1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Virus Problem (Black Internet rootkit)

Discussion in 'Malware and Virus Removal Archive' started by Pete, 2010/06/20.

  1. 2010/06/20
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    [Resolved] Virus Problem (Black Internet rootkit)

    Hello.

    I am having multiple iexplore.exe processes ( 2-5 ) running in the background and when i kill the processes, they come back up.
    Internet explorer is clearly not open and i never use it - ive always used firefox.
    Sometimes i get IE popups with ads, and other times I hear sounds/ commercials etc. without the popups and the only way to stop it is to kill the iexplore.exe process.

    I've ran CCleaner and the reg cleaner that comes with it.
    I've updated and did a full scan by Spybot S&D, Super antispyware and anti-malware bytes. Only superantispyware showed up with an Ad tracking cookie and it was removed, but the problem still persists.

    I've not been able to do my windows updates for a while i think like 20 updates because installation always fails for some reason and I could never find a solution. This was before my system got infected.

    By the way, I "m running Windows XP Professional 32 bit with SP3.

    Any input would be great appreciated !
    Thank you for your time.


    I am posting my DDS and Attach text files.



    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Pete at 20:17:59.87 on Sun 06/20/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1303 [GMT -4:00]


    ============== Running Processes ===============

    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\DAEMON Tools Lite\DTLite.exe
    C:\Program Files\Stardock\CursorFX\CursorFX.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
    C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Pete\Desktop\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    mWinlogon: UIHost=c:\documents and settings\all users\application data\tuneup software\tuneup utilities\winstyler\tu_logonui.exe
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: FGCatchUrl: {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - c:\program files\flashget\jccatch.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\mi1933~1\office14\GROOVEEX.DLL
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\mi1933~1\office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - c:\program files\flashget\getflash.dll
    uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe
    uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
    uRun: [CursorFX] "c:\program files\stardock\cursorfx\CursorFX.exe "
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [WD Drive Manager] c:\program files\western digital\wd drive manager\WDBtnMgrUI.exe
    mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
    mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
    StartupFolder: c:\docume~1\pete\startm~1\programs\startup\mozill~1.lnk - c:\program files\mozilla firefox\firefox.exe
    uPolicies-explorer: NoWinKeys = 1 (0x1)
    IE: &Download All with FlashGet - c:\program files\flashget\jc_all.htm
    IE: &Download with FlashGet - c:\program files\flashget\jc_link.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\mi1933~1\office14\ONBttnIE.dll/105
    IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
    IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe
    IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\pete\start menu\programs\imvu\Run IMVU.lnk
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
    Trusted Zone: microsoft.com
    Trusted Zone: microsoft.com\*.windowsupdate
    Trusted Zone: windowsupdate.com\download
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266743745718
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1259328307765
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\mi1933~1\office14\GROOVEEX.DLL
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    Hosts: 127.0.0.1 www.spywareinfo.com

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\pete\applic~1\mozilla\firefox\profiles\vyo3zjh0.default\
    FF - prefs.js: browser.startup.homepage - www.google.com/ncr
    FF - component: c:\documents and settings\pete\application data\mozilla\firefox\profiles\vyo3zjh0.default\extensions\cfxhelper@triton\components\dwmxpcom.dll
    FF - plugin: c:\progra~1\mi1933~1\office14\NPAUTHZ.DLL
    FF - plugin: c:\progra~1\mi1933~1\office14\NPSPWRAP.DLL
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npRLCT4Player.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: nglayout.initialpaint.delay - 600
    FF - user.js: content.notify.interval - 600000
    FF - user.js: content.max.tokenizing.time - 1800000
    FF - user.js: content.switch.threshold - 600000
    FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

    ============= SERVICES / DRIVERS ===============

    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-1-5 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-1-5 67656]
    R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2010-2-25 1047880]
    R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\western digital\wd drive manager\WDBtnMgrSvc.exe [2009-6-26 102400]
    R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
    S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2009-6-30 17408]
    S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2009-9-26 4639136]
    S3 ProtoWall;ProtoWall Network Service;c:\windows\system32\drivers\protowall.sys --> c:\windows\system32\drivers\ProtoWall.sys [?]
    S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-1-5 12872]
    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2009-10-23 11520]
    S4 ACTIVEWEBCAMWATCHDOG;Active WebCam Watchdog;c:\program files\active webcam\Watchdog.exe [2009-11-30 580608]
    S4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2009-10-29 30603640]
    S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

    =============== Created Last 30 ================

    2010-06-20 16:02:43 0 d-----w- c:\program files\Trend Micro
    2010-06-20 07:38:52 0 d-----w- C:\ComboFix
    2010-06-18 21:56:21 77312 ----a-w- c:\windows\MBR.exe
    2010-06-18 21:56:20 256512 ----a-w- c:\windows\PEV.exe
    2010-06-18 19:37:32 0 d-----w- c:\docume~1\pete\applic~1\Malwarebytes
    2010-06-18 19:37:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-06-18 19:37:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-06-18 19:37:19 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-05-31 23:49:40 0 d-----w- c:\program files\StreamTorrent 1.0
    2010-05-31 23:49:40 0 d-----w- c:\docume~1\pete\applic~1\StreamTorrent
    2010-05-28 01:22:09 0 d-----w- c:\docume~1\alluse~1\applic~1\RosettaStoneLtdBackup
    2010-05-26 23:16:35 0 d-----w- c:\docume~1\pete\applic~1\Canneverbe Limited

    ==================== Find3M ====================

    2010-06-17 22:29:44 134696 ----a-w- c:\windows\system32\nvModes.dat
    2010-06-15 02:09:14 2286080 ----a-w- c:\windows\system32\TUKernel.exe
    2009-05-22 09:22:40 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009052220090523\index.dat

    ============= FINISH: 20:18:45.62 ===============
     
    Pete,
    #1
  2. 2010/06/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    With IE8, two instances of iexplore.exe opens by default. Every opened tab will add another instance, but we can surely check, if your computer is clean.

    I still need Attach.txt log.
     

  3. to hide this advert.

  4. 2010/06/20
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    the Attach text file - >


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 5/22/2009 5:21:01 AM
    System Uptime: 6/20/2010 6:36:01 PM (2 hours ago)

    Motherboard: Dell Inc. | | 0UK437
    Processor: Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz | Microprocessor | 1828/166mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 50 GiB total, 9.353 GiB free.
    D: is FIXED (NTFS) - 62 GiB total, 35.407 GiB free.
    E: is CDROM ()
    F: is CDROM ()

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Broadcom 440x 10/100 Integrated Controller
    Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_01F21028&REV_02\4&28D6DE3B&0&00F0
    Manufacturer: Broadcom
    Name: Broadcom 440x 10/100 Integrated Controller
    PNP Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_01F21028&REV_02\4&28D6DE3B&0&00F0
    Service: bcm4sbxp

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: 1394 Net Adapter
    Device ID: V1394\NIC1394\3573C9A1384FC000
    Manufacturer: Microsoft
    Name: 1394 Net Adapter
    PNP Device ID: V1394\NIC1394\3573C9A1384FC000
    Service: NIC1394

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Bluetooth LAN Access Server Driver
    Device ID: {95C7A0A0-3094-11D7-A202-00508B9D7D5A}\BTWDNDIS\1&15C89552&0&1000000020000
    Manufacturer: Broadcom
    Name: Bluetooth LAN Access Server Driver
    PNP Device ID: {95C7A0A0-3094-11D7-A202-00508B9D7D5A}\BTWDNDIS\1&15C89552&0&1000000020000
    Service: BTWDNDIS

    ==== System Restore Points ===================

    RP245: 5/29/2010 12:04:22 AM - System Checkpoint
    RP246: 5/30/2010 6:20:03 PM - System Checkpoint
    RP247: 5/31/2010 9:26:32 PM - System Checkpoint
    RP248: 6/2/2010 1:24:25 PM - System Checkpoint
    RP249: 6/3/2010 9:17:04 PM - System Checkpoint
    RP250: 6/5/2010 12:14:36 AM - System Checkpoint
    RP251: 6/6/2010 2:07:50 AM - System Checkpoint
    RP252: 6/7/2010 3:49:17 AM - System Checkpoint
    RP253: 6/8/2010 12:46:36 PM - System Checkpoint
    RP254: 6/9/2010 4:54:19 PM - System Checkpoint
    RP255: 6/10/2010 5:40:52 PM - System Checkpoint
    RP256: 6/11/2010 5:53:13 PM - System Checkpoint
    RP257: 6/13/2010 12:48:09 PM - System Checkpoint
    RP258: 6/14/2010 2:11:43 PM - System Checkpoint
    RP259: 6/15/2010 7:55:43 PM - System Checkpoint
    RP260: 6/16/2010 2:57:35 PM - Removed A.V.A
    RP261: 6/16/2010 3:10:20 PM - Removed ijji REACTOR
    RP262: 6/17/2010 8:48:45 PM - System Checkpoint
    RP263: 6/18/2010 5:24:34 PM - Software Distribution Service 3.0
    RP264: 6/18/2010 5:26:33 PM - Software Distribution Service 3.0
    RP265: 6/19/2010 8:27:57 PM - Infected
    RP266: 6/20/2010 7:34:16 PM - Configured SigmaTel Audio
    RP267: 6/20/2010 7:36:24 PM - Configured SigmaTel Audio

    ==== Installed Programs ======================

    µTorrent
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.3.2
    Adobe Shockwave Player 11.5
    Advanced Audio FX Engine
    Advanced Video FX Engine
    AIM 7
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    B.I.S.S. Hosts Manager
    BLM 2.7.7
    Bonjour
    CCleaner
    CDBurnerXP
    Chinese Traditional Fonts Support For Adobe Reader 9
    Choice Guard
    Critical Update for Windows Media Player 11 (KB959772)
    Data Lifeguard Diagnostic for Windows
    DELL Webcam Center
    DELL Webcam Manager
    Digital Line Detect
    EVEREST Ultimate Edition v5.01
    FEAR
    FEAR Extraction Point
    FEAR Perseus Mandate
    FlashGet 1.9.6.1073
    FlashMute
    Fraps
    Google Earth Pro 4.2
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB942288-v3)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    ImgBurn
    Intel(R) PROSet/Wireless Software
    Intel® Matrix Storage Manager
    iOpus Password Recovery XP
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 18
    K-Lite Codec Pack 5.4.4 (Full)
    Laptop Integrated Webcam Driver (1.04.01.1011)
    LimeWire PRO 5.4.7
    Malwarebytes' Anti-Malware
    mDriver
    MediaMonkey 3.2
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB953297)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Games for Windows - LIVE
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Office Access MUI (English) 2010 (Beta)
    Microsoft Office Access Setup Metadata MUI (English) 2010 (Beta)
    Microsoft Office Excel MUI (English) 2010 (Beta)
    Microsoft Office Groove MUI (English) 2010 (Beta)
    Microsoft Office InfoPath MUI (English) 2010 (Beta)
    Microsoft Office Live Add-in 1.4
    Microsoft Office OneNote MUI (English) 2010 (Beta)
    Microsoft Office Outlook MUI (English) 2010 (Beta)
    Microsoft Office PowerPoint MUI (English) 2010 (Beta)
    Microsoft Office Professional Plus 2010
    Microsoft Office Professional Plus 2010 (Beta)
    Microsoft Office Proof (English) 2010 (Beta)
    Microsoft Office Proof (French) 2010 (Beta)
    Microsoft Office Proof (Spanish) 2010 (Beta)
    Microsoft Office Proofing (English) 2010 (Beta)
    Microsoft Office Publisher MUI (English) 2010 (Beta)
    Microsoft Office Send-a-Smile
    Microsoft Office Shared MUI (English) 2010 (Beta)
    Microsoft Office Shared Setup Metadata MUI (English) 2010 (Beta)
    Microsoft Office Word MUI (English) 2010 (Beta)
    Microsoft Silverlight
    Microsoft Software Update for Web Folders (English) 14 (Beta)
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Mozilla Firefox (3.6.3)
    MSVCRT
    NVIDIA Drivers
    NVIDIA PhysX
    OGA Notifier 2.0.0048.0
    Orca
    PeerGuardian 2.0
    PowerISO
    PunkBuster Services
    QuickTime
    Rosetta Stone Version 3
    Security Update for Microsoft Office 2010 File Validation - Beta (KB976133)
    Security Update for Windows Internet Explorer 7 (KB938127-v2)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371-v2)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165-v2)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980232)
    Segoe UI
    SigmaTel Audio
    Spybot - Search & Destroy
    StreamTorrent 1.0
    SUPERAntiSpyware Free Edition
    System Requirements Lab
    TeamSpeak 2 RC2
    TeamViewer 5
    TouchChip USB Driver 2.9
    Tunatic
    TuneUp Utilities
    TuneUp Utilities Language Pack (en-US)
    Ubisoft Game Launcher
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Windows (KB971513)
    Update for Windows Internet Explorer 8 (KB969497)
    Update for Windows Internet Explorer 8 (KB972636)
    Update for Windows Internet Explorer 8 (KB975364)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB943729)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Ventrilo Client
    VLC media player 1.0.5
    WD Drive Manager (x86)
    WebFldrs XP
    WIDCOMM Bluetooth Software
    Winamp
    Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04)
    Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows PowerShell(TM) 1.0
    Windows PowerShell(TM) 1.0 MUI pack
    WinRAR archiver
    Yahoo! Messenger

    ==== Event Viewer Messages From Past Week ========

    6/19/2010 8:30:35 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL SCDEmu sptd Tcpip
    6/19/2010 8:30:35 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    6/19/2010 8:30:35 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    6/19/2010 8:30:35 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/19/2010 8:29:53 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MDM with arguments " " in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
    6/19/2010 8:29:11 PM, error: sptd [4] - Driver detected an internal error in its data structures for .
    6/18/2010 5:21:43 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    6/18/2010 5:16:12 PM, error: Sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
    6/18/2010 3:35:40 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
    6/18/2010 3:28:27 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Live ID Sign-in Assistant service, but this action failed with the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    6/18/2010 3:28:17 PM, error: Service Control Manager [7031] - The Windows Live ID Sign-in Assistant service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
    6/18/2010 3:28:11 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
    6/18/2010 3:25:46 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
    6/13/2010 12:09:33 PM, error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.1.3 with the system having network hardware address 04:1E:64:27:49:DD. Network operations on this system may be disrupted as a result.
    6/13/2010 11:57:27 AM, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 001DE072E4AF has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

    ==== End Of File ===========================
     
    Pete,
    #3
  5. 2010/06/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I don't see any AV program running.
    Please, download and install ONE of these:
    - Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html
    - Avira free antivirus: http://www.free-av.com/en/download/1/avira_antivir_personal__free_antivirus.html
    After installation, run full scan.

    When done...

    STEP 1. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform Quick Scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 2. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    Do NOT use the computer while GMER is running!
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log to your next reply.

    IMPORTANT! If for some reason GMER refuses to run, try again.
    If it still fails, try to UN-check "Devices" in right pane.
    If still no joy, try to run it from Safe Mode.

    RESTART COMPUTER


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  6. 2010/06/20
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Btw, I dont have any IE browser open.

    I use only Mozilla firefox.
     
    Pete,
    #5
  7. 2010/06/20
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Thank you for your prompt reply !

    I will follow your steps and post with updates.
     
    Pete,
    #6
  8. 2010/06/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Ok :)
     
  9. 2010/06/21
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Avast! updated and full scan Results :

    http://i50.tinypic.com/r8chn7.jpg

    Malwarebytes' Anti-Malware quick scan : nothing found

    Log :
    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4219

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    6/20/2010 10:33:40 PM
    mbam-log-2010-06-20 (22-33-40).txt

    Scan type: Quick scan
    Objects scanned: 134900
    Time elapsed: 5 minute(s), 36 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    GMer rootkit scan, log :

    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit scan 2010-06-21 00:55:17
    Windows 5.1.2600 Service Pack 3
    Running: 5bsjy38k.exe; Driver: C:\DOCUME~1\Pete\LOCALS~1\Temp\kgliquow.sys


    ---- System - GMER 1.0.15 ----

    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xADFFBC7A]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xADFFBB36]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xADFFC0EA]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xADFFC014]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xADFFB70C]
    SSDT spsv.sys ZwEnumerateKey [0xF74FCDA4]
    SSDT spsv.sys ZwEnumerateValueKey [0xF74FD132]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xADFFBC10]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xADFFB64C]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xADFFB6B0]
    SSDT spsv.sys ZwQueryKey [0xF74FD20A]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xADFFBD30]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xADFFC1B8]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xADFFBCF0]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xADFFBE70]

    INT 0x62 ? 8A59FBF8
    INT 0x63 ? 8A60EBF8
    INT 0x94 ? 89A6CBF8
    INT 0xA4 ? 89A6CBF8
    INT 0xA4 ? 89A6CBF8
    INT 0xA4 ? 89A6CBF8
    INT 0xB4 ? 89A6CBF8
    INT 0xB4 ? 89A6CBF8
    INT 0xB4 ? 89A6CBF8
    INT 0xB4 ? 89A6CBF8

    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xAE008AC6]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xAE0088EA]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xAE008A24]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

    ---- Kernel code sections - GMER 1.0.15 ----

    .text TUKERNEL.EXE!ZwYieldExecution + 172 804E49CC 4 Bytes JMP 31ADFFC0
    PAGE TUKERNEL.EXE!ObInsertObject 8056DA64 5 Bytes JMP AE005EC2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    PAGE TUKERNEL.EXE!NtCreateSection 8056DB66 7 Bytes JMP AE0088EE \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    PAGE TUKERNEL.EXE!ZwCreateProcessEx 8059056D 7 Bytes JMP AE008ACA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    PAGE TUKERNEL.EXE!ZwLoadDriver 805AEDE2 7 Bytes JMP AE008A28 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    PAGE TUKERNEL.EXE!ObMakeTemporaryObject 805E74E6 5 Bytes JMP AE004536 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    ? spsv.sys The system cannot find the file specified. !
    .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB5EEC360, 0x3CEED5, 0xE8000020]
    .text USBPORT.SYS!DllUnload B5ECC8AC 5 Bytes JMP 89A6C1D8
    .text a5knqm0q.SYS B5B95386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
    .text a5knqm0q.SYS B5B953AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
    .text a5knqm0q.SYS B5B953C4 3 Bytes [00, 80, 02]
    .text a5knqm0q.SYS B5B953C9 1 Byte [30]
    .text a5knqm0q.SYS B5B953C9 11 Bytes [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
    .text ...

    ---- User code sections - GMER 1.0.15 ----

    .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[380] USER32.dll!SetWindowPos 7E4299F3 5 Bytes JMP 10001040 C:\Program Files\Stardock\CursorFX\CurXP0.dll (CursorFX support DLL/ )
    .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[380] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 100011E0 C:\Program Files\Stardock\CursorFX\CurXP0.dll (CursorFX support DLL/ )
    .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[380] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 10001120 C:\Program Files\Stardock\CursorFX\CurXP0.dll (CursorFX support DLL/ )
    .text C:\WINDOWS\Explorer.EXE[1652] USER32.dll!SetWindowPos 7E4299F3 5 Bytes JMP 01D61040 C:\Program Files\Stardock\CursorFX\CurXP0.dll (CursorFX support DLL/ )
    .text C:\WINDOWS\Explorer.EXE[1652] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 01D611E0 C:\Program Files\Stardock\CursorFX\CurXP0.dll (CursorFX support DLL/ )
    .text C:\WINDOWS\Explorer.EXE[1652] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 01D61120 C:\Program Files\Stardock\CursorFX\CurXP0.dll (CursorFX support DLL/ )
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2124] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2124] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2124] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2124] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2124] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2124] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2124] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2124] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2124] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD101 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2EDB20 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4AA7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Documents and Settings\Pete\Desktop\Downloads\5bsjy38k.exe[4004] USER32.dll!SetWindowPos 7E4299F3 5 Bytes JMP 10001040 C:\Program Files\Stardock\CursorFX\CurXP0.dll (CursorFX support DLL/ )
    .text C:\Documents and Settings\Pete\Desktop\Downloads\5bsjy38k.exe[4004] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 100011E0 C:\Program Files\Stardock\CursorFX\CurXP0.dll (CursorFX support DLL/ )
    .text C:\Documents and Settings\Pete\Desktop\Downloads\5bsjy38k.exe[4004] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 10001120 C:\Program Files\Stardock\CursorFX\CurXP0.dll (CursorFX support DLL/ )

    ---- Kernel IAT/EAT - GMER 1.0.15 ----

    IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F74E5042] spsv.sys
    IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F74E513E] spsv.sys
    IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F74E50C0] spsv.sys
    IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F74E5800] spsv.sys
    IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F74E56D6] spsv.sys
    IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F74F4B90] spsv.sys
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!KfAcquireSpinLock] 18C4830E
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!READ_PORT_UCHAR] 1C959E88
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!KeGetCurrentIrql] 9E880000
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!KfRaiseIrql] 00001CB1
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!KfLowerIrql] 0E798366
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!HalGetInterruptVector] 74AAB000
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!HalTranslateBusAddress] 8986C636
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!KeStallExecutionProcessor] 1A00001C
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!KfReleaseSpinLock] 1C8B86C6
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] C6020000
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!READ_PORT_USHORT] 001C9686
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 86C60200
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[HAL.dll!WRITE_PORT_UCHAR] 00001CB2
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[WMILIB.SYS!WmiSystemControl] 8800001C
    IAT \SystemRoot\System32\Drivers\a5knqm0q.SYS[WMILIB.SYS!WmiCompleteRequest] 001CB99E

    ---- User IAT/EAT - GMER 1.0.15 ----

    IAT C:\WINDOWS\system32\services.exe[1372] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00390002
    IAT C:\WINDOWS\system32\services.exe[1372] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00390000
    IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[2260] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)
    Device \FileSystem\Ntfs \Ntfs 8A60D1F8

    AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
    AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

    Device \Driver\usbuhci \Device\USBPDO-0 8999D1F8
    Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A60F1F8
    Device \Driver\dmio \Device\DmControl\DmConfig 8A60F1F8
    Device \Driver\dmio \Device\DmControl\DmPnP 8A60F1F8
    Device \Driver\dmio \Device\DmControl\DmInfo 8A60F1F8
    Device \Driver\usbuhci \Device\USBPDO-1 8999D1F8
    Device \Driver\usbehci \Device\USBPDO-2 89A601F8
    Device \Driver\usbuhci \Device\USBPDO-3 8999D1F8
    Device \Driver\usbuhci \Device\USBPDO-4 8999D1F8

    AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

    Device \Driver\usbuhci \Device\USBPDO-5 8999D1F8
    Device \Driver\usbehci \Device\USBPDO-6 89A601F8
    Device \Driver\Ftdisk \Device\HarddiskVolume1 8A5A01F8
    Device \Driver\Ftdisk \Device\HarddiskVolume2 8A5A01F8
    Device \Driver\Cdrom \Device\CdRom0 89A271F8
    Device \Driver\PCI_PNP2624 \Device\00000059 spsv.sys
    Device \Driver\PCI_PNP2624 \Device\00000059 spsv.sys
    Device \Driver\iaStor \Device\Ide\iaStor0 [F7B4F360] iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdePort0 [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\iaStor \Device\Ide\IAAStorageDevice-0 [F7B4F360] iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\Cdrom \Device\CdRom1 89A271F8
    Device \Driver\NetBT \Device\NetBt_Wins_Export 869251F8
    Device \Driver\NetBT \Device\NetbiosSmb 869251F8
    Device \Driver\sptd \Device\2027576374 spsv.sys

    AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
    AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

    Device \Driver\NetBT \Device\NetBT_Tcpip_{94A9EEEA-CECB-478B-9120-CFB9A709BB24} 869251F8
    Device \Driver\usbuhci \Device\USBFDO-0 8999D1F8
    Device \Driver\usbuhci \Device\USBFDO-1 8999D1F8
    Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 864BD500
    Device \Driver\usbehci \Device\USBFDO-2 89A601F8
    Device \FileSystem\MRxSmb \Device\LanmanRedirector 864BD500
    Device \Driver\usbuhci \Device\USBFDO-3 8999D1F8
    Device \Driver\usbuhci \Device\USBFDO-4 8999D1F8
    Device \Driver\Ftdisk \Device\FtControl 8A5A01F8
    Device \Driver\usbuhci \Device\USBFDO-5 8999D1F8
    Device \Driver\usbehci \Device\USBFDO-6 89A601F8
    Device \Driver\a5knqm0q \Device\Scsi\a5knqm0q1Port2Path0Target0Lun0 89A161F8
    Device \Driver\a5knqm0q \Device\Scsi\a5knqm0q1 89A161F8
    Device \FileSystem\Cdfs \Cdfs 896EC368

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x0C 0xEE 0x3C 0xDF ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x95 0xF3 0x40 0x9F ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x8A 0x18 0x9B 0xCC ...
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x0C 0xEE 0x3C 0xDF ...
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x95 0xF3 0x40 0x9F ...
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x8A 0x18 0x9B 0xCC ...

    ---- Files - GMER 1.0.15 ----

    File C:\WINDOWS\Temp\fla28.tmp 1112073 bytes

    ---- EOF - GMER 1.0.15 ----


    Note :
    System froze during the first time i attempted the scan. ( never touched the computer)
    Forced reboot, then started scan again.
    Right after I saved the file, system crashed again. and I noticed lsass.exe taking up 55 % CPU and Avast! 40 % ,
    Could not shut down, forced reboot again. Now its fine.

    My system usually never crashes.

    Thank you for your time :)
     
    Pete,
    #8
  10. 2010/06/21
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Another Note :

    Around the same time my system got infected, I noticed that the "wave volume" in my native volume control/mixer automatically turns down every now and then and I have to turn it back on to be able to listen anything. Sometimes it happens every 1 minute.

    I've tried uninstalling and reinstalling drivers but it did not help. I dont know if these problems are connected. This has never happened to be before. I have an inbuilt sound card on my laptop btw.
     
    Pete,
    #9
  11. 2010/06/21
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    GMER is rather powerful scanner, so sometimes, some odd things happen.
    As for your other issue, as I warned you at the beginning, don't try to fix anything else until your computer is declared clean, please.


    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    [color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • [color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  12. 2010/06/22
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Last edited: 2010/06/22
  13. 2010/06/22
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, paste Combofix log into your reply.
     
  14. 2010/06/22
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    ComboFix 10-06-21.01 - Pete 06/22/2010 1:13.5.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1508 [GMT -4:00]
    Running from: c:\documents and settings\Pete\Desktop\ComboFix.exe
    AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\st325602.dll

    .
    ((((((((((((((((((((((((( Files Created from 2010-05-22 to 2010-06-22 )))))))))))))))))))))))))))))))
    .

    2010-06-21 01:34 . 2010-05-06 20:39 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2010-06-21 01:34 . 2010-05-06 20:39 164048 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2010-06-21 01:34 . 2010-05-06 20:34 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2010-06-21 01:34 . 2010-05-06 20:33 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2010-06-21 01:34 . 2010-05-06 20:33 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2010-06-21 01:34 . 2010-05-06 20:33 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2010-06-21 01:34 . 2010-05-06 20:33 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2010-06-21 01:34 . 2010-05-06 20:59 38848 ----a-w- c:\windows\system32\avastSS.scr
    2010-06-21 01:34 . 2010-05-06 20:59 165032 ----a-w- c:\windows\system32\aswBoot.exe
    2010-06-21 01:34 . 2010-06-21 01:34 -------- d-----w- c:\program files\Alwil Software
    2010-06-21 01:34 . 2010-06-21 01:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
    2010-06-20 16:02 . 2010-06-20 16:02 -------- d-----w- c:\program files\Trend Micro
    2010-06-20 07:18 . 2010-06-20 07:18 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Adobe
    2010-06-20 01:36 . 2010-06-20 01:36 -------- d-----w- c:\documents and settings\Pete\Local Settings\Application Data\Deployment
    2010-06-18 21:25 . 2010-06-18 21:25 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
    2010-06-18 19:37 . 2010-06-18 19:37 -------- d-----w- c:\documents and settings\Pete\Application Data\Malwarebytes
    2010-06-18 19:37 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-06-18 19:37 . 2010-06-18 19:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-06-18 19:37 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-06-18 19:33 . 2010-06-18 19:33 63488 ----a-w- c:\documents and settings\Pete\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
    2010-06-18 16:43 . 2010-06-18 16:43 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
    2010-06-18 08:40 . 2010-06-18 08:40 198056 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
    2010-06-17 21:55 . 2010-06-17 22:16 -------- d-----w- c:\documents and settings\Pete\Local Settings\Application Data\Painkiller Resurrection
    2010-05-31 23:49 . 2010-05-31 23:49 -------- d-----w- c:\program files\StreamTorrent 1.0
    2010-05-31 23:49 . 2010-05-31 23:49 -------- d-----w- c:\documents and settings\Pete\Application Data\StreamTorrent
    2010-05-28 04:50 . 2010-06-21 05:38 -------- d-----w- c:\documents and settings\Pete\Application Data\vlc
    2010-05-28 01:27 . 2010-05-28 01:27 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
    2010-05-28 01:22 . 2010-05-28 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\RosettaStoneLtdBackup
    2010-05-26 23:16 . 2010-05-26 23:16 -------- d-----w- c:\documents and settings\Pete\Application Data\Canneverbe Limited

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-06-22 05:02 . 2009-05-23 01:49 -------- d-----w- c:\program files\PeerGuardian2
    2010-06-20 16:08 . 2009-12-07 12:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-06-20 02:59 . 2009-05-23 01:49 -------- d-----w- c:\program files\uTorrent
    2010-06-20 02:35 . 2009-05-23 01:48 -------- d-----w- c:\documents and settings\Pete\Application Data\uTorrent
    2010-06-20 02:22 . 2009-07-12 08:50 -------- d-----w- c:\documents and settings\Pete\Application Data\Media Player Classic
    2010-06-20 02:22 . 2010-04-18 17:56 -------- d-----w- c:\program files\CCleaner
    2010-06-20 00:11 . 2009-05-25 01:05 188152 ----a-w- c:\documents and settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\FlashGot.exe
    2010-06-18 21:33 . 2009-08-24 05:09 -------- d-----w- c:\program files\Microsoft Silverlight
    2010-06-18 19:33 . 2010-01-20 04:13 117760 ----a-w- c:\documents and settings\Pete\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2010-06-18 19:32 . 2009-12-07 12:34 -------- d-----w- c:\program files\SUPERAntiSpyware
    2010-06-17 22:29 . 2009-06-25 22:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-06-17 22:29 . 2009-05-22 22:12 134696 ----a-w- c:\windows\system32\nvModes.dat
    2010-06-16 19:10 . 2009-05-23 00:17 -------- d--h--w- c:\program files\InstallShield Installation Information
    2010-06-15 02:13 . 2009-07-07 06:39 5580288 ----a-w- c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
    2010-06-15 02:09 . 2009-07-07 05:55 2286080 ----a-w- c:\windows\system32\TUKernel.exe
    2010-06-02 19:21 . 2009-05-22 22:27 -------- d-----w- c:\program files\FlashGet
    2010-05-28 16:35 . 2009-10-29 20:58 -------- d-----w- c:\program files\CDBurnerXP
    2010-05-28 01:47 . 2009-09-25 15:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Rosetta Stone
    2010-05-13 05:10 . 2010-05-13 05:10 -------- d-----w- c:\program files\Ubisoft
    2010-04-30 00:50 . 2009-05-30 22:56 -------- d-----w- c:\documents and settings\Pete\Application Data\TeamViewer
    2010-04-29 03:34 . 2010-04-29 03:34 -------- d-----w- c:\program files\Tunatic
    2010-04-08 23:24 . 2009-05-22 23:06 95800 ----a-w- c:\documents and settings\Pete\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2006-06-16 03:33 . 2009-05-23 00:21 233472 ----a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
    2006-05-26 01:43 . 2009-05-23 00:20 204895 ----a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
    2005-09-29 21:41 . 2009-05-23 00:21 77824 ----a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
    2006-06-19 20:10 . 2009-05-23 00:20 426081 ----a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
    2005-02-02 19:19 . 2009-05-23 00:20 458752 ----a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
    2006-04-11 01:35 . 2009-05-23 00:21 139264 ----a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
    2005-11-09 18:10 . 2009-05-23 00:20 204800 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
    2005-11-09 18:42 . 2009-05-23 00:20 106496 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
    2006-01-04 18:22 . 2009-05-23 00:20 212992 ----a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
    2006-01-04 18:21 . 2009-05-23 00:20 167936 ----a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
    .

    ------- Sigcheck -------

    [-] 2009-05-22 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
    .
    ((((((((((((((((((((((((((((( SnapShot@2010-06-20_07.45.45 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-07-12 04:02 . 2009-07-12 04:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
    - 2009-07-12 05:05 . 2009-07-12 05:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
    + 2009-07-12 04:05 . 2009-07-12 04:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
    - 2009-07-12 05:05 . 2009-07-12 05:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
    + 2009-07-12 04:05 . 2009-07-12 04:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
    + 2001-08-23 11:00 . 2010-06-22 05:12 72248 c:\windows\system32\perfc009.dat
    - 2001-08-23 11:00 . 2010-06-20 07:42 72248 c:\windows\system32\perfc009.dat
    - 2008-04-14 00:15 . 2008-04-14 07:15 49408 c:\windows\system32\drivers\stream.sys
    + 2008-04-14 00:15 . 2008-04-14 04:15 49408 c:\windows\system32\drivers\stream.sys
    - 2009-05-22 23:34 . 2008-04-14 07:15 60160 c:\windows\system32\drivers\drmk.sys
    + 2009-05-22 23:34 . 2008-04-14 04:15 60160 c:\windows\system32\drivers\drmk.sys
    - 2008-04-14 00:15 . 2008-04-14 07:15 49408 c:\windows\system32\dllcache\stream.sys
    + 2008-04-14 00:15 . 2008-04-14 04:15 49408 c:\windows\system32\dllcache\stream.sys
    + 2009-05-22 23:34 . 2008-04-14 04:15 60160 c:\windows\system32\dllcache\drmk.sys
    - 2009-05-22 23:34 . 2008-04-14 07:15 60160 c:\windows\system32\dllcache\drmk.sys
    + 2010-06-21 05:55 . 2010-06-21 06:28 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012010062120100622\index.dat
    + 2010-06-21 05:55 . 2010-06-21 05:55 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012010061420100621\index.dat
    + 2010-06-20 15:46 . 2010-06-20 22:12 50176 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{F88B4A3B-7C82-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:37 . 2010-06-21 02:48 10752 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{EA84D15A-7CDD-11DF-9221-001DE072E4AF}.dat
    + 2010-06-22 05:13 . 2010-06-22 05:18 12288 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{E8705EAE-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-21 18:00 . 2010-06-22 02:49 44544 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{DE7ED5BD-7D5E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 02:51 . 2010-06-21 05:02 13312 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{DCFFFA62-7CDF-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 05:04 . 2010-06-21 06:54 15872 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{7FA4D829-7CF2-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 22:37 . 2010-06-21 02:35 25088 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{596445A9-7CBC-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 07:40 . 2010-06-20 08:54 18432 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{1E49D70A-7C3F-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 23:46 . 2010-06-20 23:50 89088 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{FE3E77B5-7CC5-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 19:55 . 2010-06-21 20:00 52736 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F9AA562F-7D6E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 19:41 . 2010-06-21 19:46 39936 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F8D787BF-7D6C-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 15:46 . 2010-06-20 15:50 60416 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F88B4A3D-7C82-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 20:32 . 2010-06-20 20:34 35328 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F7E548CD-7CAA-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 17:33 . 2010-06-20 17:38 41472 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F6BF7991-7C91-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 21:28 . 2010-06-21 21:32 41472 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F664D27B-7D7B-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 00:28 . 2010-06-21 00:31 86016 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F53D91E4-7CCB-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 01:04 . 2010-06-21 01:08 84992 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F02325A3-7CD0-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 20:39 . 2010-06-20 20:43 24576 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EFBADA3B-7CAB-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 04:17 . 2010-06-21 04:22 76288 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EF55468B-7CEB-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 22:55 . 2010-06-20 22:59 99840 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EE6F6535-7CBE-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 19:20 . 2010-06-20 19:22 16384 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EA87C182-7CA0-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 18:50 . 2010-06-21 18:55 61952 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E90F9C4D-7D65-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 04:03 . 2010-06-21 04:07 92160 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E8EE5785-7CE9-11DF-9222-001DE072E4AF}.dat
    + 2010-06-22 02:14 . 2010-06-22 02:19 96256 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E6A60D2D-7DA3-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 23:38 . 2010-06-20 23:41 69632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E5E3529E-7CC4-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 17:47 . 2010-06-20 17:51 64000 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E5C87C85-7C93-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 21:42 . 2010-06-21 21:46 52224 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E5880F4D-7D7D-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 05:50 . 2010-06-21 05:54 44032 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E4D5A207-7CF8-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 16:00 . 2010-06-20 16:02 55296 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E36108A0-7C84-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 05:36 . 2010-06-21 05:40 87040 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E1758F42-7CF6-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 19:19 . 2010-06-21 19:22 42496 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E0A3EB22-7D69-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 01:18 . 2010-06-21 01:22 95744 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DE8C6B09-7CD2-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 18:51 . 2010-06-20 18:52 64000 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DD071319-7C9C-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 01:25 . 2010-06-21 01:26 54784 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D95F4F51-7CD3-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 01:38 . 2010-06-22 01:42 82432 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D7D97826-7D9E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 02:42 . 2010-06-22 02:47 70144 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D74C8673-7DA7-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 01:24 . 2010-06-22 01:28 99840 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D670758F-7D9C-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 06:04 . 2010-06-21 06:08 99328 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D59090F7-7CFA-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 20:24 . 2010-06-20 20:26 73728 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D4E9C895-7CA9-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 22:46 . 2010-06-21 22:50 51200 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D4D75258-7D86-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:28 . 2010-06-20 16:30 41984 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D1E0C2AF-7C88-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 19:27 . 2010-06-20 19:31 77312 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D1ACDCF1-7CA1-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 16:35 . 2010-06-20 16:37 81408 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D143E73B-7C89-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 03:33 . 2010-06-21 03:38 65536 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D0DDFE6F-7CE5-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 17:11 . 2010-06-20 17:15 99328 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D0DB1C2A-7C8E-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 21:43 . 2010-06-20 21:47 80896 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CEE8B45E-7CB4-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 03:48 . 2010-06-21 03:53 65024 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CCD9060F-7CE7-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 20:37 . 2010-06-21 20:41 76800 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CC761BD9-7D74-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 20:23 . 2010-06-21 20:27 76800 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CB655045-7D72-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 18:15 . 2010-06-20 18:19 87552 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C7969167-7C97-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 00:33 . 2010-06-22 00:37 79360 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C5E50949-7D95-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 07:59 . 2010-06-20 08:03 87552 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C5D1926F-7C41-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 19:41 . 2010-06-20 19:45 71680 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C53EF91B-7CA3-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 06:18 . 2010-06-21 06:22 45568 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C5132BD9-7CFC-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 20:52 . 2010-06-20 20:57 64000 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C3FAF217-7CAD-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 23:00 . 2010-06-21 23:04 95744 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C3776DD5-7D88-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 03:19 . 2010-06-21 03:23 67584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C29609FD-7CE3-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 01:31 . 2010-06-21 01:36 76288 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C10529BB-7CD4-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 01:46 . 2010-06-21 01:50 76800 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BEF01A7A-7CD6-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 23:22 . 2010-06-20 23:27 33792 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BEA35DA3-7CC2-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 18:28 . 2010-06-21 18:32 74240 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BC5A058D-7D62-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 06:32 . 2010-06-21 06:36 88064 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BB2B6549-7CFE-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 23:28 . 2010-06-21 23:32 57856 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B65A1B7B-7D8C-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 08:13 . 2010-06-20 08:17 89088 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B33232CF-7C43-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 20:30 . 2010-06-20 20:32 26112 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B29167C5-7CAA-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 19:46 . 2010-06-21 19:50 87552 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AFCA79D7-7D6D-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 19:32 . 2010-06-21 19:36 59392 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AEC59A05-7D6B-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 08:56 . 2010-06-20 09:00 95744 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AD1DEF67-7C49-11DF-921E-001DE072E4AF}.dat
    + 2010-06-21 21:19 . 2010-06-21 21:23 79360 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AC6132DD-7D7A-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 19:54 . 2010-06-20 19:58 83968 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A6A0C4AB-7CA5-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 19:04 . 2010-06-20 19:08 32256 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A5C91521-7C9E-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:11 . 2010-06-22 05:13 69632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A5AC2452-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 23:50 . 2010-06-20 23:54 96256 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A3168E5D-7CC6-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 00:55 . 2010-06-21 00:59 73216 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A11F373B-7CCF-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 04:57 . 2010-06-22 05:01 75776 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9F027373-7DBA-11DF-9225-001DE072E4AF}.dat
    + 2010-06-21 20:00 . 2010-06-21 20:04 86016 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9EA16B69-7D6F-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 02:19 . 2010-06-22 02:23 66048 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9DBCC28B-7DA4-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:12 . 2010-06-20 16:16 37888 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9DB38DBC-7C86-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 17:38 . 2010-06-20 17:42 75776 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9BF22995-7C92-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 21:33 . 2010-06-21 21:37 54784 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9B54C0A7-7D7C-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 05:26 . 2010-06-21 05:31 57344 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{972806BF-7CF5-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 19:18 . 2010-06-20 19:20 27136 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{94BCA2EB-7CA0-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 00:04 . 2010-06-21 00:08 98304 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{914438F9-7CC8-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 04:07 . 2010-06-21 04:12 90624 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{903BDAFD-7CEA-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 20:22 . 2010-06-20 20:24 19968 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8FA1D34F-7CA9-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 19:09 . 2010-06-21 19:14 91648 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8F10560D-7D68-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 09:09 . 2010-06-20 09:13 89088 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8E599553-7C4B-11DF-921E-001DE072E4AF}.dat
    + 2010-06-21 20:14 . 2010-06-21 20:18 89088 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8E0C2EC8-7D71-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 18:55 . 2010-06-21 18:59 78336 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8E0913E1-7D66-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 02:33 . 2010-06-22 02:37 84992 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8D03C2A3-7DA6-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:26 . 2010-06-20 16:28 87040 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8C6DE315-7C88-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 21:47 . 2010-06-21 21:51 71168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8A9E2319-7D7E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 05:04 . 2010-06-21 05:08 57344 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{89225465-7CF2-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 17:01 . 2010-06-20 17:06 86528 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{878CAF44-7C8D-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 01:22 . 2010-06-21 01:25 94208 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{836BA8BF-7CD3-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 17:51 . 2010-06-20 17:55 77312 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7CF49715-7C94-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 02:47 . 2010-06-22 02:49 70144 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7C70E85B-7DA8-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 00:24 . 2010-06-22 00:28 63488 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7BAF5849-7D94-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 03:38 . 2010-06-21 03:43 69120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7B7C470F-7CE6-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 06:08 . 2010-06-21 06:13 48128 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7AC805AF-7CFB-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 02:55 . 2010-06-21 02:59 89600 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{75CD5075-7CE0-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 18:56 . 2010-06-20 18:58 16896 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7566BD04-7C9D-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 21:33 . 2010-06-20 21:37 96768 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{70C4DB07-7CB3-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 21:47 . 2010-06-20 21:52 79360 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{70988DDB-7CB5-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 18:19 . 2010-06-20 18:22 57856 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6CAA42D8-7C98-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 00:52 . 2010-06-22 00:56 87040 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6C831E3D-7D98-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 19:45 . 2010-06-20 19:49 47616 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A22FB85-7CA4-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 06:22 . 2010-06-21 06:27 81920 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A1D53E3-7CFD-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 18:48 . 2010-06-20 18:51 11776 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{69BF9F74-7C9C-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 01:36 . 2010-06-21 01:40 97792 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{68D5CE89-7CD5-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 20:57 . 2010-06-20 21:02 64000 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{68C97F57-7CAE-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 03:09 . 2010-06-21 03:14 68096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{68AEFE9B-7CE2-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 21:04 . 2010-06-20 21:06 94208 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6747C223-7CAF-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 19:22 . 2010-06-21 19:27 98304 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{646C25BF-7D6A-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:14 . 2010-06-21 22:18 63488 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6376A1C7-7D82-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 21:10 . 2010-06-21 21:14 75776 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{623C3253-7D79-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 18:32 . 2010-06-21 18:37 76800 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{618F17EB-7D63-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 20:55 . 2010-06-21 21:00 65536 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{60DA56CB-7D77-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 02:04 . 2010-06-21 02:09 88064 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5D6CCA85-7CD9-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 01:06 . 2010-06-22 01:10 99328 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5C166996-7D9A-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 05:18 . 2010-06-21 05:21 92672 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{59E6BCC6-7CF4-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 23:41 . 2010-06-20 23:45 97792 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{594C272F-7CC5-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 08:18 . 2010-06-20 08:22 94720 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{57EDAD3F-7C44-11DF-921D-001DE072E4AF}.dat
    + 2010-06-21 23:18 . 2010-06-21 23:23 92160 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{578A98D3-7D8B-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 00:45 . 2010-06-21 00:50 98304 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{57573267-7CCE-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 19:51 . 2010-06-21 19:55 45568 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{54D23F87-7D6E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 19:36 . 2010-06-21 19:41 88064 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{53B7EA8B-7D6C-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 06:50 . 2010-06-21 06:54 86016 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4EFE30C9-7D01-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 03:59 . 2010-06-21 04:02 67584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4EBDC30E-7CE9-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 19:59 . 2010-06-20 20:00 11264 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4B7678F9-7CA6-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 20:34 . 2010-06-20 20:39 73728 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4AE525ED-7CAB-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 21:25 . 2010-06-20 21:28 78336 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4832D7DE-7CB2-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 18:47 . 2010-06-20 18:48 14336 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{45B73542-7C9C-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 19:00 . 2010-06-21 19:04 69632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{44D37DFF-7D67-11DF-9224-001DE072E4AF}.dat
     
  15. 2010/06/22
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    + 2010-06-21 18:46 . 2010-06-21 18:50 95232 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{44293789-7D65-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 20:04 . 2010-06-21 20:09 32768 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{43DDA4D5-7D70-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 18:33 . 2010-06-20 18:37 78848 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{423823EC-7C9A-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 17:42 . 2010-06-20 17:47 69632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{40DFB567-7C93-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 21:37 . 2010-06-21 21:42 74752 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{408E97B9-7D7D-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 05:45 . 2010-06-21 05:50 79872 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3FB1401F-7CF8-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 22:50 . 2010-06-20 22:55 70656 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3BB6DEBA-7CBE-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 20:48 . 2010-06-20 20:51 62976 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{395CB970-7CAD-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 23:04 . 2010-06-20 23:07 84480 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{388D3EB1-7CC0-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 00:09 . 2010-06-21 00:13 49664 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3625D908-7CC9-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 02:32 . 2010-06-21 02:35 58880 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{34509B60-7CDD-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 20:12 . 2010-06-20 20:17 70144 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{33F1046D-7CA8-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 09:14 . 2010-06-20 09:17 56832 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{333B3563-7C4C-11DF-921E-001DE072E4AF}.dat
    + 2010-06-22 01:19 . 2010-06-22 01:23 71168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{317E2509-7D9C-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:41 . 2010-06-21 22:46 79872 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2FCAC7F5-7D86-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 19:37 . 2010-06-20 19:40 85504 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2D8AF882-7CA3-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 19:22 . 2010-06-20 19:26 41984 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2C8FA217-7CA1-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 17:06 . 2010-06-20 17:10 25088 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2C30522F-7C8E-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 00:23 . 2010-06-21 00:27 52736 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2BBAF123-7CCB-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 20:32 . 2010-06-21 20:37 60928 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{276E5629-7D74-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:37 . 2010-06-20 16:39 40448 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{270A411F-7C8A-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:08 . 2010-06-22 05:11 76288 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{25E9E198-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 16:30 . 2010-06-20 16:34 80384 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{24D4B40E-7C89-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 03:43 . 2010-06-21 03:47 55296 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{242D08E9-7CE7-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 06:28 . 2010-06-21 06:31 76288 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2339678C-7CFE-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 18:10 . 2010-06-20 18:14 89600 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{225F1CAF-7C97-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 17:56 . 2010-06-20 18:01 25088 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{21C32455-7C95-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 07:55 . 2010-06-20 07:59 98816 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{210C8E97-7C41-11DF-921D-001DE072E4AF}.dat
    + 2010-06-22 01:33 . 2010-06-22 01:38 87552 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{20AAEB43-7D9E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 00:28 . 2010-06-22 00:33 90624 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{209CE41B-7D95-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:55 . 2010-06-21 22:59 72704 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1E7B93E7-7D88-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 01:27 . 2010-06-21 01:31 79872 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1C153B8F-7CD4-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 23:18 . 2010-06-20 23:22 89600 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{19CB46FB-7CC2-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 21:52 . 2010-06-20 21:56 77824 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{182670CE-7CB6-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 20:46 . 2010-06-21 20:51 72704 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{168344DF-7D76-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 03:28 . 2010-06-21 03:33 58368 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{15A2529F-7CE5-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 21:37 . 2010-06-20 21:42 79872 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{158C4139-7CB4-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 01:47 . 2010-06-22 01:51 52224 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{15434A19-7DA0-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 03:14 . 2010-06-21 03:18 90112 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{152EE23F-7CE3-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 18:53 . 2010-06-20 18:55 24064 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{11FB8E15-7C9D-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 00:57 . 2010-06-22 01:01 56832 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{11A2BB71-7D99-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 00:42 . 2010-06-22 00:46 89088 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{104CCBAB-7D97-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 05:08 . 2010-06-21 05:12 90112 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0E7D7C6B-7CF3-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 00:36 . 2010-06-21 00:40 54272 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0D918FED-7CCD-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 19:27 . 2010-06-21 19:31 66048 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{09B1E893-7D6B-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:19 . 2010-06-21 22:23 71168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{08BA0241-7D83-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 23:32 . 2010-06-20 23:36 99328 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{083E15C9-7CC4-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 21:14 . 2010-06-21 21:19 86528 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{074195A9-7D7A-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 18:37 . 2010-06-21 18:41 56832 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0702276E-7D64-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:08 . 2010-06-20 16:12 57856 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0615024B-7C86-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 04:53 . 2010-06-22 04:56 79360 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{055C2763-7DBA-11DF-9225-001DE072E4AF}.dat
    + 2010-06-21 06:41 . 2010-06-21 06:45 65024 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0552C82D-7D00-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 21:15 . 2010-06-20 21:20 79872 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{04762935-7CB1-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 19:50 . 2010-06-20 19:54 41984 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{026ACDEA-7CA5-11DF-921F-001DE072E4AF}.dat
    + 2010-06-18 16:43 . 2010-06-22 05:18 16384 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
    - 2010-06-18 16:43 . 2010-06-20 07:45 16384 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
    - 2009-12-07 14:54 . 2010-06-20 07:45 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
    + 2009-12-07 14:54 . 2010-06-22 05:18 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
    - 2009-05-22 09:22 . 2010-06-20 07:45 49152 c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2009-05-22 09:22 . 2010-06-22 05:18 49152 c:\windows\system32\config\systemprofile\Cookies\index.dat
    - 2010-06-20 07:18 . 2010-06-20 07:19 64011 c:\windows\system32\config\systemprofile\Application Data\Adobe\Acrobat\9.0\UserCache.bin
    + 2010-06-20 07:18 . 2010-06-21 05:55 64011 c:\windows\system32\config\systemprofile\Application Data\Adobe\Acrobat\9.0\UserCache.bin
    + 2009-05-22 02:13 . 2008-04-14 09:41 4096 c:\windows\system32\ksuser.dll
    - 2009-05-22 02:13 . 2008-04-14 12:41 4096 c:\windows\system32\ksuser.dll
    + 2009-05-22 02:13 . 2008-04-14 09:41 4096 c:\windows\system32\dllcache\ksuser.dll
    - 2009-05-22 02:13 . 2008-04-14 12:41 4096 c:\windows\system32\dllcache\ksuser.dll
    + 2010-06-18 17:55 . 2010-06-22 05:06 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{A1C28E7C-7B02-11DF-9212-001DE072E4AF}.dat
    - 2010-06-18 17:55 . 2010-06-20 02:17 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{A1C28E7C-7B02-11DF-9212-001DE072E4AF}.dat
    + 2010-06-22 05:06 . 2010-06-22 05:06 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\{DEB46588-7DBB-11DF-9225-001DE072E4AF}.dat
    + 2010-06-21 18:00 . 2010-06-21 18:01 5632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{DD193501-7D5E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 08:56 . 2010-06-20 09:17 5632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{AD1DEF65-7C49-11DF-921E-001DE072E4AF}.dat
    + 2010-06-22 05:18 . 2010-06-22 05:19 7168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{A4639F90-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:11 . 2010-06-22 05:11 5120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{9EB727B6-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:08 . 2010-06-22 05:08 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{25E9E197-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 04:52 . 2010-06-22 05:06 5120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{055C2762-7DBA-11DF-9225-001DE072E4AF}.dat
    + 2010-06-20 21:51 . 2010-06-20 21:51 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{FECCAFDB-7CB5-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:09 . 2010-06-21 02:09 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{FDE6B24C-7CD9-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 02:09 . 2010-06-21 02:09 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{FDE6B24B-7CD9-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 00:07 . 2010-06-21 00:07 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F96F5733-7CC8-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 02:45 . 2010-06-21 02:45 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F8E41D90-7CDE-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:45 . 2010-06-21 02:45 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F8E41D8E-7CDE-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:45 . 2010-06-21 02:45 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F8E41D8D-7CDE-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:45 . 2010-06-21 02:45 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F8E41D8C-7CDE-11DF-9221-001DE072E4AF}.dat
    + 2010-06-22 05:14 . 2010-06-22 05:14 9728 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F80EA63C-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 08:08 . 2010-06-20 08:08 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F73EF1ED-7C42-11DF-921D-001DE072E4AF}.dat
    + 2010-06-22 00:06 . 2010-06-22 00:11 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F6F08BF6-7D91-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 17:19 . 2010-06-20 17:19 5120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F391782E-7C8F-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:13 . 2010-06-22 05:13 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F1507FB5-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:13 . 2010-06-22 05:13 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F1507FB4-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 19:49 . 2010-06-20 19:49 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F115D5A9-7CA4-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 06:05 . 2010-06-21 06:05 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EB9E5177-7CFA-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 06:04 . 2010-06-21 06:04 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EB9E5176-7CFA-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 22:32 . 2010-06-21 22:32 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EB0A38FA-7D84-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:32 . 2010-06-21 22:32 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EB0A38F9-7D84-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 05:13 . 2010-06-22 05:13 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E8705EB0-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:13 . 2010-06-22 05:13 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E8705EAF-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 17:47 . 2010-06-20 17:47 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E5C87C84-7C93-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 16:00 . 2010-06-20 16:00 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E361089F-7C84-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 18:00 . 2010-06-21 18:00 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DD193504-7D5E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 18:00 . 2010-06-21 18:00 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DD193502-7D5E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 23:38 . 2010-06-20 23:38 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DCD12032-7CC4-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 04:53 . 2010-06-21 04:53 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DB4114F8-7CF0-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 19:19 . 2010-06-21 19:19 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D99BDBB6-7D69-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 19:19 . 2010-06-21 19:19 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D99BDBB5-7D69-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 01:38 . 2010-06-22 01:38 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D7D97825-7D9E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 17:18 . 2010-06-20 17:18 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D71B65CF-7C8F-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 18:44 . 2010-06-20 18:44 7680 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D4325E11-7C9B-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 20:17 . 2010-06-20 20:17 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D35196B7-7CA8-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 18:22 . 2010-06-20 18:23 7168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D2730713-7C98-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 23:22 . 2010-06-21 23:54 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D11438B7-7D8B-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 17:11 . 2010-06-20 17:11 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D0DB1C29-7C8E-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 00:27 . 2010-06-21 00:28 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D0C9DDE1-7CCB-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 05:05 . 2010-06-22 05:06 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CEC7705D-7DBB-11DF-9225-001DE072E4AF}.dat
    + 2010-06-20 18:58 . 2010-06-20 18:59 6656 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CE89C7D1-7C9D-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 17:46 . 2010-06-20 17:46 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CD002B03-7C93-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 19:19 . 2010-06-20 19:19 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CBF216FB-7CA0-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:07 . 2010-06-21 02:07 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CAF2D0E5-7CD9-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 01:39 . 2010-06-21 01:39 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C5938765-7CD5-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 23:37 . 2010-06-20 23:37 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C2037067-7CC4-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 23:37 . 2010-06-20 23:38 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C2037066-7CC4-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 21:21 . 2010-06-20 21:21 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C002E4F8-7CB1-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 18:13 . 2010-06-21 18:14 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BDD8E0A7-7D60-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 00:20 . 2010-06-21 00:20 5120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BA3ADEA5-7CCA-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 17:24 . 2010-06-20 17:24 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B9B040F9-7C90-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 04:52 . 2010-06-21 04:52 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B7EDDD7F-7CF0-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 05:34 . 2010-06-21 05:35 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B71CAAB7-7CF6-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 05:34 . 2010-06-21 05:34 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B71CAAB5-7CF6-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 01:45 . 2010-06-21 01:45 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B6826A51-7CD6-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 05:19 . 2010-06-22 05:19 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B33E664B-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:19 . 2010-06-22 05:19 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B33E664A-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 21:42 . 2010-06-20 21:42 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AF9B74C5-7CB4-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 23:08 . 2010-06-20 23:08 5120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AF3627F2-7CC0-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 22:38 . 2010-06-21 22:38 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{ADEDB1C5-7D85-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:23 . 2010-06-21 22:23 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{ADCDB3B3-7D83-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 05:19 . 2010-06-22 05:19 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AC614131-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:19 . 2010-06-22 05:19 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AC614130-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 22:10 . 2010-06-20 22:11 6656 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AB597EC2-7CB8-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 22:10 . 2010-06-20 22:10 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AB597EC1-7CB8-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:11 . 2010-06-22 05:11 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A5AC2451-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:18 . 2010-06-22 05:18 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A4639F94-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:18 . 2010-06-22 05:18 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A4639F93-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:18 . 2010-06-22 05:18 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A4639F91-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 23:07 . 2010-06-20 23:07 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9ED92440-7CC0-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 19:47 . 2010-06-20 19:47 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9ED71703-7CA4-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:11 . 2010-06-22 05:11 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9EB727B7-7DBC-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 16:12 . 2010-06-20 16:12 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9DB38DBB-7C86-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 21:20 . 2010-06-20 21:20 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9BFF3F7B-7CB1-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 01:15 . 2010-06-22 01:15 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9989C4F1-7D9B-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 00:10 . 2010-06-22 00:10 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{993DC0A5-7D92-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 17:16 . 2010-06-20 17:16 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{99197D1A-7C8F-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 04:22 . 2010-06-21 04:22 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{967A4208-7CEC-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 01:37 . 2010-06-21 01:37 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9648A229-7CD5-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 16:47 . 2010-06-20 16:48 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9489A031-7C8B-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 20:51 . 2010-06-20 20:52 7168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9267ECB8-7CAD-11DF-921F-001DE072E4AF}.dat
     
  16. 2010/06/22
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    + 2010-06-20 23:35 . 2010-06-20 23:36 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{91F50A57-7CC4-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 23:07 . 2010-06-20 23:07 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{90ECC8AB-7CC0-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 01:08 . 2010-06-21 01:08 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{90D8A833-7CD1-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 05:18 . 2010-06-22 05:18 9728 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8FA3A846-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:18 . 2010-06-22 05:18 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8FA3A845-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-21 22:01 . 2010-06-21 22:01 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8E350BF4-7D80-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:01 . 2010-06-21 22:01 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8E350BF3-7D80-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 20:14 . 2010-06-21 20:14 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8E0C2EC7-7D71-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 18:49 . 2010-06-20 18:49 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8CD01517-7C9C-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:18 . 2010-06-22 05:18 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{88F16D7F-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:18 . 2010-06-22 05:18 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{88F16D7E-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{889F4137-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-20 17:01 . 2010-06-20 17:01 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{878CAF43-7C8D-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:17 . 2010-06-22 05:18 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{823CD05F-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:17 . 2010-06-22 05:17 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{823CD05E-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-21 04:21 . 2010-06-21 04:21 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8137296B-7CEC-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 06:23 . 2010-06-21 06:23 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{81066CBA-7CFD-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{806604CA-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{806604C9-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{806604C8-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-20 20:57 . 2010-06-20 20:58 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7FB4FA88-7CAE-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 17:16 . 2010-06-20 17:16 5120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7FA7E4A2-7C8F-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 05:04 . 2010-06-21 05:04 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7FA4D82A-7CF2-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 00:18 . 2010-06-21 00:18 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7F5A0C11-7CCA-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 20:50 . 2010-06-20 20:50 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7E919BE5-7CAD-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 18:04 . 2010-06-21 18:04 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7ACCA001-7D5F-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{788C266B-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{788C266A-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 21:53 . 2010-06-21 21:54 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{77955C41-7D7F-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 18:55 . 2010-06-20 18:55 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7566BD03-7C9D-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 16:47 . 2010-06-20 16:48 7168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{74EB50A2-7C8B-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{712E4255-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{712E4254-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-20 21:47 . 2010-06-20 21:47 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{70988DD9-7CB5-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 22:51 . 2010-06-20 22:52 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6C997613-7CBE-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 07:49 . 2010-06-20 07:50 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A89AB05-7C40-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 08:04 . 2010-06-20 08:04 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A7C5C69-7C42-11DF-921D-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A7742DB-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:48 . 2010-06-21 02:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A7742DA-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-20 19:17 . 2010-06-20 19:17 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A688311-7CA0-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:17 . 2010-06-22 05:17 9728 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A62EA07-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:17 . 2010-06-22 05:17 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A62EA06-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:17 . 2010-06-22 05:17 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6A62EA05-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 16:46 . 2010-06-20 16:46 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{649EFD67-7C8B-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:47 . 2010-06-21 02:47 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{627C0393-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:47 . 2010-06-21 02:47 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{627C0392-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:47 . 2010-06-21 02:47 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{627C0391-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 01:07 . 2010-06-21 01:07 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{61D7ABDD-7CD1-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 05:17 . 2010-06-22 05:17 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{619D02DA-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:16 . 2010-06-22 05:17 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{619D02D9-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 01:06 . 2010-06-22 01:06 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5C166995-7D9A-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 05:16 . 2010-06-22 05:16 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5A62E20A-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:16 . 2010-06-22 05:16 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5A62E209-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-21 05:39 . 2010-06-21 05:43 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5A49FC6F-7CF7-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 05:17 . 2010-06-21 05:17 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{59E6BCC5-7CF4-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 03:52 . 2010-06-21 03:52 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5833987C-7CE8-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 00:38 . 2010-06-21 00:38 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{56448439-7CCD-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 16:17 . 2010-06-20 16:17 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{52E8A814-7C87-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 16:31 . 2010-06-20 16:32 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4F4C972D-7C89-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 03:58 . 2010-06-21 03:58 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4EBDC30D-7CE9-11DF-9222-001DE072E4AF}.dat
    + 2010-06-22 02:10 . 2010-06-22 02:10 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4E9510DD-7DA3-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:03 . 2010-06-20 16:03 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4CEF653C-7C85-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 16:03 . 2010-06-20 16:03 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4CEF653B-7C85-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 03:51 . 2010-06-21 03:51 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4B596B55-7CE8-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 18:18 . 2010-06-20 18:19 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4B08F75B-7C98-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:47 . 2010-06-21 02:47 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{443506A2-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-20 20:20 . 2010-06-20 20:20 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{437591E1-7CA9-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:16 . 2010-06-22 05:16 9728 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{425487F3-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:16 . 2010-06-22 05:16 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{425487F2-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 21:24 . 2010-06-20 21:24 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{412D2ACC-7CB2-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 21:24 . 2010-06-20 21:24 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{412D2ACB-7CB2-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 08:38 . 2010-06-20 08:38 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3FA9FC53-7C47-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 21:17 . 2010-06-20 21:17 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3C2C5C41-7CB1-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 22:50 . 2010-06-20 22:50 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3BB6DEB9-7CBE-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 05:16 . 2010-06-22 05:16 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3B23F08C-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:15 . 2010-06-22 05:15 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3B23F08B-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:15 . 2010-06-22 05:15 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3B23F08A-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 20:48 . 2010-06-20 20:48 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{395CB96F-7CAD-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 18:47 . 2010-06-20 18:47 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{35DFB541-7C9C-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:32 . 2010-06-21 02:32 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{34509B5F-7CDD-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 08:38 . 2010-06-20 08:38 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{33803D2E-7C47-11DF-921D-001DE072E4AF}.dat
    + 2010-06-22 05:15 . 2010-06-22 05:15 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{32ED1678-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:15 . 2010-06-22 05:15 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{32ED1677-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-21 02:46 . 2010-06-21 02:46 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{32287950-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:46 . 2010-06-21 02:46 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3228794F-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-20 16:16 . 2010-06-20 16:16 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3032CBCF-7C87-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 00:37 . 2010-06-21 00:37 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2DF0FDF4-7CCD-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 19:36 . 2010-06-20 19:36 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2D8AF881-7CA3-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 08:38 . 2010-06-20 08:38 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2BA65ED1-7C47-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 20:26 . 2010-06-20 20:26 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{27E9A5B6-7CAA-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 20:26 . 2010-06-20 20:26 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{27E9A5B5-7CAA-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 06:35 . 2010-06-21 06:35 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{27C7C534-7CFF-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 16:30 . 2010-06-20 16:30 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{24D4B40D-7C89-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 06:28 . 2010-06-21 06:28 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2339678B-7CFE-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 03:21 . 2010-06-21 03:21 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{22F7FA4E-7CE4-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 18:32 . 2010-06-20 18:32 5120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2077D9DD-7C9A-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 06:35 . 2010-06-21 06:35 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1F84FF5F-7CFF-11DF-9223-001DE072E4AF}.dat
    + 2010-06-22 05:15 . 2010-06-22 05:15 9728 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1F2C3ACC-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 15:54 . 2010-06-20 15:55 5120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1D1C1A35-7C84-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 01:48 . 2010-06-21 01:49 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{183BAD43-7CD7-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 05:15 . 2010-06-22 05:15 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1809F181-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:14 . 2010-06-22 05:14 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1809F180-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-21 02:45 . 2010-06-21 02:45 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{13F22CD6-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 00:08 . 2010-06-21 00:08 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{137BE884-7CC9-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 15:47 . 2010-06-20 15:47 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1362836D-7C83-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 03:21 . 2010-06-21 03:21 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{12FA54AD-7CE4-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 17:48 . 2010-06-20 17:48 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{10B79539-7C94-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 05:14 . 2010-06-22 05:14 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{109435E7-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:14 . 2010-06-22 05:14 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{109435E6-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 08:08 . 2010-06-20 08:08 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0F1B3AA0-7C43-11DF-921D-001DE072E4AF}.dat
    + 2010-06-22 05:14 . 2010-06-22 05:14 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{08D49168-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-22 05:14 . 2010-06-22 05:14 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{08D49167-7DBD-11DF-9226-001DE072E4AF}.dat
    + 2010-06-20 08:08 . 2010-06-20 08:08 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{082D6510-7C43-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 20:47 . 2010-06-20 20:47 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{07C02AA9-7CAD-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 18:37 . 2010-06-21 18:37 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0702276D-7D64-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 19:50 . 2010-06-20 19:50 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{026ACDEB-7CA5-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:45 . 2010-06-21 02:45 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{01EA6438-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 02:45 . 2010-06-21 02:45 4096 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{01EA6437-7CDF-11DF-9221-001DE072E4AF}.dat
    + 2010-06-20 18:16 . 2010-06-20 18:16 4608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{016EBEF5-7C98-11DF-921F-001DE072E4AF}.dat
    + 2009-07-12 04:02 . 2009-07-12 04:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
    - 2009-07-12 05:05 . 2009-07-12 05:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
    + 2009-07-12 04:05 . 2009-07-12 04:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
    - 2007-09-06 04:24 . 2007-05-10 17:23 270336 c:\windows\system32\stacapi.dll
    + 2007-09-06 04:24 . 2007-05-10 14:23 270336 c:\windows\system32\stacapi.dll
    + 2001-08-23 11:00 . 2010-06-22 05:12 444156 c:\windows\system32\perfh009.dat
    - 2001-08-23 11:00 . 2010-06-20 07:42 444156 c:\windows\system32\perfh009.dat
    - 2009-05-22 23:34 . 2008-04-14 07:49 146048 c:\windows\system32\drivers\portcls.sys
    + 2009-05-22 23:34 . 2008-04-14 04:49 146048 c:\windows\system32\drivers\portcls.sys
    - 2008-04-14 00:46 . 2008-04-14 07:46 141056 c:\windows\system32\drivers\ks.sys
    + 2008-04-14 00:46 . 2008-04-14 04:46 141056 c:\windows\system32\drivers\ks.sys
    - 2009-05-22 23:34 . 2008-04-14 07:49 146048 c:\windows\system32\dllcache\portcls.sys
    + 2009-05-22 23:34 . 2008-04-14 04:49 146048 c:\windows\system32\dllcache\portcls.sys
    + 2008-04-14 00:46 . 2008-04-14 04:46 141056 c:\windows\system32\dllcache\ks.sys
    - 2008-04-14 00:46 . 2008-04-14 07:46 141056 c:\windows\system32\dllcache\ks.sys
    + 2009-05-22 09:22 . 2010-06-22 05:18 294912 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2010-06-20 08:22 . 2010-06-20 08:26 198144 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{FCB775CB-7C44-11DF-921D-001DE072E4AF}.dat
    + 2010-06-21 00:50 . 2010-06-21 00:55 180736 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{FC31AB69-7CCE-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 01:10 . 2010-06-22 01:14 165888 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F41B7A23-7D9A-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:33 . 2010-06-21 22:36 139264 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F2196F74-7D84-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 05:22 . 2010-06-21 05:26 139776 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F1E243EB-7CF4-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 22:41 . 2010-06-20 22:45 101376 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F1DBC715-7CBC-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 23:51 . 2010-06-21 23:55 173568 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{F02A3EE1-7D8F-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:57 . 2010-06-20 17:01 133632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EFEE23D3-7C8C-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 19:13 . 2010-06-20 19:17 108032 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EF937C4F-7C9F-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 08:50 . 2010-06-20 08:54 132608 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EE32205B-7C48-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 23:59 . 2010-06-21 00:04 121856 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{ED0BDFDE-7CC7-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 08:36 . 2010-06-20 08:41 105984 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EB6F68CB-7C46-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 20:17 . 2010-06-20 20:22 110080 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EB350678-7CA8-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:37 . 2010-06-21 02:41 142336 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EA84D15B-7CDD-11DF-9221-001DE072E4AF}.dat
    + 2010-06-21 19:05 . 2010-06-21 19:09 116224 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E9D41CA1-7D67-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 02:23 . 2010-06-21 02:27 107520 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E9B6C79B-7CDB-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 09:05 . 2010-06-20 09:09 183296 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E9601DBF-7C4A-11DF-921E-001DE072E4AF}.dat
    + 2010-06-21 21:56 . 2010-06-21 22:01 160768 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E9130C65-7D7F-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 20:09 . 2010-06-21 20:13 124928 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E8B35923-7D70-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 02:28 . 2010-06-22 02:33 128000 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E7DF60BB-7DA5-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:21 . 2010-06-20 16:25 144384 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E776CDDB-7C87-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 18:37 . 2010-06-20 18:41 110080 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E7103A95-7C9A-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 20:03 . 2010-06-20 20:07 112640 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E3DFAC4B-7CA6-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 00:05 . 2010-06-22 00:10 135680 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DFF6C2A9-7D91-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 18:00 . 2010-06-21 18:04 104960 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DE7ED5BE-7D5E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 02:51 . 2010-06-21 02:55 103936 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DCFFFA63-7CDF-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 00:13 . 2010-06-21 00:17 102912 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{DA655931-7CC9-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 18:01 . 2010-06-20 18:05 163328 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D8735495-7C95-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 00:19 . 2010-06-22 00:23 107520 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D696E223-7D93-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 23:09 . 2010-06-20 23:13 136704 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{D06C299E-7CC0-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 18:14 . 2010-06-21 18:18 123904 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CCE0F413-7D60-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 21:28 . 2010-06-20 21:32 172032 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{CBEF26B9-7CB2-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 03:04 . 2010-06-21 03:09 104960 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C2191035-7CE1-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 07:45 . 2010-06-20 07:49 142336 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{C1DB4B86-7C3F-11DF-921D-001DE072E4AF}.dat
    + 2010-06-21 22:10 . 2010-06-21 22:14 112128 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BE24F331-7D81-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 21:56 . 2010-06-20 22:01 155136 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BC638E9D-7CB6-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 20:51 . 2010-06-21 20:55 103424 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BBA07FB9-7D76-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 21:06 . 2010-06-20 21:10 124928 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BA7C12FF-7CAF-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 01:51 . 2010-06-22 01:56 105984 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BA359A9F-7DA0-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 17:24 . 2010-06-20 17:28 108032 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B9B040FA-7C90-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 02:00 . 2010-06-21 02:04 187904 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B7874A23-7CD8-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 01:01 . 2010-06-22 01:05 109056 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B6AF45D5-7D99-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 00:47 . 2010-06-22 00:52 137728 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B55BB869-7D97-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 05:13 . 2010-06-21 05:17 133120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B49E9797-7CF3-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 23:14 . 2010-06-21 23:18 169472 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B25F0FDD-7D8A-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 00:41 . 2010-06-21 00:45 159232 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B25B5879-7CCD-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 22:24 . 2010-06-21 22:27 113664 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{ADCDB3B4-7D83-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 21:05 . 2010-06-21 21:10 128512 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AB126A25-7D78-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 06:46 . 2010-06-21 06:50 111104 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{AA21556D-7D00-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 18:28 . 2010-06-20 18:31 101888 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A9DD3EB7-7C99-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 02:05 . 2010-06-22 02:10 162816 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A967258D-7DA2-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 03:54 . 2010-06-21 03:58 112640 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A7DB8967-7CE8-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 16:48 . 2010-06-20 16:52 128512 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A68CA41C-7C8B-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 23:42 . 2010-06-21 23:46 149504 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A5F22B87-7D8E-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 15:51 . 2010-06-20 15:54 173568 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A5C06095-7C83-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 08:41 . 2010-06-20 08:45 105984 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A454A65D-7C47-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 08:27 . 2010-06-20 08:31 103424 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A1A763F7-7C45-11DF-921D-001DE072E4AF}.dat
    + 2010-06-21 18:41 . 2010-06-21 18:45 156672 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9EF68785-7D64-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 02:13 . 2010-06-21 02:17 122368 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9C7C9CB3-7CDA-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 21:20 . 2010-06-20 21:24 156160 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9BFF3F7C-7CB1-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 05:41 . 2010-06-21 05:45 121856 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9A7506B3-7CF7-11DF-9223-001DE072E4AF}.dat
    + 2010-06-22 01:15 . 2010-06-22 01:19 182784 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9989C4F2-7D9B-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 00:10 . 2010-06-22 00:14 103424 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{993DC0A6-7D92-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 22:45 . 2010-06-20 22:50 131072 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{96C48E33-7CBD-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 22:01 . 2010-06-21 22:05 123904 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{953D1B60-7D80-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 23:56 . 2010-06-22 00:00 133632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{9536C945-7D90-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 20:44 . 2010-06-20 20:48 150528 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{94908E89-7CAC-11DF-921F-001DE072E4AF}.dat
     
  17. 2010/06/22
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    + 2010-06-20 23:00 . 2010-06-20 23:04 185856 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{935A8EAD-7CBF-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 01:09 . 2010-06-21 01:13 105472 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{90D8A834-7CD1-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 02:27 . 2010-06-21 02:31 121856 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8F0D3AE5-7CDC-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 18:42 . 2010-06-20 18:47 144384 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8C0C1483-7C9B-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 01:01 . 2010-06-21 01:04 113152 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{8B381C1B-7CD0-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 05:55 . 2010-06-21 05:59 187392 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{89E6F11F-7CF9-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 20:08 . 2010-06-20 20:12 112640 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{88C87369-7CA7-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 19:32 . 2010-06-20 19:36 114176 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{888332D1-7CA2-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 20:28 . 2010-06-21 20:32 133120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{823BA625-7D73-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 20:00 . 2010-06-20 20:03 108032 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{80426BFB-7CA6-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 00:18 . 2010-06-21 00:22 135168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7F5A0C12-7CCA-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 18:06 . 2010-06-20 18:10 101888 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7D8BCABB-7C96-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 01:28 . 2010-06-22 01:32 156160 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7BA7EA47-7D9D-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 18:04 . 2010-06-21 18:08 165376 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7ACCA002-7D5F-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:51 . 2010-06-21 22:55 135168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7922BE43-7D87-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 22:36 . 2010-06-21 22:41 148992 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{761D44DB-7D85-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 23:13 . 2010-06-20 23:17 112640 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{74E01D83-7CC1-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 18:18 . 2010-06-21 18:23 161280 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{71DCCE01-7D61-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 20:42 . 2010-06-21 20:46 112640 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{715C809D-7D75-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 01:42 . 2010-06-22 01:46 162816 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6FC6B12F-7D9F-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 01:50 . 2010-06-21 01:55 139776 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6C08949F-7CD7-11DF-9220-001DE072E4AF}.dat
    + 2010-06-22 00:38 . 2010-06-22 00:42 214528 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6AD759CF-7D96-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:39 . 2010-06-20 16:43 144896 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{69A5F37F-7C8A-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 03:23 . 2010-06-21 03:28 121856 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{695BA76B-7CE4-11DF-9222-001DE072E4AF}.dat
    + 2010-06-20 17:15 . 2010-06-20 17:19 109056 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{68E02CB7-7C8F-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 00:32 . 2010-06-21 00:36 128000 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{68AD8D83-7CCC-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 23:04 . 2010-06-21 23:09 128512 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6888BCED-7D89-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 23:27 . 2010-06-20 23:31 123392 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{636D262F-7CC3-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 16:03 . 2010-06-20 16:07 112128 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{6192C04A-7C85-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 22:01 . 2010-06-20 22:05 146944 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{615AA3D7-7CB7-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 06:36 . 2010-06-21 06:41 108544 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{60201829-7CFF-11DF-9223-001DE072E4AF}.dat
    + 2010-06-20 21:11 . 2010-06-20 21:15 137728 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5F6E6385-7CB0-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 01:56 . 2010-06-22 02:00 157696 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5F3D604F-7DA1-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 23:33 . 2010-06-21 23:37 116736 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5B53930F-7D8D-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 22:37 . 2010-06-20 22:41 110592 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{596445AB-7CBC-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 17:29 . 2010-06-20 17:33 112640 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{51D1EDBF-7C91-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 21:24 . 2010-06-21 21:28 144384 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{515D0CCB-7D7B-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 02:10 . 2010-06-22 02:14 114176 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4E9510DE-7DA3-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 23:47 . 2010-06-21 23:51 106496 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4B1B5223-7D8F-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 16:53 . 2010-06-20 16:57 151552 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4AF249E5-7C8C-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 19:09 . 2010-06-20 19:13 129536 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4A907B53-7C9F-11DF-921F-001DE072E4AF}.dat
    + 2010-06-20 08:46 . 2010-06-20 08:50 109568 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{495ECE67-7C48-11DF-921D-001DE072E4AF}.dat
    + 2010-06-20 23:55 . 2010-06-20 23:59 143872 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{47F369B9-7CC7-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 08:31 . 2010-06-20 08:36 153600 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{469C16D7-7C46-11DF-921D-001DE072E4AF}.dat
    + 2010-06-21 00:59 . 2010-06-21 01:01 101376 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{45F026D5-7CD0-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 22:28 . 2010-06-21 22:32 104448 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{45DEB003-7D84-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 05:01 . 2010-06-22 05:06 126976 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4477E54F-7DBB-11DF-9225-001DE072E4AF}.dat
    + 2010-06-20 09:00 . 2010-06-20 09:04 112128 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{445ABA69-7C4A-11DF-921E-001DE072E4AF}.dat
    + 2010-06-21 02:18 . 2010-06-21 02:22 105984 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4314ED73-7CDB-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 16:17 . 2010-06-20 16:21 147968 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{42DA51FC-7C87-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 02:24 . 2010-06-22 02:28 205312 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{42A589A9-7DA5-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 15:55 . 2010-06-20 15:59 215552 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3ED53D36-7C84-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 05:31 . 2010-06-21 05:35 135168 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3C6B6739-7CF6-11DF-9223-001DE072E4AF}.dat
    + 2010-06-22 00:00 . 2010-06-22 00:05 141824 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3AA51413-7D91-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 01:13 . 2010-06-21 01:17 106496 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{397FE0A5-7CD2-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 04:12 . 2010-06-21 04:17 138240 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{36C83FFB-7CEB-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 19:14 . 2010-06-21 19:18 140288 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{342669D9-7D69-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 02:38 . 2010-06-22 02:42 128000 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{322A86E5-7DA7-11DF-9224-001DE072E4AF}.dat
    + 2010-06-22 00:14 . 2010-06-22 00:19 152576 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{3161CFC5-7D93-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 05:59 . 2010-06-21 06:04 217088 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{30034797-7CFA-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 21:51 . 2010-06-21 21:56 102912 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2F9C5F61-7D7F-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 20:27 . 2010-06-20 20:30 109056 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2EDC3FF8-7CAA-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 20:18 . 2010-06-21 20:22 127488 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{25EFDE69-7D72-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 21:02 . 2010-06-20 21:04 102912 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{21D01DD5-7CAF-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 06:13 . 2010-06-21 06:17 108032 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1FBA5635-7CFC-11DF-9223-001DE072E4AF}.dat
    + 2010-06-21 03:00 . 2010-06-21 03:04 104448 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{1B262619-7CE1-11DF-9222-001DE072E4AF}.dat
    + 2010-06-21 22:05 . 2010-06-21 22:09 121344 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{191868CD-7D81-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 18:23 . 2010-06-21 18:27 270848 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{16F7A681-7D62-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 17:20 . 2010-06-20 17:24 159232 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{14BB8E19-7C90-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 18:09 . 2010-06-21 18:13 244224 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{12C10019-7D60-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 01:55 . 2010-06-21 01:59 114176 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{116FB85F-7CD8-11DF-9220-001DE072E4AF}.dat
    + 2010-06-21 23:23 . 2010-06-21 23:28 126976 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{114D9117-7D8C-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 01:41 . 2010-06-21 01:45 108032 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0EDA4D7D-7CD6-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 16:44 . 2010-06-20 16:46 159232 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0EC0CBFF-7C8B-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 23:09 . 2010-06-21 23:13 136704 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{0D67FAA3-7D8A-11DF-9224-001DE072E4AF}.dat
    + 2010-06-21 02:09 . 2010-06-21 02:13 113664 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{06E5D1E7-7CDA-11DF-9220-001DE072E4AF}.dat
    + 2010-06-20 22:06 . 2010-06-20 22:10 162816 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{063C43E7-7CB8-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 21:00 . 2010-06-21 21:04 131584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{05D630B9-7D78-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 18:24 . 2010-06-20 18:28 145408 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{048DF27B-7C99-11DF-921F-001DE072E4AF}.dat
    + 2010-06-22 02:01 . 2010-06-22 02:05 106496 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{044C4D0D-7DA2-11DF-9224-001DE072E4AF}.dat
    + 2010-06-20 18:59 . 2010-06-20 19:04 121856 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{00C3B1CB-7C9E-11DF-921F-001DE072E4AF}.dat
    + 2010-06-21 23:37 . 2010-06-21 23:42 192512 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{00AA0659-7D8E-11DF-9224-001DE072E4AF}.dat
    + 2009-05-23 00:18 . 2007-05-10 14:22 405504 c:\windows\stsystra.exe
    - 2009-05-23 00:18 . 2007-05-10 17:22 405504 c:\windows\stsystra.exe
    - 2009-07-12 05:02 . 2009-07-12 05:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
    - 2009-07-12 05:02 . 2009-07-12 05:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
    + 2009-07-12 04:02 . 2009-07-12 04:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
    + 2009-05-22 23:34 . 2007-04-10 21:02 1601536 c:\windows\system32\stlang.dll
    - 2009-05-22 23:34 . 2007-04-11 00:02 1601536 c:\windows\system32\stlang.dll
    + 2007-09-06 04:25 . 2007-05-10 14:24 1222840 c:\windows\system32\drivers\sthda.sys
    - 2007-09-06 04:25 . 2007-05-10 17:24 1222840 c:\windows\system32\drivers\sthda.sys
    + 2009-05-22 09:22 . 2010-06-22 05:18 2031616 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2010-06-18 16:43 . 2010-06-22 05:18 14483456 c:\windows\system32\config\systemprofile\PrivacIE\index.dat
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
    2009-11-04 02:12 556432 ----a-w- c:\progra~1\MI1933~1\Office14\URLREDIR.DLL

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PeerGuardian "= "c:\program files\PeerGuardian2\pg2.exe" [2005-09-18 1421824]
    "DAEMON Tools Lite "= "c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
    "CursorFX "= "c:\program files\Stardock\CursorFX\CursorFX.exe" [2008-02-19 653128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
    "WD Drive Manager "= "c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2009-06-26 450560]
    "IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
    "SigmatelSysTrayApp "= "c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
    "avast5 "= "c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]

    c:\documents and settings\Pete\Start Menu\Programs\Startup\
    Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2009-5-22 910296]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoWinKeys "= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "UIHost "= "c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^OfficeSAS.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\OfficeSAS.lnk
    backup=c:\windows\pss\OfficeSAS.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashMute]
    2006-03-11 19:49 221184 ----a-w- c:\program files\FlashMute\flashmute.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2009-10-29 00:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2010-01-11 20:21 246504 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "wuauserv "=2 (0x2)
    "wscsvc "=2 (0x2)
    "Schedule "=2 (0x2)
    "NMSAccessU "=2 (0x2)
    "JavaQuickStarterService "=2 (0x2)
    "idsvc "=3 (0x3)
    "ERSvc "=2 (0x2)
    "Bonjour Service "=2 (0x2)
    "wlidsvc "=2 (0x2)
    "PnkBstrB "=2 (0x2)
    "PnkBstrA "=2 (0x2)
    "npggsvc "=3 (0x3)
    "ACTIVEWEBCAMWATCHDOG "=3 (0x3)
    "FLEXnet Licensing Service "=3 (0x3)
    "WMPNetworkSvc "=3 (0x3)
    "Microsoft SharePoint Workspace Audit Service "=3 (0x3)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "CursorFX "= "c:\program files\Stardock\CursorFX\CursorFX.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" -atboottime
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe "
    "Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    "nwiz "=nwiz.exe /install
    "MSConfig "=c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
    "WinampAgent "= "c:\program files\Winamp\winampa.exe "
    "BCSSync "= "c:\program files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\FlashGet\\flashget.exe "=
    "c:\\Program Files\\uTorrent\\uTorrent.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "d:\\Games\\FEAR\\FEAR.exe "=
    "d:\\Games\\FEAR\\FEARMP.exe "=
    "d:\\Games\\FEAR\\FEARXP\\FEARXP.exe "=
    "d:\\Games\\FEAR Perseus Mandate\\FEARXP2.exe "=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe "=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe "=
    "c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
    "c:\\Program Files\\AIM\\aim.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe "=
    "c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE "=
    "c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE "=
    "c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE "=
    "c:\\Program Files\\LimeWire\\LimeWire.exe "=
    "c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe "=
    "c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe "=
    "c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe "=

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/20/2010 9:34 PM 164048]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [1/5/2010 8:56 AM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 8:56 AM 67656]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/20/2010 9:34 PM 19024]
    R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2/25/2010 5:59 AM 1047880]
    R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [6/26/2009 3:56 PM 102400]
    R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10/14/2009 7:24 AM 10064]
    S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/16/2009 11:01 PM 691696]
    S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [6/30/2009 8:38 AM 17408]
    S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9/26/2009 5:28 AM 4639136]
    S3 ProtoWall;ProtoWall Network Service;c:\windows\system32\DRIVERS\ProtoWall.sys --> c:\windows\system32\DRIVERS\ProtoWall.sys [?]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 8:56 AM 12872]
    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [10/23/2009 5:11 PM 11520]
    S4 ACTIVEWEBCAMWATCHDOG;Active WebCam Watchdog;c:\program files\Active WebCam\Watchdog.exe [11/30/2009 11:15 PM 580608]
    S4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [10/29/2009 11:22 AM 30603640]
    S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp
    .
    Contents of the 'Scheduled Tasks' folder

    2009-12-03 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
    IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\MI1933~1\Office14\ONBttnIE.dll/105
    IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Pete\Start Menu\Programs\IMVU\Run IMVU.lnk
    Trusted Zone: microsoft.com
    Trusted Zone: microsoft.com\*.windowsupdate
    Trusted Zone: windowsupdate.com\download
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    FF - ProfilePath - c:\documents and settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\
    FF - prefs.js: browser.startup.homepage - www.google.com/ncr
    FF - component: c:\documents and settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\cfxHelper@Triton\components\dwmxpcom.dll
    FF - plugin: c:\progra~1\MI1933~1\Office14\NPAUTHZ.DLL
    FF - plugin: c:\progra~1\MI1933~1\Office14\NPSPWRAP.DLL
    FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: nglayout.initialpaint.delay - 600
    FF - user.js: content.notify.interval - 600000
    FF - user.js: content.max.tokenizing.time - 1800000
    FF - user.js: content.switch.threshold - 600000
    FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
    .

    **************************************************************************
    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files:

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
    "ImagePath "= "c:\windows\system32\GameMon.des -service "
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,84,d1,a6,42,76,58,40,b8,14,4f,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,84,d1,a6,42,76,58,40,b8,14,4f,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(1296)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\windows\system32\WININET.dll
    .
    Completion time: 2010-06-22 01:20:58
    ComboFix-quarantined-files.txt 2010-06-22 05:20
    ComboFix2.txt 2010-06-20 07:47
    ComboFix3.txt 2010-06-18 22:34

    Pre-Run: 9,418,911,744 bytes free
    Post-Run: 9,503,195,136 bytes free

    - - End Of File - - 18F2F010FB64E21C0725C408E5A03B8B
     
  18. 2010/06/22
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Uninstall Combofix:
    Go Start > Run [Vista users, go Start> "Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall "
    Click OK (Vista users - press Enter).
    Restart computer.

    ===========================================================

    Download OTL to your Desktop.

    * Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    * Under the Custom Scan box paste this in:



    netsvcs
    %SYSTEMDRIVE%\*.exe
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    CREATERESTOREPOINT



    * Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  19. 2010/06/23
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    OTL.txt part 1 of 2

    OTL logfile created on: 6/23/2010 4:10:58 AM - Run 1
    OTL by OldTimer - Version 3.2.6.1 Folder = C:\Documents and Settings\Pete\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 68.00% Memory free
    5.00 Gb Paging File | 4.00 Gb Available in Paging File | 91.00% Paging File free
    Paging file location(s): D:\pagefile.sys 3072 4096 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 50.00 Gb Total Space | 10.31 Gb Free Space | 20.63% Space Free | Partition Type: NTFS
    Drive D: | 61.78 Gb Total Space | 35.34 Gb Free Space | 57.20% Space Free | Partition Type: NTFS
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: ----------
    Current User Name: Pete
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Standard
    Quick Scan

    ========== Processes (SafeList) ==========

    PRC - File not found -- C:\System Volume Information\Microsoft\smss.exe
    PRC - File not found -- C:\System Volume Information\Microsoft\services.exe
    PRC - [2010/06/23 04:09:48 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pete\Desktop\OTL.exe
    PRC - [2010/06/23 04:08:07 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
    PRC - [2010/05/06 16:59:42 | 002,815,192 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2010/05/06 16:59:38 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2010/03/29 08:53:22 | 000,350,704 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\NOS\bin\getPlusPlus_Adobe.exe
    PRC - [2010/02/25 05:59:54 | 001,047,880 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
    PRC - [2009/06/26 15:56:58 | 000,102,400 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
    PRC - [2009/06/26 15:56:20 | 000,450,560 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
    PRC - [2009/06/04 20:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    PRC - [2009/06/04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    PRC - [2008/04/14 08:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2008/02/19 18:59:40 | 000,653,128 | ---- | M] (Stardock Corporation) -- C:\Program Files\Stardock\CursorFX\CursorFx.exe
    PRC - [2007/05/10 10:22:32 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
    PRC - [2005/09/18 18:40:42 | 001,421,824 | ---- | M] (Methlabs) -- C:\Program Files\PeerGuardian2\pg2.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/06/23 04:09:48 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pete\Desktop\OTL.exe
    MOD - [2008/04/14 08:40:22 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
    MOD - [2008/02/01 14:46:20 | 000,035,144 | ---- | M] ( ) -- C:\Program Files\Stardock\CursorFX\CurXP0.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2010/05/06 16:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
    SRV - [2010/05/06 16:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
    SRV - [2010/05/06 16:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2010/03/30 20:02:09 | 000,435,016 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
    SRV - [2010/03/29 08:53:22 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Running] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
    SRV - [2010/02/25 05:59:54 | 001,047,880 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
    SRV - [2010/02/25 05:56:02 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
    SRV - [2009/12/03 19:29:00 | 003,377,880 | ---- | M] (INCA Internet Co., Ltd.) [Disabled | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc)
    SRV - [2009/10/29 11:22:50 | 030,603,640 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
    SRV - [2009/09/26 05:28:22 | 004,639,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
    SRV - [2009/09/25 11:16:00 | 000,655,624 | ---- | M] (Acresso Software Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
    SRV - [2009/09/06 13:38:06 | 000,071,096 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
    SRV - [2009/06/26 15:56:58 | 000,102,400 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe -- (WDBtnMgrSvc.exe)
    SRV - [2009/06/04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
    SRV - [2009/03/25 16:11:28 | 001,533,824 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
    SRV - [2007/11/13 12:43:00 | 000,580,608 | ---- | M] (PY Software) [Disabled | Stopped] -- C:\Program Files\Active WebCam\Watchdog.exe -- (ACTIVEWEBCAMWATCHDOG)


    ========== Driver Services (SafeList) ==========

    DRV - [2010/06/18 15:32:50 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
    DRV - [2010/06/18 15:32:50 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
    DRV - [2010/06/18 15:32:50 | 000,012,872 | ---- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
    DRV - [2010/05/06 16:39:23 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2010/05/06 16:39:00 | 000,164,048 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
    DRV - [2010/05/06 16:34:27 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2010/05/06 16:33:59 | 000,100,432 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2010/05/06 16:33:47 | 000,019,024 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2010/05/06 16:33:29 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2009/12/29 13:42:49 | 000,139,016 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PnkBstrK.sys -- (PnkBstrK)
    DRV - [2009/12/03 04:49:10 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
    DRV - [2009/11/12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\StarOpen.sys -- (StarOpen)
    DRV - [2009/10/14 07:24:44 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
    DRV - [2009/07/26 22:43:18 | 000,058,908 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\scdemu.sys -- (SCDEmu)
    DRV - [2009/06/17 14:21:27 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
    DRV - [2009/06/05 11:42:28 | 000,017,408 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\netaapl.sys -- (Netaapl)
    DRV - [2009/06/04 19:43:16 | 000,330,264 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\iaStor.sys -- (iaStor)
    DRV - [2009/05/01 01:02:00 | 008,055,584 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2008/12/18 23:43:48 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
    DRV - [2008/12/18 23:43:40 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
    DRV - [2008/05/12 23:06:44 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)
    DRV - [2008/04/14 01:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
    DRV - [2007/10/10 20:03:00 | 000,235,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OEM02Dev.sys -- (OEM02Dev)
    DRV - [2007/09/26 09:01:32 | 002,236,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel(R)
    DRV - [2007/06/07 20:00:02 | 000,141,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\OEM02Afx.sys -- (OEM02Afx)
    DRV - [2007/05/23 17:26:34 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
    DRV - [2007/05/10 10:24:34 | 001,222,840 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
    DRV - [2007/03/31 16:02:42 | 000,876,384 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (btkrnl)
    DRV - [2007/03/31 16:02:40 | 000,055,352 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)
    DRV - [2007/03/23 13:50:42 | 000,067,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
    DRV - [2007/03/23 13:50:36 | 000,037,280 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
    DRV - [2007/03/23 13:50:24 | 000,149,123 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
    DRV - [2007/03/23 13:50:08 | 000,037,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
    DRV - [2007/03/23 13:49:54 | 000,539,072 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
    DRV - [2007/03/05 13:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
    DRV - [2007/01/30 15:12:06 | 000,045,568 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
    DRV - [2006/11/15 03:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
    DRV - [2006/11/14 22:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
    DRV - [2006/11/14 20:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
    DRV - [2005/09/18 18:02:52 | 000,005,632 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files\PeerGuardian2\pgfilter.sys -- (pgfilter)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 28 1E F6 59 3B DB C9 01 [binary data]
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.useDBForOrder: true
    FF - prefs.js..browser.startup.homepage: "www.google.com/ncr "
    FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
    FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.1
    FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.26
    FF - prefs.js..extensions.enabledItems: {cc85cd4e-5a5b-4eda-a25c-bdaffa93b406}:0.4.5
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..extensions.enabledItems: silvermelxt@pardal.de:1.3.5
    FF - prefs.js..extensions.enabledItems: {FBF6D7FB-F305-4445-BB3D-FEF66579A033}:4.9
    FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.9
    FF - prefs.js..extensions.enabledItems: en-US@dictionaries.addons.mozilla.org:4.0.0
    FF - prefs.js..extensions.enabledItems: cfxHelper@Triton:1.2
    FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:3.3
    FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
    FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.63
    FF - prefs.js..extensions.enabledItems: {e2c58150-9d72-11dd-ad8b-0800200c9a66}:1.3.1
    FF - prefs.js..extensions.enabledItems: {6E1A2A2E-AE2A-4A26-A812-46F54288379E}:3.6.0
    FF - prefs.js..extensions.enabledItems: {069FB356-C69F-7349-D092-AB28AF836D0E}:0.9.030
    FF - prefs.js..extensions.enabledItems: rein@notiz.jp:3.6.1
    FF - prefs.js..extensions.enabledItems: silvermel@pardal.de:1.3.5
    FF - prefs.js..extensions.enabledItems: {20C3BDFF-DA68-468d-8D9A-F5A6C76B0F9E}:3.13
    FF - prefs.js..extensions.enabledItems: Strata40@SpewBoy.au:0.6.2
    FF - prefs.js..extensions.enabledItems: chromifox@altmusictv.com:3.6.5
    FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.6.3
    FF - prefs.js..extensions.enabledItems: {12bc3590-67a6-11de-8a39-0800200c9a66}:3.6
    FF - prefs.js..extensions.enabledItems: {00352F14-3F76-4e4d-ACFF-9972D7E4B3B9}:0.7.2
    FF - prefs.js..extensions.enabledItems: {b41cb5f0-2e52-11de-8c30-0800200c9a66}:2.1
    FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c9626}:1.6
    FF - prefs.js..extensions.enabledItems: {989e9382-d540-4189-88d1-fc54a949a387}:0.8.7
    FF - prefs.js..extensions.enabledItems: devious_green@firefox.theme:0.08
    FF - prefs.js..extensions.enabledItems: {13b4437e-b706-11dc-8314-0800200c9a66}:1.36.20100303
    FF - prefs.js..extensions.enabledItems: glaze_black@www.theme-oasis.org:3.3
    FF - prefs.js..extensions.enabledItems: {251297d0-6e53-11de-8a39-0800200c9a66}:3.6.15.02.10
    FF - prefs.js..extensions.enabledItems: cfxe@Triton:3.6.5


    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/23 04:08:11 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/23 04:09:21 | 000,000,000 | ---D | M]

    [2009/07/24 02:26:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Extensions
    [2009/07/24 02:26:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Extensions\IMVUClientXUL@imvu.com
    [2010/02/22 19:29:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Extensions\mozswing@mozswing.org
    [2010/06/23 04:09:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions
    [2010/03/30 19:50:00 | 000,000,000 | ---D | M] (MacOSX Theme) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{00352F14-3F76-4e4d-ACFF-9972D7E4B3B9}
    [2010/06/16 16:40:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
    [2010/01/30 17:28:39 | 000,000,000 | ---D | M] (Phoenity Next (formerly Phoenity Reborn)) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{069FB356-C69F-7349-D092-AB28AF836D0E}
    [2010/03/30 19:50:18 | 000,000,000 | ---D | M] (ANTHEM) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{07b2a769-ed19-4483-87ce-c643914c9626}
    [2010/03/30 19:49:52 | 000,000,000 | ---D | M] (Eclipse) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{12bc3590-67a6-11de-8a39-0800200c9a66}
    [2010/03/30 20:28:36 | 000,000,000 | ---D | M] (Simple Green) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{13b4437e-b706-11dc-8314-0800200c9a66}
    [2010/06/19 20:11:16 | 000,000,000 | ---D | M] (FlashGot) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
    [2010/03/30 20:28:53 | 000,000,000 | ---D | M] (Utopia FFSE White) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{20C3BDFF-DA68-468d-8D9A-F5A6C76B0F9E}
    [2010/03/30 20:28:47 | 000,000,000 | ---D | M] (Extero 2) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{251297d0-6e53-11de-8a39-0800200c9a66}
    [2010/05/23 21:13:02 | 000,000,000 | ---D | M] (Stylish) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
    [2010/03/30 19:49:35 | 000,000,000 | ---D | M] (Aero Fox) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
    [2010/01/24 01:05:24 | 000,000,000 | ---D | M] (Full Flat) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{6E1A2A2E-AE2A-4A26-A812-46F54288379E}
    [2010/03/30 19:50:22 | 000,000,000 | ---D | M] (FennecFox) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{989e9382-d540-4189-88d1-fc54a949a387}
    [2010/03/30 19:50:07 | 000,000,000 | ---D | M] (Black Stratini) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{b41cb5f0-2e52-11de-8c30-0800200c9a66}
    [2010/06/22 18:57:46 | 000,000,000 | ---D | M] (Easy Youtube Video Downloader) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
    [2010/02/19 21:31:40 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66}
    [2010/02/10 14:07:08 | 000,000,000 | ---D | M] (Google Redesigned) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{cc85cd4e-5a5b-4eda-a25c-bdaffa93b406}
    [2010/05/01 10:50:56 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
    [2010/06/23 04:09:12 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
    [2009/11/18 15:14:23 | 000,000,000 | ---D | M] (Black Steel) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{e2c58150-9d72-11dd-ad8b-0800200c9a66}
    [2010/03/12 20:54:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{FBF6D7FB-F305-4445-BB3D-FEF66579A033}
    [2010/05/11 08:07:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\cfxe@Triton
    [2010/05/11 08:07:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\cfxHelper@Triton
    [2010/03/30 19:49:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\chromifox@altmusictv.com
    [2010/03/30 20:28:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\devious_green@firefox.theme
    [2010/03/30 20:29:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\en-US@dictionaries.addons.mozilla.org
    [2010/02/19 21:31:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\Foxdie@tanjihay.com
    [2010/02/19 21:31:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\FoxdieGraphite@tanjihay.com
    [2010/03/30 20:28:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\glaze_black@www.theme-oasis.org
    [2010/02/19 21:31:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\navertheme@nhncorp.com
    [2010/02/19 21:31:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\redshift_V2@shift-themes.com
    [2010/01/21 01:17:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\rein@notiz.jp
    [2010/04/16 08:49:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\silvermel@pardal.de
    [2010/04/16 08:49:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\silvermelxt@pardal.de
    [2010/04/28 02:25:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\Strata40@SpewBoy.au
    [2010/06/22 19:19:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\youtube2mp3@mondayx.de
    [2010/03/30 19:49:52 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{12bc3590-67a6-11de-8a39-0800200c9a66}\chrome\mac\browser\extensions
    [2010/03/30 19:49:52 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{12bc3590-67a6-11de-8a39-0800200c9a66}\chrome\mac\mozapps\extensions
    [2010/03/30 19:49:52 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{12bc3590-67a6-11de-8a39-0800200c9a66}\chrome\win\browser\extensions
    [2010/03/30 19:49:52 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{12bc3590-67a6-11de-8a39-0800200c9a66}\chrome\win\mozapps\extensions
    [2010/03/30 20:28:37 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{13b4437e-b706-11dc-8314-0800200c9a66}\chrome\mozapps\extensions
    [2010/03/30 20:28:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{13b4437e-b706-11dc-8314-0800200c9a66}\chrome\mozapps\extensionsO
    [2010/03/30 19:49:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\mac\browser\extensions
    [2010/03/30 19:49:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\mac\mozapps\extensions
    [2010/03/30 19:49:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\win\browser\extensions
    [2010/03/30 19:49:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions
    [2010/03/30 20:28:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\devious_green@firefox.theme\mozapps\extensions
    [2010/04/28 02:25:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\Strata40@SpewBoy.au\chrome\mozapps\extensions
    [2009/11/09 18:57:15 | 000,001,189 | ---- | M] () -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\searchplugins\winamp-search.xml
    [2010/06/23 04:09:18 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2009/08/17 07:42:14 | 000,073,728 | ---- | M] (NHN USA Inc. ) -- C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll

    O1 HOSTS File: ([2010/06/22 01:19:18 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (www.flashget.com)
    O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
    O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (www.flashget.com)
    O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
    O4 - HKLM..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe (WDC)
    O4 - HKCU..\Run: [CursorFX] C:\Program Files\Stardock\CursorFX\CursorFX.exe (Stardock Corporation)
    O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
    O4 - HKCU..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe (Methlabs)
    O4 - Startup: C:\Documents and Settings\Pete\Start Menu\Programs\Startup\Mozilla Firefox.lnk = C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWinKeys = 1
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\JC_ALL.HTM ()
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\JC_LINK.HTM ()
    O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
    O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
    O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
    O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
    O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
    O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pete\Start Menu\Programs\IMVU\Run IMVU.lnk File not found
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O15 - HKCU\..Trusted Domains: microsoft.com ([]http in Trusted sites)
    O15 - HKCU\..Trusted Domains: microsoft.com ([]https in Trusted sites)
    O15 - HKCU\..Trusted Domains: microsoft.com ([*.windowsupdate] http in Trusted sites)
    O15 - HKCU\..Trusted Domains: microsoft.com ([*.windowsupdate] https in Trusted sites)
    O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] http in Trusted sites)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab (Solitaire Showdown Class)
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab (UnoCtrl Class)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266743745718 (WUWebControl Class)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1259328307765 (MUWebControl Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
    O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
    O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
    O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
    O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
    O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UIHost - (C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe) - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
    O24 - Desktop WallPaper: C:\Documents and Settings\Pete\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Pete\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
    O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2009/05/22 05:18:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/05/22 05:18:11 | 000,000,000 | ---D | M]
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
    NetSvcs: WmdmPmSp - File not found
     
  20. 2010/06/23
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    OTL.txt part 2 of 2 :

    CREATERESTOREPOINT
    Error starting restore point: System Restore is disabled.
    Error closing restore point: System Restore is disabled.

    ========== Files/Folders - Created Within 90 Days ==========

    [2010/06/23 04:09:47 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Pete\Desktop\OTL.exe
    [2010/06/23 04:09:17 | 000,000,000 | ---D | C] -- C:\Program Files\NOS
    [2010/06/23 04:09:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
    [2010/06/23 04:05:13 | 000,000,000 | --SD | C] -- C:\ComboFix
    [2010/06/20 21:34:28 | 000,164,048 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2010/06/20 21:34:28 | 000,100,432 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
    [2010/06/20 21:34:28 | 000,094,800 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
    [2010/06/20 21:34:28 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2010/06/20 21:34:28 | 000,028,880 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
    [2010/06/20 21:34:28 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2010/06/20 21:34:28 | 000,019,024 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2010/06/20 21:34:23 | 000,000,000 | ---D | C] -- C:\Config.Msi
    [2010/06/20 21:34:17 | 000,165,032 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2010/06/20 21:34:17 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\avastSS.scr
    [2010/06/20 21:34:12 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
    [2010/06/20 21:34:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2010/06/20 12:02:43 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
    [2010/06/19 22:23:43 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Pete\Recent
    [2010/06/19 21:36:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Local Settings\Application Data\Deployment
    [2010/06/18 15:37:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Application Data\Malwarebytes
    [2010/06/18 15:37:21 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/06/18 15:37:19 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/06/18 15:37:19 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/06/17 17:55:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Local Settings\Application Data\Painkiller Resurrection
    [2010/05/31 19:49:40 | 000,000,000 | ---D | C] -- C:\Program Files\StreamTorrent 1.0
    [2010/05/31 19:49:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Application Data\StreamTorrent
    [2010/05/28 00:50:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Application Data\vlc
    [2010/05/27 21:27:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\FLEXnet
    [2010/05/27 21:22:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\RosettaStoneLtdBackup
    [2010/05/26 19:16:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Application Data\Canneverbe Limited
    [2010/05/13 01:10:10 | 000,000,000 | ---D | C] -- C:\Program Files\Ubisoft
    [2010/04/28 23:34:29 | 000,000,000 | ---D | C] -- C:\Program Files\Tunatic
    [2010/04/18 13:56:14 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
    [2010/04/18 13:54:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
    [2010/04/18 12:32:13 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
    [2010/04/18 12:29:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot2
    [2010/04/18 12:28:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution.old
    [2010/04/18 12:25:17 | 000,000,000 | ---D | C] -- C:\Program Files\MSECACHE
    [2010/03/31 12:56:01 | 000,000,000 | ---D | C] -- C:\Program Files\Stardock
    [2010/03/31 12:56:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Stardock
    [2010/03/30 20:00:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\TuneUp Software
    [2010/03/30 19:39:15 | 000,030,536 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\TURegOpt.exe
    [2010/03/30 19:39:15 | 000,030,024 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\uxtuneup.dll
    [2010/03/30 19:39:00 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2010
    [2010/03/26 00:52:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Application Data\ImgBurn
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files - Modified Within 90 Days ==========

    [2010/06/23 04:10:44 | 000,525,448 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
    [2010/06/23 04:10:44 | 000,444,156 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/06/23 04:10:44 | 000,072,248 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/06/23 04:09:48 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pete\Desktop\OTL.exe
    [2010/06/23 04:07:18 | 000,230,258 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
    [2010/06/23 04:07:18 | 000,134,696 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001
    [2010/06/23 04:06:08 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/06/23 04:06:03 | 2145,427,456 | -HS- | M] () -- C:\hiberfil.sys
    [2010/06/23 04:05:19 | 013,893,632 | ---- | M] () -- C:\Documents and Settings\Pete\ntuser.dat
    [2010/06/23 04:05:19 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Pete\ntuser.ini
    [2010/06/22 01:19:23 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
    [2010/06/22 01:19:18 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2010/06/20 22:30:01 | 000,158,243 | ---- | M] () -- C:\Documents and Settings\Pete\Desktop\avast results.JPG
    [2010/06/20 21:34:28 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2010/06/20 21:34:28 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2010/06/20 12:08:31 | 000,000,250 | ---- | M] () -- C:\WINDOWS\BissHM.ini
    [2010/06/20 12:08:25 | 000,000,686 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100620-121323.backup
    [2010/06/20 12:02:43 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Pete\Desktop\HijackThis.lnk
    [2010/06/19 19:58:26 | 000,000,582 | ---- | M] () -- C:\WINDOWS\win.ini
    [2010/06/19 19:58:26 | 000,000,460 | RHS- | M] () -- C:\boot.ini
    [2010/06/18 17:22:52 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/06/18 17:14:36 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
    [2010/06/18 15:34:38 | 002,742,748 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100618-153531.backup
    [2010/06/17 18:29:44 | 000,134,696 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat
    [2010/06/16 15:08:51 | 000,078,612 | ---- | M] () -- C:\ReactorException.dmp
    [2010/06/15 19:31:35 | 002,738,686 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100618-153438.backup
    [2010/06/15 00:45:01 | 002,647,070 | -H-- | M] () -- C:\Documents and Settings\Pete\Local Settings\Application Data\IconCache.db
    [2010/06/14 23:08:41 | 000,000,107 | ---- | M] () -- C:\Documents and Settings\Pete\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
    [2010/06/11 00:50:08 | 002,738,686 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100615-193135.backup
    [2010/06/11 00:10:51 | 000,140,800 | ---- | M] () -- C:\Documents and Settings\Pete\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/05/31 19:49:40 | 000,000,792 | ---- | M] () -- C:\Documents and Settings\Pete\Desktop\StreamTorrent 1.0.lnk
    [2010/05/27 21:43:55 | 000,002,477 | ---- | M] () -- C:\Documents and Settings\Pete\Desktop\Rosetta Stone Version 3.lnk
    [2010/05/26 19:16:33 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CDBurnerXP.lnk
    [2010/05/20 08:46:48 | 002,729,613 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100611-005008.backup
    [2010/05/15 11:53:36 | 002,729,515 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100520-084648.backup
    [2010/05/06 17:07:48 | 002,727,447 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100515-115336.backup
    [2010/05/06 16:59:57 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\avastSS.scr
    [2010/05/06 16:59:36 | 000,165,032 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2010/05/06 16:39:23 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2010/05/06 16:39:00 | 000,164,048 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2010/05/06 16:34:27 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2010/05/06 16:33:59 | 000,100,432 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
    [2010/05/06 16:33:55 | 000,094,800 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
    [2010/05/06 16:33:47 | 000,019,024 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2010/05/06 16:33:29 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
    [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/04/28 23:34:29 | 000,001,478 | ---- | M] () -- C:\Documents and Settings\Pete\Desktop\Tunatic.lnk
    [2010/04/26 13:03:37 | 002,727,087 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100506-170748.backup
    [2010/04/19 16:18:53 | 000,001,908 | ---- | M] () -- C:\WINDOWS\diagwrn.xml
    [2010/04/19 16:18:53 | 000,001,908 | ---- | M] () -- C:\WINDOWS\diagerr.xml
    [2010/04/18 14:03:13 | 002,726,329 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100426-130337.backup
    [2010/04/08 19:24:36 | 000,095,800 | ---- | M] () -- C:\Documents and Settings\Pete\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    [2010/03/31 13:02:38 | 000,345,016 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/03/30 23:07:09 | 002,715,341 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100418-140312.backup
    [2010/03/26 00:52:16 | 000,001,546 | ---- | M] () -- C:\Documents and Settings\Pete\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
    [2010/03/26 00:52:16 | 000,001,528 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ImgBurn.lnk
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2010/06/20 22:26:41 | 000,158,243 | ---- | C] () -- C:\Documents and Settings\Pete\Desktop\avast results.JPG
    [2010/06/20 21:34:28 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2010/06/20 12:02:43 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\Pete\Desktop\HijackThis.lnk
    [2010/06/19 21:30:42 | 2145,427,456 | -HS- | C] () -- C:\hiberfil.sys
    [2010/06/18 04:40:28 | 000,198,056 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
    [2010/05/31 19:49:40 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Pete\Desktop\StreamTorrent 1.0.lnk
    [2010/04/28 23:34:29 | 000,001,478 | ---- | C] () -- C:\Documents and Settings\Pete\Desktop\Tunatic.lnk
    [2010/04/19 16:18:45 | 000,001,908 | ---- | C] () -- C:\WINDOWS\diagwrn.xml
    [2010/04/19 16:18:45 | 000,001,908 | ---- | C] () -- C:\WINDOWS\diagerr.xml
    [2010/04/05 00:24:12 | 000,078,612 | ---- | C] () -- C:\ReactorException.dmp
    [2010/03/26 00:52:16 | 000,001,546 | ---- | C] () -- C:\Documents and Settings\Pete\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
    [2010/03/26 00:52:16 | 000,001,528 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ImgBurn.lnk
    [2009/12/07 02:10:43 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
    [2009/12/07 02:10:43 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
    [2009/12/07 02:10:42 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
    [2009/12/07 02:10:42 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
    [2009/12/07 02:10:41 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
    [2009/12/07 02:10:41 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
    [2009/11/06 11:58:04 | 000,178,975 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
    [2009/10/29 16:59:00 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
    [2009/10/27 12:45:30 | 000,000,250 | ---- | C] () -- C:\WINDOWS\BissHM.ini
    [2009/08/10 12:35:16 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
    [2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
    [2009/08/01 01:18:22 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
    [2009/06/25 17:20:28 | 000,139,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
    [2009/05/22 17:40:34 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
    [2009/05/01 03:31:06 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
    [2009/05/01 03:31:06 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
    [2009/05/01 03:31:06 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
    [2009/05/01 03:31:06 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
    [2008/10/07 12:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
    [2008/10/07 12:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
    [2008/10/07 12:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
    [2008/10/07 12:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
    [2008/10/07 12:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
    [2008/10/07 12:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
    [2008/10/07 12:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
    [2008/10/07 12:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
    [2008/10/07 12:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
    [2008/10/07 12:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
    [2007/05/17 17:52:30 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
    [2007/05/17 17:23:20 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
    [2005/02/17 15:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
    [2005/02/17 15:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
    [2001/11/14 16:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

    ========== LOP Check ==========

    [2009/10/18 15:32:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
    [2010/06/20 21:34:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2009/12/03 04:48:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
    [2009/08/01 01:10:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
    [2010/05/27 21:47:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Rosetta Stone
    [2010/05/27 21:22:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RosettaStoneLtdBackup
    [2009/07/07 01:44:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Stardock
    [2010/06/17 18:29:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
    [2009/06/02 21:26:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ThumbnailCache4R
    [2010/03/30 19:36:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
    [2009/06/02 21:25:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\5600-6600 Series
    [2010/05/26 19:16:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Canneverbe Limited
    [2009/06/16 23:07:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\DAEMON Tools Lite
    [2009/08/01 01:10:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\DAEMON Tools Pro
    [2010/03/26 01:15:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\ImgBurn
    [2009/09/25 15:03:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\Lexmark Productivity Studio
    [2010/04/07 06:35:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\LimeWire
    [2010/05/31 19:49:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\StreamTorrent
    [2009/12/13 10:10:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\SystemRequirementsLab
    [2010/04/29 20:50:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\TeamViewer
    [2009/05/24 20:55:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\TuneUp Software
    [2010/06/19 22:35:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Pete\Application Data\uTorrent
    [2009/12/03 04:29:07 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.exe >

    < %systemroot%\*. /mp /s >

    < %systemroot%\system32\*.dll /lockedfiles >
    [2008/04/14 08:41:52 | 000,033,280 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\cryptdll.dll
    [2008/04/14 08:41:56 | 000,094,720 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iphlpapi.dll
    [2008/05/19 09:33:20 | 004,445,184 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\msi.dll
    [2009/03/08 07:22:38 | 000,156,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\msls31.dll
    [2008/04/14 03:00:48 | 000,061,440 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\msvcrt40.dll
    [2008/04/14 08:42:04 | 000,237,056 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\rasapi32.dll
    [2008/04/14 08:42:04 | 000,061,440 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\rasman.dll
    [2008/04/14 08:42:06 | 000,044,032 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\rtutils.dll
    [2008/04/14 08:42:06 | 000,007,168 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\sensapi.dll
    [2008/04/14 08:42:08 | 000,713,216 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\sxs.dll
    [2008/04/14 08:42:08 | 000,181,760 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\tapi32.dll
    [2008/04/14 02:09:26 | 002,897,920 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\xpsp2res.dll
    [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

    < %systemroot%\Tasks\*.job /lockedfiles >

    < %systemroot%\system32\drivers\*.sys /lockedfiles >

    < %systemroot%\System32\config\*.sav >
    [2009/05/21 22:09:55 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2009/05/21 22:09:55 | 001,089,536 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2009/05/21 22:09:55 | 000,946,176 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 487 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05EE1EEF
    < End of report >
     
  21. 2010/06/23
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Extras.txt :

    OTL Extras logfile created on: 6/23/2010 4:10:58 AM - Run 1
    OTL by OldTimer - Version 3.2.6.1 Folder = C:\Documents and Settings\Pete\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 68.00% Memory free
    5.00 Gb Paging File | 4.00 Gb Available in Paging File | 91.00% Paging File free
    Paging file location(s): D:\pagefile.sys 3072 4096 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 50.00 Gb Total Space | 10.31 Gb Free Space | 20.63% Space Free | Partition Type: NTFS
    Drive D: | 61.78 Gb Total Space | 35.34 Gb Free Space | 57.20% Space Free | Partition Type: NTFS
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: ----------
    Current User Name: Pete
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Standard
    Quick Scan

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1 "
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [MediaMonkey.1Play] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
    Directory [MediaMonkey.2PlayNext] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
    Directory [MediaMonkey.3Enqueue] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
    Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
    Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
    Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "D:\Games\Combat Arms\CombatArms.exe" = D:\Games\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe -- File not found
    "D:\Games\Combat Arms\Engine.exe" = D:\Games\Combat Arms\Engine.exe:*Enabled:Engine.exe -- File not found
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
    "C:\Nexon\Combat Arms\CombatArms.exe" = C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe -- File not found
    "C:\Nexon\Combat Arms\Engine.exe" = C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe -- File not found
    "C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe" = C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe:*:Enabled:Rosetta Stone Ltd Services -- (Rosetta Stone Ltd. )
    "C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe" = C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe:*:Enabled:Rosetta Stone Version 3 Application -- (Multidmedia Limited )

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\FlashGet\flashget.exe" = C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget -- (FlashGet.com)
    "C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
    "D:\Games\FEAR\FEAR.exe" = D:\Games\FEAR\FEAR.exe:*:Enabled:FEAR -- (Monolith Productions, Inc.)
    "D:\Games\FEAR\FEARMP.exe" = D:\Games\FEAR\FEARMP.exe:*:Enabled:FEAR -- (Monolith Productions, Inc.)
    "D:\Games\FEAR\FEARXP\FEARXP.exe" = D:\Games\FEAR\FEARXP\FEARXP.exe:*:Enabled:FEARXP -- (Monolith Productions, Inc.)
    "D:\Games\FEAR Perseus Mandate\FEARXP2.exe" = D:\Games\FEAR Perseus Mandate\FEARXP2.exe:*:Enabled:FEARXP2 -- (TimeGate Studios, Inc.)
    "C:\Program Files\Ventrilo\Ventrilo.exe" = C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe -- (Flagship Industries, Inc.)
    "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL LLC)
    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
    "C:\Program Files\TeamViewer\Version5\TeamViewer.exe" = C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
    "C:\Program Files\Microsoft Office\Office14\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace -- (Microsoft Corporation)
    "C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
    "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
    "C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
    "C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe" = C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe:*:Enabled:Ubisoft Game Launcher -- (Ubisoft)
    "C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe" = C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe:*:Enabled:Rosetta Stone Ltd Services -- (Rosetta Stone Ltd. )
    "C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe" = C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe:*:Enabled:Rosetta Stone Version 3 Application -- (Multidmedia Limited )


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    "{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable
    "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
    "{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
    "{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{20140000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 14 (Beta)
    "{20140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010 (Beta)
    "{20140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010 (Beta)
    "{20140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010 (Beta)
    "{20140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010 (Beta)
    "{20140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010 (Beta)
    "{20140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010 (Beta)
    "{20140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010 (Beta)
    "{20140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 (Beta)
    "{20140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 (Beta)
    "{20140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010 (Beta)
    "{20140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010 (Beta)
    "{20140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010 (Beta)
    "{20140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010 (Beta)
    "{20140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010 (Beta)
    "{20140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010 (Beta)
    "{20140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010 (Beta)
    "{20140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010 (Beta)
    "{20140000-011A-0000-0000-0000000FF1CE}" = Microsoft Office Send-a-Smile
    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
    "{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
    "{2B653229-9854-4989-B780-D978F5F13EAB}" = FEAR
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
    "{7CC71C42-99C1-4A28-B20B-FC47516975FD}" = TouchChip USB Driver 2.9
    "{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
    "{813EE1F0-D251-4F98-AC91-9B98CF22717E}" = WD Drive Manager (x86)
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
    "{85F4CBCB-9BBC-4B50-A7D8-E1106771498D}" = Orca
    "{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8D0BB1D1-E9FB-49E9-A9C1-09C00F38DA0C}" = FEAR Perseus Mandate
    "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
    "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
    "{909BBDB7-BABE-434C-9124-863A9F8D1CF8}" = FEAR Extraction Point
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{99011A6E-5200-11DE-BDB8-7ACD56D89593}" = Rosetta Stone Version 3
    "{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
    "{A1C962E2-2426-49C6-A38B-9A07E40D607C}" = Microsoft Games for Windows - LIVE
    "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
    "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
    "{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
    "{A931C76A-8189-4485-A686-53A91658CD30}" = B.I.S.S. Hosts Manager
    "{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
    "{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
    "{AC76BA86-7AD7-2448-0000-900000000003}" = Chinese Traditional Fonts Support For Adobe Reader 9
    "{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
    "{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes
    "{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
    "{DD1865F0-AD73-40FB-B23E-1822E02396FF}" = NVIDIA PhysX
    "{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
    "{E40CE517-0D42-4198-96B4-C8232B257EB5}" = Data Lifeguard Diagnostic for Windows
    "{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
    "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
    "{FE3997D3-6B56-4AC4-A99C-9DDFC45359BF}" = TuneUp Utilities Language Pack (en-US)
    "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    "4569969E1360D2854474C661EF9B4D54F143EB16" = Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04)
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "Advanced Audio FX Engine" = Advanced Audio FX Engine
    "Advanced Video FX Engine" = Advanced Video FX Engine
    "AIM_7" = AIM 7
    "avast5" = avast! Free Antivirus
    "CCleaner" = CCleaner
    "Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
    "DELL Webcam Center" = DELL Webcam Center
    "DELL Webcam Manager" = DELL Webcam Manager
    "EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.01
    "FlashGet" = FlashGet 1.9.6.1073
    "Fraps" = Fraps
    "Google Earth Pro 4.2" = Google Earth Pro 4.2
    "HijackThis" = HijackThis 2.0.2
    "ie8" = Windows Internet Explorer 8
    "ImgBurn" = ImgBurn
    "iOpus Password Recovery XP" = iOpus Password Recovery XP
    "KLiteCodecPack_is1" = K-Lite Codec Pack 5.4.4 (Full)
    "LimeWire" = LimeWire PRO 5.4.7
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "MediaMonkey_is1" = MediaMonkey 3.2
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Mozilla Firefox (3.6.4)" = Mozilla Firefox (3.6.4)
    "NVIDIA Drivers" = NVIDIA Drivers
    "Office14.PROPLUS" = Microsoft Office Professional Plus 2010
    "PeerGuardian_is1" = PeerGuardian 2.0
    "PowerISO" = PowerISO
    "ProInst" = Intel(R) PROSet/Wireless Software
    "PunkBusterSvc" = PunkBuster Services
    "StreamTorrent 1.0" = StreamTorrent 1.0
    "SystemRequirementsLab" = System Requirements Lab
    "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
    "TeamViewer 5" = TeamViewer 5
    "The Blocklist Manager_is1" = BLM 2.7.7
    "Tunatic" = Tunatic
    "TuneUp Utilities" = TuneUp Utilities
    "VLC media player" = VLC media player 1.0.5
    "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    "Winamp" = Winamp
    "WinLiveSuite_Wave3" = Windows Live Essentials
    "WinRAR archiver" = WinRAR archiver
    "Yahoo! Messenger" = Yahoo! Messenger

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "FlashMute" = FlashMute
    "uTorrent" = µTorrent

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 5/13/2010 1:56:58 PM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application cursorfx.exe, version 2.0.0.1, faulting module
    unknown, version 0.0.0.0, fault address 0x6356b870.

    Error - 5/24/2010 11:13:45 AM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application teamviewer.exe, version 5.0.7478.0, faulting
    module teamviewer.exe, version 5.0.7478.0, fault address 0x0015f630.

    Error - 5/31/2010 7:44:54 PM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application softonicdownloader56473.exe, version 0.0.0.0,
    faulting module unknown, version 0.0.0.0, fault address 0x003e4c41.

    Error - 6/5/2010 1:36:09 PM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application yahoomessenger.exe, version 10.0.0.1102, faulting
    module ntdll.dll, version 5.1.2600.5755, fault address 0x00010cce.

    Error - 6/14/2010 10:13:27 PM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application winstyler.exe, version 9.0.4020.33, faulting
    module vcl120.bpl, version 12.0.3210.17555, fault address 0x000b7f43.

    Error - 6/17/2010 2:31:28 PM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application smss.exe, version 1.0.0.1, faulting module ntdll.dll,
    version 5.1.2600.5755, fault address 0x000369da.

    Error - 6/17/2010 6:29:54 PM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application wdbtnmgrui.exe, version 2.0.115.0, faulting module
    unknown, version 0.0.0.0, fault address 0x6356b870.

    Error - 6/20/2010 4:53:48 AM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module mshtml.dll, version 8.0.6001.18904, fault address 0x000f460f.

    Error - 6/20/2010 4:53:52 AM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module msctfime.ime, version 5.1.2600.5768, fault address 0x00016a95.

    Error - 6/20/2010 4:53:56 AM | Computer Name = ---------- | Source = Application Error | ID = 1000
    Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
    dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

    [ System Events ]
    Error - 6/19/2010 8:30:35 PM | Computer Name = ---------- | Source = Service Control Manager | ID = 7001
    Description = The TCP/IP NetBIOS Helper service depends on the AFD service which
    failed to start because of the following error: %%31

    Error - 6/19/2010 8:30:35 PM | Computer Name = ---------- | Source = Service Control Manager | ID = 7001
    Description = The Apple Mobile Device service depends on the TCP/IP Protocol Driver
    service which failed to start because of the following error: %%31

    Error - 6/19/2010 8:30:35 PM | Computer Name = ---------- | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL SCDEmu sptd Tcpip

    Error - 6/19/2010 9:22:07 PM | Computer Name = ---------- | Source = sptd | ID = 262148
    Description = Driver detected an internal error in its data structures for .

    Error - 6/19/2010 9:22:28 PM | Computer Name = ---------- | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service MDM with arguments
    " " in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}

    Error - 6/19/2010 9:23:31 PM | Computer Name = ---------- | Source = Service Control Manager | ID = 7001
    Description = The DHCP Client service depends on the NetBios over Tcpip service
    which failed to start because of the following error: %%31

    Error - 6/19/2010 9:23:31 PM | Computer Name = ---------- | Source = Service Control Manager | ID = 7001
    Description = The TCP/IP NetBIOS Helper service depends on the AFD service which
    failed to start because of the following error: %%31

    Error - 6/19/2010 9:23:31 PM | Computer Name = ---------- | Source = Service Control Manager | ID = 7001
    Description = The Apple Mobile Device service depends on the TCP/IP Protocol Driver
    service which failed to start because of the following error: %%31

    Error - 6/19/2010 9:23:31 PM | Computer Name = ---------- | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL SCDEmu sptd Tcpip

    Error - 6/19/2010 9:29:53 PM | Computer Name = ---------- | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service MDM with arguments
    " " in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}

    [ TuneUp Events ]
    Error - 7/5/2009 4:08:26 PM | Computer Name = ---------- | Source = TuneUp Program Statistics | ID = 131840
    Description =

    Error - 7/5/2009 4:08:36 PM | Computer Name = ---------- | Source = TuneUp Program Statistics | ID = 131840
    Description =

    Error - 7/5/2009 8:21:31 PM | Computer Name = ---------- | Source = TuneUp Program Statistics | ID = 131840
    Description =


    < End of report >
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.