Possible Rootkit

dr. · November 22, 2010

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 3:40:00 PM, on 11/22/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe

C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

C:\Program Files\Lock My PC 4\lockpc.exe

C:\windows\Explorer.EXE

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

C:\windows\system\hpsysdrv.exe

C:\HP\KBD\KBD.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\windows\system32\S3tray2.exe

C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\windows\system32\ctfmon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe

C:\Program Files\Opera\opera.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Documents and Settings\Owner\Local Settings\Application Data\Opera\Opera\temporary_downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus9.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus9.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus9.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus9.hpwis.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=14597&l=dis

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus9.hpwis.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\IPSBHO.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [s3TRAY2] S3tray2.exe

O4 - HKLM\..\Run: [XboxStat] "c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')

O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\windows\System32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\windows\System32\shdocvw.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1285986839921

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O20 - Winlogon Notify: fsp_lmwl - fsp_lmwl.dll (file missing)

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\System32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\System32\browseui.dll

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\windows\System32\nvsvc32.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--

End of file - 7821 bytes

kahdah · November 22, 2010

Hello dr.

Welcome to Malwarebytes.

=====================

Download OTL to your desktop.
Double click on OTL to run it.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Please download Rootkit Unhooker and save it to your desktop.

Note since it is in rar format and if you do not have anyhting that will open it then you can download 7 zip and use it to extract the data it can be found

here:
Right click on the .rar file and choose extract files.
Double-click RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan
Check Drivers, Stealth Code, Files, and Code Hooks
Uncheck the rest, then click OK
When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
Wait till the scanner has finished then go File > Save Report
Save the report somewhere you can find it, typically your desktop. Click Close
Copy the entire contents of the report and paste it in your next reply.

Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

dr. · November 23, 2010

Hello dr.
Welcome to Malwarebytes.
=====================
Download OTL to your desktop.
Double click on OTL to run it.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
====================
Please download Rootkit Unhooker and save it to your desktop.
Note since it is in rar format and if you do not have anyhting that will open it then you can download 7 zip and use it to extract the data it can be found
here:
Right click on the .rar file and choose extract files.
Double-click RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan
Check Drivers, Stealth Code, Files, and Code Hooks
Uncheck the rest, then click OK
When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
Wait till the scanner has finished then go File > Save Report
Save the report somewhere you can find it, typically your desktop. Click Close
Copy the entire contents of the report and paste it in your next reply.
Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Your software gave my computer a trojan-agent, nows it even more messed up then before IE8 cant even load thanks alot

kahdah · November 23, 2010

Your software gave my computer a trojan-agent, nows it even more messed up then before IE8 cant even load thanks alot

This is an incorrect statement.

This is not my software and it is not a trojan agent.

The same antivirus software that tells you this is also letting the malware run on your system.

I am not here to infect your computer I am here to disinfect the machine since you posted for assistance I will help you clean the machine up.

The alert you have received from your antivirus telling you it is a trojan agent is what is called a false positive.

This file is merely a scanner and a custom created program so it needs to be run in order to see what is going on with the system.

The IE8 opening\not opening is merely a coincidence these files are completely safe.

If you wish to proceed please disable your anti virus program to run the programs they are scanners only they do nothing but scan and move/delete files if they need to be but only if we paste a script in will it do those functions.

dr. · November 23, 2010

This is an incorrect statement.
This is not my software and it is not a trojan agent.
The same antivirus software that tells you this is also letting the malware run on your system.
I am not here to infect your computer I am here to disinfect the machine since you posted for assistance I will help you clean the machine up.
The alert you have received from your antivirus telling you it is a trojan agent is what is called a false positive.
This file is merely a scanner and a custom created program so it needs to be run in order to see what is going on with the system.
The IE8 opening\not opening is merely a coincidence these files are completely safe.
If you wish to proceed please disable your anti virus program to run the programs they are scanners only they do nothing but scan and move/delete files if they need to be but only if we paste a script in will it do those functions.

Okay, sorry. I just don't want to have to format it again, and my CPU is spiking hardcore for 0% to 40% to 100%

dr. · November 23, 2010

OTL logfile created on: 11/22/2010 10:13:47 PM - Run 1

OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Owner\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 65.00% Memory free

5.00 Gb Paging File | 4.00 Gb Available in Paging File | 89.00% Paging File free

Paging file location(s): [binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 68.35 Gb Total Space | 48.96 Gb Free Space | 71.63% Space Free | Partition Type: NTFS

Drive D: | 465.64 Gb Total Space | 334.78 Gb Free Space | 71.90% Space Free | Partition Type: FAT32

Computer Name: YOUR-LK4RLMSU41 | User Name: Owner | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/22 22:09:53 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

PRC - [2010/10/25 12:27:44 | 001,096,872 | ---- | M] (Auslogics) -- C:\Program Files\Auslogics\Auslogics BoostSpeed\boostspeed.exe

PRC - [2010/10/08 16:00:10 | 000,836,464 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe

PRC - [2010/07/22 23:05:56 | 000,126,904 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe

PRC - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2010/04/29 15:39:32 | 000,437,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2009/09/30 17:57:20 | 000,718,688 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

PRC - [2009/03/05 18:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

PRC - [2009/02/23 19:43:12 | 000,576,000 | ---- | M] (MagicISO, Inc.) -- C:\Program Files\MagicDisc\MagicDisc.exe

PRC - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/10/30 21:51:44 | 000,492,720 | ---- | M] () -- C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

PRC - [2007/10/30 21:07:38 | 000,427,288 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

PRC - [2004/11/02 17:59:50 | 000,316,544 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

PRC - [2003/02/25 05:33:14 | 000,069,632 | ---- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\S3tray2.exe

========== Modules (SafeList) ==========

MOD - [2010/11/22 22:09:53 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

MOD - [2010/08/23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

MOD - [2010/08/16 21:39:11 | 000,413,552 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\asOEHook.dll

MOD - [2009/07/12 01:02:02 | 000,653,120 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\Microsoft.VC90.CRT\msvcr90.dll

MOD - [2009/07/12 01:02:00 | 000,569,664 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\Microsoft.VC90.CRT\msvcp90.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (NMIndexingService)

SRV - File not found [On_Demand | Stopped] -- C:\windows\System32\appmgmts.dll -- (AppMgmt)

SRV - [2010/07/22 23:05:56 | 000,126,904 | R--- | M] (Symantec Corporation) [unknown | Running] -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe -- (NIS)

SRV - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2010/03/18 18:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state)

SRV - [2010/03/18 15:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)

SRV - [2010/03/18 15:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2007/10/30 21:51:44 | 000,492,720 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe -- (TryAndDecideService)

SRV - [2007/10/30 21:07:38 | 000,427,288 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)

SRV - [2004/11/02 17:59:50 | 000,316,544 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe -- (SymWSC)

========== Driver Services (SafeList) ==========

DRV - [2010/11/22 01:32:43 | 000,004,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nocashio.sys -- (nocashio)

DRV - [2010/11/16 04:27:00 | 001,371,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101122.022\NAVEX15.SYS -- (NAVEX15)

DRV - [2010/11/16 04:27:00 | 000,086,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101122.022\NAVENG.SYS -- (NAVENG)

DRV - [2010/11/12 11:47:14 | 000,126,512 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)

DRV - [2010/11/12 10:51:51 | 000,231,248 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\truecrypt.sys -- (truecrypt)

DRV - [2010/11/11 03:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)

DRV - [2010/11/11 03:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)

DRV - [2010/11/03 18:07:06 | 000,691,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101104.001\BHDrvx86.sys -- (BHDrvx86)

DRV - [2010/10/19 14:36:22 | 000,341,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101122.004\IDSXpx86.sys -- (IDSxpx86)

DRV - [2010/10/02 07:28:09 | 000,441,760 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\timntr.sys -- (timounter)

DRV - [2010/10/02 07:28:09 | 000,044,384 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)

DRV - [2010/10/02 07:27:57 | 000,129,248 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\snapman.sys -- (snapman)

DRV - [2010/10/02 07:27:38 | 000,368,544 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\tdrpman.sys -- (tdrpman)

DRV - [2010/07/28 21:33:05 | 000,666,672 | R--- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SYMEFA.SYS -- (SymEFA)

DRV - [2010/07/28 20:54:36 | 000,489,008 | R--- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SRTSP.SYS -- (SRTSP)

DRV - [2010/07/28 20:54:36 | 000,050,096 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)

DRV - [2010/07/21 19:27:14 | 000,043,952 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIMMP)

DRV - [2010/07/21 19:27:14 | 000,043,952 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIM)

DRV - [2010/07/12 19:20:22 | 000,369,072 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SYMTDI.SYS -- (SYMTDI)

DRV - [2010/06/26 22:05:55 | 000,134,704 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\windows\system32\drivers\NIS\1201000.025\Ironx86.SYS -- (SymIRON)

DRV - [2010/06/13 04:50:57 | 000,339,504 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SYMDS.SYS -- (SymDS)

DRV - [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2009/09/09 20:24:14 | 000,062,424 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\xusb21.sys -- (xusb21)

DRV - [2009/02/24 18:42:14 | 000,116,736 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mcdbus.sys -- (mcdbus)

DRV - [2008/04/13 12:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)

DRV - [2004/10/01 11:24:02 | 002,279,424 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2004/08/03 23:29:54 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)

DRV - [2003/06/19 02:59:00 | 000,140,800 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\windows\System32\DRIVERS\fasttx2k.sys -- (fasttx2k)

DRV - [2003/05/26 14:57:50 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3Psddr)

DRV - [2003/05/06 16:34:56 | 000,394,752 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)

DRV - [2003/04/11 09:51:30 | 000,010,624 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)

DRV - [2003/03/31 22:29:42 | 000,625,537 | ---- | M] (LT) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)

DRV - [2003/03/19 23:51:00 | 000,018,688 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\windows\System32\DRIVERS\nv_agp.sys -- (nv_agp)

DRV - [2003/02/20 17:18:36 | 000,036,608 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\windows\System32\DRIVERS\SISAGPX.sys -- (SISAGP)

DRV - [2002/12/27 12:41:00 | 000,026,880 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\windows\System32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2002/10/04 18:04:10 | 000,046,976 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139)

DRV - [2002/07/29 23:43:50 | 000,023,808 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus9.hpwis.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus9.hpwis.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus9.hpwis.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=14597&l=dis

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0

FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.1

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2010/11/12 11:48:30 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\ [2010/11/12 11:46:41 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/17 23:09:06 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/17 22:49:31 | 000,000,000 | ---D | M]

[2010/11/17 23:09:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions

[2010/11/22 18:59:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\fzr1aavl.default\extensions

[2010/11/17 23:36:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\fzr1aavl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/11/17 23:10:03 | 000,002,470 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\fzr1aavl.default\searchplugins\safesearch.xml

[2010/11/17 22:49:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/11/17 17:10:55 | 000,433,944 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 ad.de.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.dk.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.es.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.fr.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.it.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.jp.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.kr.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.linkexchange.com

O1 - Hosts: 127.0.0.1 ad.linksynergy.com

O1 - Hosts: 127.0.0.1 ad.nl.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.no.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.preferences.com

O1 - Hosts: 127.0.0.1 ad.se.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.sma.punto.net

O1 - Hosts: 127.0.0.1 ad.uk.doubleclick.net

O1 - Hosts: 127.0.0.1 ad.webprovider.com

O1 - Hosts: 127.0.0.1 ad08.focalink.com

O1 - Hosts: 127.0.0.1 ad1.adcept.net

O1 - Hosts: 127.0.0.1 ad2.adcept.net

O1 - Hosts: 127.0.0.1 ad3.adcept.net

O1 - Hosts: 127.0.0.1 ad-adex3.flycast.com

O1 - Hosts: 127.0.0.1 adcontroller.unicast.com

O1 - Hosts: 127.0.0.1 adcreatives.imaginemedia.com

O1 - Hosts: 14900 more lines...

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)

O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\IPSBHO.dll (Symantec Corporation)

O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)

O4 - HKLM..\Run: [KernelFaultCheck] File not found

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\windows\System32\nwiz.exe (NVIDIA Corporation)

O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()

O4 - HKLM..\Run: [s3TRAY2] C:\windows\System32\S3tray2.exe (S3 Graphics, Inc.)

O4 - HKLM..\Run: [XboxStat] c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)

O4 - HKCU..\Run: [NVIEW] C:\windows\System32\nview.dll (NVIDIA Corporation)

O4 - HKCU..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPropertiesMyComputer = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileAssociate = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found

O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5...heckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1285986839921 (WUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 76.7.255.188 65.164.201.148

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\fsp_lmwl: DllName - Reg Error: Value error. - Reg Error: Value error. File not found

O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\windows\System32\igfxsrvc.dll (Intel Corporation)

O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O30 - LSA: Authentication Packages - (relog_ap) - C:\windows\System32\relog_ap.dll (Acronis)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2003/07/24 02:29:01 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2002/10/17 09:56:50 | 000,000,036 | RH-- | M] () - D:\autorun.inf -- [ FAT32 ]

O32 - AutoRun File - [2006/02/09 14:59:36 | 000,000,000 | RH-D | M] - D:\autorun -- [ FAT32 ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (sasnative32) - File not found

O34 - HKLM BootExecute: (Execute settings...) - File not found

O34 - HKLM BootExecute: (on\Explore) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/22 22:09:53 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

[2010/11/22 19:43:04 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Owner\Recent

[2010/11/22 19:32:35 | 000,000,000 | ---D | C] -- C:\windows\Minidump

[2010/11/22 18:29:09 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Owner\Application Data\pcouffin.sys

[2010/11/22 18:29:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\PcSetup

[2010/11/22 00:40:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\HHD Software

[2010/11/22 00:32:36 | 000,116,736 | ---- | C] (MagicISO, Inc.) -- C:\windows\System32\drivers\mcdbus.sys

[2010/11/22 00:32:33 | 000,000,000 | ---D | C] -- C:\Program Files\MagicDisc

[2010/11/21 19:29:06 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\DBvsSF

[2010/11/21 19:28:48 | 000,000,000 | -H-D | C] -- C:\windows\PIF

[2010/11/21 05:23:59 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Installer Clean Up

[2010/11/21 05:23:06 | 000,000,000 | ---D | C] -- C:\Program Files\MSECACHE

[2010/11/21 05:20:00 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys

[2010/11/21 05:19:57 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

[2010/11/21 05:19:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/11/21 02:53:12 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\Virtualdub

[2010/11/21 02:37:04 | 000,000,000 | ---D | C] -- C:\Program Files\YouTube Downloader

[2010/11/21 02:11:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\WMTools Downloaded Files

[2010/11/21 02:01:52 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos

[2010/11/21 02:01:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\My Documents\My Videos

[2010/11/20 15:07:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Identities

[2010/11/18 18:13:20 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\Nintendo 64 (N64)

[2010/11/18 15:59:39 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_7.dll

[2010/11/18 15:59:39 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_5.dll

[2010/11/18 15:59:38 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_43.dll

[2010/11/18 15:59:38 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_7.dll

[2010/11/18 15:59:37 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dcsx_43.dll

[2010/11/18 15:59:36 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx11_43.dll

[2010/11/18 15:59:35 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_43.dll

[2010/11/18 15:59:35 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_43.dll

[2010/11/18 15:59:34 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_6.dll

[2010/11/18 15:59:34 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_4.dll

[2010/11/18 15:59:33 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_6.dll

[2010/11/18 15:59:32 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_7.dll

[2010/11/18 15:59:31 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_5.dll

[2010/11/18 15:59:29 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_5.dll

[2010/11/18 15:59:28 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_42.dll

[2010/11/18 15:59:27 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dcsx_42.dll

[2010/11/18 15:59:27 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx11_42.dll

[2010/11/18 15:59:26 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_42.dll

[2010/11/18 15:59:25 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_42.dll

[2010/11/18 15:59:24 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_41.dll

[2010/11/18 15:59:24 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_41.dll

[2010/11/18 15:59:24 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_41.dll

[2010/11/18 15:59:22 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_4.dll

[2010/11/18 15:59:22 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_3.dll

[2010/11/18 15:59:21 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_4.dll

[2010/11/18 15:59:21 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_6.dll

[2010/11/18 15:59:20 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_40.dll

[2010/11/18 15:59:20 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_40.dll

[2010/11/18 15:59:19 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_40.dll

[2010/11/18 15:59:18 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_3.dll

[2010/11/18 15:59:18 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_2.dll

[2010/11/18 15:59:17 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_3.dll

[2010/11/18 15:59:16 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_5.dll

[2010/11/18 15:59:15 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_2.dll

[2010/11/18 15:59:15 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_1.dll

[2010/11/18 15:59:14 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_2.dll

[2010/11/18 15:59:13 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_39.dll

[2010/11/18 15:59:13 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_39.dll

[2010/11/18 15:59:13 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_39.dll

[2010/11/18 15:59:11 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_1.dll

[2010/11/18 15:59:11 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_1.dll

[2010/11/18 15:59:11 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_0.dll

[2010/11/18 15:59:10 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_4.dll

[2010/11/18 15:59:09 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_38.dll

[2010/11/18 15:59:09 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_38.dll

[2010/11/18 15:59:08 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_38.dll

[2010/11/18 15:59:07 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_0.dll

[2010/11/18 15:59:06 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_0.dll

[2010/11/18 15:59:05 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_3.dll

[2010/11/18 15:59:04 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_37.dll

[2010/11/18 15:59:04 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_37.dll

[2010/11/18 15:59:03 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_37.dll

[2010/11/18 15:59:02 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_10.dll

[2010/11/18 15:59:01 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_36.dll

[2010/11/18 15:59:01 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_36.dll

[2010/11/18 15:59:00 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_36.dll

[2010/11/18 15:58:58 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_9.dll

[2010/11/18 15:58:57 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_35.dll

[2010/11/18 15:58:57 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_35.dll

[2010/11/18 15:58:56 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_35.dll

[2010/11/18 15:58:55 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_8.dll

[2010/11/18 15:58:55 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_2.dll

[2010/11/18 15:58:54 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_34.dll

[2010/11/18 15:58:54 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_34.dll

[2010/11/18 15:58:53 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_34.dll

[2010/11/18 15:58:50 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_7.dll

[2010/11/18 15:58:44 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_33.dll

[2010/11/18 15:58:44 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_33.dll

[2010/11/18 15:58:38 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_33.dll

[2010/11/18 15:58:37 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_6.dll

[2010/11/18 15:58:35 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_5.dll

[2010/11/18 15:58:34 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_32.dll

[2010/11/18 15:58:32 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_4.dll

[2010/11/18 15:58:32 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\x3daudio1_1.dll

[2010/11/18 15:58:31 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_31.dll

[2010/11/18 15:58:30 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_3.dll

[2010/11/18 15:58:29 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xinput1_2.dll

[2010/11/18 15:58:28 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_2.dll

[2010/11/18 15:58:27 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xinput1_1.dll

[2010/11/18 15:58:25 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_1.dll

[2010/11/18 15:58:20 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_0.dll

[2010/11/18 15:58:20 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\x3daudio1_0.dll

[2010/11/18 15:58:19 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_29.dll

[2010/11/18 15:58:18 | 000,061,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xinput9_1_0.dll

[2010/11/18 15:58:17 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_27.dll

[2010/11/18 15:58:15 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_26.dll

[2010/11/18 15:58:14 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_25.dll

[2010/11/18 15:58:12 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_24.dll

[2010/11/18 15:54:20 | 000,000,000 | ---D | C] -- C:\windows\Logs

[2010/11/18 15:02:53 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\PS2

[2010/11/17 23:53:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Auslogics

[2010/11/17 23:49:50 | 000,000,000 | ---D | C] -- C:\Program Files\Auslogics

[2010/11/17 23:08:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla

[2010/11/17 23:08:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Mozilla

[2010/11/17 22:49:28 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2010/11/17 21:07:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DirectX

[2010/11/17 21:05:58 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\dreamcast

[2010/11/17 20:05:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Downloads

[2010/11/17 20:01:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Registry Mechanic

[2010/11/17 18:24:56 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\SNES ROMS

[2010/11/17 17:57:51 | 000,016,184 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\windows\System32\ROBoot.exe

[2010/11/17 17:45:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Systweak

[2010/11/17 17:42:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Systweak

[2010/11/17 15:09:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Xbox 360 Accessories

[2010/11/17 11:55:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Threat Expert

[2010/11/16 20:40:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\WinZip

[2010/11/16 20:39:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WinZip

[2010/11/16 20:39:03 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip

[2010/11/16 19:57:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\DFX

[2010/11/16 19:54:45 | 000,000,000 | ---D | C] -- C:\Program Files\DFX

[2010/11/16 19:54:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DFX

[2010/11/16 19:52:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DFX

[2010/11/16 13:13:12 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\Super Nintendo

[2010/11/16 11:40:33 | 000,000,000 | ---D | C] -- C:\windows\System32\XPSViewer

[2010/11/16 11:40:28 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild

[2010/11/16 11:40:17 | 000,000,000 | ---D | C] -- C:\Program Files\Reference Assemblies

[2010/11/16 11:39:32 | 000,117,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\prntvpt.dll

[2010/11/16 11:39:31 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xpssvcs.dll

[2010/11/16 11:39:31 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\xpssvcs.dll

[2010/11/16 11:39:31 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\printfilterpipelinesvc.exe

[2010/11/16 11:39:31 | 000,575,488 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\xpsshhdr.dll

[2010/11/16 11:39:31 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\filterpipelineprintproc.dll

[2010/11/16 11:39:30 | 000,000,000 | ---D | C] -- C:\c2abe63ea84c83266ac191

[2010/11/16 10:38:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2010/11/16 10:32:41 | 000,000,000 | ---D | C] -- C:\0ac34ef71f547cdfb08e67

[2010/11/16 10:32:25 | 000,000,000 | ---D | C] -- C:\56e44aa85a13a069f62108561b886a

[2010/11/16 01:18:15 | 000,043,952 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\SymIM.sys

[2010/11/16 01:06:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/11/15 23:56:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Malwarebytes

[2010/11/15 23:56:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010/11/15 23:19:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Readon_Technology

[2010/11/15 23:19:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Readon Player

[2010/11/15 22:54:58 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET

[2010/11/15 22:28:39 | 000,000,000 | ---D | C] -- C:\windows\Sun

[2010/11/15 17:37:53 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\spmsgXP_2k3.dll

[2010/11/15 17:29:25 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\WdfCoInstaller01007.dll

[2010/11/15 17:29:25 | 000,062,424 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\xusb21.sys

[2010/11/15 17:29:25 | 000,000,000 | ---D | C] -- C:\windows\System32\DRVSTORE

[2010/11/15 17:29:14 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xinput1_3.dll

[2010/11/14 21:40:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Acronis

[2010/11/14 21:32:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Uniblue

[2010/11/14 21:32:29 | 000,000,000 | ---D | C] -- C:\Program Files\Uniblue

[2010/11/14 21:23:07 | 000,000,000 | ---D | C] -- C:\Program Files\PS3 Media Server

[2010/11/14 19:19:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\FFOutput

[2010/11/14 19:18:11 | 000,000,000 | ---D | C] -- C:\Program Files\FreeTime

[2010/11/13 02:15:49 | 000,000,000 | ---D | C] -- C:\Program Files\mkv2vob

[2010/11/13 01:04:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Yahoo

[2010/11/13 01:02:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Yahoo!

[2010/11/13 01:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo!

[2010/11/13 00:56:46 | 000,000,000 | ---D | C] -- C:\Program Files\Yahoo!

[2010/11/12 20:19:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\vsosdk

[2010/11/12 18:18:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\ConvertXToDVD

[2010/11/12 17:46:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Vso

[2010/11/12 17:45:11 | 000,000,000 | ---D | C] -- C:\Program Files\VSO

[2010/11/12 16:49:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\OpenOffice.org

[2010/11/12 16:37:39 | 000,000,000 | ---D | C] -- C:\Program Files\JRE

[2010/11/12 16:37:33 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3

[2010/11/12 16:36:43 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javaws.exe

[2010/11/12 16:36:43 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javaw.exe

[2010/11/12 16:36:43 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\java.exe

[2010/11/12 12:02:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Tific

[2010/11/12 12:01:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Symantec

[2010/11/12 11:49:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Symantec

[2010/11/12 11:47:14 | 000,126,512 | ---- | C] (Symantec Corporation) -- C:\windows\System32\drivers\SYMEVENT.SYS

[2010/11/12 11:47:14 | 000,060,808 | ---- | C] (Symantec Corporation) -- C:\windows\System32\S32EVNT1.DLL

[2010/11/12 11:47:02 | 000,666,672 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\SymEFA.sys

[2010/11/12 11:47:02 | 000,489,008 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\srtsp.sys

[2010/11/12 11:47:02 | 000,369,072 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\symtdi.sys

[2010/11/12 11:47:02 | 000,339,504 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\SymDS.sys

[2010/11/12 11:47:02 | 000,331,312 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\symtdiv.sys

[2010/11/12 11:47:02 | 000,294,448 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\symnets.sys

[2010/11/12 11:47:02 | 000,134,704 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\Ironx86.sys

[2010/11/12 11:47:02 | 000,050,096 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\srtspx.sys

[2010/11/12 11:46:44 | 000,000,000 | ---D | C] -- C:\windows\System32\drivers\NIS

[2010/11/12 11:46:44 | 000,000,000 | ---D | C] -- C:\windows\System32\drivers\NIS\1201000.025

[2010/11/12 11:46:41 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Sidebar

[2010/11/12 11:46:41 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Internet Security

[2010/11/12 11:46:20 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller

[2010/11/12 11:41:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller

[2010/11/12 11:35:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Norton

[2010/11/12 11:35:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Norton

[2010/11/12 11:24:41 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy

[2010/11/12 11:24:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

[2010/11/12 11:03:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Adobe

[2010/11/12 11:01:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TrueCrypt

[2010/11/12 10:52:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\TrueCrypt

[2010/11/12 10:51:51 | 000,231,248 | ---- | C] (TrueCrypt Foundation) -- C:\windows\System32\drivers\truecrypt.sys

[2010/11/12 10:51:50 | 000,000,000 | ---D | C] -- C:\Program Files\TrueCrypt

[2010/11/12 10:49:49 | 003,487,848 | ---- | C] (TrueCrypt Foundation) -- C:\Documents and Settings\Owner\My Documents\TrueCrypt Setup 7.0a.exe

[2010/11/12 00:51:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Media Player Classic

[2010/11/12 00:16:39 | 000,156,672 | ---- | C] (Radioactive) -- C:\windows\System32\rmc_fixasf.exe

[2010/11/12 00:12:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\mdnslib

[2010/11/12 00:12:44 | 000,000,000 | ---D | C] -- C:\windows\Applian Director

[2010/11/12 00:12:44 | 000,000,000 | ---D | C] -- C:\Program Files\Applian Director

[2010/11/12 00:12:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\FLVService

[2010/11/12 00:12:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Ask and Record Toolbar

[2010/11/12 00:12:19 | 000,000,000 | ---D | C] -- C:\windows\Replay Media Catcher

[2010/11/11 23:41:42 | 000,232,448 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\windows\System32\mp3fhg.acm

[2010/11/11 23:41:41 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\windows\System32\yv12vfw.dll

[2010/11/11 23:41:41 | 000,151,552 | ---- | C] (fccHandler) -- C:\windows\System32\ac3acm.acm

[2010/11/11 23:41:36 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack

[2010/11/11 23:38:31 | 000,000,000 | ---D | C] -- C:\Program Files\Hoo Technologies

[2010/11/11 22:11:11 | 000,000,000 | ---D | C] -- C:\Program Files\Tweak-XP

[2010/11/11 22:10:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard

[2010/11/11 21:26:30 | 000,933,888 | ---- | C] (Adroit Technologies) -- C:\windows\System32\SmartTabs29.ocx

[2010/11/11 21:26:30 | 000,221,184 | ---- | C] (RSP Software - http://rspsoftware.clic3.net) -- C:\windows\System32\rspencr330.ocx

[2010/11/11 21:21:38 | 000,000,000 | ---D | C] -- C:\Program Files\Lock My PC 4

[2010/11/11 21:19:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\WinRAR

[2010/11/11 19:43:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Symantec

[2010/10/27 04:00:21 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0

[2010/10/26 13:49:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Acronis

[2010/10/26 11:26:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\ImgBurn

[2010/10/26 11:25:25 | 000,000,000 | ---D | C] -- C:\Program Files\ImgBurn

[2010/10/26 11:20:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\LightScribe

[2010/10/26 11:18:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Ahead

[2010/10/26 11:15:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\LightScribe

[2010/10/26 08:46:49 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mfc42.dll

[2010/10/26 08:46:49 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mfc40u.dll

[2010/10/26 08:46:34 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\comctl32.dll

[2010/10/25 17:41:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Ahead

[2010/10/25 17:40:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Ahead

[2010/10/25 17:31:05 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_30.dll

[2010/10/25 17:31:04 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_28.dll

[2010/10/25 16:53:29 | 000,000,000 | ---D | C] -- C:\windows\Prefetch

[2010/10/25 16:39:43 | 000,000,000 | ---D | C] -- C:\windows\System32\scripting

[2010/10/25 16:39:42 | 000,000,000 | ---D | C] -- C:\windows\l2schemas

[2010/10/25 16:39:41 | 000,000,000 | ---D | C] -- C:\windows\System32\en

[2010/10/25 16:34:02 | 000,000,000 | ---D | C] -- C:\windows\network diagnostic

[2010/10/25 15:34:11 | 000,000,000 | ---D | C] -- C:\windows\pss

[2010/10/25 15:33:49 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2010/10/25 15:05:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\VS Revo Group

[2010/10/25 14:56:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun

[2010/10/25 14:56:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2010/10/25 14:56:30 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\deployJava1.dll

[2010/10/25 14:56:30 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javacpl.cpl

[2010/10/25 14:54:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Sun

[2010/10/25 14:34:24 | 000,060,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\usbaudio.sys

========== Files - Modified Within 30 Days ==========

[2010/11/22 22:09:53 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

[2010/11/22 19:46:32 | 000,000,412 | ---- | M] () -- C:\windows\tasks\Symantec NetDetect.job

[2010/11/22 19:45:41 | 000,001,394 | ---- | M] () -- C:\windows\System\hpsysdrv.DAT

[2010/11/22 19:44:28 | 000,000,408 | ---- | M] () -- C:\windows\tasks\Auslogics BoostSpeed Integrator Start On Windows Logon.job

[2010/11/22 19:44:03 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat

[2010/11/22 19:43:51 | 2130,235,392 | -HS- | M] () -- C:\hiberfil.sys

[2010/11/22 18:29:09 | 000,087,608 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\inst.exe

[2010/11/22 18:29:09 | 000,047,360 | ---- | M] (VSO Software) -- C:\Documents and Settings\Owner\Application Data\pcouffin.sys

[2010/11/22 18:29:09 | 000,007,887 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.cat

[2010/11/22 18:29:09 | 000,001,144 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.inf

[2010/11/22 01:32:43 | 000,004,096 | ---- | M] () -- C:\windows\System32\drivers\nocashio.sys

[2010/11/22 00:40:13 | 000,002,310 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Hex Editor Neo.lnk

[2010/11/22 00:40:13 | 000,002,292 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Hex Editor Neo.lnk

[2010/11/22 00:32:50 | 000,000,652 | ---- | M] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\MagicDisc.lnk

[2010/11/22 00:32:49 | 000,000,640 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\MagicDisc.lnk

[2010/11/21 05:20:13 | 000,000,714 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/11/21 03:06:07 | 000,073,728 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/11/21 02:37:08 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\YouTube Downloader.lnk

[2010/11/18 15:58:37 | 000,752,944 | ---- | M] () -- C:\windows\System32\drivers\NIS\1201000.025\Cat.DB

[2010/11/17 23:50:05 | 000,000,924 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Auslogics BoostSpeed.lnk

[2010/11/17 23:50:04 | 000,000,906 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Auslogics BoostSpeed.lnk

[2010/11/17 23:09:12 | 000,000,000 | ---- | M] () -- C:\windows\nsreg.dat

[2010/11/17 22:49:42 | 000,001,626 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

[2010/11/17 22:49:42 | 000,001,608 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

[2010/11/17 18:01:42 | 000,002,576 | ---- | M] () -- C:\windows\System32\ASOROSet.bin

[2010/11/17 17:10:55 | 000,433,944 | R--- | M] () -- C:\windows\System32\drivers\etc\HOSTS

[2010/11/17 09:37:09 | 000,502,724 | ---- | M] () -- C:\windows\System32\perfh009.dat

[2010/11/17 09:37:09 | 000,087,682 | ---- | M] () -- C:\windows\System32\perfc009.dat

[2010/11/16 20:39:50 | 000,001,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk

[2010/11/16 12:25:32 | 000,153,976 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT

[2010/11/15 17:39:53 | 000,000,000 | -H-- | M] () -- C:\windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf

[2010/11/15 17:39:50 | 000,000,000 | -H-- | M] () -- C:\windows\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf

[2010/11/15 17:26:28 | 000,001,158 | ---- | M] () -- C:\windows\System32\wpa.dbl

[2010/11/14 21:32:32 | 000,000,747 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk

[2010/11/14 21:32:32 | 000,000,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SpeedUpMyPC.lnk

[2010/11/14 21:23:23 | 000,000,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\PS3 Media Server.lnk

[2010/11/14 19:18:37 | 000,000,851 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Format Factory.lnk

[2010/11/13 02:15:54 | 000,001,701 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\mkv2vob.lnk

[2010/11/13 01:01:54 | 000,000,820 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk

[2010/11/13 01:01:54 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk

[2010/11/12 20:26:03 | 000,001,057 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\vso_ts_preview.xml

[2010/11/12 16:38:37 | 000,000,885 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\OpenOffice.org 3.2.lnk

[2010/11/12 11:47:14 | 000,126,512 | ---- | M] (Symantec Corporation) -- C:\windows\System32\drivers\SYMEVENT.SYS

[2010/11/12 11:47:14 | 000,060,808 | ---- | M] (Symantec Corporation) -- C:\windows\System32\S32EVNT1.DLL

[2010/11/12 11:47:14 | 000,007,456 | ---- | M] () -- C:\windows\System32\drivers\SYMEVENT.CAT

[2010/11/12 11:47:14 | 000,000,805 | ---- | M] () -- C:\windows\System32\drivers\SYMEVENT.INF

[2010/11/12 11:47:04 | 000,001,973 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Norton Internet Security.LNK

[2010/11/12 11:24:48 | 000,000,955 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy (for blind users).lnk

[2010/11/12 11:24:48 | 000,000,951 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk

[2010/11/12 11:24:48 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk

[2010/11/12 11:20:54 | 000,009,275 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts.20101112-093003.backup

[2010/11/12 11:14:53 | 003,883,008 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\True Crypt

[2010/11/12 11:04:11 | 000,369,152 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\ISORecorderV2RC1.msi

[2010/11/12 10:51:53 | 000,000,640 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\TrueCrypt.lnk

[2010/11/12 10:51:51 | 000,231,248 | ---- | M] (TrueCrypt Foundation) -- C:\windows\System32\drivers\truecrypt.sys

[2010/11/12 10:50:03 | 003,487,848 | ---- | M] (TrueCrypt Foundation) -- C:\Documents and Settings\Owner\My Documents\TrueCrypt Setup 7.0a.exe

[2010/11/12 01:39:12 | 000,237,568 | ---- | M] () -- C:\windows\System32\rmc_rtspdl.dll

[2010/11/12 01:39:12 | 000,156,672 | ---- | M] (Radioactive) -- C:\windows\System32\rmc_fixasf.exe

[2010/11/11 23:41:47 | 000,000,938 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Media Player Classic.lnk

[2010/11/11 23:38:33 | 000,000,897 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\WAV MP3 Converter.lnk

[2010/11/11 22:37:56 | 000,019,734 | ---- | M] () -- C:\windows\System32\oemlogo.bmp

[2010/11/11 22:37:56 | 000,000,431 | ---- | M] () -- C:\windows\System32\oeminfo.ini

[2010/11/11 22:12:11 | 000,000,463 | ---- | M] () -- C:\windows\txp-lcn.ini

[2010/11/11 22:06:22 | 000,000,103 | ---- | M] () -- C:\windows\_vmtxp.ini

[2010/11/11 21:55:38 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk

[2010/11/11 20:49:27 | 000,000,610 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk

[2010/11/11 20:49:27 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Opera.lnk

[2010/10/26 11:53:22 | 000,000,608 | ---- | M] () -- C:\windows\QUICKEN.INI

[2010/10/26 11:25:27 | 000,001,554 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk

[2010/10/26 11:25:27 | 000,001,536 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\ImgBurn.lnk

[2010/10/25 17:33:08 | 000,316,640 | ---- | M] () -- C:\windows\WMSysPr9.prx

[2010/10/25 16:56:09 | 000,000,812 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk

[2010/10/25 16:33:41 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2010/10/25 14:58:19 | 000,001,737 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk

[2010/10/25 14:56:15 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\deployJava1.dll

[2010/10/25 14:56:15 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\javaws.exe

[2010/10/25 14:56:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\javaw.exe

[2010/10/25 14:56:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\java.exe

[2010/10/25 14:56:15 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\javacpl.cpl

[2010/10/25 07:07:06 | 000,000,283 | RHS- | M] () -- C:\boot.ini

========== Files Created - No Company Name ==========

[2010/11/22 19:43:51 | 2130,235,392 | -HS- | C] () -- C:\hiberfil.sys

[2010/11/22 18:29:10 | 000,000,055 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.log

[2010/11/22 18:29:09 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\inst.exe

[2010/11/22 18:29:09 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.cat

[2010/11/22 18:29:09 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.inf

[2010/11/22 01:32:43 | 000,004,096 | ---- | C] () -- C:\windows\System32\drivers\nocashio.sys

[2010/11/22 00:40:13 | 000,002,310 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Hex Editor Neo.lnk

[2010/11/22 00:40:13 | 000,002,292 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Hex Editor Neo.lnk

[2010/11/22 00:32:50 | 000,000,652 | ---- | C] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\MagicDisc.lnk

[2010/11/22 00:32:49 | 000,000,640 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\MagicDisc.lnk

[2010/11/21 05:20:13 | 000,000,714 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/11/21 02:37:08 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\YouTube Downloader.lnk

[2010/11/17 23:50:48 | 000,000,408 | ---- | C] () -- C:\windows\tasks\Auslogics BoostSpeed Integrator Start On Windows Logon.job

[2010/11/17 23:50:04 | 000,000,924 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Auslogics BoostSpeed.lnk

[2010/11/17 23:50:04 | 000,000,906 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Auslogics BoostSpeed.lnk

[2010/11/17 23:09:12 | 000,000,000 | ---- | C] () -- C:\windows\nsreg.dat

[2010/11/17 22:49:42 | 000,001,626 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

[2010/11/17 22:49:42 | 000,001,608 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

[2010/11/17 17:57:51 | 000,002,576 | ---- | C] () -- C:\windows\System32\ASOROSet.bin

[2010/11/16 20:39:50 | 000,001,732 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk

[2010/11/15 17:39:53 | 000,000,000 | -H-- | C] () -- C:\windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf

[2010/11/15 17:39:50 | 000,000,000 | -H-- | C] () -- C:\windows\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf

[2010/11/14 21:32:32 | 000,000,747 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk

[2010/11/14 21:32:32 | 000,000,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SpeedUpMyPC.lnk

[2010/11/14 21:23:22 | 000,000,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\PS3 Media Server.lnk

[2010/11/14 19:18:37 | 000,000,851 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Format Factory.lnk

[2010/11/13 02:15:52 | 000,001,701 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\mkv2vob.lnk

[2010/11/13 01:01:54 | 000,000,820 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk

[2010/11/13 01:01:54 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk

[2010/11/12 17:46:21 | 000,001,057 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\vso_ts_preview.xml

[2010/11/12 16:38:37 | 000,000,885 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\OpenOffice.org 3.2.lnk

[2010/11/12 11:47:20 | 000,752,944 | ---- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\Cat.DB

[2010/11/12 11:47:14 | 000,007,456 | ---- | C] () -- C:\windows\System32\drivers\SYMEVENT.CAT

[2010/11/12 11:47:14 | 000,000,805 | ---- | C] () -- C:\windows\System32\drivers\SYMEVENT.INF

[2010/11/12 11:47:04 | 000,001,973 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Norton Internet Security.LNK

[2010/11/12 11:46:45 | 000,003,373 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymEFA.inf

[2010/11/12 11:46:45 | 000,002,792 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymDS.inf

[2010/11/12 11:46:45 | 000,001,473 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymNetV.inf

[2010/11/12 11:46:45 | 000,001,445 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymNet.inf

[2010/11/12 11:46:45 | 000,001,389 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\srtspx.inf

[2010/11/12 11:46:45 | 000,001,383 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\srtsp.inf

[2010/11/12 11:46:45 | 000,000,741 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\Iron.inf

[2010/11/12 11:46:44 | 000,007,787 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\symnetv.cat

[2010/11/12 11:46:44 | 000,007,446 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymNet.cat

[2010/11/12 11:46:44 | 000,007,444 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymEFA.cat

[2010/11/12 11:46:44 | 000,007,442 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\srtspx.cat

[2010/11/12 11:46:44 | 000,007,438 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymDS.cat

[2010/11/12 11:46:44 | 000,007,438 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\srtsp.cat

[2010/11/12 11:46:44 | 000,007,438 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\iron.cat

[2010/11/12 11:46:44 | 000,000,172 | ---- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\isolate.ini

[2010/11/12 11:24:48 | 000,000,955 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy (for blind users).lnk

[2010/11/12 11:24:48 | 000,000,951 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk

[2010/11/12 11:24:48 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk

[2010/11/12 11:14:53 | 003,883,008 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\True Crypt

[2010/11/12 11:04:11 | 000,369,152 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\ISORecorderV2RC1.msi

[2010/11/12 10:51:53 | 000,000,640 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\TrueCrypt.lnk

[2010/11/12 00:16:38 | 000,237,568 | ---- | C] () -- C:\windows\System32\rmc_rtspdl.dll

[2010/11/11 23:41:47 | 000,000,938 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Media Player Classic.lnk

[2010/11/11 23:41:45 | 000,165,376 | ---- | C] () -- C:\windows\System32\unrar.dll

[2010/11/11 23:41:44 | 000,000,038 | ---- | C] () -- C:\windows\avisplitter.ini

[2010/11/11 23:41:41 | 000,790,528 | ---- | C] () -- C:\windows\System32\xvidcore.dll

[2010/11/11 23:41:40 | 000,134,144 | ---- | C] () -- C:\windows\System32\xvidvfw.dll

[2010/11/11 23:41:40 | 000,108,032 | ---- | C] () -- C:\windows\System32\ff_vfw.dll

[2010/11/11 23:38:33 | 000,000,897 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\WAV MP3 Converter.lnk

[2010/11/11 22:12:11 | 000,000,463 | ---- | C] () -- C:\windows\txp-lcn.ini

[2010/11/11 22:06:08 | 000,000,103 | ---- | C] () -- C:\windows\_vmtxp.ini

[2010/11/11 21:55:38 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk

[2010/10/26 13:11:08 | 000,073,728 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/10/26 11:25:27 | 000,001,554 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk

[2010/10/26 11:25:27 | 000,001,536 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\ImgBurn.lnk

[2010/10/25 14:58:19 | 000,001,737 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk

[2010/10/01 20:49:03 | 000,067,630 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\bdinstall.bin

[2004/09/17 18:37:42 | 000,061,440 | ---- | C] () -- C:\windows\System32\vuins32.dll

[2003/07/26 04:17:16 | 000,000,061 | ---- | C] () -- C:\windows\smscfg.ini

[2003/07/26 04:16:43 | 000,000,000 | ---- | C] () -- C:\windows\System32\iAlmcoin.dll

[2003/07/26 02:57:44 | 000,000,051 | ---- | C] () -- C:\windows\System32\mshrml.ini

[2003/07/24 04:05:31 | 000,167,936 | ---- | C] () -- C:\windows\System32\PCDrJNI_1_1.dll

[2003/07/24 04:02:11 | 000,025,438 | ---- | C] () -- C:\windows\System32\CHODDI.SYS

[2003/07/24 04:01:47 | 000,024,576 | ---- | C] () -- C:\windows\System32\syscontr.dll

[2003/07/24 04:01:15 | 000,045,056 | ---- | C] () -- C:\windows\System32\hpreg.dll

[2003/07/24 03:47:54 | 000,000,052 | ---- | C] () -- C:\windows\intuprof.ini

[2003/07/24 03:47:40 | 000,000,608 | ---- | C] () -- C:\windows\QUICKEN.INI

[2003/07/24 03:19:54 | 000,001,793 | ---- | C] () -- C:\windows\System32\fxsperf.ini

[2003/07/24 02:52:31 | 000,363,520 | ---- | C] () -- C:\windows\System32\psisdecd.dll

[2003/07/24 02:44:55 | 000,299,073 | ---- | C] () -- C:\windows\System32\PythonCOM22.dll

[2003/07/24 02:44:55 | 000,065,536 | ---- | C] () -- C:\windows\System32\PyWinTypes22.dll

[2003/07/24 02:44:37 | 000,016,896 | ---- | C] () -- C:\windows\System32\bcbmm.dll

[2003/07/24 02:32:33 | 000,000,802 | ---- | C] () -- C:\windows\orun32.ini

[2003/07/24 02:18:12 | 000,000,431 | ---- | C] () -- C:\windows\System32\oeminfo.ini

[2003/07/23 23:46:21 | 000,000,438 | ---- | C] () -- C:\windows\System32\1_ssetup.ini

[2003/07/23 23:46:21 | 000,000,000 | ---- | C] () -- C:\windows\System32\sunistlog.ini

[2003/07/23 19:22:12 | 000,004,161 | ---- | C] () -- C:\windows\ODBCINST.INI

========== LOP Check ==========

[2010/10/02 07:28:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis

[2010/10/01 20:49:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BitDefender

[2010/11/16 19:52:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DFX

[2010/10/26 11:20:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe

[2010/11/21 04:31:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Systweak

[2010/11/22 22:30:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/11/12 11:01:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TrueCrypt

[2010/11/12 20:19:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk

[2010/11/16 20:40:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip

[2010/10/26 13:49:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Acronis

[2010/11/17 23:53:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Auslogics

[2010/10/26 11:26:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\ImgBurn

[2010/10/25 15:29:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\interMute

[2010/11/12 16:49:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\OpenOffice.org

[2010/10/02 06:48:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Opera

[2010/11/17 20:03:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Registry Mechanic

[2003/07/24 04:02:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\SampleView

[2010/11/21 04:31:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Systweak

[2010/11/12 12:02:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Tific

[2010/11/12 11:09:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\TrueCrypt

[2010/11/14 21:32:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Uniblue

[2010/11/22 18:29:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Vso

[2010/11/22 19:44:28 | 000,000,408 | ---- | M] () -- C:\windows\Tasks\Auslogics BoostSpeed Integrator Start On Windows Logon.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 48 bytes -> C:\Documents and Settings\All Users\DRM:??????????

@Alternate Data Stream - 159 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07BF512B

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1

< End of report >

dr. · November 23, 2010

OTL logfile created on: 11/22/2010 10:13:47 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 65.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): [binary data over 100 bytes]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 68.35 Gb Total Space | 48.96 Gb Free Space | 71.63% Space Free | Partition Type: NTFS
Drive D: | 465.64 Gb Total Space | 334.78 Gb Free Space | 71.90% Space Free | Partition Type: FAT32
Computer Name: YOUR-LK4RLMSU41 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2010/11/22 22:09:53 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2010/10/25 12:27:44 | 001,096,872 | ---- | M] (Auslogics) -- C:\Program Files\Auslogics\Auslogics BoostSpeed\boostspeed.exe
PRC - [2010/10/08 16:00:10 | 000,836,464 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2010/07/22 23:05:56 | 000,126,904 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
PRC - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010/04/29 15:39:32 | 000,437,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2009/09/30 17:57:20 | 000,718,688 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
PRC - [2009/03/05 18:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/02/23 19:43:12 | 000,576,000 | ---- | M] (MagicISO, Inc.) -- C:\Program Files\MagicDisc\MagicDisc.exe
PRC - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/10/30 21:51:44 | 000,492,720 | ---- | M] () -- C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
PRC - [2007/10/30 21:07:38 | 000,427,288 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2004/11/02 17:59:50 | 000,316,544 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
PRC - [2003/02/25 05:33:14 | 000,069,632 | ---- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\S3tray2.exe
========== Modules (SafeList) ==========
MOD - [2010/11/22 22:09:53 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
MOD - [2010/08/23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2010/08/16 21:39:11 | 000,413,552 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\asOEHook.dll
MOD - [2009/07/12 01:02:02 | 000,653,120 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\Microsoft.VC90.CRT\msvcr90.dll
MOD - [2009/07/12 01:02:00 | 000,569,664 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\Microsoft.VC90.CRT\msvcp90.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [On_Demand | Stopped] -- -- (NMIndexingService)
SRV - File not found [On_Demand | Stopped] -- C:\windows\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/07/22 23:05:56 | 000,126,904 | R--- | M] (Symantec Corporation) [unknown | Running] -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe -- (NIS)
SRV - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010/03/18 18:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state)
SRV - [2010/03/18 15:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 15:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2007/10/30 21:51:44 | 000,492,720 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe -- (TryAndDecideService)
SRV - [2007/10/30 21:07:38 | 000,427,288 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2004/11/02 17:59:50 | 000,316,544 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe -- (SymWSC)
========== Driver Services (SafeList) ==========
DRV - [2010/11/22 01:32:43 | 000,004,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nocashio.sys -- (nocashio)
DRV - [2010/11/16 04:27:00 | 001,371,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101122.022\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/11/16 04:27:00 | 000,086,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101122.022\NAVENG.SYS -- (NAVENG)
DRV - [2010/11/12 11:47:14 | 000,126,512 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/11/12 10:51:51 | 000,231,248 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\truecrypt.sys -- (truecrypt)
DRV - [2010/11/11 03:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/11/11 03:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/11/03 18:07:06 | 000,691,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101104.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010/10/19 14:36:22 | 000,341,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101122.004\IDSXpx86.sys -- (IDSxpx86)
DRV - [2010/10/02 07:28:09 | 000,441,760 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\timntr.sys -- (timounter)
DRV - [2010/10/02 07:28:09 | 000,044,384 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2010/10/02 07:27:57 | 000,129,248 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\snapman.sys -- (snapman)
DRV - [2010/10/02 07:27:38 | 000,368,544 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\tdrpman.sys -- (tdrpman)
DRV - [2010/07/28 21:33:05 | 000,666,672 | R--- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SYMEFA.SYS -- (SymEFA)
DRV - [2010/07/28 20:54:36 | 000,489,008 | R--- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SRTSP.SYS -- (SRTSP)
DRV - [2010/07/28 20:54:36 | 000,050,096 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/07/21 19:27:14 | 000,043,952 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIMMP)
DRV - [2010/07/21 19:27:14 | 000,043,952 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIM)
DRV - [2010/07/12 19:20:22 | 000,369,072 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SYMTDI.SYS -- (SYMTDI)
DRV - [2010/06/26 22:05:55 | 000,134,704 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\windows\system32\drivers\NIS\1201000.025\Ironx86.SYS -- (SymIRON)
DRV - [2010/06/13 04:50:57 | 000,339,504 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\NIS\1201000.025\SYMDS.SYS -- (SymDS)
DRV - [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2009/09/09 20:24:14 | 000,062,424 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\xusb21.sys -- (xusb21)
DRV - [2009/02/24 18:42:14 | 000,116,736 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mcdbus.sys -- (mcdbus)
DRV - [2008/04/13 12:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2004/10/01 11:24:02 | 002,279,424 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/08/03 23:29:54 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2003/06/19 02:59:00 | 000,140,800 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\windows\System32\DRIVERS\fasttx2k.sys -- (fasttx2k)
DRV - [2003/05/26 14:57:50 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3Psddr)
DRV - [2003/05/06 16:34:56 | 000,394,752 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
DRV - [2003/04/11 09:51:30 | 000,010,624 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2003/03/31 22:29:42 | 000,625,537 | ---- | M] (LT) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
DRV - [2003/03/19 23:51:00 | 000,018,688 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\windows\System32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2003/02/20 17:18:36 | 000,036,608 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\windows\System32\DRIVERS\SISAGPX.sys -- (SISAGP)
DRV - [2002/12/27 12:41:00 | 000,026,880 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\windows\System32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2002/10/04 18:04:10 | 000,046,976 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139)
DRV - [2002/07/29 23:43:50 | 000,023,808 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus9.hpwis.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus9.hpwis.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus9.hpwis.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=14597&l=dis
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost
========== FireFox ==========
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2010/11/12 11:48:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\ [2010/11/12 11:46:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/17 23:09:06 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/17 22:49:31 | 000,000,000 | ---D | M]
[2010/11/17 23:09:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/11/22 18:59:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\fzr1aavl.default\extensions
[2010/11/17 23:36:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\fzr1aavl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/17 23:10:03 | 000,002,470 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\fzr1aavl.default\searchplugins\safesearch.xml
[2010/11/17 22:49:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
O1 HOSTS File: ([2010/11/17 17:10:55 | 000,433,944 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 ad.de.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.dk.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.es.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.fr.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.it.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.jp.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.kr.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.linkexchange.com
O1 - Hosts: 127.0.0.1 ad.linksynergy.com
O1 - Hosts: 127.0.0.1 ad.nl.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.no.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.preferences.com
O1 - Hosts: 127.0.0.1 ad.se.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.sma.punto.net
O1 - Hosts: 127.0.0.1 ad.uk.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.webprovider.com
O1 - Hosts: 127.0.0.1 ad08.focalink.com
O1 - Hosts: 127.0.0.1 ad1.adcept.net
O1 - Hosts: 127.0.0.1 ad2.adcept.net
O1 - Hosts: 127.0.0.1 ad3.adcept.net
O1 - Hosts: 127.0.0.1 ad-adex3.flycast.com
O1 - Hosts: 127.0.0.1 adcontroller.unicast.com
O1 - Hosts: 127.0.0.1 adcreatives.imaginemedia.com
O1 - Hosts: 14900 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\IPSBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\windows\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [s3TRAY2] C:\windows\System32\S3tray2.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [XboxStat] c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)
O4 - HKCU..\Run: [NVIEW] C:\windows\System32\nview.dll (NVIDIA Corporation)
O4 - HKCU..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPropertiesMyComputer = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileAssociate = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1285986839921 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 76.7.255.188 65.164.201.148
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\fsp_lmwl: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\windows\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (relog_ap) - C:\windows\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/07/24 02:29:01 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2002/10/17 09:56:50 | 000,000,036 | RH-- | M] () - D:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2006/02/09 14:59:36 | 000,000,000 | RH-D | M] - D:\autorun -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (sasnative32) - File not found
O34 - HKLM BootExecute: (Execute settings...) - File not found
O34 - HKLM BootExecute: (on\Explore) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010/11/22 22:09:53 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/11/22 19:43:04 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Owner\Recent
[2010/11/22 19:32:35 | 000,000,000 | ---D | C] -- C:\windows\Minidump
[2010/11/22 18:29:09 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Owner\Application Data\pcouffin.sys
[2010/11/22 18:29:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\PcSetup
[2010/11/22 00:40:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\HHD Software
[2010/11/22 00:32:36 | 000,116,736 | ---- | C] (MagicISO, Inc.) -- C:\windows\System32\drivers\mcdbus.sys
[2010/11/22 00:32:33 | 000,000,000 | ---D | C] -- C:\Program Files\MagicDisc
[2010/11/21 19:29:06 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\DBvsSF
[2010/11/21 19:28:48 | 000,000,000 | -H-D | C] -- C:\windows\PIF
[2010/11/21 05:23:59 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Installer Clean Up
[2010/11/21 05:23:06 | 000,000,000 | ---D | C] -- C:\Program Files\MSECACHE
[2010/11/21 05:20:00 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys
[2010/11/21 05:19:57 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2010/11/21 05:19:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/21 02:53:12 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\Virtualdub
[2010/11/21 02:37:04 | 000,000,000 | ---D | C] -- C:\Program Files\YouTube Downloader
[2010/11/21 02:11:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\WMTools Downloaded Files
[2010/11/21 02:01:52 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[2010/11/21 02:01:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\My Documents\My Videos
[2010/11/20 15:07:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Identities
[2010/11/18 18:13:20 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\Nintendo 64 (N64)
[2010/11/18 15:59:39 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_7.dll
[2010/11/18 15:59:39 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_5.dll
[2010/11/18 15:59:38 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_43.dll
[2010/11/18 15:59:38 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_7.dll
[2010/11/18 15:59:37 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dcsx_43.dll
[2010/11/18 15:59:36 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx11_43.dll
[2010/11/18 15:59:35 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_43.dll
[2010/11/18 15:59:35 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_43.dll
[2010/11/18 15:59:34 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_6.dll
[2010/11/18 15:59:34 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_4.dll
[2010/11/18 15:59:33 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_6.dll
[2010/11/18 15:59:32 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_7.dll
[2010/11/18 15:59:31 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_5.dll
[2010/11/18 15:59:29 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_5.dll
[2010/11/18 15:59:28 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_42.dll
[2010/11/18 15:59:27 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dcsx_42.dll
[2010/11/18 15:59:27 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx11_42.dll
[2010/11/18 15:59:26 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_42.dll
[2010/11/18 15:59:25 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_42.dll
[2010/11/18 15:59:24 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_41.dll
[2010/11/18 15:59:24 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_41.dll
[2010/11/18 15:59:24 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_41.dll
[2010/11/18 15:59:22 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_4.dll
[2010/11/18 15:59:22 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_3.dll
[2010/11/18 15:59:21 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_4.dll
[2010/11/18 15:59:21 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_6.dll
[2010/11/18 15:59:20 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_40.dll
[2010/11/18 15:59:20 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_40.dll
[2010/11/18 15:59:19 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_40.dll
[2010/11/18 15:59:18 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_3.dll
[2010/11/18 15:59:18 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_2.dll
[2010/11/18 15:59:17 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_3.dll
[2010/11/18 15:59:16 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_5.dll
[2010/11/18 15:59:15 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_2.dll
[2010/11/18 15:59:15 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_1.dll
[2010/11/18 15:59:14 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_2.dll
[2010/11/18 15:59:13 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_39.dll
[2010/11/18 15:59:13 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_39.dll
[2010/11/18 15:59:13 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_39.dll
[2010/11/18 15:59:11 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_1.dll
[2010/11/18 15:59:11 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_1.dll
[2010/11/18 15:59:11 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_0.dll
[2010/11/18 15:59:10 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_4.dll
[2010/11/18 15:59:09 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_38.dll
[2010/11/18 15:59:09 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_38.dll
[2010/11/18 15:59:08 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_38.dll
[2010/11/18 15:59:07 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_0.dll
[2010/11/18 15:59:06 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_0.dll
[2010/11/18 15:59:05 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_3.dll
[2010/11/18 15:59:04 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_37.dll
[2010/11/18 15:59:04 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_37.dll
[2010/11/18 15:59:03 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_37.dll
[2010/11/18 15:59:02 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_10.dll
[2010/11/18 15:59:01 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_36.dll
[2010/11/18 15:59:01 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_36.dll
[2010/11/18 15:59:00 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_36.dll
[2010/11/18 15:58:58 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_9.dll
[2010/11/18 15:58:57 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_35.dll
[2010/11/18 15:58:57 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_35.dll
[2010/11/18 15:58:56 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_35.dll
[2010/11/18 15:58:55 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_8.dll
[2010/11/18 15:58:55 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_2.dll
[2010/11/18 15:58:54 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_34.dll
[2010/11/18 15:58:54 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_34.dll
[2010/11/18 15:58:53 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_34.dll
[2010/11/18 15:58:50 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_7.dll
[2010/11/18 15:58:44 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_33.dll
[2010/11/18 15:58:44 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_33.dll
[2010/11/18 15:58:38 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_33.dll
[2010/11/18 15:58:37 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_6.dll
[2010/11/18 15:58:35 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_5.dll
[2010/11/18 15:58:34 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_32.dll
[2010/11/18 15:58:32 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_4.dll
[2010/11/18 15:58:32 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\x3daudio1_1.dll
[2010/11/18 15:58:31 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_31.dll
[2010/11/18 15:58:30 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_3.dll
[2010/11/18 15:58:29 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xinput1_2.dll
[2010/11/18 15:58:28 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_2.dll
[2010/11/18 15:58:27 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xinput1_1.dll
[2010/11/18 15:58:25 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_1.dll
[2010/11/18 15:58:20 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine2_0.dll
[2010/11/18 15:58:20 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\x3daudio1_0.dll
[2010/11/18 15:58:19 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_29.dll
[2010/11/18 15:58:18 | 000,061,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xinput9_1_0.dll
[2010/11/18 15:58:17 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_27.dll
[2010/11/18 15:58:15 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_26.dll
[2010/11/18 15:58:14 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_25.dll
[2010/11/18 15:58:12 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_24.dll
[2010/11/18 15:54:20 | 000,000,000 | ---D | C] -- C:\windows\Logs
[2010/11/18 15:02:53 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\PS2
[2010/11/17 23:53:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Auslogics
[2010/11/17 23:49:50 | 000,000,000 | ---D | C] -- C:\Program Files\Auslogics
[2010/11/17 23:08:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla
[2010/11/17 23:08:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Mozilla
[2010/11/17 22:49:28 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2010/11/17 21:07:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DirectX
[2010/11/17 21:05:58 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\dreamcast
[2010/11/17 20:05:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Downloads
[2010/11/17 20:01:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Registry Mechanic
[2010/11/17 18:24:56 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\SNES ROMS
[2010/11/17 17:57:51 | 000,016,184 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\windows\System32\ROBoot.exe
[2010/11/17 17:45:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Systweak
[2010/11/17 17:42:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Systweak
[2010/11/17 15:09:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Xbox 360 Accessories
[2010/11/17 11:55:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Threat Expert
[2010/11/16 20:40:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\WinZip
[2010/11/16 20:39:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2010/11/16 20:39:03 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip
[2010/11/16 19:57:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\DFX
[2010/11/16 19:54:45 | 000,000,000 | ---D | C] -- C:\Program Files\DFX
[2010/11/16 19:54:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DFX
[2010/11/16 19:52:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DFX
[2010/11/16 13:13:12 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Owner\Desktop\Super Nintendo
[2010/11/16 11:40:33 | 000,000,000 | ---D | C] -- C:\windows\System32\XPSViewer
[2010/11/16 11:40:28 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild
[2010/11/16 11:40:17 | 000,000,000 | ---D | C] -- C:\Program Files\Reference Assemblies
[2010/11/16 11:39:32 | 000,117,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\prntvpt.dll
[2010/11/16 11:39:31 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xpssvcs.dll
[2010/11/16 11:39:31 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\xpssvcs.dll
[2010/11/16 11:39:31 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\printfilterpipelinesvc.exe
[2010/11/16 11:39:31 | 000,575,488 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\xpsshhdr.dll
[2010/11/16 11:39:31 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\filterpipelineprintproc.dll
[2010/11/16 11:39:30 | 000,000,000 | ---D | C] -- C:\c2abe63ea84c83266ac191
[2010/11/16 10:38:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/11/16 10:32:41 | 000,000,000 | ---D | C] -- C:\0ac34ef71f547cdfb08e67
[2010/11/16 10:32:25 | 000,000,000 | ---D | C] -- C:\56e44aa85a13a069f62108561b886a
[2010/11/16 01:18:15 | 000,043,952 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\SymIM.sys
[2010/11/16 01:06:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/11/15 23:56:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2010/11/15 23:56:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/11/15 23:19:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Readon_Technology
[2010/11/15 23:19:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Readon Player
[2010/11/15 22:54:58 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2010/11/15 22:28:39 | 000,000,000 | ---D | C] -- C:\windows\Sun
[2010/11/15 17:37:53 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\spmsgXP_2k3.dll
[2010/11/15 17:29:25 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\WdfCoInstaller01007.dll
[2010/11/15 17:29:25 | 000,062,424 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\xusb21.sys
[2010/11/15 17:29:25 | 000,000,000 | ---D | C] -- C:\windows\System32\DRVSTORE
[2010/11/15 17:29:14 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xinput1_3.dll
[2010/11/14 21:40:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Acronis
[2010/11/14 21:32:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Uniblue
[2010/11/14 21:32:29 | 000,000,000 | ---D | C] -- C:\Program Files\Uniblue
[2010/11/14 21:23:07 | 000,000,000 | ---D | C] -- C:\Program Files\PS3 Media Server
[2010/11/14 19:19:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\FFOutput
[2010/11/14 19:18:11 | 000,000,000 | ---D | C] -- C:\Program Files\FreeTime
[2010/11/13 02:15:49 | 000,000,000 | ---D | C] -- C:\Program Files\mkv2vob
[2010/11/13 01:04:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Yahoo
[2010/11/13 01:02:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Yahoo!
[2010/11/13 01:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo!
[2010/11/13 00:56:46 | 000,000,000 | ---D | C] -- C:\Program Files\Yahoo!
[2010/11/12 20:19:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/11/12 18:18:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\ConvertXToDVD
[2010/11/12 17:46:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Vso
[2010/11/12 17:45:11 | 000,000,000 | ---D | C] -- C:\Program Files\VSO
[2010/11/12 16:49:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2010/11/12 16:37:39 | 000,000,000 | ---D | C] -- C:\Program Files\JRE
[2010/11/12 16:37:33 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2010/11/12 16:36:43 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javaws.exe
[2010/11/12 16:36:43 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javaw.exe
[2010/11/12 16:36:43 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\java.exe
[2010/11/12 12:02:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Tific
[2010/11/12 12:01:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Symantec
[2010/11/12 11:49:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Symantec
[2010/11/12 11:47:14 | 000,126,512 | ---- | C] (Symantec Corporation) -- C:\windows\System32\drivers\SYMEVENT.SYS
[2010/11/12 11:47:14 | 000,060,808 | ---- | C] (Symantec Corporation) -- C:\windows\System32\S32EVNT1.DLL
[2010/11/12 11:47:02 | 000,666,672 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\SymEFA.sys
[2010/11/12 11:47:02 | 000,489,008 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\srtsp.sys
[2010/11/12 11:47:02 | 000,369,072 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\symtdi.sys
[2010/11/12 11:47:02 | 000,339,504 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\SymDS.sys
[2010/11/12 11:47:02 | 000,331,312 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\symtdiv.sys
[2010/11/12 11:47:02 | 000,294,448 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\symnets.sys
[2010/11/12 11:47:02 | 000,134,704 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\Ironx86.sys
[2010/11/12 11:47:02 | 000,050,096 | R--- | C] (Symantec Corporation) -- C:\windows\System32\drivers\NIS\1201000.025\srtspx.sys
[2010/11/12 11:46:44 | 000,000,000 | ---D | C] -- C:\windows\System32\drivers\NIS
[2010/11/12 11:46:44 | 000,000,000 | ---D | C] -- C:\windows\System32\drivers\NIS\1201000.025
[2010/11/12 11:46:41 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Sidebar
[2010/11/12 11:46:41 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Internet Security
[2010/11/12 11:46:20 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/11/12 11:41:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2010/11/12 11:35:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Norton
[2010/11/12 11:35:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Norton
[2010/11/12 11:24:41 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/11/12 11:24:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/11/12 11:03:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Adobe
[2010/11/12 11:01:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TrueCrypt
[2010/11/12 10:52:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\TrueCrypt
[2010/11/12 10:51:51 | 000,231,248 | ---- | C] (TrueCrypt Foundation) -- C:\windows\System32\drivers\truecrypt.sys
[2010/11/12 10:51:50 | 000,000,000 | ---D | C] -- C:\Program Files\TrueCrypt
[2010/11/12 10:49:49 | 003,487,848 | ---- | C] (TrueCrypt Foundation) -- C:\Documents and Settings\Owner\My Documents\TrueCrypt Setup 7.0a.exe
[2010/11/12 00:51:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Media Player Classic
[2010/11/12 00:16:39 | 000,156,672 | ---- | C] (Radioactive) -- C:\windows\System32\rmc_fixasf.exe
[2010/11/12 00:12:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\mdnslib
[2010/11/12 00:12:44 | 000,000,000 | ---D | C] -- C:\windows\Applian Director
[2010/11/12 00:12:44 | 000,000,000 | ---D | C] -- C:\Program Files\Applian Director
[2010/11/12 00:12:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\FLVService
[2010/11/12 00:12:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Ask and Record Toolbar
[2010/11/12 00:12:19 | 000,000,000 | ---D | C] -- C:\windows\Replay Media Catcher
[2010/11/11 23:41:42 | 000,232,448 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\windows\System32\mp3fhg.acm
[2010/11/11 23:41:41 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\windows\System32\yv12vfw.dll
[2010/11/11 23:41:41 | 000,151,552 | ---- | C] (fccHandler) -- C:\windows\System32\ac3acm.acm
[2010/11/11 23:41:36 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack
[2010/11/11 23:38:31 | 000,000,000 | ---D | C] -- C:\Program Files\Hoo Technologies
[2010/11/11 22:11:11 | 000,000,000 | ---D | C] -- C:\Program Files\Tweak-XP
[2010/11/11 22:10:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2010/11/11 21:26:30 | 000,933,888 | ---- | C] (Adroit Technologies) -- C:\windows\System32\SmartTabs29.ocx
[2010/11/11 21:26:30 | 000,221,184 | ---- | C] (RSP Software - http://rspsoftware.clic3.net) -- C:\windows\System32\rspencr330.ocx
[2010/11/11 21:21:38 | 000,000,000 | ---D | C] -- C:\Program Files\Lock My PC 4
[2010/11/11 21:19:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\WinRAR
[2010/11/11 19:43:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Symantec
[2010/10/27 04:00:21 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2010/10/26 13:49:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Acronis
[2010/10/26 11:26:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\ImgBurn
[2010/10/26 11:25:25 | 000,000,000 | ---D | C] -- C:\Program Files\ImgBurn
[2010/10/26 11:20:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2010/10/26 11:18:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Ahead
[2010/10/26 11:15:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\LightScribe
[2010/10/26 08:46:49 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mfc42.dll
[2010/10/26 08:46:49 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mfc40u.dll
[2010/10/26 08:46:34 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\comctl32.dll
[2010/10/25 17:41:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Ahead
[2010/10/25 17:40:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Ahead
[2010/10/25 17:31:05 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_30.dll
[2010/10/25 17:31:04 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_28.dll
[2010/10/25 16:53:29 | 000,000,000 | ---D | C] -- C:\windows\Prefetch
[2010/10/25 16:39:43 | 000,000,000 | ---D | C] -- C:\windows\System32\scripting
[2010/10/25 16:39:42 | 000,000,000 | ---D | C] -- C:\windows\l2schemas
[2010/10/25 16:39:41 | 000,000,000 | ---D | C] -- C:\windows\System32\en
[2010/10/25 16:34:02 | 000,000,000 | ---D | C] -- C:\windows\network diagnostic
[2010/10/25 15:34:11 | 000,000,000 | ---D | C] -- C:\windows\pss
[2010/10/25 15:33:49 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/10/25 15:05:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\VS Revo Group
[2010/10/25 14:56:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/10/25 14:56:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/10/25 14:56:30 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\deployJava1.dll
[2010/10/25 14:56:30 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javacpl.cpl
[2010/10/25 14:54:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Sun
[2010/10/25 14:34:24 | 000,060,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\usbaudio.sys
========== Files - Modified Within 30 Days ==========
[2010/11/22 22:09:53 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/11/22 19:46:32 | 000,000,412 | ---- | M] () -- C:\windows\tasks\Symantec NetDetect.job
[2010/11/22 19:45:41 | 000,001,394 | ---- | M] () -- C:\windows\System\hpsysdrv.DAT
[2010/11/22 19:44:28 | 000,000,408 | ---- | M] () -- C:\windows\tasks\Auslogics BoostSpeed Integrator Start On Windows Logon.job
[2010/11/22 19:44:03 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat
[2010/11/22 19:43:51 | 2130,235,392 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/22 18:29:09 | 000,087,608 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\inst.exe
[2010/11/22 18:29:09 | 000,047,360 | ---- | M] (VSO Software) -- C:\Documents and Settings\Owner\Application Data\pcouffin.sys
[2010/11/22 18:29:09 | 000,007,887 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.cat
[2010/11/22 18:29:09 | 000,001,144 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.inf
[2010/11/22 01:32:43 | 000,004,096 | ---- | M] () -- C:\windows\System32\drivers\nocashio.sys
[2010/11/22 00:40:13 | 000,002,310 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Hex Editor Neo.lnk
[2010/11/22 00:40:13 | 000,002,292 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Hex Editor Neo.lnk
[2010/11/22 00:32:50 | 000,000,652 | ---- | M] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\MagicDisc.lnk
[2010/11/22 00:32:49 | 000,000,640 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\MagicDisc.lnk
[2010/11/21 05:20:13 | 000,000,714 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/21 03:06:07 | 000,073,728 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/21 02:37:08 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\YouTube Downloader.lnk
[2010/11/18 15:58:37 | 000,752,944 | ---- | M] () -- C:\windows\System32\drivers\NIS\1201000.025\Cat.DB
[2010/11/17 23:50:05 | 000,000,924 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Auslogics BoostSpeed.lnk
[2010/11/17 23:50:04 | 000,000,906 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Auslogics BoostSpeed.lnk
[2010/11/17 23:09:12 | 000,000,000 | ---- | M] () -- C:\windows\nsreg.dat
[2010/11/17 22:49:42 | 000,001,626 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/11/17 22:49:42 | 000,001,608 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/11/17 18:01:42 | 000,002,576 | ---- | M] () -- C:\windows\System32\ASOROSet.bin
[2010/11/17 17:10:55 | 000,433,944 | R--- | M] () -- C:\windows\System32\drivers\etc\HOSTS
[2010/11/17 09:37:09 | 000,502,724 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2010/11/17 09:37:09 | 000,087,682 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2010/11/16 20:39:50 | 000,001,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
[2010/11/16 12:25:32 | 000,153,976 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2010/11/15 17:39:53 | 000,000,000 | -H-- | M] () -- C:\windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf
[2010/11/15 17:39:50 | 000,000,000 | -H-- | M] () -- C:\windows\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/11/15 17:26:28 | 000,001,158 | ---- | M] () -- C:\windows\System32\wpa.dbl
[2010/11/14 21:32:32 | 000,000,747 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk
[2010/11/14 21:32:32 | 000,000,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SpeedUpMyPC.lnk
[2010/11/14 21:23:23 | 000,000,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\PS3 Media Server.lnk
[2010/11/14 19:18:37 | 000,000,851 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Format Factory.lnk
[2010/11/13 02:15:54 | 000,001,701 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\mkv2vob.lnk
[2010/11/13 01:01:54 | 000,000,820 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/11/13 01:01:54 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/11/12 20:26:03 | 000,001,057 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\vso_ts_preview.xml
[2010/11/12 16:38:37 | 000,000,885 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\OpenOffice.org 3.2.lnk
[2010/11/12 11:47:14 | 000,126,512 | ---- | M] (Symantec Corporation) -- C:\windows\System32\drivers\SYMEVENT.SYS
[2010/11/12 11:47:14 | 000,060,808 | ---- | M] (Symantec Corporation) -- C:\windows\System32\S32EVNT1.DLL
[2010/11/12 11:47:14 | 000,007,456 | ---- | M] () -- C:\windows\System32\drivers\SYMEVENT.CAT
[2010/11/12 11:47:14 | 000,000,805 | ---- | M] () -- C:\windows\System32\drivers\SYMEVENT.INF
[2010/11/12 11:47:04 | 000,001,973 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Norton Internet Security.LNK
[2010/11/12 11:24:48 | 000,000,955 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy (for blind users).lnk
[2010/11/12 11:24:48 | 000,000,951 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/11/12 11:24:48 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk
[2010/11/12 11:20:54 | 000,009,275 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts.20101112-093003.backup
[2010/11/12 11:14:53 | 003,883,008 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\True Crypt
[2010/11/12 11:04:11 | 000,369,152 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\ISORecorderV2RC1.msi
[2010/11/12 10:51:53 | 000,000,640 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\TrueCrypt.lnk
[2010/11/12 10:51:51 | 000,231,248 | ---- | M] (TrueCrypt Foundation) -- C:\windows\System32\drivers\truecrypt.sys
[2010/11/12 10:50:03 | 003,487,848 | ---- | M] (TrueCrypt Foundation) -- C:\Documents and Settings\Owner\My Documents\TrueCrypt Setup 7.0a.exe
[2010/11/12 01:39:12 | 000,237,568 | ---- | M] () -- C:\windows\System32\rmc_rtspdl.dll
[2010/11/12 01:39:12 | 000,156,672 | ---- | M] (Radioactive) -- C:\windows\System32\rmc_fixasf.exe
[2010/11/11 23:41:47 | 000,000,938 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Media Player Classic.lnk
[2010/11/11 23:38:33 | 000,000,897 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\WAV MP3 Converter.lnk
[2010/11/11 22:37:56 | 000,019,734 | ---- | M] () -- C:\windows\System32\oemlogo.bmp
[2010/11/11 22:37:56 | 000,000,431 | ---- | M] () -- C:\windows\System32\oeminfo.ini
[2010/11/11 22:12:11 | 000,000,463 | ---- | M] () -- C:\windows\txp-lcn.ini
[2010/11/11 22:06:22 | 000,000,103 | ---- | M] () -- C:\windows\_vmtxp.ini
[2010/11/11 21:55:38 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2010/11/11 20:49:27 | 000,000,610 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[2010/11/11 20:49:27 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/10/26 11:53:22 | 000,000,608 | ---- | M] () -- C:\windows\QUICKEN.INI
[2010/10/26 11:25:27 | 000,001,554 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
[2010/10/26 11:25:27 | 000,001,536 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\ImgBurn.lnk
[2010/10/25 17:33:08 | 000,316,640 | ---- | M] () -- C:\windows\WMSysPr9.prx
[2010/10/25 16:56:09 | 000,000,812 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/10/25 16:33:41 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/10/25 14:58:19 | 000,001,737 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/10/25 14:56:15 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\deployJava1.dll
[2010/10/25 14:56:15 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\javaws.exe
[2010/10/25 14:56:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\javaw.exe
[2010/10/25 14:56:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\java.exe
[2010/10/25 14:56:15 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\javacpl.cpl
[2010/10/25 07:07:06 | 000,000,283 | RHS- | M] () -- C:\boot.ini
========== Files Created - No Company Name ==========
[2010/11/22 19:43:51 | 2130,235,392 | -HS- | C] () -- C:\hiberfil.sys
[2010/11/22 18:29:10 | 000,000,055 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.log
[2010/11/22 18:29:09 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\inst.exe
[2010/11/22 18:29:09 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.cat
[2010/11/22 18:29:09 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\pcouffin.inf
[2010/11/22 01:32:43 | 000,004,096 | ---- | C] () -- C:\windows\System32\drivers\nocashio.sys
[2010/11/22 00:40:13 | 000,002,310 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Hex Editor Neo.lnk
[2010/11/22 00:40:13 | 000,002,292 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Hex Editor Neo.lnk
[2010/11/22 00:32:50 | 000,000,652 | ---- | C] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\MagicDisc.lnk
[2010/11/22 00:32:49 | 000,000,640 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\MagicDisc.lnk
[2010/11/21 05:20:13 | 000,000,714 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/21 02:37:08 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\YouTube Downloader.lnk
[2010/11/17 23:50:48 | 000,000,408 | ---- | C] () -- C:\windows\tasks\Auslogics BoostSpeed Integrator Start On Windows Logon.job
[2010/11/17 23:50:04 | 000,000,924 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Auslogics BoostSpeed.lnk
[2010/11/17 23:50:04 | 000,000,906 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Auslogics BoostSpeed.lnk
[2010/11/17 23:09:12 | 000,000,000 | ---- | C] () -- C:\windows\nsreg.dat
[2010/11/17 22:49:42 | 000,001,626 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/11/17 22:49:42 | 000,001,608 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/11/17 17:57:51 | 000,002,576 | ---- | C] () -- C:\windows\System32\ASOROSet.bin
[2010/11/16 20:39:50 | 000,001,732 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
[2010/11/15 17:39:53 | 000,000,000 | -H-- | C] () -- C:\windows\System32\drivers\Msft_Kernel_xusb21_01007.Wdf
[2010/11/15 17:39:50 | 000,000,000 | -H-- | C] () -- C:\windows\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/11/14 21:32:32 | 000,000,747 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk
[2010/11/14 21:32:32 | 000,000,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SpeedUpMyPC.lnk
[2010/11/14 21:23:22 | 000,000,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\PS3 Media Server.lnk
[2010/11/14 19:18:37 | 000,000,851 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Format Factory.lnk
[2010/11/13 02:15:52 | 000,001,701 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\mkv2vob.lnk
[2010/11/13 01:01:54 | 000,000,820 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/11/13 01:01:54 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/11/12 17:46:21 | 000,001,057 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\vso_ts_preview.xml
[2010/11/12 16:38:37 | 000,000,885 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\OpenOffice.org 3.2.lnk
[2010/11/12 11:47:20 | 000,752,944 | ---- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\Cat.DB
[2010/11/12 11:47:14 | 000,007,456 | ---- | C] () -- C:\windows\System32\drivers\SYMEVENT.CAT
[2010/11/12 11:47:14 | 000,000,805 | ---- | C] () -- C:\windows\System32\drivers\SYMEVENT.INF
[2010/11/12 11:47:04 | 000,001,973 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Norton Internet Security.LNK
[2010/11/12 11:46:45 | 000,003,373 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymEFA.inf
[2010/11/12 11:46:45 | 000,002,792 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymDS.inf
[2010/11/12 11:46:45 | 000,001,473 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymNetV.inf
[2010/11/12 11:46:45 | 000,001,445 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymNet.inf
[2010/11/12 11:46:45 | 000,001,389 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\srtspx.inf
[2010/11/12 11:46:45 | 000,001,383 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\srtsp.inf
[2010/11/12 11:46:45 | 000,000,741 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\Iron.inf
[2010/11/12 11:46:44 | 000,007,787 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\symnetv.cat
[2010/11/12 11:46:44 | 000,007,446 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymNet.cat
[2010/11/12 11:46:44 | 000,007,444 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymEFA.cat
[2010/11/12 11:46:44 | 000,007,442 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\srtspx.cat
[2010/11/12 11:46:44 | 000,007,438 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\SymDS.cat
[2010/11/12 11:46:44 | 000,007,438 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\srtsp.cat
[2010/11/12 11:46:44 | 000,007,438 | R--- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\iron.cat
[2010/11/12 11:46:44 | 000,000,172 | ---- | C] () -- C:\windows\System32\drivers\NIS\1201000.025\isolate.ini
[2010/11/12 11:24:48 | 000,000,955 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy (for blind users).lnk
[2010/11/12 11:24:48 | 000,000,951 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/11/12 11:24:48 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk
[2010/11/12 11:14:53 | 003,883,008 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\True Crypt
[2010/11/12 11:04:11 | 000,369,152 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\ISORecorderV2RC1.msi
[2010/11/12 10:51:53 | 000,000,640 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\TrueCrypt.lnk
[2010/11/12 00:16:38 | 000,237,568 | ---- | C] () -- C:\windows\System32\rmc_rtspdl.dll
[2010/11/11 23:41:47 | 000,000,938 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Media Player Classic.lnk
[2010/11/11 23:41:45 | 000,165,376 | ---- | C] () -- C:\windows\System32\unrar.dll
[2010/11/11 23:41:44 | 000,000,038 | ---- | C] () -- C:\windows\avisplitter.ini
[2010/11/11 23:41:41 | 000,790,528 | ---- | C] () -- C:\windows\System32\xvidcore.dll
[2010/11/11 23:41:40 | 000,134,144 | ---- | C] () -- C:\windows\System32\xvidvfw.dll
[2010/11/11 23:41:40 | 000,108,032 | ---- | C] () -- C:\windows\System32\ff_vfw.dll
[2010/11/11 23:38:33 | 000,000,897 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\WAV MP3 Converter.lnk
[2010/11/11 22:12:11 | 000,000,463 | ---- | C] () -- C:\windows\txp-lcn.ini
[2010/11/11 22:06:08 | 000,000,103 | ---- | C] () -- C:\windows\_vmtxp.ini
[2010/11/11 21:55:38 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2010/10/26 13:11:08 | 000,073,728 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/26 11:25:27 | 000,001,554 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
[2010/10/26 11:25:27 | 000,001,536 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\ImgBurn.lnk
[2010/10/25 14:58:19 | 000,001,737 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/10/01 20:49:03 | 000,067,630 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\bdinstall.bin
[2004/09/17 18:37:42 | 000,061,440 | ---- | C] () -- C:\windows\System32\vuins32.dll
[2003/07/26 04:17:16 | 000,000,061 | ---- | C] () -- C:\windows\smscfg.ini
[2003/07/26 04:16:43 | 000,000,000 | ---- | C] () -- C:\windows\System32\iAlmcoin.dll
[2003/07/26 02:57:44 | 000,000,051 | ---- | C] () -- C:\windows\System32\mshrml.ini
[2003/07/24 04:05:31 | 000,167,936 | ---- | C] () -- C:\windows\System32\PCDrJNI_1_1.dll
[2003/07/24 04:02:11 | 000,025,438 | ---- | C] () -- C:\windows\System32\CHODDI.SYS
[2003/07/24 04:01:47 | 000,024,576 | ---- | C] () -- C:\windows\System32\syscontr.dll
[2003/07/24 04:01:15 | 000,045,056 | ---- | C] () -- C:\windows\System32\hpreg.dll
[2003/07/24 03:47:54 | 000,000,052 | ---- | C] () -- C:\windows\intuprof.ini
[2003/07/24 03:47:40 | 000,000,608 | ---- | C] () -- C:\windows\QUICKEN.INI
[2003/07/24 03:19:54 | 000,001,793 | ---- | C] () -- C:\windows\System32\fxsperf.ini
[2003/07/24 02:52:31 | 000,363,520 | ---- | C] () -- C:\windows\System32\psisdecd.dll
[2003/07/24 02:44:55 | 000,299,073 | ---- | C] () -- C:\windows\System32\PythonCOM22.dll
[2003/07/24 02:44:55 | 000,065,536 | ---- | C] () -- C:\windows\System32\PyWinTypes22.dll
[2003/07/24 02:44:37 | 000,016,896 | ---- | C] () -- C:\windows\System32\bcbmm.dll
[2003/07/24 02:32:33 | 000,000,802 | ---- | C] () -- C:\windows\orun32.ini
[2003/07/24 02:18:12 | 000,000,431 | ---- | C] () -- C:\windows\System32\oeminfo.ini
[2003/07/23 23:46:21 | 000,000,438 | ---- | C] () -- C:\windows\System32\1_ssetup.ini
[2003/07/23 23:46:21 | 000,000,000 | ---- | C] () -- C:\windows\System32\sunistlog.ini
[2003/07/23 19:22:12 | 000,004,161 | ---- | C] () -- C:\windows\ODBCINST.INI
========== LOP Check ==========
[2010/10/02 07:28:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis
[2010/10/01 20:49:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BitDefender
[2010/11/16 19:52:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DFX
[2010/10/26 11:20:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2010/11/21 04:31:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Systweak
[2010/11/22 22:30:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/11/12 11:01:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TrueCrypt
[2010/11/12 20:19:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/11/16 20:40:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2010/10/26 13:49:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Acronis
[2010/11/17 23:53:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Auslogics
[2010/10/26 11:26:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\ImgBurn
[2010/10/25 15:29:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\interMute
[2010/11/12 16:49:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2010/10/02 06:48:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Opera
[2010/11/17 20:03:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Registry Mechanic
[2003/07/24 04:02:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\SampleView
[2010/11/21 04:31:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Systweak
[2010/11/12 12:02:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Tific
[2010/11/12 11:09:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\TrueCrypt
[2010/11/14 21:32:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Uniblue
[2010/11/22 18:29:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Vso
[2010/11/22 19:44:28 | 000,000,408 | ---- | M] () -- C:\windows\Tasks\Auslogics BoostSpeed Integrator Start On Windows Logon.job
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 48 bytes -> C:\Documents and Settings\All Users\DRM:??????????
@Alternate Data Stream - 159 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07BF512B
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
< End of report >

>Drivers

>Stealth

>Files

Suspect File: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\BASH\BHREGISTRYINFO.DB-journal Status: Hidden

Suspect File: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\SymDS\Temp\sdmys_E931690641B79AB76BDEF98B Status: Hidden

>Hooks

ntoskrnl.exe+0x00004AA2, Type: Inline - RelativeJump at address 0x804DBAA2 hook handler located in [ntoskrnl.exe]

ntoskrnl.exe+0x0000B704, Type: Inline - RelativeJump at address 0x804E2704 hook handler located in [ntoskrnl.exe]

ntoskrnl.exe+0x0000B788, Type: Inline - RelativeCall at address 0x804E2788 hook handler located in [unknown_code_page]

ntoskrnl.exe+0x0000B78D, Type: Inline - RelativeJump at address 0x804E278D hook handler located in [ntoskrnl.exe]

ntoskrnl.exe+0x0000B79C, Type: Inline - RelativeJump at address 0x804E279C hook handler located in [ntoskrnl.exe]

ntoskrnl.exe+0x0000B880, Type: Inline - RelativeJump at address 0x804E2880 hook handler located in [ntoskrnl.exe]

ntoskrnl.exe+0x0000B8A0, Type: Inline - RelativeJump at address 0x804E28A0 hook handler located in [ntoskrnl.exe]

ntoskrnl.exe+0x0000BAAC, Type: Inline - RelativeJump at address 0x804E2AAC hook handler located in [ntoskrnl.exe]

ntoskrnl.exe+0x0000BAE4, Type: Inline - RelativeJump at address 0x804E2AE4 hook handler located in [ntoskrnl.exe]

ntoskrnl.exe+0x0000BB0C, Type: Inline - RelativeJump at address 0x804E2B0C hook handler located in [ntoskrnl.exe]

[1448]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification at address 0x01001268 hook handler located in [shimeng.dll]

!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

dr. · November 23, 2010