Remove Hard Drive Diagnostic [Removal Guide]

Hello Diepzeeknikker,

Please post here:

http://www.GeekPolice.net/f11-virus-spyware-malware-removal

Doc Inferno,
How do you go about removing the Hard Drive Diagnostic virus when I can't access my desktop? Every time I start my computer (in any variation of normal or safe mode) it directs me to a blank safe mode screen with no icons showing except fake virus windows?

logosystems wrote:

Doc Inferno,
How do you go about removing the Hard Drive Diagnostic virus when I can't access my desktop? Every time I start my computer (in any variation of normal or safe mode) it directs me to a blank safe mode screen with no icons showing except fake virus windows?

I think hard drive diagnostic has developed this nasty variant that logosystems and my client seem to have fallen victim to. With this variant, you can't go into safe mode (with or without networking) without hard drive diagnostic starting. It disables control-alt-delete, you have no start menu.

One thing you CAN do is go into safe mode with command prompt. From there, you can start regedit - but I've checked all the current version -> run keys and not found the virus in any of those locations.

Personally, I got really lucky. One of my reboots, I went into safe mode with networking after half a dozen times where I was in safe mode where I had no ability to do anything except interact with the virus. I put in a flash drive with rkill, mbam, and combofix on it. I put those things on the computer's hard drive, ran rkill, installed mbam (malwarebytes) and began running a full scan. I came back half an hour later and found the virus asking me to run a scan, I hit the X on it to close the window - and then the computer started shutting down - mid-scan - and before I had cleaned anything. So now I was back to square one. But then with the next dozen reboots, I was not able to replicate the scenario where I was able to get into safe mode (or normal mode) with the ability to interact with the desktop.

But eventually, I tried safe mode with command prompt where I could run combofix. Since I didn't have an internet connection, I could download the Windows recovery tool thing it wants you to download, but that was ok - running combofix without it seemed to work fine.

So what if I wasn't able to get into safe mode with networking that one time. I don't know if it would have been possible, but I would have put the tools on a flash drive or CD and seen if I could access them from safe mode with command prompt. Another thing I was considering was installing a LiveLinux CD that you could boot from the CD and then also access NTFS with. I don't have any experience with that, but I saw that recommended somewhere. I downloaded Knoppix, but didn't have to use it. My plan was to look around in temp folders and application data folders (this is a Win XP computer) and find virus looking files like 8973jhfe9.exe and such.

I hope this helps someone. I've been cleaning malware for more than a year with the simple trick of booting into safe mode with networking and running a full scan with malwarebytes. If this trend continues where the malware exists in even safe mode, it's going to get a lot harder.

Why can't the antivirus vendors protect against this damn malware? I don't know - but I wish someone would at least explain why it's so difficult to do so.

Hi all,

I wonder if anyone can help? I followed GeekPolice's tips for removing Hard Drive Diagnostic, which worked well, but I'm left with a small problem. My Desktop has disappeared! I have the taskbar and start menu, but no Desktop icons and no ability to right-click.

I have played with the explorer.exe in Task Manager, but no joy. Any ideas?

One extra bit of info, after removing HDD, all of my files were hidden, so I had to unhide them all...but this hasn't helped my Desktop

Thanks for any help!

Dan

Hello Danno,

Read this: http://www.GeekPolice.net/-t3821.htm

Hi Doc,

I'm told my copy and paste of the OTL file is too long. Is there another way, or just specific section you require?

Thanks,

Dan

Hello Dan,

You can split up your OTL log into multiple posts.

Hi Doc,


Part 1:

OTL logfile created on: 02/05/2011 17:03:37 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Dan\My Documents\Downloads
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

447.00 Mb Total Physical Memory | 48.00 Mb Available Physical Memory | 11.00% Memory free
1.00 Gb Paging File | 0.00 Gb Available in Paging File | 33.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.37 Gb Total Space | 6.73 Gb Free Space | 4.70% Space Free | Partition Type: NTFS
Drive D: | 5.66 Gb Total Space | 0.63 Gb Free Space | 11.18% Space Free | Partition Type: FAT32

Computer Name: YOUR-C94F920E24 | User Name: Dan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/02 17:00:45 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dan\My Documents\Downloads\OTL.com
PRC - [2011/04/29 20:01:54 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/04/12 09:40:16 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files\PowerISO\PWRISOVM.EXE
PRC - [2009/06/13 16:21:57 | 000,382,384 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jucheck.exe
PRC - [2007/12/04 15:36:33 | 000,017,272 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2007/12/04 14:00:23 | 000,079,224 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2007/12/04 14:00:16 | 000,140,664 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2007/12/04 13:59:01 | 000,345,464 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2007/06/13 11:23:07 | 001,033,216 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/12/06 21:06:06 | 000,054,784 | ---- | M] (Macrovision) -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE
PRC - [2006/10/05 23:11:54 | 000,866,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2006/10/05 23:11:34 | 000,013,592 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2003/05/08 12:00:58 | 000,049,152 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe


========== Modules (SafeList) ==========

MOD - [2011/05/02 17:00:45 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dan\My Documents\Downloads\OTL.com
MOD - [2006/08/25 16:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2003/05/08 12:00:46 | 000,159,744 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE2.0\OpHookSE2.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - File not found [On_Demand | Stopped] -- -- (ACDaemon)
SRV - [2007/12/04 15:36:33 | 000,017,272 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2007/12/04 14:00:16 | 000,140,664 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2007/12/04 13:59:53 | 000,247,160 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2007/12/04 13:59:01 | 000,345,464 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2006/12/10 18:57:56 | 000,069,120 | ---- | M] (BOONTY) [On_Demand | Stopped] -- C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe -- (Boonty Games)
SRV - [2006/12/06 21:06:06 | 000,054,784 | ---- | M] (Macrovision) [Auto | Running] -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE -- (C-DillaCdaC11BA)
SRV - [2006/10/05 23:11:34 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2004/08/04 05:00:00 | 000,011,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\chkdsk.exe -- (Prossedpl)


========== Driver Services (SafeList) ==========

DRV - [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010/04/12 09:44:34 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2010/01/31 16:45:11 | 000,007,936 | ---- | M] (FNet Co., Ltd.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\FNETURPX.SYS -- (FNETURPX)
DRV - [2007/12/04 15:55:46 | 000,094,544 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2007/12/04 15:53:39 | 000,023,152 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2007/12/04 15:51:52 | 000,042,912 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2007/12/04 15:49:02 | 000,026,624 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2007/06/25 10:43:38 | 000,098,344 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117obex.sys -- (s117obex)
DRV - [2007/06/25 10:43:36 | 000,108,456 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdm.sys -- (s117mdm)
DRV - [2007/06/25 10:43:36 | 000,100,264 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mgmt.sys -- (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM)
DRV - [2007/06/25 10:43:36 | 000,098,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117unic.sys -- (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM)
DRV - [2007/06/25 10:43:36 | 000,022,952 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117nd5.sys -- (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS)
DRV - [2007/06/25 10:43:26 | 000,014,888 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdfl.sys -- (s117mdfl)
DRV - [2007/06/25 10:43:22 | 000,082,984 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117bus.sys -- (s117bus) Sony Ericsson Device 117 driver (WDM)
DRV - [2007/03/27 19:19:36 | 010,252,544 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)
DRV - [2006/12/22 21:58:28 | 000,639,224 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2006/12/06 21:06:06 | 000,012,464 | ---- | M] (Macrovision Europe Ltd) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CDAC15BA.SYS -- (CdaC15BA)
DRV - [2006/07/24 17:15:04 | 004,353,024 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/04/04 22:58:44 | 001,536,000 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006/02/27 06:46:20 | 000,081,408 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2005/12/12 18:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)
DRV - [2005/06/29 18:03:18 | 000,175,104 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ftsata2.sys -- (ftsata2)
DRV - [2005/02/23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2005/02/11 12:24:24 | 000,079,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750obex.sys -- (k750obex)
DRV - [2005/02/11 12:22:48 | 000,081,728 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mgmt.sys -- (k750mgmt)
DRV - [2005/02/11 12:21:10 | 000,089,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdm.sys -- (k750mdm)
DRV - [2005/02/11 12:21:02 | 000,006,576 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdfl.sys -- (k750mdfl)
DRV - [2005/02/11 12:19:20 | 000,055,216 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750bus.sys -- (k750bus) Sony Ericsson 750 driver (WDM)
DRV - [2004/08/03 15:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2003/11/05 08:45:12 | 000,017,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\bb-run.sys -- (bb-run)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101677&l=dis
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/ig?hl=en"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/29 20:02:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/29 20:02:05 | 000,000,000 | ---D | M]

[2009/06/13 16:29:38 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dan\Application Data\Mozilla\Extensions
[2009/06/13 16:29:38 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dan\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2011/05/02 15:22:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\ybzl689c.default\extensions
[2011/03/18 21:39:51 | 000,000,000 | ---D | M] (Screengrab) -- C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\ybzl689c.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2009/09/04 19:59:20 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\ybzl689c.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/29 20:13:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/02/27 15:51:55 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2009/06/13 16:22:04 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2006/01/18 13:50:00 | 000,319,488 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npsnapfish.dll
[2008/02/04 16:42:15 | 000,024,673 | ---- | M] (Check Point Software Technologies Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll

O1 HOSTS File: ([2004/08/04 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ZoneAlarm Spy Blocker BHO) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm)
O3 - HKLM\..\Toolbar: (ZoneAlarm Spy Blocker) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm)
O3 - HKCU\..\Toolbar\ShellBrowser: (ZoneAlarm Spy Blocker) - {F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Spy Blocker) - {F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [NWEReboot] File not found
O4 - HKLM..\Run: [OpwareSE2] C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PCDrProfiler] File not found
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [TkBellExe] File not found
O4 - HKLM..\Run: [Virtual PDF Printer] File not found
O4 - HKLM..\Run: [Waiting1690] File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [RSxWcWRakP] File not found
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\NPSWF32_FlashUtil.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O9 - Extra Button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www.truprint.co.uk/TruprintActivia.cab (Snapfish Activia)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} https://upload.facebook.com/controls/FacebookPhotoUploader.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165435357656 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/05 17:32:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001/07/27 08:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2004/04/30 00:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{90cae649-e5dc-11db-a02c-001921a176e1}\Shell\AutoRun\command - "" = J:\setupSNK.exe
O33 - MountPoints2\{e2d8d339-855d-11db-9f6c-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{e2d8d339-855d-11db-9f6c-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e2d8d339-855d-11db-9f6c-806d6172696f}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0

SafeBootMin: AppMgmt - File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: vsmon - Service
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {25E11AF0-DBCF-42F5-157D-8D46E12E16CE} - Security Update for Microsoft .NET Framework 2.0 (KB922770)
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4F29C341-A241-5EC8-BFAF-AED4E47625CE} - Security Update for Microsoft .NET Framework 2.0 (KB922770)
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {52231B79-2301-E460-8C18-A139ADF9714A} - IE7 Uninstall Stub
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {72AFA5AC-47B4-4079-6322-2B96EE664BDA} - Microsoft Windows Media Player
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {79CC0002-A659-6811-6B4A-39179C3A6DC2} - IE7 Uninstall Stub
ActiveX: {835D87EC-B0FA-E557-3FDF-1FB69FB57114} - Themes Setup
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {A1A2503C-CE5D-F49D-2739-E1C37EE05E96} - DirectX
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C8FAC320-7382-68B5-9CB6-0652DD08D9AC} - Java (Sun)
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Reg Error: Value error.
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E69378DF-5750-8FAA-F0CB-08A9EA6D59D5} - Microsoft Windows Media Player
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F4EBFAD4-C373-EED7-CEDF-65F8E573C8C3} - DirectX
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: Microsoft Base Smart Card Crypto Provider Package -

Drivers32: msacm.divxa32 - C:\WINDOWS\System32\DivXa32.acm (Kristal StudioD
FileDescription)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codec - C:\WINDOWS\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivXNetworks, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54619700398653440)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/28 23:05:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\Malwarebytes
[2011/04/28 21:54:37 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/04/28 21:54:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/04/28 21:54:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/04/28 21:54:34 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/28 21:54:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/04/28 21:49:49 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Dan\Recent
[2011/04/17 14:33:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\My Documents\FrostWire
[2011/04/17 14:25:45 | 000,000,000 | ---D | C] -- C:\Program Files\FrostWire
[2011/04/10 16:27:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Desktop\7.Oz (mini)
[2011/04/03 17:21:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\APW_DATA
[2007/03/12 12:41:52 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll
[2005/11/23 13:55:32 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Dan\My Documents\*.tmp files -> C:\Documents and Settings\Dan\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/02 14:31:55 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/05/02 14:28:18 | 000,000,187 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.DAT
[2011/05/02 14:13:46 | 000,000,264 | ---- | M] () -- C:\WINDOWS\tasks\RegistryBooster.job
[2011/05/02 14:11:10 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/05/02 14:11:08 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/02 14:11:07 | 469,159,936 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/28 21:54:38 | 000,000,792 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/26 22:26:33 | 000,000,144 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~18997044r
[2011/04/26 22:26:33 | 000,000,128 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~18997044
[2011/04/26 22:26:11 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\18997044
[2011/04/18 19:45:17 | 000,293,294 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Subs Club.jpeg
[2011/04/18 19:44:06 | 000,245,003 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Let's Knit! Local - Let's Knit Magazine1
[2011/04/18 19:43:55 | 000,277,194 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Let's Knit! Local - Let's Knit Magazine.jpeg
[2011/04/14 20:31:40 | 000,099,328 | ---- | M] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/07 22:24:41 | 000,007,177 | ---- | M] () -- C:\Documents and Settings\Dan\.recently-used.xbel
[2011/04/07 22:06:06 | 000,198,280 | ---- | M] () -- C:\Documents and Settings\Dan\jm2.jpg
[2011/04/07 22:05:14 | 000,203,054 | ---- | M] () -- C:\Documents and Settings\Dan\jm.jpg
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Dan\My Documents\*.tmp files -> C:\Documents and Settings\Dan\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/28 23:03:19 | 469,159,936 | -HS- | C] () -- C:\hiberfil.sys
[2011/04/28 21:54:38 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/26 22:26:33 | 000,000,144 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~18997044r
[2011/04/26 22:26:33 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~18997044
[2011/04/26 22:26:11 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\18997044
[2011/04/18 19:45:17 | 000,293,294 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Subs Club.jpeg
[2011/04/18 19:44:06 | 000,245,003 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Let's Knit! Local - Let's Knit Magazine1
[2011/04/18 19:43:55 | 000,277,194 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Let's Knit! Local - Let's Knit Magazine.jpeg
[2011/04/07 22:24:41 | 000,007,177 | ---- | C] () -- C:\Documents and Settings\Dan\.recently-used.xbel
[2011/04/07 22:06:06 | 000,198,280 | ---- | C] () -- C:\Documents and Settings\Dan\jm2.jpg
[2011/04/07 22:05:14 | 000,203,054 | ---- | C] () -- C:\Documents and Settings\Dan\jm.jpg
[2011/03/10 13:53:10 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2010/02/27 16:00:58 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/02/13 16:23:09 | 000,081,700 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009/08/30 20:03:48 | 000,000,768 | ---- | C] () -- C:\WINDOWS\System32\Remover.ini
[2009/07/26 15:46:09 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\PUTTY.RND
[2008/04/20 13:51:39 | 000,000,022 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\kodakpcd.ini
[2007/11/04 12:20:44 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\fusioncache.dat
[2007/09/19 21:11:52 | 000,041,472 | ---- | C] () -- C:\WINDOWS\System32\cam1690.dll
[2007/06/20 12:02:19 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007/03/23 16:34:42 | 001,597,440 | ---- | C] () -- C:\WINDOWS\stic1690.exe
[2007/03/20 16:44:02 | 000,000,566 | ---- | C] () -- C:\WINDOWS\System32\SP7302.ini
[2007/01/10 21:31:24 | 000,036,363 | ---- | C] () -- C:\WINDOWS\CSTBox.INI
[2007/01/09 19:41:57 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/01/07 13:29:23 | 000,000,532 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2007/01/03 10:13:12 | 000,000,032 | ---- | C] () -- C:\WINDOWS\render.ini
[2007/01/02 20:48:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mtstack.INI
[2007/01/02 20:40:20 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\MTSTACK.EXE
[2006/12/30 00:57:03 | 000,000,316 | ---- | C] () -- C:\Documents and Settings\Dan\Application Data\wklnhst.dat
[2006/12/24 16:21:02 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/12/20 14:09:14 | 000,000,098 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/12/10 21:12:30 | 000,004,212 | ---- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2006/12/10 16:54:35 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe
[2006/12/10 16:37:04 | 000,002,062 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2006/12/07 22:53:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006/12/06 22:18:49 | 000,099,328 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/10/12 05:55:49 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/10/12 05:34:33 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys
[2006/10/12 05:30:09 | 000,012,985 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2006/10/12 05:30:03 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2006/10/12 05:24:45 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2006/10/12 05:22:02 | 000,000,102 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/10/12 05:16:41 | 000,095,822 | ---- | C] () -- C:\WINDOWS\hpqins69.dat
[2006/10/12 05:15:42 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2006/10/12 05:12:31 | 000,125,796 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2006/10/12 05:10:52 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006/10/12 04:53:03 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2006/09/19 10:07:28 | 000,827,392 | ---- | C] () -- C:\WINDOWS\vsnpstd3.exe
[2005/12/05 17:49:08 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/12/05 17:36:34 | 000,445,678 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005/12/05 17:36:34 | 000,072,692 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005/12/05 17:34:46 | 000,380,040 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/12/05 17:31:48 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/12/05 17:30:02 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/02/24 12:29:14 | 000,162,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\PFC027.sys
[2005/01/25 15:15:42 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\PA207USD.DLL
[2004/08/04 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 05:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 05:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/08/04 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/06/24 13:10:06 | 000,000,573 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/02/27 17:36:18 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini
[2003/05/29 09:55:32 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\Uninstall.exe
[2003/05/29 09:55:18 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\CSUninstall.exe
[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/10/15 23:54:04 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2002/10/06 19:42:58 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2002/10/05 00:04:26 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2002/10/05 00:04:26 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2002/10/05 00:04:18 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2002/05/16 01:38:40 | 000,091,136 | ---- | C] () -- C:\WINDOWS\System32\mp4fil32.dll
[2002/05/04 15:19:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\avisynthEx.dll
[2002/04/19 16:23:26 | 000,106,137 | ---- | C] () -- C:\WINDOWS\System32\libpostproc.dll
[2002/04/19 15:51:04 | 000,211,760 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2001/08/23 16:12:28 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 16:11:02 | 000,004,490 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/06/22 13:06:02 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\MPEG2DEC.dll
[2000/09/14 03:03:00 | 000,000,145 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT.DAT

========== Custom Scans ==========


< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/12/05 17:31:36 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 11:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 13:15:46 | 000,306,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2005/12/05 17:32:14 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2004/02/27 17:36:18 | 000,013,023 | ---- | M] () -- C:\WINDOWS\snpstd3.src

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2009/04/04 14:00:00 | 001,228,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\Dan\My Documents\ADBEDRWVCS4_LS1.exe
[1 C:\Documents and Settings\Dan\My Documents\*.tmp files -> C:\Documents and Settings\Dan\My Documents\*.tmp -> ]

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 05:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\*.exe >
[2011/04/29 20:01:54 | 000,122,328 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\crashreporter.exe
[2011/04/29 20:01:54 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
[2006/04/15 00:05:02 | 000,009,952 | ---- | M] () -- C:\Program Files\Mozilla Firefox\regxpcom.exe
[2011/04/29 20:01:59 | 000,246,744 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\updater.exe

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2006/12/06 22:15:29 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Dan\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2006/12/22 21:58:28 | 000,639,224 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

< %systemroot%\System32\config\*.sav >
[2005/12/05 17:23:36 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2005/12/05 17:23:36 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2005/12/05 17:23:36 | 000,884,736 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2004/08/04 05:00:00 | 000,009,029 | ---- | M] () -- C:\WINDOWS\system32\ansi.sys
[2006/10/12 05:30:09 | 000,012,985 | ---- | M] () -- C:\WINDOWS\system32\CHODDI.SYS
[2004/08/04 05:00:00 | 000,027,097 | ---- | M] () -- C:\WINDOWS\system32\country.sys
[2004/08/04 05:00:00 | 000,004,768 | ---- | M] () -- C:\WINDOWS\system32\himem.sys
[2004/08/04 05:00:00 | 000,042,809 | ---- | M] () -- C:\WINDOWS\system32\key01.sys
[2004/08/04 05:00:00 | 000,042,537 | ---- | M] () -- C:\WINDOWS\system32\keyboard.sys
[2004/08/04 05:00:00 | 000,027,866 | ---- | M] () -- C:\WINDOWS\system32\ntdos.sys
[2004/08/04 05:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos404.sys
[2004/08/04 05:00:00 | 000,029,370 | ---- | M] () -- C:\WINDOWS\system32\ntdos411.sys
[2004/08/04 05:00:00 | 000,029,274 | ---- | M] () -- C:\WINDOWS\system32\ntdos412.sys
[2004/08/04 05:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos804.sys
[2004/08/04 05:00:00 | 000,033,840 | ---- | M] () -- C:\WINDOWS\system32\ntio.sys
[2004/08/04 05:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio404.sys
[2004/08/04 05:00:00 | 000,035,648 | ---- | M] () -- C:\WINDOWS\system32\ntio411.sys
[2004/08/04 05:00:00 | 000,035,424 | ---- | M] () -- C:\WINDOWS\system32\ntio412.sys
[2004/08/04 05:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio804.sys
[2004/08/04 05:00:00 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\watchdog.sys
[2010/05/02 06:56:34 | 001,850,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\win32k.sys
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.dll >
[2006/04/04 22:27:02 | 000,040,960 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2erec.dll

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >
[2006/12/06 21:06:06 | 000,054,784 | ---- | M] (Macrovision) -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 13:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %SYSTEMDRIVE%\*.* >
[2005/12/05 17:32:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2006/12/06 20:32:42 | 000,000,211 | RHS- | M] () -- C:\BOOT.BAK
[2009/09/06 19:10:56 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2004/08/04 05:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2005/12/05 17:32:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/01/10 14:42:50 | 000,000,045 | ---- | M] () -- C:\error.log
[2001/09/05 22:00:58 | 001,700,352 | ---- | M] (Microsoft Corporation) -- C:\gdiplus.dll
[2011/05/02 14:11:07 | 469,159,936 | -HS- | M] () -- C:\hiberfil.sys
[2009/08/31 00:02:43 | 000,152,088 | ---- | M] () -- C:\img2-001.raw
[2005/12/05 17:32:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/08/04 20:55:35 | 000,082,272 | ---- | M] () -- C:\logfile
[2005/12/05 17:32:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2011/05/02 14:11:05 | 704,643,072 | -HS- | M] () -- C:\pagefile.sys
[2009/04/29 22:23:55 | 000,000,268 | ---- | M] () -- C:\sqmdata00.sqm
[2009/05/17 22:07:20 | 000,000,268 | ---- | M] () -- C:\sqmdata01.sqm
[2009/06/08 21:06:35 | 000,000,232 | ---- | M] () -- C:\sqmdata02.sqm
[2006/12/16 00:59:33 | 000,000,268 | ---- | M] () -- C:\sqmdata03.sqm
[2006/12/22 21:58:59 | 000,000,268 | ---- | M] () -- C:\sqmdata04.sqm
[2006/12/22 22:09:43 | 000,000,268 | ---- | M] () -- C:\sqmdata05.sqm
[2006/12/23 02:57:54 | 000,000,268 | ---- | M] () -- C:\sqmdata06.sqm
[2006/12/29 18:58:21 | 000,000,268 | ---- | M] () -- C:\sqmdata07.sqm
[2007/06/21 19:10:33 | 000,000,268 | ---- | M] () -- C:\sqmdata08.sqm
[2007/07/25 19:10:18 | 000,000,268 | ---- | M] () -- C:\sqmdata09.sqm
[2007/08/03 18:38:29 | 000,000,268 | ---- | M] () -- C:\sqmdata10.sqm
[2007/08/15 14:24:10 | 000,000,268 | ---- | M] () -- C:\sqmdata11.sqm
[2007/08/20 14:37:09 | 000,000,268 | ---- | M] () -- C:\sqmdata12.sqm
[2007/08/23 12:18:00 | 000,000,268 | ---- | M] () -- C:\sqmdata13.sqm
[2007/08/29 12:33:28 | 000,000,268 | ---- | M] () -- C:\sqmdata14.sqm
[2007/09/03 15:24:35 | 000,000,268 | ---- | M] () -- C:\sqmdata15.sqm
[2007/10/08 11:46:36 | 000,000,268 | ---- | M] () -- C:\sqmdata16.sqm
[2007/12/12 10:16:07 | 000,000,268 | ---- | M] () -- C:\sqmdata17.sqm
[2008/02/09 14:14:27 | 000,000,268 | ---- | M] () -- C:\sqmdata18.sqm
[2008/04/08 23:03:28 | 000,000,268 | ---- | M] () -- C:\sqmdata19.sqm
[2009/04/29 22:23:55 | 000,000,244 | ---- | M] () -- C:\sqmnoopt00.sqm
[2009/05/17 22:07:20 | 000,000,244 | ---- | M] () -- C:\sqmnoopt01.sqm
[2009/06/08 21:06:35 | 000,000,244 | ---- | M] () -- C:\sqmnoopt02.sqm
[2006/12/16 00:59:33 | 000,000,244 | ---- | M] () -- C:\sqmnoopt03.sqm
[2006/12/22 21:58:58 | 000,000,244 | ---- | M] () -- C:\sqmnoopt04.sqm
[2006/12/22 22:09:43 | 000,000,244 | ---- | M] () -- C:\sqmnoopt05.sqm
[2006/12/23 02:57:54 | 000,000,244 | ---- | M] () -- C:\sqmnoopt06.sqm
[2006/12/29 18:58:21 | 000,000,244 | ---- | M] () -- C:\sqmnoopt07.sqm
[2007/06/21 19:10:33 | 000,000,244 | ---- | M] () -- C:\sqmnoopt08.sqm
[2007/07/25 19:10:18 | 000,000,244 | ---- | M] () -- C:\sqmnoopt09.sqm
[2007/08/03 18:38:29 | 000,000,244 | ---- | M] () -- C:\sqmnoopt10.sqm
[2007/08/15 14:24:09 | 000,000,244 | ---- | M] () -- C:\sqmnoopt11.sqm
[2007/08/20 14:37:09 | 000,000,244 | ---- | M] () -- C:\sqmnoopt12.sqm
[2007/08/23 12:18:00 | 000,000,244 | ---- | M] () -- C:\sqmnoopt13.sqm
[2007/08/29 12:33:28 | 000,000,244 | ---- | M] () -- C:\sqmnoopt14.sqm
[2007/09/03 15:24:35 | 000,000,244 | ---- | M] () -- C:\sqmnoopt15.sqm
[2007/10/08 11:46:36 | 000,000,244 | ---- | M] () -- C:\sqmnoopt16.sqm
[2007/12/12 10:16:07 | 000,000,244 | ---- | M] () -- C:\sqmnoopt17.sqm
[2008/02/09 14:14:27 | 000,000,244 | ---- | M] () -- C:\sqmnoopt18.sqm
[2008/04/08 23:03:28 | 000,000,244 | ---- | M] () -- C:\sqmnoopt19.sqm
[2007/06/01 14:13:35 | 000,918,206 | ---- | M] () -- C:\TB.log

Part 2:

< %PROGRAMFILES%\*. >
[2008/01/22 20:05:37 | 000,000,000 | ---D | M] -- C:\Program Files\ACAD2000
[2007/01/07 13:25:03 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2006/12/10 20:51:52 | 000,000,000 | ---D | M] -- C:\Program Files\Alwil Software
[2009/12/19 19:15:46 | 000,000,000 | ---D | M] -- C:\Program Files\Amazon
[2006/12/28 16:24:09 | 000,000,000 | ---D | M] -- C:\Program Files\AnswerWorks 4.0
[2009/01/10 20:58:34 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2010/01/03 13:59:47 | 000,000,000 | ---D | M] -- C:\Program Files\ArcSoft
[2006/10/12 05:12:58 | 000,000,000 | ---D | M] -- C:\Program Files\ATI Technologies
[2006/12/28 16:23:46 | 000,000,000 | ---D | M] -- C:\Program Files\AutoCAD 2004
[2006/12/22 22:33:56 | 000,000,000 | ---D | M] -- C:\Program Files\Autodesk
[2009/09/13 11:06:59 | 000,000,000 | ---D | M] -- C:\Program Files\AVG
[2007/07/05 18:12:24 | 000,000,000 | ---D | M] -- C:\Program Files\BitComet
[2011/04/17 14:59:22 | 000,000,000 | ---D | M] -- C:\Program Files\BitTorrent
[2009/09/20 15:59:21 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2007/07/05 18:12:03 | 000,000,000 | ---D | M] -- C:\Program Files\Boonty
[2007/04/08 14:48:43 | 000,000,000 | ---D | M] -- C:\Program Files\BoontyGames
[2011/03/09 17:32:16 | 000,000,000 | ---D | M] -- C:\Program Files\Canon
[2011/03/09 17:43:07 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2005/12/06 13:58:22 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2006/12/22 22:02:28 | 000,000,000 | ---D | M] -- C:\Program Files\DAEMON Tools
[2009/08/30 20:54:57 | 000,000,000 | ---D | M] -- C:\Program Files\DIFX
[2007/09/23 14:57:13 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2006/12/07 21:15:38 | 000,000,000 | ---D | M] -- C:\Program Files\EPSON
[2009/06/30 20:49:43 | 000,000,000 | ---D | M] -- C:\Program Files\FileZilla FTP Client
[2011/03/10 13:52:50 | 000,000,000 | ---D | M] -- C:\Program Files\FoxTabPDFConverter
[2011/04/17 14:34:32 | 000,000,000 | ---D | M] -- C:\Program Files\FrostWire
[2010/02/22 12:42:27 | 000,000,000 | ---D | M] -- C:\Program Files\GIMP-2.0
[2008/02/04 16:05:46 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2007/05/29 15:10:21 | 000,000,000 | ---D | M] -- C:\Program Files\Hewlett-Packard
[2007/05/29 15:10:44 | 000,000,000 | ---D | M] -- C:\Program Files\HP
[2009/08/30 20:51:14 | 000,000,000 | ---D | M] -- C:\Program Files\HP VGA Webcam
[2011/03/09 17:28:16 | 000,000,000 | ---D | M] -- C:\Program Files\InstallShield Installation Information
[2008/03/19 20:25:52 | 000,000,000 | ---D | M] -- C:\Program Files\IntelligentAdvisor
[2011/04/29 13:39:00 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2009/09/20 16:08:44 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2009/09/20 16:10:56 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2009/06/13 16:21:43 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2008/02/03 22:34:19 | 000,000,000 | ---D | M] -- C:\Program Files\Kiran's Typing Tutor
[2011/03/09 17:43:46 | 000,000,000 | ---D | M] -- C:\Program Files\Kodak
[2009/09/04 20:48:30 | 000,000,000 | ---D | M] -- C:\Program Files\LimeWire
[2009/11/11 12:30:26 | 000,000,000 | ---D | M] -- C:\Program Files\Macromedia
[2008/05/10 18:25:28 | 000,000,000 | ---D | M] -- C:\Program Files\MagicDVDRipper
[2011/04/28 21:54:38 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2008/08/16 13:13:13 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2009/11/10 21:07:24 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2007/03/11 13:20:22 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
[2007/05/10 20:33:54 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2005/12/07 13:32:30 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2008/01/08 21:43:52 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/08/09 18:46:09 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2007/03/25 17:27:59 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2007/03/11 13:18:45 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2010/03/20 14:36:08 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2011/05/02 15:23:09 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2009/08/08 19:15:00 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2008/01/08 21:43:20 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
[2006/12/28 23:02:40 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2005/12/07 13:32:50 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2006/12/06 21:25:54 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2009/08/08 19:02:55 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0
[2007/01/05 17:09:19 | 000,000,000 | ---D | M] -- C:\Program Files\My Downloaded Games
[2007/06/19 15:30:58 | 000,000,000 | ---D | M] -- C:\Program Files\Nero
[2005/12/07 13:33:04 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2007/03/25 17:28:20 | 000,000,000 | ---D | M] -- C:\Program Files\NimoCodec Pack
[2006/10/12 05:39:09 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2006/12/06 21:41:40 | 000,000,000 | ---D | M] -- C:\Program Files\OpenOffice.org 2.0
[2010/06/06 19:02:06 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2009/08/30 22:53:07 | 000,000,000 | ---D | M] -- C:\Program Files\PC Camer@
[2009/08/30 20:03:16 | 000,000,000 | ---D | M] -- C:\Program Files\PC VGA Camer@ Plus
[2006/10/12 05:34:36 | 000,000,000 | ---D | M] -- C:\Program Files\PC-Doctor for DOS
[2010/01/31 16:45:10 | 000,000,000 | ---D | M] -- C:\Program Files\PcCloneEX
[2011/03/13 11:41:42 | 000,000,000 | ---D | M] -- C:\Program Files\PowerISO
[2008/01/26 21:19:12 | 000,000,000 | ---D | M] -- C:\Program Files\quicksnooker
[2011/03/10 21:46:53 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2009/08/08 19:14:48 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2009/08/30 22:36:08 | 000,000,000 | ---D | M] -- C:\Program Files\RegCure
[2007/01/07 13:28:16 | 000,000,000 | ---D | M] -- C:\Program Files\ScanSoft
[2010/02/27 15:51:53 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2008/11/05 22:34:14 | 000,000,000 | ---D | M] -- C:\Program Files\Sonic
[2008/02/04 16:05:47 | 000,000,000 | ---D | M] -- C:\Program Files\Spybot - Search & Destroy
[2010/12/28 13:04:12 | 000,000,000 | ---D | M] -- C:\Program Files\Uniblue
[2005/12/06 13:58:38 | 000,000,000 | ---D | M] -- C:\Program Files\Uninstall Information
[2006/12/07 22:39:03 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2008/11/05 22:26:17 | 000,000,000 | ---D | M] -- C:\Program Files\Winamp
[2006/12/06 20:49:02 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Defender
[2009/11/10 21:13:46 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2009/08/09 18:39:50 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live SkyDrive
[2008/11/05 22:23:17 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live Toolbar
[2007/03/25 17:28:00 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2006/12/06 21:28:15 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2005/12/07 13:33:18 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2006/12/06 23:12:56 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Resource Kits
[2005/12/06 13:58:42 | 000,000,000 | ---D | M] -- C:\Program Files\WindowsUpdate
[2005/12/07 13:33:36 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2008/05/03 07:54:09 | 000,000,000 | ---D | M] -- C:\Program Files\YASACDBurner
[2008/05/03 08:05:29 | 000,000,000 | ---D | M] -- C:\Program Files\YASAVideoEncoder
[2008/02/04 16:42:15 | 000,000,000 | ---D | M] -- C:\Program Files\ZoneAlarmSB

< %appdata%\*.* >
[2005/12/05 17:24:42 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Dan\Application Data\desktop.ini
[2007/07/05 21:16:04 | 000,000,316 | ---- | M] () -- C:\Documents and Settings\Dan\Application Data\wklnhst.dat


< MD5 for: AGP440.SYS >
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\OldPC\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\OldPC\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008/04/13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\agp440.sys
[2004/08/03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\OldPC\WINDOWS\ServicePackFiles\i386\agp440.sys
[2004/08/03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\OldPC\WINDOWS\system32\drivers\agp440.sys
[2001/08/17 13:58:00 | 000,025,472 | ---- | M] (Microsoft Corporation) MD5=65880045C51AA36184841CEE915A61DF -- C:\OldPC\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\OldPC\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\OldPC\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008/04/13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\atapi.sys
[2001/08/17 13:51:56 | 000,086,656 | ---- | M] (Microsoft Corporation) MD5=A64013E98426E1877CB653685C5C0009 -- C:\OldPC\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2001/08/18 13:00:00 | 000,086,656 | ---- | M] (Microsoft Corporation) MD5=A64013E98426E1877CB653685C5C0009 -- C:\OldPC\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\OldPC\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\OldPC\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: DISK.SYS >
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\OldPC\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\OldPC\WINDOWS\ServicePackFiles\i386\sp2.cab:disk.sys
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:disk.sys
[2004/08/03 22:59:56 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\OldPC\WINDOWS\ServicePackFiles\i386\disk.sys
[2004/08/03 22:59:56 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\OldPC\WINDOWS\system32\drivers\disk.sys
[2004/08/04 05:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\system32\drivers\disk.sys
[2008/04/13 19:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\disk.sys
[2001/08/17 13:52:36 | 000,033,664 | ---- | M] (Microsoft Corporation) MD5=43A10CD19D648E57ED039A6CAA667A56 -- C:\OldPC\WINDOWS\$NtServicePackUninstall$\disk.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 01:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\eventlog.dll
[2004/08/04 00:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\OldPC\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2004/08/04 00:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\OldPC\WINDOWS\system32\eventlog.dll
[2004/08/04 05:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2004/08/04 05:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\eventlog.dll
[2001/08/18 13:00:00 | 000,047,616 | ---- | M] (Microsoft Corporation) MD5=A510B91253544D56B5712D66BE8371E9 -- C:\OldPC\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2005/06/17 07:33:40 | 000,872,064 | ---- | M] (Intel Corporation) MD5=9A65E42664D1534B68512CAAD0EFE963 -- C:\hp\drivers\Intel_5_1_0_1022_PV\iastor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/14 01:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\netlogon.dll
[2009/02/06 19:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 19:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2004/08/04 00:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\OldPC\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2004/08/04 00:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\OldPC\WINDOWS\system32\netlogon.dll
[2004/08/04 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2004/08/04 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\netlogon.dll
[2001/08/18 13:00:00 | 000,397,824 | ---- | M] (Microsoft Corporation) MD5=F41C1602DC79AB72035F2388FCA0255F -- C:\OldPC\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 00:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\OldPC\WINDOWS\ServicePackFiles\i386\scecli.dll
[2004/08/04 00:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\OldPC\WINDOWS\system32\scecli.dll
[2004/08/04 05:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\dllcache\scecli.dll
[2004/08/04 05:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\scecli.dll
[2001/08/18 13:00:00 | 000,174,080 | ---- | M] (Microsoft Corporation) MD5=73968C834C316ADC7A2F07DC4B5F3665 -- C:\OldPC\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 01:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\scecli.dll

< MD5 for: USBSTOR.SYS >
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\OldPC\WINDOWS\Driver Cache\i386\sp2.cab:usbstor.sys
[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\OldPC\WINDOWS\ServicePackFiles\i386\sp2.cab:usbstor.sys
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbstor.sys
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:usbstor.sys
[2001/08/17 14:03:22 | 000,021,760 | ---- | M] (Microsoft Corporation) MD5=694F2B90124EB086C38C18DA97A13E48 -- C:\OldPC\WINDOWS\$NtServicePackUninstall$\usbstor.sys
[2004/08/03 23:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\OldPC\WINDOWS\ServicePackFiles\i386\usbstor.sys
[2004/08/03 23:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\OldPC\WINDOWS\system32\drivers\usbstor.sys
[2004/08/04 05:00:00 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\system32\drivers\usbstor.sys
[2008/04/13 19:45:38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\usbstor.sys

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-29 08:25:21

========== Alternate Data Streams ==========

@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2615E8F1

< End of report >

Hi Doc,

Any ideas? Or are you still reading all that? hehe

Thanks,

Dan

Hello Danno,

Please post it here: http://www.GeekPolice.net/f11-virus-spyware-malware-removal