Possible malware affecting Recycle Bin

**xero** · 24-10-2010

I have read the sticky, carried out the instructions, and now need some help interpreting results.
I have had a problem for some time with files disappearing from the Recycle Bin (thread is There is a hole in the bucket, dear Liza - Recycle bin woes, in XP section).
A couple of days ago I was copying files from a HDD I was intending to remove and replace with a larger one. I mistakenly copied some files to the wrong folder. When I discovered the error I copied them again to the correct folder. I then did a search, to locate where I had mistakenly sent the folders, and then deleted the files from the wrong folder, in batches (picture files, some were quite large). I then emptied the Recycle Bin, and on one occasion when I could see 7 or 8 folders the dialog asked if I wanted to delete these 16 folders. So while I could not see some of the folders, the system was still seeing them.
At that point respondents to the thread suggested posting here.
I have run my usual full set of scans (SpyBot, mbam, Avast and SuperAntiSpyware), plus cleared out all temporary files with CCleaner, then TFC. TFC aleays finds some CCleaner misses. I also ran a scan with GMER, and here it gets interesting.
GMER found some indications of rootkits, then Super found Trojan.Agent/Gen in GMER! I reported this as a false positive as I doubt DAL would link me to a trojan,
The GMER log follows:
GMER 1.0.15.15477 - GMER - Rootkit Detector and Remover
Rootkit quick scan 2010-10-24 11:43:11
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\RUSSEL~1\LOCALS~1\Temp\pwaiqkob.sys

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 32: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 156299119 (+255): rootkit-like behavior;

---- System - GMER 1.0.15 ----

SSDT spxp.sys ZwEnumerateKey [0xB9EC9E4C]
SSDT spxp.sys ZwEnumerateValueKey [0xB9ECA1DA]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xB18A0BAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0xB18A09D2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0xB18A0B0C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [B9E29B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 [B9E29B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [B9E29B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-23 [B9E29B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort2 [B9E29B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort3 [B9E29B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP3T1L0-2b [B9E29B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-17 [B9E29B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-f [B9E29B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device aswSP.SYS (avast! self protection module/AVAST Software)
Device 8A8A31F8
Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device 8A485470

AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- EOF - GMER 1.0.15 ----

I will most interested to see what people make of this situation.
Of possible interest is that the system has had to close explorer.exe before it would shut down. This has occurred for about 10 -14 days. Also at the time of copying all these files the system froze twice in a short space of time, with explorer.exe using 98-100% of CPU, then with nothing but the browser running explorer.exe was sitting on a steady 50%. I decided the thing was over wrought and shut it down. Since then explorer.exe has not been any trouble, but I have backed up some important stuff on the C drive in case I need to do a clean install, I really don't want do that.

**broni** · 24-10-2010

Super found Trojan.Agent/Gen in GMER!

Surely, you can disregard the warning.

You need to post ALL required logs.

**xero** · 25-10-2010

Hi Broni,
Yes indeed I disregarded that alleged Trojan, I actually reported to Super as a false positive. I said there was no way DAL would link me to a Trojan
As for the logs, Spybot found nothing, mbam ditto, and Avast reported no probs.
The log for mbam follows:
Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 4931

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/24/2010 12:45:22 PM
mbam-log-2010-10-24 (12-45-22).txt

Scan type: Quick scan
Objects scanned: 149870
Time elapsed: 7 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I await your exert opinion.

**broni** · 25-10-2010

I need you to follow ALL instructions from here: http://www.d-a-l.com/help/spyware-ad...s-updated.html
For starters, you're infected with a rootkit.

**xero** · 25-10-2010

Hi Broni,
Just triend to post all those logs. The compute hung after the MBR, and then when I was able to paste the OTL logs

The file(s) uploaded were too large to process.

I will now attempt to do it in 2 posts.
mbam:
Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 4939

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/25/2010 11:44:54 AM
mbam-log-2010-10-25 (11-44-54).txt

Scan type: Quick scan
Objects scanned: 149139
Time elapsed: 6 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

MBR:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000007fd

Kernel Drivers (total 156):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E4000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9EAE000 spgu.sys
0xBA5AA000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xB9E96000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xB9E68000 ACPI.sys
0xB9E57000 pci.sys
0xBA0A8000 isapnp.sys
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0B8000 MountMgr.sys
0xB9E38000 ftdisk.sys
0xBA330000 PartMgr.sys
0xBA0C8000 VolSnap.sys
0xB9E20000 atapi.sys
0xBA0D8000 disk.sys
0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9E00000 fltmgr.sys
0xB9DEE000 sr.sys
0xB9DD7000 KSecDD.sys
0xB9D4A000 Ntfs.sys
0xB9D35000 inspect.sys
0xB9D08000 \WINDOWS\System32\DRIVERS\NDIS.SYS
0xBA338000 \WINDOWS\System32\DRIVERS\TDI.SYS
0xB9C9D000 timntr.sys
0xBA0F8000 ohci1394.sys
0xBA108000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xB9C83000 Mup.sys
0xBA340000 hotcore3.sys
0xBA2F8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB94BE000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB9340000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xB932C000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA308000 \SystemRoot\System32\drivers\pivot.sys
0xBA4A8000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB9308000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA4B0000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB92DF000 \SystemRoot\system32\drivers\wfcxvcap.sys
0xBA318000 \SystemRoot\system32\drivers\STREAM.SYS
0xB92BC000 \SystemRoot\system32\drivers\ks.sys
0xB9C33000 \SystemRoot\system32\DRIVERS\wfcxacap.sys
0xB9C2F000 \SystemRoot\system32\drivers\wfcxtcap.sys
0xB9276000 \SystemRoot\system32\DRIVERS\yk51x86.sys
0xBA350000 \SystemRoot\system32\DRIVERS\fdc.sys
0xB9576000 \SystemRoot\system32\DRIVERS\serial.sys
0xB9C2B000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB9262000 \SystemRoot\system32\DRIVERS\parport.sys
0xB9566000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xBA358000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xB9556000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA388000 \SystemRoot\System32\Drivers\ULCDRHlp.sys
0xB9546000 \SystemRoot\System32\Drivers\cdrbsdrv.SYS
0xB9536000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xB9526000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB922A000 \SystemRoot\System32\Drivers\a5iikpdt.SYS
0xBA736000 \SystemRoot\system32\DRIVERS\audstub.sys
0xB9516000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB9C13000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB9213000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xB9506000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xB94F6000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xB9202000 \SystemRoot\system32\DRIVERS\psched.sys
0xB94E6000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA3F0000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA3F8000 \SystemRoot\system32\DRIVERS\raspti.sys
0xBA138000 \SystemRoot\System32\Drivers\pcouffin.sys
0xB98DC000 \SystemRoot\System32\Drivers\PdiPorts.sys
0xBA148000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA408000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5EA000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB91A4000 \SystemRoot\system32\DRIVERS\update.sys
0xB98D8000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA410000 \SystemRoot\system32\DRIVERS\UimBus.sys
0xB9186000 \SystemRoot\System32\Drivers\Uim_IM.sys
0xB9155000 \SystemRoot\System32\Drivers\UimFIO.SYS
0xBA158000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xB8C50000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xB8C2C000 \SystemRoot\system32\drivers\portcls.sys
0xBA168000 \SystemRoot\system32\drivers\drmk.sys
0xBA198000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5EE000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xB9C5F000 \SystemRoot\system32\drivers\wfcxxbar.sys
0xBA420000 \SystemRoot\system32\drivers\wfcxatun.sys
0xBA428000 \SystemRoot\system32\drivers\wfcxdtun.sys
0xB9C5B000 \SystemRoot\system32\drivers\BdaSup.SYS
0xBA430000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xB1B5B000 \SystemRoot\System32\DRIVERS\cmdguard.sys
0xBA5F6000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA793000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5F8000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA440000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA448000 \SystemRoot\System32\drivers\vga.sys
0xBA5FA000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5FC000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA450000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA458000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB9C23000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB1B28000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xB1ACF000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xBA460000 \SystemRoot\System32\DRIVERS\cmdhlp.sys
0xB1A81000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA1B8000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xBA1C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB19B9000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB1997000 \SystemRoot\System32\drivers\afd.sys
0xBA1D8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xBA468000 \SystemRoot\System32\Drivers\SCDEmu.SYS
0xB1975000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xBA470000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xB194A000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB18DA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA1E8000 \SystemRoot\System32\Drivers\Fips.SYS
0xB188B000 \SystemRoot\System32\Drivers\aswSP.SYS
0xBA480000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xBA488000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xB1BB4000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA208000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xB1BB0000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xBA490000 \SystemRoot\system32\DRIVERS\point32.sys
0xBA218000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB1817000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xB17FF000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xBA5FE000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB1BA8000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA4A0000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA719000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF025000 \SystemRoot\System32\ati2dvag.dll
0xBF067000 \SystemRoot\System32\ati2cqag.dll
0xBF0A6000 \SystemRoot\System32\atikvmag.dll
0xBF012000 \SystemRoot\System32\wpfb_ati2dvag.dll
0xBF0DC000 \SystemRoot\System32\ati3duag.dll
0xBF360000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xAF74B000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xB1A61000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xAF6AE000 \SystemRoot\system32\DRIVERS\thdudf.sys
0xAF69D000 \SystemRoot\System32\Drivers\Udfs.SYS
0xAF695000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xAF456000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xAEE51000 \SystemRoot\system32\drivers\wdmaud.sys
0xAF24E000 \SystemRoot\system32\drivers\sysaudio.sys
0xAEB00000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA5F2000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xAE940000 \SystemRoot\system32\DRIVERS\srv.sys
0xAE58F000 \SystemRoot\System32\Drivers\HTTP.sys
0xAE740000 \??\C:\Program Files\WinFast\WFDTV\WFIOCTL.SYS
0xB1863000 \SystemRoot\System32\Drivers\aswRdr.SYS
0xBA664000 \SystemRoot\system32\drivers\MSPQM.sys
0xAE3C0000 \??\C:\DOCUME~1\RUSSEL~1\LOCALS~1\Temp\pwaiqkob.sy s
0xAE395000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll
0x10000000 \Program Files\DAEMON Tools Pro\Engine.dll

Processes (total 47):
0 System Idle Process
4 System
768 C:\WINDOWS\system32\smss.exe
832 csrss.exe
860 C:\WINDOWS\system32\winlogon.exe
904 C:\WINDOWS\system32\services.exe
916 C:\WINDOWS\system32\lsass.exe
1088 C:\WINDOWS\system32\ati2evxx.exe
1104 C:\WINDOWS\system32\svchost.exe
1180 svchost.exe
1276 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
1352 C:\WINDOWS\system32\svchost.exe
1464 svchost.exe
1644 svchost.exe
1748 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1892 C:\WINDOWS\system32\ati2evxx.exe
1964 C:\WINDOWS\explorer.exe
308 C:\PROGRA~1\ALWILS~1\Avast5\AvastUI.exe
316 C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
336 C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
352 C:\Program Files\WinFast\WFDTV\WFWIZ.exe
452 C:\WINDOWS\system32\ctfmon.exe
464 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
540 C:\Program Files\Westnet Usage Grabber\wug.exe
1044 C:\WINDOWS\system32\spoolsv.exe
2488 svchost.exe
2524 C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLi censeServer.exe
2600 C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
2748 C:\WINDOWS\system32\bgsvcgen.exe
2788 C:\Program Files\Bonjour\mDNSResponder.exe
2932 C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
2960 C:\Program Files\Canon\IJPLM\ijplmsvc.exe
2996 C:\Program Files\Java\jre6\bin\jqs.exe
3024 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
3148 C:\Program Files\CDBurnerXP\NMSAccessU.exe
3160 C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
3184 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
3252 C:\WINDOWS\system32\svchost.exe
3344 C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
3540 C:\WINDOWS\system32\wuauclt.exe
4032 wmiprvse.exe
1764 C:\WINDOWS\system32\wscntfy.exe
1912 alg.exe
2228 C:\WINDOWS\system32\CNAB3RPK.EXE
1932 C:\Program Files\Mozilla Firefox\firefox.exe
1508 C:\Program Files\Mozilla Thunderbird\thunderbird.exe
2456 C:\Documents and Settings\Russell Chapman\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive2 at offset 0x00000000`00007e00 (NTFS)
\\.\F: --> \\.\PhysicalDrive2 at offset 0x0000007d`00146e00 (NTFS)
\\.\I: --> \\.\PhysicalDrive3 at offset 0x00000000`00007e00 (NTFS)
\\.\J: --> \\.\PhysicalDrive3 at offset 0x00000080`2c72e000 (NTFS)

PhysicalDrive0 Model Number: WDCWD800JD-22MSA1, Rev: 10.01E01
PhysicalDrive1 Model Number: ST32000542AS, Rev: CC34
PhysicalDrive2 Model Number: ST31000340AS, Rev: SD15
PhysicalDrive3 Model Number: WDCWD20EARS-00J2GB0, Rev: 80.00A80

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
1863 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
931 GB \\.\PhysicalDrive2 Unknown MBR code
SHA1: 639AC5CDF8A5CF3245975932C6A4215450A7B98F
1863 GB \\.\PhysicalDrive3 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
Half way there, new post soon.

**broni** · 25-10-2010

Try to split OTL.txt into two replies.
The board seems to be slow tonight and it's timing out after 30 seconds.
I reported the problem.
The smaller parts, the more chance you have it to post them.

Bed time is coming

**xero** · 25-10-2010

The OTL log is 600kb, but I can't paste it, or attach it!
This is OTLExtra:
OTL Extras logfile created on: 10/25/2010 12:01:16 PM - Run 1
OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\Russell Chapman\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 65.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 5.12 Gb Free Space | 6.87% Space Free | Partition Type: NTFS
Drive D: | 1863.01 Gb Total Space | 1860.57 Gb Free Space | 99.87% Space Free | Partition Type: NTFS
Drive E: | 500.00 Gb Total Space | 131.26 Gb Free Space | 26.25% Space Free | Partition Type: NTFS
Drive F: | 431.51 Gb Total Space | 156.61 Gb Free Space | 36.29% Space Free | Partition Type: NTFS
Drive H: | 3.73 Gb Total Space | 3.73 Gb Free Space | 99.99% Space Free | Partition Type: FAT32
Drive I: | 512.69 Gb Total Space | 364.78 Gb Free Space | 71.15% Space Free | Partition Type: NTFS
Drive J: | 1350.32 Gb Total Space | 172.21 Gb Free Space | 12.75% Space Free | Partition Type: NTFS

Computer Name: RUSSELL-1AA4F63 | User Name: Russell Chapman | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.js [@ = jsfile] -- C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe (Macromedia, Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
jsfile [open] -- "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\DomainPr ofile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\GloballyOpenPorts\List]
"29160:TCP" = 29160:TCP:*:Enabled:µTorrent
"5985:TCP" = 5985:TCP:*

isabled:Windows Remote Management
"80:TCP" = 80:TCP:*

isabled:Windows Remote Management - Compatibility Mode (HTTP-In)

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\DomainPr ofile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List]
"C:\WINDOWS\system32\CNAB3RPK.EXE" = C:\WINDOWS\system32\CNAB3RPK.EXE:*:Enabled:Canon LBP3000 RPC Server Process -- (CANON INC.)
"C:\Documents and Settings\Russell Chapman\Desktop\utorrent.exe" = C:\Documents and Settings\Russell Chapman\Desktop\utorrent.exe:*:Enabled:µTorrent -- File not found
"C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe" = C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe:*

isabled:Fireworks MX -- (Macromedia Inc.)
"C:\Documents and Settings\Russell Chapman\My Documents\utorrent.exe" = C:\Documents and Settings\Russell Chapman\My Documents\utorrent.exe:*:Enabled:µTorrent -- File not found
"I:\Installers\utorrent 1.8.2.exe" = I:\Installers\utorrent 1.8.2.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"H:\uTorrent.exe" = H:\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.0.0 (r181)
"{0217E1D1-BCEF-4A61-AF6D-F7740F65A066}" = Pivot Software
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{05121C4B-19D3-4AB8-B275-FE4B60E0C4E1}" = WinFast DTV2000 H Driver
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0DEA342C-15CB-4F52-97B6-06A9C4B9C06F}" = SDK
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX340_series" = Canon MX340 series MP Drivers
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{218D2E7E-37A9-4B5D-B4A1-13FD6B8B9D17}" = Corel DVD MovieFactory 7
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 21
"{29D851C2-048C-4B5E-8D1F-25D473342BB5}" = ScanSoft OmniPage SE 4.0
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2A539CD9-0F75-4875-9A32-E06DD93C4114}" = Adobe Extension Manager CS3
"{31A07FB5-E753-4DAA-9879-3C62933E83FC}" = TMPGEnc Plus 2.5
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38BA2875-D7AD-4611-ABA3-C385051ADF42}" = Eraser 6.0.7.1893
"{3A12C952-61D5-4C3B-B68B-8CFBE47E22F1}" = Adobe Setup
"{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}" = Macromedia Flash MX
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}" = Adobe Photoshop CS3
"{3E9F2540-DD55-42FB-8EB6-5508EEC54013}" = TMPGEnc DVD Author 3 with DivX Authoring
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HYDRAVISION
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{47D0C5E6-9FBA-49DB-8F88-BFAA5BA38646}" = Microsoft Math Add-in for Word 2007
"{485DF5E7-8379-4BFA-BAE1-9B8DBFE0D6B4}" = Paragon Drive Backup™ 9 Professional
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{54B4FDFB-9345-4EC9-AA2B-B1476A8B20EF}_is1" = iCare Format Recovery Software1.1
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69C3355C-2053-4565-BA10-A8BF4FF77E95}" = Quick Conversion
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7148F0A8-6813-11D6-A77B-00B0D0142040}" = Java 2 Runtime Environment, SE v1.4.2_04
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76C24F39-B161-498F-BD8B-C64789812D13}_is1" = ConvertXtoDVD 3.3.4.106e
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B4AB829-DFD3-436D-B808-D9733D76C590}" = Macromedia Dreamweaver MX
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8DC32C34-72D1-4646-B532-9604479209A3}_is1" = USB Threat Defnder 1.0
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{930B2432-43D4-11D5-9871-00C04F8EEB39}" = Macromedia Fireworks MX
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9FD45917-95E6-449D-ACC9-01E634A34CBD}_is1" = MPEG Video Wizard DVD 5.0 (12/2009)
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A586DC50-B18D-48FB-B7CC-A598200457C2}" = Acer eDisplay Management
"{A5BA14E0-7384-11D4-BAE7-00409631A2C8}" = Macromedia Extension Manager
"{AB706D91-2242-4E1D-B4D0-1ED35387F5A7}" = Microsoft Office Excel 2007 Get Started Tab
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-1033-0000-7760-100000000002}" = Adobe Acrobat 7.0 Professional
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1.3
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B148AB4B-C8FA-474B-B981-F2943C5B5BCD}" = OGA Notifier 1.7.0105.35.0
"{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}" = @BIOS B06.0721.01
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C7DDA8E7-AD3D-4F51-AC1E-B0FF57002192}" = Microsoft IntelliPoint 6.3
"{C92C584E-C781-475E-A8E2-C67D993A6B95}" = WinFast PVR2
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF097717-F174-4144-954A-FBC4BF301033}" = Nero 7 Ultra Edition
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D7AC932D-297F-46C8-9834-FA23854CC150}_is1" = MKV Converter Studio V2.0.1
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1" = ConvertXtoDVD 4.1.2.336
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{F01D5ED5-D53A-4468-B428-149DC2CB3110}" = Adobe Dreamweaver CS3
"{F0B87F14-DCE0-480B-960C-EEC677C15454}" = ATI Catalyst Control Center
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F9000000-0001-0000-0000-074957833700}" = ABBYY FineReader 9.0 Professional Edition
"{FA300000-0001-0000-0000-074957833700}" = ABBYY PDF Transformer 3.0
"{FD8E178D-8B4E-42DA-B434-EFF270329B1C}" = COMODO Internet Security
"{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}" = Adobe Setup
"ABBYY PDF Transformer 3.0" = ABBYY PDF Transformer 3.0
"Absolute Audio Converter_is1" = Absolute Audio Converter 4.1
"Adobe Acrobat 7.0 Professional - V" = Adobe Acrobat 7.1.0 Professional
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe_435a6af7459cb02a9c1138113a26e93" = Adobe Dreamweaver CS3
"Adobe_719d6f144d0c086a0dfa7ff76bb9ac1" = Adobe Photoshop CS3
"Aiseesoft Blu-ray Ripper_is1" = Aiseesoft Blu-ray Ripper
"All ATI Software" = ATI - Software Uninstall Utility
"Any DVD Converter Professional_is1" = Any DVD Converter Professional 4.0.5
"Any DVD Shrink_is1" = Any DVD Shrink 1.2.1
"Any Video Converter_is1" = Any Video Converter 2.7.3
"ATI Display Driver" = ATI Display Driver
"avast5" = avast! Free Antivirus
"Avidemux 2.5" = Avidemux 2.5
"Canon LBP3000" = Canon LBP3000
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner
"Cool Edit Pro 2.0" = Cool Edit Pro 2.0
"dBpoweramp [ID Tag Update] Codec" = dBpoweramp [ID Tag Update] Codec
"dBpoweramp [Multi Encoder] Codec" = dBpoweramp [Multi Encoder] Codec
"dBpoweramp [Tag From Filename] Codec" = dBpoweramp [Tag From Filename] Codec
"dBpoweramp CD Writer" = dBpoweramp CD Writer
"dBpoweramp DSP Effects" = dBpoweramp DSP Effects
"dBpoweramp FLAC Codec" = dBpoweramp FLAC Codec
"dBpoweramp m4a Codec" = dBpoweramp m4a Codec
"dBpoweramp Monkeys Audio Codec" = dBpoweramp Monkeys Audio Codec
"dBpoweramp Music Converter" = dBpoweramp Music Converter
"dBpoweramp Ogg Vorbis Codec" = dBpoweramp Ogg Vorbis Codec
"dBpoweramp Windows Media Audio 10 Codec" = dBpoweramp Windows Media Audio 10 Codec
"DirectVobSub" = DirectVobSub (remove only)
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDFab 8_is1" = DVDFab 8.0.2.2 (01/10/2010)
"DVDStyler_is1" = DVDStyler v1.8.0.2
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Easy-WebPrint" = Easy-WebPrint
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"Fast DVD Ripper_is1" = Fast DVD Ripper 1.1
"Flip PowerPoint_is1" = Flip PowerPoint 1.2
"foobar2000" = foobar2000 v1.0
"Free Download Manager_is1" = Free Download Manager 3.0
"Gold Fish Animated Wallpaper_is1" = Gold Fish Animated Wallpaper version 1.0
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"InstallShield_{218D2E7E-37A9-4B5D-B4A1-13FD6B8B9D17}" = Corel DVD MovieFactory 7 TBYB
"InstallShield_{31A07FB5-E753-4DAA-9879-3C62933E83FC}" = TMPGEnc Plus 2.5
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"iuVCR_is1" = iuVCR
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.9.0 (Basic)
"MAGIX Audio Cleaning Lab 15 deluxe Trial UK" = MAGIX Audio Cleaning Lab 15 deluxe Trial 10.0.2.0 (UK)
"MAGIX Screenshare UK" = MAGIX Screenshare 4.3.6.1987 (UK)
"MainApp.exe_is1" = CloneDVD 4.3.0.3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaCoder" = MediaCoder 0.7.5.4742
"MediaCoder NT CUDA" = MediaCoder NT CUDA 1.0-20100720
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"MKVtoolnix" = MKVtoolnix 3.3.0
"Mozilla Firefox (3.5.14)" = Mozilla Firefox (3.5.14)
"Mozilla Thunderbird (2.0.0.24)" = Mozilla Thunderbird (2.0.0.24)
"MP Navigator EX 3.1" = Canon MP Navigator EX 3.1
"Mpeg Video Wizard DVD 5.0" = MPEG Video Wizard DVD 5.0.0.103 (12/2009)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Ogg Codecs" = Ogg Codecs 0.81.15562
"PowerISO" = PowerISO
"qt7lite_is1" = QT Lite 2.1.1
"QuarkXPress" = QuarkXPress 4.0
"Revo Uninstaller" = Revo Uninstaller 1.85
"Secunia PSI" = Secunia PSI
"Software Informer_is1" = Software Informer 1.0 BETA
"SolveigMM AVI Trimmer" = SolveigMM AVI Trimmer
"SolveigMM Video Splitter" = SolveigMM Video Splitter
"Speed Dial Utility" = Canon Speed Dial Utility
"Total Video Converter 3.61_is1" = Total Video Converter 3.61 100319
"Unlocker" = Unlocker 1.9.0
"VeryPDF PDF2Word v3.0_is1" = VeryPDF PDF2Word v3.0
"VLC media player" = VLC media player 1.1.4
"Westnet Usage Grabber_is1" = Westnet Usage Grabber 7.3
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wondershare FLV Downloader Pro_is1" = Wondershare FLV Downloader Pro(Build 1.4.1.16)
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Uninstall]
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 10/14/2010 5:07:14 AM | Computer Name = RUSSELL-1AA4F63 | Source = MsiInstaller | ID = 11500
Description = Product: Adobe Reader 9.4.0 -- Error 1500.Another installation is
in progress. You must complete that installation before continuing this one.

Error - 10/14/2010 5:07:15 AM | Computer Name = RUSSELL-1AA4F63 | Source = MsiInstaller | ID = 11500
Description = Product: Adobe Reader 9.4.0 -- Error 1500.Another installation is
in progress. You must complete that installation before continuing this one.

Error - 10/14/2010 5:07:15 AM | Computer Name = RUSSELL-1AA4F63 | Source = MsiInstaller | ID = 11500
Description = Product: Adobe Reader 9.4.0 -- Error 1500.Another installation is
in progress. You must complete that installation before continuing this one.

Error - 10/14/2010 5:07:16 AM | Computer Name = RUSSELL-1AA4F63 | Source = MsiInstaller | ID = 11500
Description = Product: Adobe Reader 9.4.0 -- Error 1500.Another installation is
in progress. You must complete that installation before continuing this one.

Error - 10/14/2010 5:07:28 AM | Computer Name = RUSSELL-1AA4F63 | Source = MsiInstaller | ID = 11500
Description = Product: Adobe Reader 9.4.0 -- Error 1500.Another installation is
in progress. You must complete that installation before continuing this one.

Error - 10/14/2010 5:07:30 AM | Computer Name = RUSSELL-1AA4F63 | Source = MsiInstaller | ID = 11500
Description = Product: Adobe Reader 9.4.0 -- Error 1500.Another installation is
in progress. You must complete that installation before continuing this one.

Error - 10/15/2010 1:36:45 AM | Computer Name = RUSSELL-1AA4F63 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x08ecceb0.

Error - 10/15/2010 1:36:54 AM | Computer Name = RUSSELL-1AA4F63 | Source = Application Error | ID = 1001
Description = Fault bucket 287211576.

Error - 10/20/2010 11:14:55 AM | Computer Name = RUSSELL-1AA4F63 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x0a73ceb0.

Error - 10/20/2010 11:15:09 AM | Computer Name = RUSSELL-1AA4F63 | Source = Application Error | ID = 1001
Description = Fault bucket 268973345.

[ System Events ]
Error - 10/18/2010 8:59:06 AM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 10/18/2010 11:00:48 AM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 10/18/2010 10:09:34 PM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 10/18/2010 10:12:22 PM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 10/18/2010 10:16:14 PM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 10/20/2010 8:36:10 AM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 10/21/2010 6:54:17 AM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 10/24/2010 2:00:58 AM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 10/24/2010 5:00:58 AM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 10/25/2010 12:07:03 AM | Computer Name = RUSSELL-1AA4F63 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

< End of report >
The OTL report that I can't attach is replete with Asian characters and what I suspect may be machine code. What do you suggest? Can you pm me with an email address?
And I really don't like that bit about a bad block, please let me know what to do here.

**xero** · 25-10-2010

OTL might have to be in thirds:
OTL logfile created on: 10/25/2010 12:01:16 PM - Run 1
OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\Russell Chapman\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 65.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 5.12 Gb Free Space | 6.87% Space Free | Partition Type: NTFS
Drive D: | 1863.01 Gb Total Space | 1860.57 Gb Free Space | 99.87% Space Free | Partition Type: NTFS
Drive E: | 500.00 Gb Total Space | 131.26 Gb Free Space | 26.25% Space Free | Partition Type: NTFS
Drive F: | 431.51 Gb Total Space | 156.61 Gb Free Space | 36.29% Space Free | Partition Type: NTFS
Drive H: | 3.73 Gb Total Space | 3.73 Gb Free Space | 99.99% Space Free | Partition Type: FAT32
Drive I: | 512.69 Gb Total Space | 364.78 Gb Free Space | 71.15% Space Free | Partition Type: NTFS
Drive J: | 1350.32 Gb Total Space | 172.21 Gb Free Space | 12.75% Space Free | Partition Type: NTFS

Computer Name: RUSSELL-1AA4F63 | User Name: Russell Chapman | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/10/25 11:39:32 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Russell Chapman\Desktop\OTL.exe
PRC - [2010/10/21 09:46:08 | 000,908,760 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/09/10 23:41:42 | 001,901,056 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
PRC - [2010/09/10 23:41:20 | 002,500,552 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
PRC - [2010/09/07 23:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/07 23:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/03/04 23:38:00 | 000,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe
PRC - [2010/01/26 18:43:09 | 000,759,048 | ---- | M] (ABBYY) -- C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
PRC - [2009/11/12 14:09:44 | 000,080,496 | ---- | M] () -- C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
PRC - [2009/09/08 20:12:51 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
PRC - [2009/07/23 17:11:02 | 000,145,504 | ---- | M] (B.H.A Corporation) -- C:\WINDOWS\system32\bgsvcgen.exe
PRC - [2009/07/15 13:43:46 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) -- C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/06/03 02:05:58 | 000,065,680 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/18 22:27:52 | 000,458,752 | ---- | M] (Studiocoast) -- C:\Program Files\Westnet Usage Grabber\wug.exe
PRC - [2007/12/06 21:03:41 | 000,660,768 | ---- | M] (ABBYY (BIT Software)) -- C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLi censeServer.exe
PRC - [2007/11/16 16:13:00 | 000,090,112 | ---- | M] (Leadtek Research Inc.) -- C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
PRC - [2007/11/15 15:55:12 | 002,850,816 | ---- | M] (Leadtek Research Inc.) -- C:\Program Files\WinFast\WFDTV\WFWIZ.exe
PRC - [2005/03/23 00:00:00 | 000,057,344 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\CNAB3RPK.EXE

========== Modules (SafeList) ==========

MOD - [2010/10/25 11:39:32 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Russell Chapman\Desktop\OTL.exe
MOD - [2010/08/24 00:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2009/07/12 01:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a 1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
MOD - [2009/07/11 19:41:02 | 000,097,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a 1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll
MOD - [2008/05/14 01:13:36 | 000,077,824 | ---- | M] (SuperAdBlocker.com) -- C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
MOD - [2008/04/13 23:07:58 | 000,208,384 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rsaenh.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -d -f %ProgramFiles%\WinPcap\rpcapd.ini -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/09/10 23:41:42 | 001,901,056 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2010/09/07 23:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/07 23:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/07 23:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/03/18 16:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspn et_state.exe -- (aspnet_state)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\ WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\msco rsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 13:16:28 | 000,124,240 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSv cHost.exe -- (NetTcpPortSharing)
SRV - [2010/03/04 23:38:00 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2010/01/26 18:43:09 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe -- (ABBYY.Licensing.PDFTransformer.Classic.3.0)
SRV - [2009/11/12 14:09:44 | 000,080,496 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe -- (DTSRVC)
SRV - [2009/09/08 20:12:51 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2009/07/23 17:11:02 | 000,145,504 | ---- | M] (B.H.A Corporation) [Auto | Running] -- C:\WINDOWS\System32\bgsvcgen.exe -- (bgsvcgen)
SRV - [2009/07/23 14:36:30 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/07/15 13:43:46 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService)
SRV - [2008/06/03 02:05:58 | 000,065,680 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2007/12/06 21:03:41 | 000,660,768 | ---- | M] (ABBYY (BIT Software)) [Auto | Running] -- C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLi censeServer.exe -- (ABBYY.Licensing.FineReader.Professional.9.0)

========== Driver Services (SafeList) ==========

DRV - File not found [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\psi_mf.sys -- (PSI)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2010/09/10 23:40:54 | 000,091,560 | ---- | M] (COMODO) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\inspect.sys -- (Inspect)
DRV - [2010/09/10 23:40:52 | 000,239,240 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmdGuard.sys -- (cmdGuard)
DRV - [2010/09/10 23:40:52 | 000,025,240 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cmdhlp.sys -- (cmdHlp)
DRV - [2010/09/07 22:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/07 22:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/07 22:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/07 22:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/09/07 22:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/09/07 22:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/06/21 10:01:50 | 000,066,944 | ---- | M] (TOSHIBA Corporation) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\thdudf.sys -- (thdudf)
DRV - [2010/06/18 13:06:16 | 000,697,328 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010/05/11 02:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/05/09 11:48:19 | 000,044,384 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2010/05/09 11:48:18 | 000,441,760 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\timntr.sys -- (timounter)
DRV - [2010/02/18 02:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/11/12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009/09/28 02:02:44 | 000,014,424 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\PeerBlock\pbfilter.sys -- (pbfilter)
DRV - [2009/07/23 17:11:03 | 000,033,408 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS -- (cdrbsdrv)
DRV - [2009/07/15 13:43:32 | 000,017,136 | ---- | M] (Portrait Displays, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PdiPorts.sys -- (PdiPorts)
DRV - [2009/06/02 18:02:46 | 005,085,184 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/12/13 14:47:38 | 000,129,896 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Uim_IM.sys -- (Uim_IM)
DRV - [2008/12/13 14:47:38 | 000,040,496 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hotcore3.sys -- (hotcore3)
DRV - [2008/12/13 14:47:38 | 000,032,056 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\UimBus.sys -- (UimBus)
DRV - [2008/08/05 20:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008/04/14 00:23:10 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008/04/14 00:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2008/04/13 22:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/12/06 09:51:00 | 000,285,952 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2007/09/25 22:59:46 | 000,015,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\MediaCoder\SysInfo.sys -- (CrystalSysInfo)
DRV - [2007/09/19 13:37:58 | 000,031,744 | ---- | M] (Leadtek Research Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\wfcxatun.sys -- (wfcxatun)
DRV - [2007/09/19 11:12:52 | 000,021,248 | ---- | M] (Leadtek Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wfcxdtun.sys -- (wfcxdtun)
DRV - [2007/09/19 11:10:32 | 000,167,040 | ---- | M] (Leadtek Research Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\wfcxvcap.sys -- (WFCXVCAP)
DRV - [2007/09/19 11:09:52 | 000,010,496 | ---- | M] (Leadtek Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wfcxxbar.sys -- (wfcxxbar)
DRV - [2007/09/19 11:09:42 | 000,015,872 | ---- | M] (Leadtek Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wfcxtcap.sys -- (wfcxtcap)
DRV - [2007/09/19 11:09:32 | 000,009,856 | ---- | M] (Leadtek Research Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\wfcxacap.sys -- (wfcxacap)
DRV - [2007/08/07 08:15:07 | 000,033,052 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2007/02/09 12:17:18 | 000,017,465 | ---- | M] (Portrait Displays, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\pivot.sys -- (Pivot)
DRV - [2007/02/09 12:17:16 | 000,011,323 | ---- | M] (Portrait Displays, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pivotmou.sys -- (pivotmou)
DRV - [2006/02/21 20:46:26 | 001,505,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006/01/04 15:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2005/01/06 16:55:38 | 000,009,446 | ---- | M] (Leadtek Research Inc.) [Kernel | On_Demand | Running] -- C:\Program Files\WinFast\WFDTV\WFIOCTL.sys -- (WFIOCTL)
DRV - [2004/12/23 04:47:10 | 000,027,392 | R--- | M] (Ulead Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ULCDRHlp.sys -- (ULCDRHlp)
DRV - [2004/05/02 16:47:08 | 000,023,040 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\GVCplDrv.sys -- (GVCplDrv)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Mozilla Firefox Start Page
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Wikipedia (en)"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: clean_and_close@csb7.com:2.5.1
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: en-AU@dictionaries.addons.mozilla.org:2.1.1
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.3.2
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.10
FF - prefs.js..extensions.enabledItems: {d37dc5d0-431d-44e5-8c91-49419370caa1}:2.6.18
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {06997db0-c027-4d5f-bd37-b0d9230226ea}:0.61
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.9
FF - prefs.js..extensions.enabledItems: smartbookmarksbar@remy.juteau:1.4.3
FF - prefs.js..extensions.enabledItems: toggleprivatebrowsing@supernova00.biz:1.8
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: yespopupsV1@pathetic****roach.com:0.9.8b
FF - prefs.js..extensions.enabledItems: {e2c58150-9d72-11dd-ad8b-0800200c9a66}:1.3.1
FF - prefs.js..extensions.enabledItems: {8181B740-5255-11D9-9FF6-0090995D2DCA}:0.8.09.07.17

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/21 09:46:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/21 09:46:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/07/10 20:20:43 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010/10/14 17:08:39 | 000,000,000 | ---D | M]

[2010/07/03 16:04:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Extensions
[2010/07/03 16:04:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Extensions\MediaCoder
[2010/07/03 16:01:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Extensions\MediaCoder-MCEX
[2010/10/14 17:27:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\ghitx29p.Default User\extensions
[2010/10/24 17:24:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions
[2009/10/28 10:02:42 | 000,000,000 | ---D | M] (Toolbar Buttons) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/04/08 13:44:55 | 000,000,000 | ---D | M] (Remove Cookies for Site) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{06997db0-c027-4d5f-bd37-b0d9230226ea}
[2010/10/10 15:48:53 | 000,000,000 | ---D | M] (Flagfox) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010/10/13 22

06 | 000,000,000 | ---D | M] (Session Manager) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2010/04/28 13:53:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/29 21:26:29 | 000,000,000 | ---D | M] (FEBE) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2009/08/30 11:03:52 | 000,000,000 | ---D | M] (Phoenity Modern) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{8181B740-5255-11D9-9FF6-0090995D2DCA}
[2010/09/18 09:36:17 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/10/22 09:01:29 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/08/19 12:47:12 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/05/18 17:57:50 | 000,000,000 | ---D | M] (FoxClocks) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
[2010/02/25 18:02:09 | 000,000,000 | ---D | M] (Black Steel) -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\{e2c58150-9d72-11dd-ad8b-0800200c9a66}
[2010/04/12 22:40:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\clean_and_close@csb7.com
[2009/10/14 20:02:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\en-AU@dictionaries.addons.mozilla.org
[2009/08/30 11:03:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\smartbookmarksbar@remy.juteau
[2009/08/30 11:03:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\toggleprivatebrowsing@supernova00.biz
[2009/08/30 11:03:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\ext ensions\yespopupsV1@pathetic****roach.com
[2009/02/06 16:07:05 | 000,010,952 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\sea rchplugins\gutenberg.xml
[2009/02/06 16:02:38 | 000,001,504 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\sea rchplugins\imdb.xml
[2009/02/06 16:03:47 | 000,001,650 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\sea rchplugins\longman-english-dictionary.xml
[2009/02/06 16:04:13 | 000,000,705 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\sea rchplugins\webster.xml
[2009/02/06 16:11:51 | 000,001,224 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\Mozilla\Firefox\Profiles\rsbtzxag.default\sea rchplugins\yahoo-answers.xml
[2010/10/24 17:24:14 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/28 17:44:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/29 20:38:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/07 09:06:57 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/07 09:06:57 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/07 09:06:58 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/07 09:06:58 | 000,000,831 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

**xero** · 25-10-2010

The next part of the report is in rectangles in Notepad, Asian characters when I post it. I just got another fatal error, will now try just the English bits:
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [Eraser] C:\PROGRA~1\Eraser\Eraser.exe File not found
O4 - HKLM..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe (Leadtek Research Inc.)
O4 - HKLM..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe (Leadtek Research Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\Russell Chapman\Start Menu\Programs\Startup\Westnet Usage Grabber.lnk = C:\Program Files\Westnet Usage Grabber\wug.exe (Studiocoast)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveAutorun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoSaveSettings = 0
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/micr...?1261182997109 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/micr...?1258416787359 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.4.2/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Russell Chapman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Russell Chapman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/22 21:29:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.mpegacm - C:\Program Files\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.ulmp3acm - C:\Program Files\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/10/25 11:39:28 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Russell Chapman\Desktop\OTL.exe
[2010/10/24 12:50:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Russell Chapman\Recent
[2010/10/24 11:39:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Russell Chapman\Desktop\Luther
[2010/10/24 11:04:21 | 000,116,224 | ---- | C] (Xerox) -- C:\WINDOWS\System32\dllcache\xrxwiadr.dll
[2010/10/24 11:04:17 | 000,023,040 | ---- | C] (Xerox Corporation) -- C:\WINDOWS\System32\dllcache\xrxwbtmp.dll
[2010/10/24 11:04:03 | 000,099,865 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\xlog.exe
[2010/10/24 11:03:52 | 000,016,970 | ---- | C] (US Robotics MCD (Megahertz)) -- C:\WINDOWS\System32\dllcache\xem336n5.sys
[2010/10/24 11:03:04 | 000,154,624 | ---- | C] (Lucent Technologies) -- C:\WINDOWS\System32\dllcache\wlluc48.sys
[2010/10/24 11:03:00 | 000,034,890 | ---- | C] (Raytheon Corp.) -- C:\WINDOWS\System32\dllcache\wlandrv2.sys
[2010/10/24 11:02:51 | 000,771,581 | ---- | C] (Rockwell) -- C:\WINDOWS\System32\dllcache\winacisa.sys
[2010/10/24 11:02:33 | 000,035,871 | ---- | C] (Winbond Electronics Corp.) -- C:\WINDOWS\System32\dllcache\wbfirdma.sys
[2010/10/24 11:02:22 | 000,016,925 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w940nd.sys
[2010/10/24 11:02:18 | 000,019,016 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w926nd.sys
[2010/10/24 11:02:15 | 000,019,528 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w840nd.sys
[2010/10/24 11:02:08 | 000,064,605 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\vvoice.sys
[2010/10/24 11:02:04 | 000,397,502 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\vpctcom.sys
[2010/10/24 11:02:00 | 000,604,253 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\vmodem.sys
[2010/10/24 11:01:56 | 000,249,402 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\vinwm.sys
[2010/10/24 11:01:42 | 000,765,884 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usrti.sys
[2010/10/24 11:01:28 | 000,794,399 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1806v.sys
[2010/10/24 11:01:24 | 000,793,598 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1806.sys
[2010/10/24 11:01:21 | 000,794,654 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1801.sys
[2010/10/24 11:01:15 | 000,032,384 | ---- | C] (KLSI USA, Inc.) -- C:\WINDOWS\System32\dllcache\usb101et.sys
[2010/10/24 11:00:57 | 000,050,688 | ---- | C] (UMAX DATA SYSTEMS INC.) -- C:\WINDOWS\System32\dllcache\umaxscan.dll
[2010/10/24 11:00:43 | 000,211,968 | ---- | C] (UMAX Data Systems Inc.) -- C:\WINDOWS\System32\dllcache\um54scan.dll
[2010/10/24 11:00:39 | 000,216,064 | ---- | C] (UMAX Data Systems Inc.) -- C:\WINDOWS\System32\dllcache\um34scan.dll
[2010/10/24 11:00:27 | 000,166,784 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridxpm.sys
[2010/10/24 11:00:23 | 000,525,568 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridxp.dll
[2010/10/24 11:00:20 | 000,159,232 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridkbm.sys
[2010/10/24 11:00:16 | 000,440,576 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridkb.dll
[2010/10/24 11:00:13 | 000,222,336 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\trid3dm.sys
[2010/10/24 11:00:10 | 000,315,520 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\trid3d.dll
[2010/10/24 10:59:41 | 000,123,995 | ---- | C] (Tiger Jet Network) -- C:\WINDOWS\System32\dllcache\tjisdn.sys
[2010/10/24 10:59:35 | 000,138,528 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tgiulnt5.sys
[2010/10/24 10:59:32 | 000,081,408 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tgiul50.dll
[2010/10/24 10:59:31 | 000,149,376 | ---- | C] (M-Systems) -- C:\WINDOWS\System32\dllcache\tffsport.sys
[2010/10/24 10:59:27 | 000,017,129 | ---- | C] (TDK Corporation) -- C:\WINDOWS\System32\dllcache\tdkcd31.sys
[2010/10/24 10:59:24 | 000,037,961 | ---- | C] (TDK Corporation) -- C:\WINDOWS\System32\dllcache\tdk100b.sys
[2010/10/24 10:59:10 | 000,036,640 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\t2r4mini.sys
[2010/10/24 10:59:07 | 000,172,768 | ---- | C] (Number Nine Visual Technology) -- C:\WINDOWS\System32\dllcache\t2r4disp.dll
[2010/10/24 10:58:27 | 000,155,648 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlnprop.dll
[2010/10/24 10:58:24 | 000,053,248 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlncoin.dll
[2010/10/24 10:58:21 | 000,285,760 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlnata.sys
[2010/10/24 10:58:17 | 000,016,896 | ---- | C] (SCM Microsystems, Inc.) -- C:\WINDOWS\System32\dllcache\stcusb.sys
[2010/10/24 10:58:13 | 000,048,736 | ---- | C] (3Com) -- C:\WINDOWS\System32\dllcache\srwlnd5.sys
[2010/10/24 10:57:54 | 000,019,072 | ---- | C] (Adaptec, Inc.) -- C:\WINDOWS\System32\dllcache\sparrow.sys
[2010/10/24 10:57:25 | 000,058,368 | ---- | C] (Silicon Motion Inc.) -- C:\WINDOWS\System32\dllcache\smiminib.sys
[2010/10/24 10:57:21 | 000,147,200 | ---- | C] (Silicon Motion Inc.) -- C:\WINDOWS\System32\dllcache\smidispb.dll
[2010/10/24 10:57:18 | 000,025,034 | ---- | C] (SMC Networks, Inc.) -- C:\WINDOWS\System32\dllcache\smcpwr2n.sys
[2010/10/24 10:57:15 | 000,035,913 | ---- | C] (SMC) -- C:\WINDOWS\System32\dllcache\smcirda.sys
[2010/10/24 10:57:12 | 000,024,576 | ---- | C] (SMC Networks, Inc.) -- C:\WINDOWS\System32\dllcache\smc8000n.sys
[2010/10/24 10

47 | 000,063,547 | ---- | C] (Symbol Technologies) -- C:\WINDOWS\System32\dllcache\sla30nd5.sys
[2010/10/24 10

44 | 000,091,294 | ---- | C] (SysKonnect, a business unit of Schneider & Koch & Co. Datensysteme GmbH.) -- C:\WINDOWS\System32\dllcache\skfpwin.sys
[2010/10/24 10

41 | 000,094,698 | ---- | C] (SysKonnect GmbH.) -- C:\WINDOWS\System32\dllcache\sk98xwin.sys
[2010/10/24 10

33 | 000,032,768 | ---- | C] (SiS Corporation) -- C:\WINDOWS\System32\dllcache\sisnic.sys
[2010/10/24 10

05 | 000,161,568 | ---- | C] (Micro Systemation) -- C:\WINDOWS\System32\dllcache\sgsmusb.sys
[2010/10/24 10

02 | 000,018,400 | ---- | C] (Micro Systemation) -- C:\WINDOWS\System32\dllcache\sgsmld.sys
[2010/10/24 10:55:59 | 000,098,080 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\sgiulnt5.sys
[2010/10/24 10:55:56 | 000,386,560 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\sgiul50.dll
[2010/10/24 10:43:38 | 000,017,280 | ---- | C] (SCM Microsystems) -- C:\WINDOWS\System32\dllcache\scr111.sys
[2010/10/24 10:43:32 | 000,023,936 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\sccmusbm.sys
[2010/10/24 10:43:29 | 000,023,936 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\sccmn50m.sys
[2010/10/24 10:43:15 | 000,077,824 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav4m.sys
[2010/10/24 10:43:12 | 000,198,400 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav4.dll
[2010/10/24 10:43:09 | 000,061,504 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav3dm.sys
[2010/10/24 10:43:06 | 000,179,264 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav3d.dll
[2010/10/24 10:43:03 | 000,210,496 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mvirge.dll
[2010/10/24 10:43:00 | 000,062,496 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mtrio.dll
[2010/10/24 10:42:57 | 000,041,216 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mt3d.sys
[2010/10/24 10:42:54 | 000,182,272 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mt3d.dll
[2010/10/24 10:42:51 | 000,166,720 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3m.sys
[2010/10/24 10:42:45 | 000,082,432 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia450.dll
[2010/10/24 10:42:42 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia430.dll
[2010/10/24 10:42:35 | 000,029,696 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw450ext.dll
[2010/10/24 10:42:34 | 000,027,648 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw430ext.dll
[2010/10/24 10:42:23 | 000,009,216 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\rsmgrstr.dll
[2010/10/24 10:42:18 | 000,079,104 | ---- | C] (Comtrol Corporation) -- C:\WINDOWS\System32\dllcache\rocket.sys
[2010/10/24 10:42:14 | 000,037,563 | ---- | C] (RadioLAN) -- C:\WINDOWS\System32\dllcache\rlnet5.sys
[2010/10/24 10:42:11 | 000,086,097 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\reslog32.dll
[2010/10/24 10:33:07 | 000,714,762 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\r2mdmkxx.sys
[2010/10/24 10:33:04 | 000,899,146 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\r2mdkxga.sys
[2010/10/24 10:32:36 | 000,130,942 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserlv.sys
[2010/10/24 10:32:34 | 000,112,574 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserlp.sys
[2010/10/24 10:32:31 | 000,128,286 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserli.sys
[2010/10/24 10:32:20 | 000,016,128 | ---- | C] (SCM Microsystems, Inc.) -- C:\WINDOWS\System32\dllcache\pscr.sys
[2010/10/24 10:31:30 | 000,086,016 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\pctspk.exe
[2010/10/24 10:31:18 | 000,029,502 | ---- | C] (Marconi Communications, Inc.) -- C:\WINDOWS\System32\dllcache\pca200e.sys
[2010/10/24 10:31:18 | 000,026,153 | ---- | C] (Linksys) -- C:\WINDOWS\System32\dllcache\pcmlm56.sys
[2010/10/24 10:31:15 | 000,030,495 | ---- | C] (Linksys) -- C:\WINDOWS\System32\dllcache\pc100nds.sys
[2010/10/24 10:30:34 | 000,054,186 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otcsercb.sys
[2010/10/24 10:30:31 | 000,043,689 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otceth5.sys
[2010/10/24 10:30:28 | 000,027,209 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otc06x5.sys
[2010/10/24 10:30:25 | 000,054,528 | ---- | C] (Yamaha Corp.) -- C:\WINDOWS\System32\dllcache\opl3sax.sys
[2010/10/24 10:30:09 | 000,051,552 | ---- | C] (Kensington Technology Group) -- C:\WINDOWS\System32\dllcache\ntgrip.sys
[2010/10/24 10:29:54 | 000,087,040 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\nm6wdm.sys
[2010/10/24 10:29:51 | 000,126,080 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\nm5a2wdm.sys
[2010/10/24 10:29:47 | 000,132,695 | ---- | C] (802.11b) -- C:\WINDOWS\System32\dllcache\netwlan5.sys
[2010/10/24 10:29:39 | 000,039,264 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\neo20xx.sys
[2010/10/24 10:29:36 | 000,060,480 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\neo20xx.dll
[2010/10/24 10:29:29 | 000,091,488 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i3disp.dll
[2010/10/24 10:29:27 | 000,027,936 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i3d.sys
[2010/10/24 10:29:24 | 000,033,088 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128v2.sys
[2010/10/24 10:29:21 | 000,059,104 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128v2.dll
[2010/10/24 10:29:18 | 000,013,664 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128.sys
[2010/10/24 10:29:16 | 000,035,392 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128.dll
[2010/10/24 10:29:08 | 000,075,520 | ---- | C] (Moxa Technologies Co., Ltd.) -- C:\WINDOWS\System32\dllcache\mxport.sys
[2010/10/24 10:29:05 | 000,007,168 | ---- | C] (Moxa Technologies Co., Ltd) -- C:\WINDOWS\System32\dllcache\mxport.dll
[2010/10/24 10:29:02 | 000,019,968 | ---- | C] (Macronix International Co., Ltd. ) -- C:\WINDOWS\System32\dllcache\mxnic.sys
[2010/10/24 10:28:59 | 000,019,968 | ---- | C] (Moxa Technologies Co., Ltd) -- C:\WINDOWS\System32\dllcache\mxicfg.dll
[2010/10/24 10:28:57 | 000,021,888 | ---- | C] (Moxa Technologies Co., Ltd.) -- C:\WINDOWS\System32\dllcache\mxcard.sys
[2010/10/24 10:28:18 | 000,017,280 | ---- | C] (American Megatrends Inc.) -- C:\WINDOWS\System32\dllcache\mraid35x.sys
[2010/10/24 10:27:47 | 000,164,586 | ---- | C] (Madge Networks Ltd) -- C:\WINDOWS\System32\dllcache\mdgndis5.sys
[2010/10/24 10:24:15 | 000,797,500 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltsmt.sys
[2010/10/24 10:24:13 | 000,802,683 | ---- | C] (Lucent Technologies) -- C:\WINDOWS\System32\dllcache\ltsm.sys
[2010/10/24 10:24:11 | 000,420,992 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltmdmntt.sys
[2010/10/24 10:24:09 | 000,606,684 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltmdmnt.sys
[2010/10/24 10:24:09 | 000,576,746 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltmdmntl.sys
[2010/10/24 10:24:06 | 000,727,786 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\ltck000c.sys
[2010/10/24 10:24:00 | 000,070,730 | ---- | C] (Linksys Group, Inc.) -- C:\WINDOWS\System32\dllcache\lne100tx.sys
[2010/10/24 10:23:57 | 000,020,573 | ---- | C] (The Linksts Group ) -- C:\WINDOWS\System32\dllcache\lne100.sys
[2010/10/24 10:23:54 | 000,025,065 | ---- | C] (D-Link) -- C:\WINDOWS\System32\dllcache\lmndis3.sys
[2010/10/24 10:23:52 | 000,015,744 | ---- | C] (Litronic Industries) -- C:\WINDOWS\System32\dllcache\lit220p.sys
[2010/10/24 10:23:48 | 000,026,442 | ---- | C] (SMSC) -- C:\WINDOWS\System32\dllcache\lanepic5.sys
[2010/10/24 10:23:45 | 000,019,016 | ---- | C] (Kingston Technology Company ) -- C:\WINDOWS\System32\dllcache\ktc111.sys
[2010/10/24 10:23:01 | 000,023,552 | ---- | C] (MKNet Corporation) -- C:\WINDOWS\System32\dllcache\irmk7.sys
[2010/10/24 10:22:24 | 000,372,824 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\iconf32.dll
[2010/10/24 10:20:47 | 000,068,608 | ---- | C] (Avisioin) -- C:\WINDOWS\System32\dllcache\hpgt53tk.dll
[2010/10/24 10:20:38 | 000,126,976 | ---- | C] (Hewlett Packard) -- C:\WINDOWS\System32\dllcache\hpgt34tk.dll
[2010/10/24 10:20:13 | 000,028,288 | ---- | C] (Gemplus) -- C:\WINDOWS\System32\dllcache\grserial.sys
[2010/10/24 10:20:11 | 000,082,304 | ---- | C] (Gemplus) -- C:\WINDOWS\System32\dllcache\grclass.sys
[2010/10/24 10:20:09 | 000,017,408 | ---- | C] (Gemplus) -- C:\WINDOWS\System32\dllcache\gpr400.sys
[2010/10/24 10:19:55 | 000,454,912 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fxusbase.sys
[2010/10/24 10:19:46 | 000,455,296 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fusbbase.sys
[2010/10/24 10:19:44 | 000,455,680 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fus2base.sys
[2010/10/24 10:19:41 | 000,442,240 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fpnpbase.sys
[2010/10/24 10:19:38 | 000,441,728 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fpcmbase.sys
[2010/10/24 10:19:37 | 000,444,416 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fpcibase.sys
[2010/10/24 10:19:35 | 000,034,173 | ---- | C] (Marconi Communications, Inc.) -- C:\WINDOWS\System32\dllcache\forehe.sys
[2010/10/24 10:19:16 | 000,024,618 | ---- | C] (NETGEAR) -- C:\WINDOWS\System32\dllcache\fa410nd5.sys
[2010/10/24 10:19:12 | 000,011,850 | ---- | C] (FUJITSU LIMITED) -- C:\WINDOWS\System32\dllcache\f3ab18xj.sys
[2010/10/24 10:19:10 | 000,012,362 | ---- | C] (FUJITSU LIMITED) -- C:\WINDOWS\System32\dllcache\f3ab18xi.sys
[2010/10/24 10:17:47 | 000,334,208 | ---- | C] (Yamaha Corp.) -- C:\WINDOWS\System32\dllcache\ds1wdm.sys
[2010/10/24 10:17:43 | 000,028,062 | ---- | C] (National Semiconductor Coproration) -- C:\WINDOWS\System32\dllcache\dp83820.sys
[2010/10/24 10:17:35 | 000,029,696 | ---- | C] (CNet Technology, Inc. ) -- C:\WINDOWS\System32\dllcache\dm9pci5.sys
[2010/10/24 10:17:32 | 000,026,698 | ---- | C] (D-Link Corporation) -- C:\WINDOWS\System32\dllcache\dlh5xnd5.sys
[2010/10/24 10:17:31 | 000,952,007 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\diwan.sys
[2010/10/24 10:17:26 | 000,236,060 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\ditrace.exe
[2010/10/24 10:17:25 | 000,038,985 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\disrvsu.dll
[2010/10/24 10:17:24 | 000,031,305 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\disrvpp.dll
[2010/10/24 10:17:23 | 000,006,729 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\disrvci.dll
[2010/10/24 10:17:21 | 000,091,305 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\dimaint.sys
[2010/10/24 10:17:02 | 000,024,649 | ---- | C] (D-Link) -- C:\WINDOWS\System32\dllcache\dfe650d.sys
[2010/10/24 10:17:01 | 000,024,648 | ---- | C] (D-Link) -- C:\WINDOWS\System32\dllcache\dfe650.sys
[2010/10/24 10:16:57 | 000,020,928 | ---- | C] (Digital Networks, LLC) -- C:\WINDOWS\System32\dllcache\defpa.sys
[2010/10/24 10:16:36 | 000,048,640 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwrwdm.sys
[2010/10/24 10:16:35 | 000,093,952 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwcwdm.sys
[2010/10/24 10:16:34 | 000,111,872 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwcspud.sys
[2010/10/24 10:16:33 | 000,003,584 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwcosnt5.sys
[2010/10/24 10:16:32 | 000,072,832 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwbwdm.sys
[2010/10/24 10:16:31 | 000,003,072 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwbmidi.sys
[2010/10/24 10:16:29 | 000,003,072 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwbase.sys
[2010/10/24 10:16:27 | 000,249,856 | ---- | C] (Comtrol® Corporation) -- C:\WINDOWS\System32\dllcache\ctmasetp.dll
[2010/10/24 10:16:20 | 000,216,064 | ---- | C] (COMPAQ Inc.) -- C:\WINDOWS\System32\dllcache\cpscan.dll
[2010/10/24 10:16:08 | 000,020,736 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\cmbp0wdm.sys
[2010/10/24 10:16:01 | 000,980,034 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\cicap.sys
[2010/10/24 10:15:54 | 000,049,182 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cem56n5.sys
[2010/10/24 10:15:54 | 000,022,044 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cem33n5.sys
[2010/10/24 10:15:53 | 000,022,044 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cem28n5.sys
[2010/10/24 10:15:52 | 000,027,164 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\ce3n5.sys
[2010/10/24 10:15:52 | 000,021,530 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\ce2n5.sys
[2010/10/24 10:15:49 | 000,714,698 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cbmdmkxx.sys
[2010/10/24 10:15:48 | 000,046,108 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cben5.sys
[2010/10/24 10:15:48 | 000,039,680 | ---- | C] (Silicom Ltd.) -- C:\WINDOWS\System32\dllcache\cb325.sys
[2010/10/24 10:15:47 | 000,037,916 | ---- | C] (Fast Ethernet Controller Provider) -- C:\WINDOWS\System32\dllcache\cb102.sys
[2010/10/24 10:15:46 | 000,032,256 | ---- | C] (Eicon Technology Corporation) -- C:\WINDOWS\System32\dllcache\diapi2NT.dll
[2010/10/24 10:15:44 | 000,164,923 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\diapi2.sys
[2010/10/24 10:15:17 | 000,031,529 | ---- | C] (BreezeCOM) -- C:\WINDOWS\System32\dllcache\brzwlan.sys
[2010/10/24 10:15:16 | 000,011,008 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brusbmdm.sys
[2010/10/24 10:15:16 | 000,010,368 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brusbscn.sys
[2010/10/24 10:15:15 | 000,060,416 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brserwdm.sys
[2010/10/24 10:15:15 | 000,009,728 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brserif.dll
[2010/10/24 10:15:14 | 000,005,120 | ---- | C] (Brother Industries,Ltd.) -- C:\WINDOWS\System32\dllcache\brscnrsm.dll
[2010/10/24 10:15:12 | 000,039,552 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brparwdm.sys
[2010/10/24 10:15:12 | 000,003,168 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brparimg.sys
[2010/10/24 10:15:11 | 000,041,472 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfusb.dll
[2010/10/24 10:15:10 | 000,032,256 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfrsmg.exe
[2010/10/24 10:15:10 | 000,029,696 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmflpt.dll
[2010/10/24 10:15:09 | 000,015,360 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfbidi.dll
[2010/10/24 10:15:08 | 000,003,968 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brfiltup.sys
[2010/10/24 10:15:07 | 000,012,160 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brfiltlo.sys
[2010/10/24 10:15:07 | 000,002,944 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brfilt.sys
[2010/10/24 10:15:06 | 000,012,800 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brevif.dll
[2010/10/24 10:15:06 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brcoinst.dll
[2010/10/24 10:15:05 | 000,019,456 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brbidiif.dll
[2010/10/24 10:14:58 | 000,871,388 | ---- | C] (BCM) -- C:\WINDOWS\System32\dllcache\bcmdm.sys
[2010/10/24 10:14:55 | 000,036,128 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.sys
[2010/10/24 10:14:54 | 000,342,336 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.dll
[2010/10/24 10:14:54 | 000,089,952 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\b1cbase.sys
[2010/10/24 10:14:53 | 000,036,992 | ---- | C] (Aztech Systems Ltd) -- C:\WINDOWS\System32\dllcache\aztw2320.sys
[2010/10/24 10:14:52 | 000,144,384 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmenum.dll
[2010/10/24 10:14:52 | 000,037,568 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmwan.sys
[2010/10/24 10:14:51 | 000,087,552 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmcoxp.dll
[2010/10/24 10:14:32 | 000,097,354 | ---- | C] (Bay Networks, Inc.) -- C:\WINDOWS\System32\dllcache\aspndis3.sys
[2010/10/24 10:14:23 | 000,016,969 | ---- | C] (AmbiCom, Inc.) -- C:\WINDOWS\System32\dllcache\amb8002.sys
[2010/10/24 10:13:17 | 000,046,112 | ---- | C] (Adaptec, Inc ) -- C:\WINDOWS\System32\dllcache\adptsf50.sys
[2010/10/24 10:13:16 | 000,747,392 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8830.sys
[2010/10/24 10:13:16 | 000,010,880 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\admjoy.sys
[2010/10/24 10:13:15 | 000,584,448 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8810.sys
[2010/10/24 10:13:15 | 000,553,984 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8820.sys
[2010/10/24 10:13:13 | 000,061,440 | ---- | C] (Color Flatbed Scanner) -- C:\WINDOWS\System32\dllcache\acerscad.dll
[2010/10/24 10:13:09 | 000,462,848 | ---- | C] (Aureal Inc.) -- C:\WINDOWS\System32\dllcache\a3dapi.dll
[2010/10/24 10:13:09 | 000,098,304 | ---- | C] (Aureal Semiconductor) -- C:\WINDOWS\System32\dllcache\a3d.dll
[2010/10/24 10:13:06 | 000,762,780 | ---- | C] (3Com, Inc.) -- C:\WINDOWS\System32\dllcache\3cwmcru.sys
[2010/10/24 10:13:06 | 000,689,216 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2010/10/24 10:13:06 | 000,148,352 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2010/10/24 09:48:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Russell Chapman\Desktop\A Few Good Men
[2010/10/23 19:46:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Russell Chapman\Desktop\MKVTools 2.4.2
[2010/10/20 07:49:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Russell Chapman\Desktop\Travels With A Tangerine
[2010/10/14 17:01:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2010/10/14 16:51:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Russell Chapman\Application Data\CBS Interactive
[2010/10/11 08:17:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Russell Chapman\Desktop\Archie Roach -The Tracker
[2010/09/29 13:08:29 | 000,048,640 | ---- | C] (Tracker Software Products Ltd.) -- C:\WINDOWS\System32\pxc40pma.dll
[2010/09/29 13:05:17 | 000,000,000 | ---D | C] -- C:\Program Files\ABBYY PDF Transformer 3.0
[2010/09/27 15:30:01 | 000,000,000 | ---D | C] -- C:\Program Files\Total Video Converter
[2010/09/27 15:04:07 | 014,912,840 | ---- | C] (HamsterSoft, Inc. ) -- C:\Documents and Settings\Russell Chapman\Desktop\hamsterfreevideoconverter.exe
[2010/09/25 15:57:45 | 000,000,000 | ---D | C] -- C:\Program Files\DVDFab 8
[2009/08/20 18:30:09 | 006,613,816 | ---- | C] (InstallShield Software Corporation) -- C:\Program Files\DRWProSetup.exe
[2009/07/23 14:23:55 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Russell Chapman\Application Data\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2010/10/25 11:46:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/10/25 11:39:32 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Russell Chapman\Desktop\OTL.exe
[2010/10/25 11:39:04 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\MBRCheck.exe
[2010/10/24 21:57:39 | 000,000,002 | ---- | M] () -- C:\WINDOWS\System32\Dvbpws.dll
[2010/10/24 18:11:22 | 000,205,824 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/24 11:11:07 | 000,286,404 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\gmer.zip
[2010/10/24 10:32:29 | 000,044,198 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\Utility.docx
[2010/10/24 10:32:06 | 000,056,577 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\Utility.pdf
[2010/10/24 10:30:39 | 000,002,533 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk
[2010/10/23 20:11:03 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/22 19:15:26 | 000,486,232 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\[isoHunt] Pulp Fiction KLAXXON 1.48gb 37s .torrent
[2010/10/22 19:10:59 | 000,001,168 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\vso_ts_preview.xml
[2010/10/22 18:07:12 | 000,070,858 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\Panasonic S35 P1.docx
[2010/10/22 18:05:38 | 041,446,863 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\Panasonic DVD S35.doc
[2010/10/22 17:13:23 | 000,008,441 | ---- | M] () -- C:\WINDOWS\CDPlayer.ini
[2010/10/22 11:03:23 | 000,000,670 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\DVDFab 8.lnk
[2010/10/22 10:37:35 | 001,161,486 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\F000787.pdf
[2010/10/21 10:51:00 | 000,025,600 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\GSpot How To.docx
[2010/10/21 10:48:14 | 000,411,509 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\GSpot270a.zip
[2010/10/21 09:42:35 | 001,620,896 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/21 09:29:22 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/10/20 21:29:38 | 000,090,090 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\[isoHunt] Last_Chance_to_See_1-6_(complete__English_subs).5536096.TPB 4.36gb 13s.torrent
[2010/10/20 16:25:47 | 002,278,957 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\goldfish.wmv
[2010/10/19 16:00:08 | 000,294,912 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\gmer.exe
[2010/10/19 15:32:38 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/10/19 14:52:07 | 725,601,694 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\White Mischief (Divx) Greta Scacchi.avi
[2010/10/18 17:01:58 | 000,019,604 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\Gretta Scacchi.docx
[2010/10/17 10:35:07 | 022,569,700 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\How to give women squirting orgasms.flv
[2010/10/16 13:25:26 | 000,165,109 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\email error.docx
[2010/10/16 13:24:55 | 000,037,656 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\email error.pdf
[2010/10/15 11:30:52 | 000,000,706 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\MediaCoder.lnk
[2010/10/14 17:26:47 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\Microsoft\Internet Explorer\Quick Launch\CDBurnerXP.lnk
[2010/10/14 16:28:14 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\CCleaner.lnk
[2010/10/14 08:46:10 | 000,017,407 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\let.the.right.one.in.(2008).eng.2c d.(3451822).zip
[2010/10/12 08:31:18 | 000,010,873 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\Dr Davies letter.docx
[2010/10/09 17:06:46 | 000,180,657 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\eml2m065_en.zip
[2010/10/09 12:51:09 | 004,159,783 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\Politicamente_INcorreto.flv
[2010/10/09 12:50:35 | 000,017,829 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\nun_with_guns.jpg
[2010/10/06 12:30:26 | 000,650,704 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\JVC UX-H100 manual.pdf
[2010/10/05 16:48:55 | 000,014,824 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\[isoHunt] An Education DVDRip XviD-ALLiANCE700mb 300+s.torrent
[2010/10/03 16:02:44 | 1534,371,840 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\Rockwiz 001.mpg
[2010/10/02 13:48:42 | 000,172,299 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\howlandmoanfrontcopy.jpg
[2010/10/02 10

03 | 000,566,742 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/10/02 10

03 | 000,113,832 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/09/29 18:55:12 | 000,026,924 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\Microdirect Purchase Order - 254.doc
[2010/09/27 15:04:50 | 014,912,840 | ---- | M] (HamsterSoft, Inc. ) -- C:\Documents and Settings\Russell Chapman\Desktop\hamsterfreevideoconverter.exe
[2010/09/27 14:15:31 | 000,033,280 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\How to turn a modest gift into a dynamic little nonprofit.doc
[2010/09/27 14:04:35 | 000,242,848 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\The Global Journey of the Sarajevo Haggadah.jpg
[2010/09/26 11:47:47 | 000,015,146 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\My Documents\Rituals Episode descriptions.docx

========== Files Created - No Company Name ==========

[2010/10/25 11:39:03 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\MBRCheck.exe
[2010/10/24 11:40:48 | 000,294,912 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\gmer.exe
[2010/10/24 11:11:03 | 000,286,404 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\gmer.zip
[2010/10/24 11:04:17 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xrxscnui.dll
[2010/10/24 11:04:13 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xrxftplt.exe
[2010/10/24 10:32:28 | 000,044,198 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\Utility.docx
[2010/10/24 10:32:06 | 000,056,577 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\Utility.pdf
[2010/10/24 10:20:45 | 000,165,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt53.dll
[2010/10/24 10:20:40 | 000,093,696 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt42.dll
[2010/10/24 10:20:35 | 000,101,376 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt34.dll
[2010/10/24 10:20:31 | 000,089,088 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt33.dll
[2010/10/24 10:20:26 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt21.dll
[2010/10/24 10:17:30 | 000,029,768 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divasu.dll
[2010/10/24 10:17:29 | 000,037,962 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divaprop.dll
[2010/10/24 10:17:28 | 000,006,216 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divaci.dll
[2010/10/24 10:14:45 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativxbar.sys
[2010/10/24 10:14:45 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atixbar.sys
[2010/10/24 10:14:44 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativttxx.sys
[2010/10/24 10:14:44 | 000,009,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativmdcd.sys
[2010/10/24 10:14:43 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitvsnd.sys
[2010/10/24 10:14:43 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitunep.sys
[2010/10/24 10:14:42 | 000,049,920 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtcap.sys
[2010/10/24 10:14:42 | 000,026,880 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtsnd.sys
[2010/10/24 10:14:41 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atipcxxx.sys
[2010/10/24 10:14:36 | 000,046,464 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atibt829.sys
[2010/10/22 19:15:23 | 000,486,232 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\[isoHunt] Pulp Fiction KLAXXON 1.48gb 37s .torrent
[2010/10/22 18:03:14 | 000,070,858 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\Panasonic S35 P1.docx
[2010/10/22 17:33:48 | 041,446,863 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\Panasonic DVD S35.doc
[2010/10/22 10:37:26 | 001,161,486 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\F000787.pdf
[2010/10/21 10:51:00 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\GSpot How To.docx
[2010/10/21 10:48:10 | 000,411,509 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\GSpot270a.zip
[2010/10/20 21:29:37 | 000,090,090 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\[isoHunt] Last_Chance_to_See_1-6_(complete__English_subs).5536096.TPB 4.36gb 13s.torrent
[2010/10/20 16:25:46 | 002,278,957 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\goldfish.wmv
[2010/10/19 14:55:24 | 725,601,694 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\White Mischief (Divx) Greta Scacchi.avi
[2010/10/18 17:01:57 | 000,019,604 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\Gretta Scacchi.docx
[2010/10/17 10:35:03 | 022,569,700 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\How to give women squirting orgasms.flv
[2010/10/16 13:25:26 | 000,165,109 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\email error.docx
[2010/10/16 13:24:55 | 000,037,656 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\email error.pdf
[2010/10/15 11:30:52 | 000,000,706 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\MediaCoder.lnk
[2010/10/14 17:26:47 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Application Data\Microsoft\Internet Explorer\Quick Launch\CDBurnerXP.lnk
[2010/10/14 08:46:08 | 000,017,407 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\let.the.right.one.in.(2008).eng.2c d.(3451822).zip
[2010/10/12 08:31:18 | 000,010,873 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\Dr Davies letter.docx
[2010/10/09 17:06:43 | 000,180,657 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\eml2m065_en.zip
[2010/10/09 12:50:34 | 000,017,829 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\nun_with_guns.jpg
[2010/10/09 12:48:33 | 004,159,783 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\Politicamente_INcorreto.flv
[2010/10/06 12:30:26 | 000,650,704 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\JVC UX-H100 manual.pdf
[2010/10/05 16:48:54 | 000,014,824 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\[isoHunt] An Education DVDRip XviD-ALLiANCE700mb 300+s.torrent
[2010/10/03 16:00:22 | 1534,371,840 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\Rockwiz 001.mpg
[2010/10/02 13:48:41 | 000,172,299 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\howlandmoanfrontcopy.jpg
[2010/09/29 18:55:12 | 000,026,924 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\Microdirect Purchase Order - 254.doc
[2010/09/27 14:15:30 | 000,033,280 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\How to turn a modest gift into a dynamic little nonprofit.doc
[2010/09/27 14:04:34 | 000,242,848 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\The Global Journey of the Sarajevo Haggadah.jpg
[2010/09/26 11:47:47 | 000,015,146 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\My Documents\Rituals Episode descriptions.docx
[2010/09/25 15:57:55 | 000,000,670 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Desktop\DVDFab 8.lnk
[2010/08/15 09:08:11 | 000,000,033 | ---- | C] () -- C:\WINDOWS\quark.ini
[2010/08/06 11:23:45 | 000,000,122 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010/07/01 17:14:44 | 000,007,420 | ---- | C] () -- C:\WINDOWS\UA000104.DLL
[2010/07/01 17:05:10 | 000,209,040 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2010/07/01 17:05:10 | 000,204,944 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2010/07/01 17:05:10 | 000,196,752 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2010/07/01 17:05:10 | 000,196,752 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2010/07/01 17:05:10 | 000,192,656 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2010/07/01 17:05:10 | 000,024,720 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2010/06/18 13:06:16 | 000,697,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2010/06/13 13:28:32 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010/06/13 11:16:36 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2010/06/13 11:16:36 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2010/06/13 11:16:36 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2010/06/13 11:16:36 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2010/05/10 18:37:15 | 000,002,304 | ---- | C] () -- C:\WINDOWS\System32\Machnm32.sys
[2010/05/05 20:27:58 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/05/03 15:13:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SMMVSplitter.INI
[2010/03/12 10:11:27 | 000,000,363 | ---- | C] () -- C:\WINDOWS\pdf2word.INI
[2010/02/05 07:54:23 | 000,000,002 | ---- | C] () -- C:\WINDOWS\System32\Dvbpws.dll
[2009/12/16 17:13:27 | 000,008,441 | ---- | C] () -- C:\WINDOWS\CDPlayer.ini
[2009/07/29 22:05:22 | 092,003,328 | ---- | C] () -- C:\Program Files\DB9_Prof_free_en.msi
[2009/07/26 23:25:40 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/07/26 15:36:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\lgfwup.ini
[2009/07/24 12:23:04 | 000,205,824 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/24 11:30:37 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2009/07/24 11:30:02 | 000,006,211 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2009/07/23 16:42:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2009/07/23 16:11:48 | 000,001,168 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Application Data\vso_ts_preview.xml
[2009/07/23 14:24:08 | 000,000,034 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Application Data\pcouffin.log
[2009/07/23 14:23:55 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Application Data\pcouffin.cat
[2009/07/23 14:23:55 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Application Data\pcouffin.inf
[2009/07/23 14:19:39 | 000,000,040 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2009/07/23 11:45:25 | 000,000,419 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2009/07/23 10:42:04 | 000,000,138 | ---- | C] () -- C:\Documents and Settings\Russell Chapman\Local Settings\Application Data\fusioncache.dat
[2009/07/23 10:33:29 | 000,023,040 | R--- | C] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys
[2009/07/23 08:28:22 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2009/07/23 05:07:45 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/12/31 17:04:42 | 000,691,560 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

========== LOP Check ==========

[2010/05/09 11:48:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis
[2010/03/02 16:24:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/06/13 13:28:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2010/05/28 16:45:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2010/07/13 17:07:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJ
[2010/05/28 16:53:26 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJMyPrinter
[2010/09/09 17:09:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJPLM
[2010/07/13 17:03:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJScan
[2010/05/28 16:54:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJSolutionMenu
[2010/06/18 13:05:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
[2009/07/23 14:23:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DVDXStudio
[2009/07/23 17:38:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG
[2010/07/01 17:05:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InterVideo
[2009/07/24 11:32:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MAGIX
[2009/08/29 18:33:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PassMark
[2009/07/23 11:45:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010/10/09 16:58:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft
[2010/09/25 18:50:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/12/18 13:00:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2010/04/23 13:30:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/04/25 12:16:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\AnvSoft
[2010/03/19 09:05:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Any DVD Shrink
[2010/07/03 16:06:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Any Video Converter
[2010/06/06 20:05:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Apowersoft
[2010/06/05 11:19:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\avidemux
[2010/10/15 11:30:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Broad Intelligence
[2010/06/13 13:28:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Canneverbe Limited
[2010/07/13 17:03:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Canon
[2010/10/14 17:30:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\CBS Interactive
[2010/06/18 14:17:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\DAEMON Tools Pro
[2010/03/26 12:42:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\dBpoweramp
[2010/05/10 18:41:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\DisplayTune
[2009/08/07 09:51:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\FLV Extract
[2010/08/22 10:49:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\foobar2000
[2010/10/25 11:39:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Free Download Manager
[2010/06/13 12:59:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\ImTOO Software Studio
[2010/04/18 11:06:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\LEAPS
[2010/04/25 11:47:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\mkvtoolnix
[2009/08/30 15:33:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Opera
[2009/07/23 17:17:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Pegasys Inc
[2009/07/23 11:45:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\ScanSoft
[2010/05/03 15:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Seven Zip
[2009/12/23 15:58:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Sony
[2009/07/23 10:51:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Thunderbird
[2010/07/01 17:20:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Ulead Systems
[2010/10/25 10:38:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\uTorrent
[2010/10/22 19:11:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\Vso
[2010/06/05 12:52:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Russell Chapman\Application Data\YCanPDF

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/07/22 21:29:27 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/06/13 17:55:57 | 000,022,152 | ---- | M] () -- C:\avi_log.txt
[2009/07/22 21:24:44 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/09/17 13:18:03 | 000,000,281 | -HS- | M] () -- C:\boot.ini
[2010/02/05 16:00:22 | 000,260,272 | ---- | M] () -- C:\cmldr
[2009/07/22 21:29:27 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2009/09/25 11:06:50 | 000,000,000 | ---- | M] () -- C:\default.wav.wav
[2009/07/22 21:29:27 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/05/03 18:12:10 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2009/07/22 21:29:27 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2006/02/28 20:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/07/22 21:40:35 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/10/25 11:46:41 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys
[2010/05/10 18:36:38 | 000,000,173 | ---- | M] () -- C:\pdisdk.log
[2010/05/10 18:37:34 | 000,000,184 | ---- | M] () -- C:\pivot.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/07/22 21:29:04 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/09/13 05:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD83. DLL
[2010/05/16 05:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPDA5. DLL
[2006/09/13 05:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP83. DLL
[2010/05/16 05:00:00 | 000,070,656 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPPA5. DLL
[2008/07/06 20:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpi pelineprintproc.dll
[2006/10/26 19

12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr .dll
[2008/07/06 18:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfil terpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 23:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/28 15:36:12 | 092,003,328 | ---- | M] () -- C:\Program Files\DB9_Prof_free_en.msi
[2009/08/12 11:17:40 | 006,613,816 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\DRWProSetup.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/07/23 05:04:12 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/07/23 05:04:12 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/07/23 05:04:12 | 000,901,120 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/07/22 21:43:31 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >
[2007/07/02 14:19:30 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\NEROINSTAEC43759.DB
[2010/07/01 16:38:35 | 000,007,680 | -HS- | M] () -- C:\WINDOWS\system32\Thumbs.db

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/07/23 07:37:04 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/07/22 21:33:28 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2004/04/20 14:05:02 | 001,189,345 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\CDriver setup.exe
[2008/11/16 19:18:38 | 000,053,248 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\FLVExtract.exe
[2010/10/19 16:00:08 | 000,294,912 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\gmer.exe
[2010/09/27 15:04:50 | 014,912,840 | ---- | M] (HamsterSoft, Inc. ) -- C:\Documents and Settings\Russell Chapman\Desktop\hamsterfreevideoconverter.exe
[2010/10/25 11:39:04 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\MBRCheck.exe
[2009/03/14 17:14:44 | 000,387,584 | ---- | M] (Jacek Pazera) -- C:\Documents and Settings\Russell Chapman\Desktop\mp4toavi.exe
[2010/06/02 20:29:23 | 003,189,496 | ---- | M] ( ) -- C:\Documents and Settings\Russell Chapman\Desktop\MPC-HomeCinema.1.3.1249.0.(x86).exe
[2007/07/14 09:38:38 | 000,875,008 | ---- | M] () -- C:\Documents and Settings\Russell Chapman\Desktop\MultiCalc.exe
[2010/10/25 11:39:32 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Russell Chapman\Desktop\OTL.exe
[2009/07/02 14:33:38 | 000,265,216 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Russell Chapman\Desktop\TFC.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< >

< fashion & modeling forum >

< %USERPROFILE%\Favorites\*.url /x >
[2009/07/23 07:37:04 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Russell Chapman\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/10/25 12:00:31 | 000,032,768 | -HS- | M] () -- C:\Documents and Settings\Russell Chapman\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/14 05:41:52 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 01:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 01:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 22:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 23:00:30 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/14 05:42:30 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2007/04/02 23:37:24 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2007/04/02 23:37:24 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2007/04/02 23:37:26 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2009/08/18 22:20:59 | 000,005,120 | -HS- | M] () -- C:\Program Files\Messenger\Thumbs.db
[2004/08/04 01:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 01:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\cmldr:SummaryInformation
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:83EFE2BCDD2D383D
@Alternate Data Stream - 163 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:264B2CC4
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FB1B13D8

< End of report >

**xero** · 25-10-2010