[2011/02/02 15:52:45 | 000,033,792 | ---- | C] () -- C:\Windows\SysNative\httpapi.dll
[2011/02/02 15:47:37 | 000,104,960 | ---- | C] () -- C:\Windows\SysNative\cabview.dll
[2011/02/02 15:47:36 | 000,218,112 | ---- | C] () -- C:\Windows\SysNative\wintrust.dll
[2011/02/02 15:45:14 | 000,227,328 | ---- | C] () -- C:\Windows\SysNative\mpg2splt.ax
[2011/02/02 15:45:14 | 000,101,376 | ---- | C] () -- C:\Windows\SysNative\MSNP.ax
[2011/02/02 15:45:11 | 000,558,592 | ---- | C] () -- C:\Windows\SysNative\EncDec.dll
[2011/02/02 15:45:11 | 000,375,808 | ---- | C] () -- C:\Windows\SysNative\psisdecd.dll
[2011/02/02 15:45:11 | 000,289,792 | ---- | C] () -- C:\Windows\SysNative\psisrndr.ax
[2011/02/02 15:42:19 | 000,057,560 | ---- | C] () -- C:\Windows\SysNative\wuauclt.exe
[2011/02/02 15:42:19 | 000,043,744 | ---- | C] () -- C:\Windows\SysNative\wups2.dll
[2011/02/02 15:42:18 | 002,621,440 | ---- | C] () -- C:\Windows\SysNative\wucltux.dll
[2011/02/02 15:42:18 | 002,424,024 | ---- | C] () -- C:\Windows\SysNative\wuaueng.dll
[2011/02/02 15:42:07 | 000,700,640 | ---- | C] () -- C:\Windows\SysNative\wuapi.dll
[2011/02/02 15:42:07 | 000,098,816 | ---- | C] () -- C:\Windows\SysNative\wudriver.dll
[2011/02/02 15:42:07 | 000,038,112 | ---- | C] () -- C:\Windows\SysNative\wups.dll
[2011/02/02 15:41:53 | 000,185,416 | ---- | C] () -- C:\Windows\SysNative\wuwebv.dll
[2011/02/02 15:41:53 | 000,036,864 | ---- | C] () -- C:\Windows\SysNative\wuapp.exe
[2011/02/02 15:33:58 | 001,638,912 | ---- | C] () -- C:\Windows\SysNative\mshtml.tlb
[2011/02/02 15:33:58 | 001,062,912 | ---- | C] () -- C:\Windows\SysNative\mstime.dll
[2011/02/02 15:33:58 | 000,096,768 | ---- | C] () -- C:\Windows\SysNative\mshtmled.dll
[2011/02/02 15:33:57 | 000,243,712 | ---- | C] () -- C:\Windows\SysNative\occache.dll
[2011/02/02 15:33:56 | 000,252,416 | ---- | C] () -- C:\Windows\SysNative\iepeers.dll
[2011/02/02 15:33:56 | 000,219,136 | ---- | C] () -- C:\Windows\SysNative\ieui.dll
[2011/02/02 15:33:56 | 000,071,680 | ---- | C] () -- C:\Windows\SysNative\msfeedsbs.dll
[2011/02/02 15:33:56 | 000,056,832 | ---- | C] () -- C:\Windows\SysNative\licmgr10.dll
[2011/02/02 15:33:56 | 000,031,744 | ---- | C] () -- C:\Windows\SysNative\jsproxy.dll
[2011/02/02 15:33:55 | 001,486,848 | ---- | C] () -- C:\Windows\SysNative\urlmon.dll
[2011/02/02 15:33:55 | 000,710,656 | ---- | C] () -- C:\Windows\SysNative\msfeeds.dll
[2011/02/02 15:33:54 | 001,147,904 | ---- | C] () -- C:\Windows\SysNative\wininet.dll
[2011/02/02 15:33:54 | 000,162,816 | ---- | C] () -- C:\Windows\SysNative\ieUnatt.exe
[2011/02/02 15:33:54 | 000,132,096 | ---- | C] () -- C:\Windows\SysNative\iesysprep.dll
[2011/02/02 15:33:54 | 000,077,312 | ---- | C] () -- C:\Windows\SysNative\iesetup.dll
[2011/02/02 15:33:54 | 000,072,192 | ---- | C] () -- C:\Windows\SysNative\iernonce.dll
[2011/02/02 15:33:54 | 000,070,656 | ---- | C] () -- C:\Windows\SysNative\ie4uinit.exe
[2011/02/02 15:33:54 | 000,057,667 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2011/02/02 15:33:54 | 000,057,667 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2011/02/02 15:33:54 | 000,012,288 | ---- | C] () -- C:\Windows\SysNative\msfeedssync.exe
[2011/02/02 15:33:53 | 000,479,232 | ---- | C] () -- C:\Windows\SysNative\html.iec
[2011/02/02 15:33:53 | 000,459,776 | ---- | C] () -- C:\Windows\SysNative\iedkcs32.dll
[2011/02/02 15:33:52 | 002,340,864 | ---- | C] () -- C:\Windows\SysNative\iertutil.dll
[2011/02/02 15:33:51 | 001,538,560 | ---- | C] () -- C:\Windows\SysNative\inetcpl.cpl
[2011/02/02 15:33:50 | 012,474,368 | ---- | C] () -- C:\Windows\SysNative\ieframe.dll
[2011/02/02 15:33:48 | 009,259,520 | ---- | C] () -- C:\Windows\SysNative\mshtml.dll
[2011/02/02 15:32:02 | 000,161,792 | ---- | C] () -- C:\Windows\SysNative\advpack.dll
[2011/02/02 15:32:02 | 000,088,064 | ---- | C] () -- C:\Windows\SysNative\admparse.dll
[2011/02/02 15:32:02 | 000,085,504 | ---- | C] () -- C:\Windows\SysNative\icardie.dll
[2011/02/02 15:32:02 | 000,022,528 | ---- | C] () -- C:\Windows\SysNative\corpol.dll
[2011/02/02 15:32:01 | 000,223,232 | ---- | C] () -- C:\Windows\SysNative\msls31.dll
[2011/02/02 15:32:01 | 000,157,696 | ---- | C] () -- C:\Windows\SysNative\ieakeng.dll
[2011/02/02 15:32:01 | 000,077,824 | ---- | C] () -- C:\Windows\SysNative\tdc.ocx
[2011/02/02 15:32:00 | 000,125,952 | ---- | C] () -- C:\Windows\SysNative\inseng.dll
[2011/02/02 15:32:00 | 000,076,288 | ---- | C] () -- C:\Windows\SysNative\wextract.exe
[2011/02/02 15:32:00 | 000,052,736 | ---- | C] () -- C:\Windows\SysNative\imgutil.dll
[2011/02/02 15:31:59 | 000,481,280 | ---- | C] () -- C:\Windows\SysNative\ieapfltr.dll
[2011/02/02 15:31:59 | 000,063,488 | ---- | C] () -- C:\Windows\SysNative\pngfilt.dll
[2011/02/02 15:31:58 | 000,508,416 | ---- | C] () -- C:\Windows\SysNative\dxtmsft.dll
[2011/02/02 15:31:58 | 000,318,464 | ---- | C] () -- C:\Windows\SysNative\dxtrans.dll
[2011/02/02 15:31:57 | 000,304,640 | ---- | C] () -- C:\Windows\SysNative\webcheck.dll
[2011/02/02 15:31:57 | 000,271,872 | ---- | C] () -- C:\Windows\SysNative\ieaksie.dll
[2011/02/02 15:31:56 | 000,278,528 | ---- | C] () -- C:\Windows\SysNative\WinFXDocObj.exe
[2011/02/02 15:31:56 | 000,241,664 | ---- | C] () -- C:\Windows\SysNative\msrating.dll
[2011/02/02 15:31:56 | 000,163,840 | ---- | C] () -- C:\Windows\SysNative\ieakui.dll
[2011/02/02 15:31:56 | 000,131,584 | ---- | C] () -- C:\Windows\SysNative\PDMSetup.exe
[2011/02/02 15:31:56 | 000,129,024 | ---- | C] () -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2011/02/02 15:31:56 | 000,128,512 | ---- | C] () -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2011/02/02 15:31:56 | 000,125,440 | ---- | C] () -- C:\Windows\SysNative\SetDepNx.exe
[2011/02/02 15:31:56 | 000,041,984 | ---- | C] () -- C:\Windows\SysNative\mshta.exe
[2011/02/02 15:31:55 | 000,817,664 | ---- | C] () -- C:\Windows\SysNative\jscript.dll
[2011/02/02 15:31:55 | 000,612,864 | ---- | C] () -- C:\Windows\SysNative\vbscript.dll
[2011/02/02 15:31:55 | 000,108,032 | ---- | C] () -- C:\Windows\SysNative\url.dll
[2011/02/02 15:31:55 | 000,048,128 | ---- | C] () -- C:\Windows\SysNative\mshtmler.dll
[2011/02/02 15:31:54 | 003,698,584 | ---- | C] () -- C:\Windows\SysNative\ieapfltr.dat
[2011/02/02 15:31:53 | 000,193,536 | ---- | C] () -- C:\Windows\SysNative\iexpress.exe
[2011/02/02 15:21:43 | 000,176,640 | ---- | C] () -- C:\Windows\SysNative\Faultrep.dll
[2011/02/02 15:21:43 | 000,120,832 | ---- | C] () -- C:\Windows\SysNative\wersvc.dll
[2011/02/02 15:21:42 | 000,087,552 | ---- | C] () -- C:\Windows\SysNative\consent.exe
[2011/02/02 15:21:41 | 001,875,456 | ---- | C] () -- C:\Windows\SysNative\msxml3.dll
[2011/02/02 15:21:39 | 000,841,216 | ---- | C] () -- C:\Windows\SysNative\WindowsCodecs.dll
[2011/02/02 15:21:39 | 000,470,016 | ---- | C] () -- C:\Windows\SysNative\PhotoMetadataHandler.dll
[2011/02/02 15:21:39 | 000,386,560 | ---- | C] () -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2011/02/02 15:21:36 | 000,054,272 | ---- | C] () -- C:\Windows\SysNative\iyuv_32.dll
[2011/02/02 15:21:36 | 000,038,400 | ---- | C] () -- C:\Windows\SysNative\msvidc32.dll
[2011/02/02 15:21:35 | 000,108,544 | ---- | C] () -- C:\Windows\SysNative\avifil32.dll
[2011/02/02 15:21:35 | 000,093,184 | ---- | C] () -- C:\Windows\SysNative\mciavi32.dll
[2011/02/02 15:21:35 | 000,076,800 | ---- | C] () -- C:\Windows\SysNative\avicap32.dll
[2011/02/02 15:21:35 | 000,025,600 | ---- | C] () -- C:\Windows\SysNative\msyuv.dll
[2011/02/02 15:21:35 | 000,015,872 | ---- | C] () -- C:\Windows\SysNative\msrle32.dll
[2011/02/02 15:21:35 | 000,013,824 | ---- | C] () -- C:\Windows\SysNative\tsbyuv.dll
[2011/02/02 15:21:34 | 000,143,360 | ---- | C] () -- C:\Windows\SysNative\msvfw32.dll
[2011/02/02 15:21:23 | 000,141,312 | ---- | C] () -- C:\Windows\SysNative\netiohlp.dll
[2011/02/02 15:21:22 | 000,032,256 | ---- | C] () -- C:\Windows\SysNative\NETSTAT.EXE
[2011/02/02 15:21:22 | 000,023,040 | ---- | C] () -- C:\Windows\SysNative\ARP.EXE
[2011/02/02 15:21:22 | 000,012,800 | ---- | C] () -- C:\Windows\SysNative\MRINFO.EXE
[2011/02/02 15:21:21 | 000,021,504 | ---- | C] () -- C:\Windows\SysNative\ROUTE.EXE
[2011/02/02 15:21:21 | 000,011,264 | ---- | C] () -- C:\Windows\SysNative\finger.exe
[2011/02/02 15:21:21 | 000,010,752 | ---- | C] () -- C:\Windows\SysNative\TCPSVCS.EXE
[2011/02/02 15:21:21 | 000,010,240 | ---- | C] () -- C:\Windows\SysNative\HOSTNAME.EXE
[2011/02/02 15:21:20 | 000,017,920 | ---- | C] () -- C:\Windows\SysNative\netevent.dll
[2011/02/02 15:20:54 | 001,692,160 | ---- | C] () -- C:\Windows\SysNative\lsasrv.dll
[2011/02/02 15:20:54 | 000,515,656 | ---- | C] () -- C:\Windows\SysNative\drivers\ksecdd.sys
[2011/02/02 15:20:54 | 000,268,800 | ---- | C] () -- C:\Windows\SysNative\msv1_0.dll
[2011/02/02 15:20:54 | 000,205,312 | ---- | C] () -- C:\Windows\SysNative\wdigest.dll
[2011/02/02 15:20:54 | 000,094,720 | ---- | C] () -- C:\Windows\SysNative\secur32.dll
[2011/02/02 15:20:53 | 000,011,264 | ---- | C] () -- C:\Windows\SysNative\lsass.exe
[2011/02/02 15:20:52 | 000,557,056 | ---- | C] () -- C:\Windows\SysNative\wmpeffects.dll
[2011/02/02 15:20:50 | 000,295,936 | ---- | C] () -- C:\Windows\SysNative\raschap.dll
[2011/02/02 15:20:50 | 000,280,576 | ---- | C] () -- C:\Windows\SysNative\rastls.dll
[2011/02/02 15:20:47 | 000,462,848 | ---- | C] () -- C:\Windows\SysNative\odbc32.dll
[2011/02/02 15:20:41 | 001,794,560 | ---- | C] () -- C:\Windows\SysNative\msxml6.dll
[2011/02/02 15:19:49 | 002,900,480 | ---- | C] () -- C:\Windows\SysNative\WMVCORE.DLL
[2011/02/02 15:19:48 | 003,547,136 | ---- | C] () -- C:\Windows\SysNative\mf.dll
[2011/02/02 15:19:46 | 001,090,048 | ---- | C] () -- C:\Windows\SysNative\wmpmde.dll
[2011/02/02 15:19:40 | 000,974,848 | ---- | C] () -- C:\Windows\SysNative\inetcomm.dll
[2011/02/02 15:19:37 | 000,141,824 | ---- | C] () -- C:\Windows\SysNative\drivers\srvnet.sys
[2011/02/02 15:19:36 | 002,608,803 | ---- | C] () -- C:\Windows\SysNative\wlan.tmf
[2011/02/02 15:19:35 | 000,376,832 | ---- | C] () -- C:\Windows\SysNative\wlansec.dll
[2011/02/02 15:19:35 | 000,353,280 | ---- | C] () -- C:\Windows\SysNative\wlanmsm.dll
[2011/02/02 15:19:35 | 000,157,184 | ---- | C] () -- C:\Windows\SysNative\L2SecHC.dll
[2011/02/02 15:19:34 | 000,615,936 | ---- | C] () -- C:\Windows\SysNative\wlansvc.dll
[2011/02/02 15:19:34 | 000,097,792 | ---- | C] () -- C:\Windows\SysNative\wlanhlp.dll
[2011/02/02 15:19:34 | 000,086,528 | ---- | C] () -- C:\Windows\SysNative\wlanapi.dll
[2011/02/02 15:19:33 | 000,324,608 | ---- | C] () -- C:\Windows\SysNative\PortableDeviceApi.dll
[2011/02/02 15:19:31 | 000,267,776 | ---- | C] () -- C:\Windows\SysNative\spoolsv.exe
[2011/02/02 15:19:29 | 000,818,688 | ---- | C] () -- C:\Windows\SysNative\WMSPDMOD.DLL
[2011/02/02 15:19:27 | 000,273,920 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb10.sys
[2011/02/02 15:19:27 | 000,135,168 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb.sys
[2011/02/02 15:19:27 | 000,105,472 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb20.sys
[2011/02/02 15:19:26 | 000,202,752 | ---- | C] () -- C:\Windows\SysNative\wkssvc.dll
[2011/02/02 15:19:24 | 000,622,080 | ---- | C] () -- C:\Windows\SysNative\usp10.dll
[2011/02/02 15:19:20 | 001,245,184 | ---- | C] () -- C:\Windows\SysNative\WMNetMgr.dll
[2011/02/02 15:19:19 | 000,112,640 | ---- | C] () -- C:\Windows\SysNative\logagent.exe
[2011/02/02 15:19:00 | 000,372,736 | ---- | C] () -- C:\Windows\SysNative\unregmp2.exe
[2011/02/02 15:18:31 | 001,030,656 | ---- | C] () -- C:\Windows\SysNative\printfilterpipelinesvc.exe
[2011/02/02 15:18:31 | 000,718,336 | ---- | C] () -- C:\Windows\SysNative\rpcss.dll
[2011/02/02 15:18:29 | 000,231,424 | ---- | C] () -- C:\Windows\SysNative\sdohlp.dll
[2011/02/02 15:18:29 | 000,163,840 | ---- | C] () -- C:\Windows\SysNative\iasrecst.dll
[2011/02/02 15:18:29 | 000,075,776 | ---- | C] () -- C:\Windows\SysNative\iasads.dll
[2011/02/02 15:18:29 | 000,061,440 | ---- | C] () -- C:\Windows\SysNative\iasdatastore.dll
[2011/02/02 15:18:29 | 000,036,352 | ---- | C] () -- C:\Windows\SysNative\printfilterpipelineprxy.dll
[2011/02/02 15:18:29 | 000,024,576 | ---- | C] () -- C:\Windows\SysNative\iashost.exe
[2011/02/02 15:18:14 | 012,898,304 | ---- | C] () -- C:\Windows\SysNative\shell32.dll
[2011/02/02 15:17:46 | 013,425,152 | ---- | C] () -- C:\Windows\SysNative\wmp.dll
[2011/02/02 15:17:42 | 008,147,968 | ---- | C] () -- C:\Windows\SysNative\wmploc.DLL
[2011/02/02 15:17:28 | 000,462,848 | ---- | C] () -- C:\Windows\SysNative\drivers\srv.sys
[2011/02/02 15:17:28 | 000,174,592 | ---- | C] () -- C:\Windows\SysNative\drivers\srv2.sys
[2011/02/02 15:17:26 | 001,208,832 | ---- | C] () -- C:\Windows\SysNative\kernel32.dll
[2011/02/02 15:17:24 | 000,025,600 | ---- | C] () -- C:\Windows\SysNative\amxread.dll
[2011/02/02 15:17:24 | 000,015,872 | ---- | C] () -- C:\Windows\SysNative\apilogen.dll
[2011/02/02 15:17:22 | 001,420,176 | ---- | C] () -- C:\Windows\SysNative\drivers\tcpip.sys
[2011/02/02 15:17:19 | 004,690,832 | ---- | C] () -- C:\Windows\SysNative\ntoskrnl.exe
[2011/02/02 15:17:17 | 000,633,856 | ---- | C] () -- C:\Windows\SysNative\comctl32.dll
[2011/02/02 15:17:15 | 000,050,688 | ---- | C] () -- C:\Windows\SysNative\rtutils.dll
[2011/02/02 15:17:09 | 000,002,048 | ---- | C] () -- C:\Windows\SysNative\tzres.dll
[2011/02/02 15:16:57 | 001,923,584 | ---- | C] () -- C:\Windows\SysNative\ole32.dll
[2011/02/02 15:16:54 | 000,189,952 | ---- | C] () -- C:\Windows\SysNative\t2embed.dll
[2011/02/02 15:16:52 | 000,367,104 | ---- | C] () -- C:\Windows\SysNative\atmfd.dll
[2011/02/02 15:16:51 | 000,096,256 | ---- | C] () -- C:\Windows\SysNative\fontsub.dll
[2011/02/02 15:16:51 | 000,048,128 | ---- | C] () -- C:\Windows\SysNative\atmlib.dll
[2011/02/02 15:16:43 | 000,295,424 | ---- | C] () -- C:\Windows\SysNative\MP4SDECD.DLL
[2011/02/02 15:16:42 | 000,388,608 | ---- | C] () -- C:\Windows\SysNative\gdi32.dll
[2011/02/02 15:15:50 | 000,594,944 | ---- | C] () -- C:\Windows\SysNative\RMActivate_isv.exe
[2011/02/02 15:15:50 | 000,594,432 | ---- | C] () -- C:\Windows\SysNative\RMActivate.exe
[2011/02/02 15:15:49 | 000,535,040 | ---- | C] () -- C:\Windows\SysNative\secproc.dll
[2011/02/02 15:15:49 | 000,534,016 | ---- | C] () -- C:\Windows\SysNative\secproc_isv.dll
[2011/02/02 15:15:49 | 000,413,696 | ---- | C] () -- C:\Windows\SysNative\RMActivate_ssp_isv.exe
[2011/02/02 15:15:49 | 000,409,600 | ---- | C] () -- C:\Windows\SysNative\RMActivate_ssp.exe
[2011/02/02 15:15:48 | 000,457,216 | ---- | C] () -- C:\Windows\SysNative\msdrm.dll
[2011/02/02 15:15:48 | 000,159,232 | ---- | C] () -- C:\Windows\SysNative\secproc_ssp_isv.dll
[2011/02/02 15:15:48 | 000,158,720 | ---- | C] () -- C:\Windows\SysNative\secproc_ssp.dll
[2011/02/02 15:15:45 | 000,437,248 | ---- | C] () -- C:\Windows\SysNative\WSDApi.dll
[2011/02/02 15:15:43 | 001,280,512 | ---- | C] () -- C:\Windows\SysNative\rpcrt4.dll
[2011/02/02 15:15:32 | 000,368,128 | ---- | C] () -- C:\Windows\SysNative\wmpdxm.dll
[2011/02/02 15:15:30 | 000,009,216 | ---- | C] () -- C:\Windows\SysNative\spwmp.dll
[2011/02/02 15:15:29 | 000,005,120 | ---- | C] () -- C:\Windows\SysNative\msdxm.ocx
[2011/02/02 15:15:29 | 000,005,120 | ---- | C] () -- C:\Windows\SysNative\dxmasf.dll
[2011/02/02 15:15:28 | 000,043,520 | ---- | C] () -- C:\Windows\SysNative\msdxm.tlb
[2011/02/02 15:15:28 | 000,018,432 | ---- | C] () -- C:\Windows\SysNative\amcompat.tlb
[2011/02/02 15:15:26 | 000,660,480 | ---- | C] () -- C:\Windows\SysNative\win32spl.dll
[2011/02/02 15:15:17 | 000,791,552 | ---- | C] () -- C:\Windows\SysNative\localspl.dll
[2011/02/02 15:15:13 | 000,088,576 | ---- | C] () -- C:\Windows\SysNative\atl.dll
[2011/02/02 15:15:12 | 000,084,480 | ---- | C] () -- C:\Windows\SysNative\asycfilt.dll
[2011/02/02 15:15:10 | 000,656,384 | ---- | C] () -- C:\Windows\SysNative\kerberos.dll
[2011/02/02 15:15:03 | 002,423,296 | ---- | C] () -- C:\Windows\SysNative\mstscax.dll
[2011/02/02 15:12:55 | 000,730,112 | ---- | C] () -- C:\Windows\SysNative\msdtcprx.dll
[2011/02/02 15:12:55 | 000,048,640 | ---- | C] () -- C:\Windows\SysNative\xolehlp.dll
[2011/02/02 15:12:54 | 002,751,488 | ---- | C] () -- C:\Windows\SysNative\win32k.sys
[2011/02/02 15:12:52 | 000,072,192 | ---- | C] () -- C:\Windows\SysNative\l3codeca.acm
[2011/02/02 15:12:51 | 000,880,640 | ---- | C] () -- C:\Windows\SysNative\timedate.cpl
[2011/02/02 15:12:48 | 000,082,944 | ---- | C] () -- C:\Windows\SysNative\msasn1.dll
[2011/02/02 15:12:47 | 001,570,816 | ---- | C] () -- C:\Windows\SysNative\quartz.dll
[2011/02/02 15:12:46 | 001,691,648 | ---- | C] () -- C:\Windows\SysNative\connect.dll
[2011/02/02 15:12:45 | 000,883,200 | ---- | C] () -- C:\Windows\SysNative\drivers\dxgkrnl.sys
[2011/02/02 15:12:45 | 000,399,872 | ---- | C] () -- C:\Windows\SysNative\emdmgmt.dll
[2011/02/02 15:12:45 | 000,187,392 | ---- | C] () -- C:\Windows\SysNative\drivers\nwifi.sys
[2011/02/02 15:12:45 | 000,048,640 | ---- | C] () -- C:\Windows\SysNative\dataclen.dll
[2011/02/02 15:12:45 | 000,047,104 | ---- | C] () -- C:\Windows\SysNative\cdd.dll
[2011/02/02 15:09:16 | 000,648,704 | ---- | C] () -- C:\Windows\SysNative\netapi32.dll
[2011/02/02 15:09:11 | 001,251,840 | ---- | C] () -- C:\Windows\SysNative\sdclt.exe
[2011/02/02 15:09:08 | 000,032,256 | ---- | C] () -- C:\Windows\SysNative\Apphlpdm.dll
[2011/02/02 15:09:07 | 004,240,384 | ---- | C] () -- C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2011/02/02 15:08:41 | 000,854,528 | ---- | C] () -- C:\Windows\SysNative\schedsvc.dll
[2011/02/02 15:08:41 | 000,655,872 | ---- | C] () -- C:\Windows\SysNative\taskschd.dll
[2011/02/02 15:08:41 | 000,499,712 | ---- | C] () -- C:\Windows\SysNative\wmicmiplugin.dll
[2011/02/02 15:08:40 | 000,410,112 | ---- | C] () -- C:\Windows\SysNative\taskcomp.dll
[2011/02/02 15:08:40 | 000,267,776 | ---- | C] () -- C:\Windows\SysNative\taskeng.exe
[2011/02/02 15:08:38 | 000,343,040 | ---- | C] () -- C:\Windows\SysNative\schannel.dll
[2011/02/02 15:08:34 | 000,439,808 | ---- | C] () -- C:\Windows\SysNative\winhttp.dll
[2011/02/02 15:02:24 | 000,049,152 | ---- | C] () -- C:\Windows\CNYUSB.dll
[2011/02/02 14:46:01 | 551,778,020 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/02/02 14:34:34 | 000,000,975 | ---- | C] () -- C:\Users\unseth\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/02/02 14:28:04 | 000,126,312 | ---- | C] () -- C:\Windows\SysNative\GEARAspi64.dll
[2011/02/02 14:28:04 | 000,019,304 | ---- | C] () -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2011/02/02 14:26:28 | 000,025,424 | ---- | C] () -- C:\Windows\SysNative\drivers\COH_Mon.sys
[2011/02/02 14:26:28 | 000,010,557 | ---- | C] () -- C:\Windows\SysNative\drivers\COH_Mon.cat
[2011/02/02 14:25:39 | 000,001,773 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2011/02/02 14:25:39 | 000,001,771 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/02/02 14:21:49 | 000,000,898 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/02 14:21:49 | 000,000,894 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/02 12:04:28 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\Gateway_DX4200-09_1.0_PTG040X007907024B82703.MRK
[2011/02/02 12:01:39 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\LogConfigTemp.xml
[2011/02/02 12:01:38 | 000,585,216 | ---- | C] () -- C:\Windows\SysNative\INT15_64.dll
[2011/02/02 12:01:38 | 000,017,952 | ---- | C] () -- C:\Windows\SysNative\drivers\int15_64.sys
[2011/02/02 11:59:51 | 006,416,928 | ---- | C] () -- C:\Windows\System\DriveIcon.dll
[2011/02/02 11:59:51 | 000,066,048 | ---- | C] () -- C:\Windows\SysNative\drivers\RTSTOR64.sys
[2011/02/02 11:59:51 | 000,005,430 | ---- | C] () -- C:\Windows\System\MyMulti.ico
[2011/02/02 11:59:21 | 000,581,120 | ---- | C] () -- C:\Windows\mHotkey.exe
[2011/02/02 11:59:21 | 000,003,088 | ---- | C] () -- C:\Windows\MODLED.xml
[2011/02/02 11:59:21 | 000,003,084 | ---- | C] () -- C:\Windows\mHotkey.xml
[2011/02/02 11:59:21 | 000,000,870 | ---- | C] () -- C:\Windows\mhotkey_reg.ini
[2011/02/02 11:59:20 | 000,294,912 | ---- | C] () -- C:\Windows\PIC.dll
[2011/02/02 11:59:20 | 000,036,864 | ---- | C] () -- C:\Windows\LchDrvKey.exe
[2011/02/02 11:58:52 | 000,000,951 | ---- | C] () -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011/02/02 11:58:48 | 000,000,981 | ---- | C] () -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/02/02 11:58:46 | 000,000,976 | ---- | C] () -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011/02/02 11:58:37 | 000,000,917 | ---- | C] () -- C:\Users\unseth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2011/02/02 11:57:23 | 000,112,780 | ---- | C] () -- C:\Windows\SysNative\log.xml
[2011/02/02 11:55:16 | 000,000,258 | ---- | C] () -- C:\Users\unseth\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2011/02/02 11:55:16 | 000,000,240 | ---- | C] () -- C:\Users\unseth\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2011/02/02 11:45:52 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/02/02 11:44:29 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2011/02/02 11:38:27 | 001,253,376 | ---- | C] () -- C:\Windows\SysNative\drivers\agrsm64.sys
[2011/02/02 11:38:27 | 000,014,336 | ---- | C] () -- C:\Windows\SysNative\agrsco64.dll
[2008/01/20 20:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008/01/20 20:49:49 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
========== LOP Check ========== [2011/02/03 09:35:25 | 000,021,582 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS >[2008/01/20 20:46:51 | 000,064,568 | ---- | M] () MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\SysNative\drivers\AGP440.sys
[2008/01/20 20:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
< MD5 for: ATAPI.SYS >[2008/01/20 20:46:50 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
[2008/02/21 23:29:46 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=2297D8A0E2F3E1BA55E1538BA33B9E86 -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.22120_none_39cac090f315177e\atapi.sys
[2008/02/21 23:30:43 | 000,022,584 | ---- | M] () MD5=62BD869AFA2BF2E30F9D3FF428C87D5C -- C:\Windows\SysNative\drivers\atapi.sys
[2008/02/21 23:30:43 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=62BD869AFA2BF2E30F9D3FF428C87D5C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18023_none_394424a3d9f4c3b9\atapi.sys
< MD5 for: CNGAUDIT.DLL >[2006/11/02 05:16:48 | 000,014,848 | ---- | M] () MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\SysNative\cngaudit.dll
[2006/11/02 05:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006/11/02 03:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll
[2006/11/02 03:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
< MD5 for: IASTORV.SYS >[2008/01/20 20:46:59 | 000,290,872 | ---- | M] () MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2008/01/20 20:46:59 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys
< MD5 for: NETLOGON.DLL >[2008/01/20 20:51:03 | 000,716,800 | ---- | M] () MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\Windows\SysNative\netlogon.dll
[2008/01/20 20:51:03 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2008/01/20 20:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SysWOW64\netlogon.dll
[2008/01/20 20:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll
< MD5 for: NVSTOR.SYS >[2008/01/20 20:46:54 | 000,054,328 | ---- | M] () MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\SysNative\drivers\nvstor.sys
[2008/01/20 20:46:54 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys
< MD5 for: SCECLI.DLL >[2008/01/20 20:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SysWOW64\scecli.dll
[2008/01/20 20:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2008/01/20 20:49:49 | 000,235,520 | ---- | M] () MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\Windows\SysNative\scecli.dll
[2008/01/20 20:49:49 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
< %systemroot%\*. /mp /s >< End of report >
OTL Extras logfile created on: 2/3/2011 9:43:41 AM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\unseth\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 55.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 586.40 Gb Total Space | 537.41 Gb Free Space | 91.64% Space Free | Partition Type: NTFS
Drive D: | 461.55 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: UNSETH-PC | User Name: unseth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe ()
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" ()
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l ()
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" ()
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{A490E25E-C0D4-468C-B775-A4D63E10C249}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{D2924E90-7A3A-4784-A624-DF4556480B6B}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{2B8AD1EE-28D4-42FF-AE4B-856E5862D583}" = ccCommon64
"{6361EA0C-499F-40C0-6924-A8D974784908}" = ccc-utility64
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{816EB8D3-C431-5997-8A7B-99EED8D88C99}" = ATI Catalyst Install Manager
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90B5B05F-AFDA-4922-A153-45B14200BA77}" = SPBBC 64bit
"{BD927EB7-78D3-4DC4-9325-7CBD89D8F0E5}" = GearDrvs
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D75B1A1F-BBEC-4DF2-ACE4-9B166438A621}" = Symantec Real Time Storage Protection Component (x64)
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FE916F56-3C2B-4206-B0C2-4DCDD673308C}" = SymNet x64
"Agere Systems Soft Modem" = Agere Systems PCI-SV92PP Soft Modem
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0204009C-53D7-67E6-6631-62A1DBD66BCA}" = Catalyst Control Center Localization German
"{0BDD3FAD-61CD-4BF3-B9C4-4CEFD43F53F8}" = Norton 360 HTMLHelp
"{14911AD7-62FA-2DF7-961A-314786398DDD}" = Catalyst Control Center Localization Danish
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18960408-D04F-61BB-802E-13851583716E}" = CCC Help French
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FF2E7A9-824F-8B73-6332-C9DD19B08A67}" = CCC Help Finnish
"{21829177-4DED-4209-AD08-490B3AC9C01A}" = Norton 360
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23638DF5-41EF-7AEC-8AEB-2C7B4A298D05}" = CCC Help Norwegian
"{24DF7221-644B-4C3A-A478-459502D40522}" = Backup
"{26D08718-801F-2F78-B5DC-78D50714AA95}" = Catalyst Control Center Localization French
"{2B462A9D-286B-0A4F-6FB8-E71B39AB3978}" = Catalyst Control Center Localization Spanish
"{2D38E148-989C-9E77-E655-328FE0726761}" = Catalyst Control Center Localization Finnish
"{2D617065-1C52-4240-B5BC-C0AE12157777}" = Norton 360
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java 6 Update 5
"{3594EE90-B157-4519-9E82-8B6F4711A0A1}" = Catalyst Control Center - Branding
"{3770179C-38F3-A941-643C-5790E78D80C7}" = Skins
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{45690715-80A6-4445-B61D-ADEC5888E8CD}" = Symantec Technical Support Controls
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{482020CC-FEF7-9392-69F0-6C6F26FD7BCD}" = Catalyst Control Center Localization Japanese
"{4D19B0D8-896C-96AE-27B2-98B8B3997EBD}" = Catalyst Control Center Graphics Light
"{55A6283C-638A-4EE0-B491-51118554BDA2}" = Norton Confidential Core
"{5ADE38D8-1B9C-6F79-C88F-A84B01E4175C}" = CCC Help Dutch
"{5F00DF7E-418B-4CD9-8EC5-781156BCC49E}" = Microsoft Money Shared Libraries
"{600494AA-0E7B-6F10-9426-AFF9914CA403}" = Catalyst Control Center Graphics Full New
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{68C96BC9-EB2A-C0F1-0BAE-8E7FACD1CC52}" = Catalyst Control Center Core Implementation
"{69897DB3-8AA0-AB8B-C41F-5F18CE08DD10}" = CCC Help German
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7BBEF4EB-4996-3B90-1F79-0CED09C781F5}" = Catalyst Control Center Localization Swedish
"{7C95F789-0941-CBF8-A906-507E1F938B23}" = Catalyst Control Center Localization Dutch
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Gateway Recovery Management
"{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{00C5525B-3CB3-467D-8100-2E6FB306CD86}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9D05E935-B635-73BC-1320-80496C7EC481}" = CCC Help English
"{9DE36FF9-B4DC-76E5-DE1A-D940D5BB1E83}" = CCC Help Danish
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B24E05CC-46FF-4787-BBB8-5CD516AFB118}" = ccCommon
"{B3920458-4EA6-A26B-7621-AB086AC4086D}" = CCC Help Spanish
"{B7BC1735-B009-2946-AA94-2A60190616BE}" = Catalyst Control Center Localization Norwegian
"{B8CCF37C-4C5D-0B17-1472-FEDB3D88F9E8}" = CCC Help Japanese
"{B9D218EA-982B-53A2-BEEA-EF4C08DDD3DB}" = Catalyst Control Center Localization Italian
"{BB034FA9-BC86-7231-4618-B30918CD43F7}" = CCC Help Swedish
"{BE709AB0-E637-D304-F30C-B4B84F496DA7}" = ccc-core-static
"{C1E7BB59-E1BE-CC2F-32B8-F0EAB1322BC4}" = CCC Help Italian
"{C55C9458-6FAA-0DA2-3F35-CAD71AA13A89}" = Catalyst Control Center Graphics Full Existing
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{EB1F488E-AB5E-DB3A-A144-51802C2B0041}" = Catalyst Control Center Graphics Previews Vista
"{ED5DCA6F-5FEA-47CB-83DB-210A468C298B}" = WUR0817 Keyboard Driver
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"avast5" = avast! Free Antivirus
"Google Chrome" = Google Chrome
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"Marvell Miniport Driver" = Marvell Miniport Driver
"McAfee Security Scan" = McAfee Security Scan Plus
"Money2007b" = Microsoft Money Essentials
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"Smart Copy" = Smart Copy 3.1.1.1
"SymSetup.{2D617065-1C52-4240-B5BC-C0AE12157777}" = Norton 360 (Symantec Corporation)
"WildTangent gateway Master Uninstall" = Gateway Games
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
========== Last 10 Event Log Errors ========== [ Application Events ]
Error - 2/2/2011 8:53:15 PM | Computer Name = unseth-PC | Source = WinMgmt | ID = 10
Description =
Error - 2/2/2011 9:04:50 PM | Computer Name = unseth-PC | Source = WinMgmt | ID = 10
Description =
Error - 2/2/2011 9:11:00 PM | Computer Name = unseth-PC | Source = EventSystem | ID = 4621
Description =
Error - 2/2/2011 9:13:48 PM | Computer Name = unseth-PC | Source = WinMgmt | ID = 10
Description =
Error - 2/2/2011 9:14:24 PM | Computer Name = unseth-PC | Source = Application Error | ID = 1000
Description = Faulting application LuComServer_3_4.EXE, version 3.4.1.238, time
stamp 0x48932a97, faulting module unknown, version 0.0.0.0, time stamp 0x00000000,
exception code 0xc0000005, fault offset 0x75caa57d, process id 0xb74, application
start time 0x01cbc33fb17e6609.
Error - 2/2/2011 9:14:33 PM | Computer Name = unseth-PC | Source = Application Error | ID = 1000
Description = Faulting application LuCallbackProxy.exe, version 3.4.1.234, time
stamp 0x47bdf466, faulting module unknown, version 0.0.0.0, time stamp 0x00000000,
exception code 0xc0000005, fault offset 0x75caa57d, process id 0x498, application
start time 0x01cbc33fb719caf9.
Error - 2/2/2011 9:27:12 PM | Computer Name = unseth-PC | Source = WinMgmt | ID = 10
Description =
Error - 2/2/2011 9:54:43 PM | Computer Name = unseth-PC | Source = WinMgmt | ID = 10
Description =
Error - 2/2/2011 10:01:05 PM | Computer Name = unseth-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18999, time stamp
0x4ccf92fb, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception
code 0xc0000005, fault offset 0x7537a57d, process id 0xb30, application start time
0x01cbc34637807a61.
Error - 2/2/2011 10:06:49 PM | Computer Name = unseth-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18999, time stamp
0x4ccf92fb, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception
code 0xc0000005, fault offset 0x7537a57d, process id 0xd34, application start time
0x01cbc34704845591.
[ System Events ]
Error - 2/2/2011 4:39:16 PM | Computer Name = unseth-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 2/2/2011 4:39:16 PM | Computer Name = unseth-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 2/2/2011 4:54:12 PM | Computer Name = unseth-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 2:50:32 PM on 2/2/2011 was unexpected.
Error - 2/2/2011 4:54:15 PM | Computer Name = unseth-PC | Source = HTTP | ID = 15016
Description =
Error - 2/2/2011 4:55:15 PM | Computer Name = unseth-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 2/2/2011 4:55:15 PM | Computer Name = unseth-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 2/2/2011 4:59:42 PM | Computer Name = unseth-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 2:57:46 PM on 2/2/2011 was unexpected.
Error - 2/2/2011 4:59:46 PM | Computer Name = unseth-PC | Source = HTTP | ID = 15016
Description =
Error - 2/2/2011 5:01:07 PM | Computer Name = unseth-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 2/2/2011 5:01:07 PM | Computer Name = unseth-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
The computer didn't crash while I was running the reports... so I guess that is a good sign... we shall see.