Solved WIN xp bogs down; ok in safe mode

JAK · 2012/12/07

[Resolved] WIN xp bogs down; ok in safe mode

Win XP, sp3: I posted at Win XP post and team member told me that I had malware and to repost over here. He gave me the malware removal page to work through and then to post results. As I tried to download the DDS from mirror 1, Avast blocked bleeping computer and said the file is a virus. Is that normal for av to see that file that way?
And if not possible to run malwarebytes, etc normally does running it in safemode produce the same results log wise?

broni · 2012/12/07

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=============================

I use Avast as well and it doesn't complain about DDS.
Is your Avast up to date?

I prefer all logs from normal mode unless normal mode is a total no go.

JAK · 2012/12/08

Was going to ask where to begin but I see it on the homepage of this section.

broni · 2012/12/08

Please, complete all steps listed HERE

JAK · 2012/12/10

Comp is 100 miles away and thought I could walk them thru it over the phone, but probably not. So I will get it this Sunday. If this post can wait otherwise I can repost then.

broni · 2012/12/10

No problem

JAK · 2012/12/16

WIN xp bogs down; ok in safe mode II

The other thread was closed out so I'm starting this one with the same info from
"WIN xp bogs down; ok in safe mode ".
I got the comp here now. Ran Malwarebytes in regular Windows mode and it ran and said no malicious items. But now I can't open the log. Just sits there. When I had gone to update MB it couldn't because of error 732 (0,0).
In Explore - Programs - MB - there isn't a "log" listed.

JAK · 2012/12/16

got the log in safemode

Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 3
12/16/2012 1:59:28 PM
mbam-log-2012-12-16 (13-59-28).txt
Scan type: Quick Scan
Objects scanned: 94221
Time elapsed: 8 minute(s), 5 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

JAK · 2012/12/16

aswmbr log

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-12-16 16:09:36
-----------------------------
16:09:36.937 OS Version: Windows 5.1.2600 Service Pack 3
16:09:36.937 Number of processors: 1 586 0x209
16:09:36.953 ComputerName: S50 UserName:
16:09:37.875 Initialize success
16:09:38.031 AVAST engine defs: 12121601
16:09:44.781 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
16:09:44.781 Disk 0 Vendor: WDC_WD400BB-23JHA1 06.01C06 Size: 38162MB BusType: 3
16:09:44.781 Device \Driver\atapi -> DriverStartIo 85e652e2
16:09:44.796 Disk 0 MBR read successfully
16:09:44.796 Disk 0 MBR scan
16:09:44.812 Disk 0 Windows XP default MBR code
16:09:44.812 Disk 0 MBR hidden
16:09:44.812 Disk 0 Partition 1 00 07 HPFS/NTFS NTFS 38154 MB offset 63
16:09:44.828 Disk 0 scanning sectors +78140160
16:09:44.890 Disk 0 scanning C:\WINDOWS\system32\drivers
16:10:02.500 Service scanning
16:10:45.078 Modules scanning
16:11:03.453 Disk 0 trace - called modules:
16:11:03.468 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x85e654b1]<<
16:11:03.468 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86383ab8]
16:11:03.468 3 CLASSPNP.SYS[f7649fd7] -> nt!IofCallDriver -> \Device\0000005f[0x863c7a08]
16:11:03.468 5 ACPI.sys[f75c0620] -> nt!IofCallDriver -> [0x863df940]
16:11:03.468 \Driver\atapi[0x8613c030] -> IRP_MJ_CREATE -> 0x85e654b1
16:11:05.093 AVAST engine scan C:\WINDOWS
16:11:37.437 AVAST engine scan C:\WINDOWS\system32
16:15:20.546 AVAST engine scan C:\WINDOWS\system32\drivers
16:15:26.703 AVAST engine scan C:\Documents and Settings\OWNER
16:23:22.343 AVAST engine scan C:\Documents and Settings\All Users
16:43:57.828 Scan finished successfully
16:45:31.656 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\OWNER\Desktop\MBR.dat "
16:45:31.656 The log file has been saved successfully to "C:\Documents and Settings\OWNER\Desktop\aswMBR.txt "

JAK · 2012/12/16

dds log

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 4/1/2009 9:34:44 PM
System Uptime: 12/16/2012 4:07:16 PM (0 hours ago)
.
Motherboard: IBM | | IBM
Processor: Intel(R) Pentium(R) 4 CPU 2.66GHz | WMT478/NWD | 2659/133mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 12.174 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP612: 12/12/2012 10:31:07 PM - Software Distribution Service 3.0
RP613: 12/13/2012 5:31:39 AM - Software Distribution Service 3.0
RP614: 12/13/2012 6:53:16 AM - Software Distribution Service 3.0
RP615: 12/13/2012 9:09:18 AM - Software Distribution Service 3.0
RP616: 12/13/2012 9:53:28 AM - Software Distribution Service 3.0
RP617: 12/14/2012 3:47:37 PM - Software Distribution Service 3.0
.
==== Installed Programs ======================
.
"Nero SoundTrax Help
10 Talismans
7 Artifacts
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player 11 ActiveX
Adobe Reader 9.1
Adobe Shockwave Player 11.5
Advertising Center
Angkor (remove only)
Apple Mobile Device Support
Apple Software Update
Around the World in 80 Days (remove only)
avast! Free Antivirus
Babylon toolbar
Big Fish Games: Game Manager
Bonjour
Call of Atlantis (remove only)
Clickotrickz
Compatibility Pack for the 2007 Office system
Cradle of Egypt: Collector's Edition (remove only)
Cradle Of Persia (remove only)
Cradle Of Rome (remove only)
Cradle of Rome 2: Premium Edition (remove only)
Critical Update for Windows Media Player 11 (KB959772)
CWA Reminder by We-Care.com v4.0.19.3
DealCabby
DefaultTab
Diskeeper 2009 Pro Premier
DolbyFiles
Enchanted Cavern (remove only)
Enchanted Cavern 2 (remove only)
Fitz
Freeze.com NetAssistant
GameHouse
GamingWonderland Toolbar
Google Toolbar for Internet Explorer
Google Update Helper
Heroes of Hellas (remove only)
HiJackThis version 2.0.4
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
ImagXpress
Intel(R) Extreme Graphics 2 Driver
Intel(R) Network Connections Drivers
IrfanView (remove only)
iTunes
iWin Games (remove only)
Java Auto Updater
Java(TM) 6 Update 26
Jewel of Atlantis
Jewel Quest (remove only)
Jewel Quest II (remove only)
Jewel Quest III (remove only)
Jewel Quest Mysteries: Curse of the Emerald Tear (remove only)
Jewel Quest Mysteries: The Oracle of Ur - Collector's Edition (remove only)
Jewel Quest Mysteries: The Seventh Gate Collector's Edition (remove only)
Jewel Quest The Sleepless Star (remove only)
Jewel Quest: Heritage (remove only)
Jewel Quest: The Sapphire Dragon -- Collector's Edition (remove only)
Lamp of Aladdin (remove only)
Learning Essentials for Microsoft Office
Linez
Linkz
Malwarebytes' Anti-Malware
MapsGalaxy Toolbar
Menu Templates - Starter Kit
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656370)
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft English TTS Engine
Microsoft Math
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access database engine 2007 (English)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.5
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Streets & Trips 2009
Microsoft Student 2007 for Learning Essentials
Microsoft Student with Encarta Premium 2009
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox (3.0.8)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser
Mystic Palace
Mystika
Nero 9 Trial
Nero Burning ROM Help
Nero BurnRights
Nero ControlCenter
Nero CoverDesigner
Nero CoverDesigner Help
Nero Disc Copy Gadget
Nero Disc Copy Gadget Help
Nero DiscSpeed
Nero DriveSpeed
Nero Express Help
Nero InfoTool
Nero Installer
Nero Recode
Nero Recode Help
Nero Rescue Agent
Nero RescueAgent Help
Nero ShowTime
Nero StartSmart
Nero StartSmart Help
Nero Vision
Nero WaveEditor
Nero WaveEditor Help
NeroBurningROM
NeroExpress
neroxml
NetAssistant
NTREGOPT 1.1j
OGA Notifier 2.0.0048.0
OpenAL
Paradise Quest
Paragon Drive Backup™ 9 Professional
QuickTime
Rainforest Adventure
RealArcade
RegSupreme
Rise of Atlantis (remove only)
SAPI Wrapper
Season Match (remove only)
Secrets of Olympus
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2482017)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Slot Quest - The Museum Escape
SoundTrax
Spell Checker For OE 2.1
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
SUPERAntiSpyware
Temple of Jewels
Tibet Quest (remove only)
TranslatorBar_1 Toolbar
Treasures of Montezuma 2 (remove only)
Triadz
TTS Wrapper
Tweak UI
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB957244)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB957241)
Update for Microsoft Office Excel 2007 Help (KB957242)
Update for Microsoft Office InfoPath 2007 Help (KB957243)
Update for Microsoft Office OneNote 2007 Help (KB957245)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB957246)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760573) 32-Bit Edition
Update for Microsoft Office PowerPoint 2007 Help (KB957247)
Update for Microsoft Office Publisher 2007 Help (KB957249)
Update for Microsoft Office Word 2007 Help (KB957252)
Update for Microsoft Script Editor Help (KB957253)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB898461)
Update for Windows XP (KB943729)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC 9.0 Runtime
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.8a
Web Games Player Plugin
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows PowerShell(TM) 1.0
Windows PowerShell(TM) 1.0 MUI pack
Woodville Chronicles
Yahoo! Software Update
Yontoo 1.10.03
.
==== Event Viewer Messages From Past Week ========
.
12/9/2012 6:26:22 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/16/2012 3:32:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
12/16/2012 3:32:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments " " in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
12/13/2012 5:31:20 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service gupdate1c9cad0f3b9b694 with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
12/13/2012 10:16:19 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service MSIServer with arguments " " in order to run the server: {000C101C-0000-0000-C000-000000000046}
12/10/2012 8:37:22 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service gusvc with arguments " " in order to run the server: {89DAE4CD-9F17-4980-902A-99BA84A8F5C8}
.
==== End Of File ===========================

JAK · 2012/12/16

other dds log

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26
Run by OWNER at 16:55:50 on 2012-12-16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.568 [GMT -6:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ================
.
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Documents and Settings\OWNER\Application Data\DefaultTab\DefaultTab\DTUpdate.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\iWin Games\iWinTrusted.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uURLSearchHooks: TranslatorBar 1 Toolbar: {00bf7b9c-acd2-4080-bea8-b1c41987070f} - c:\program files\translatorbar_1\prxtbTra2.dll
uURLSearchHooks: <No Name>: {a8625cb7-85fe-4936-92a4-b2a7c925209e} -
uURLSearchHooks: <No Name>: {26842a09-ffa8-4e2c-ae12-0c80f01c3295} -
uURLSearchHooks: NetAssistant: {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - c:\program files\freeze.com\netassistant\NetAssistant.dll
uURLSearchHooks: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - <orphaned>
BHO: TranslatorBar 1 Toolbar: {00bf7b9c-acd2-4080-bea8-b1c41987070f} - c:\program files\translatorbar_1\prxtbTra2.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} - c:\documents and settings\owner\application data\defaulttab\defaulttab\DefaultTabBHO.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.7529.1424\swg.dll
BHO: DealCabby: {CF3EE69A-4099-46C8-A62E-ABB2FD5447BB} - c:\documents and settings\owner\local settings\application data\dealcabby\ie\dealcabby_20121014101001.dll
BHO: WeCareReminder Class: {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - c:\documents and settings\all users\application data\wecarereminder\IEHelperv2.5.0.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: NetAssistant: {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - c:\program files\freeze.com\netassistant\NetAssistant.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -
TB: TranslatorBar 1 Toolbar: {00BF7B9C-ACD2-4080-BEA8-B1C41987070F} - c:\program files\translatorbar_1\prxtbTra2.dll
TB: MapsGalaxy: {364EA597-E728-4CE4-BB4A-ED846EF47970} -
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: GamingWonderland: {A899079D-206F-43A6-BE6A-07E0FA648EA0} -
TB: TranslatorBar 1 Toolbar: {00bf7b9c-acd2-4080-bea8-b1c41987070f} - c:\program files\translatorbar_1\prxtbTra2.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1150595.exe -Update -1150595 - "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)" - "http://www.gamingwonderland.com/games/free-casino/skull-and-bones-slots "
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32
dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
dRunOnce: [AutoLaunch] c:\program files\lavasoft\ad-aware\AutoLaunch.exe monthly
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
uPolicies-Explorer: NoResolveTrack = dword:1
uPolicies-Explorer: NoSMMyPictures = dword:1
uPolicies-Explorer: StartMenuLogoff = dword:1
uPolicies-Explorer: NoSMConfigurePrograms = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: ForceClassicControlPanel = dword:1
mPolicies-Explorer: NoResolveTrack = dword:1
mPolicies-Explorer: NoSMMyPictures = dword:1
mPolicies-Explorer: NoSMHelp = dword:1
mPolicies-Explorer: StartMenuLogoff = dword:1
mPolicies-Explorer: NoSMConfigurePrograms = dword:1
IE: &Search - http://tbedits.gamingwonderland.com...89C4-4804-B3D5-D07D92AD50F9&n=2012042213&cv=1
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - LocalServer32 - <no file>
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD}
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238635888656
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238715092234
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
TCP: NameServer = 192.168.254.254
TCP: Interfaces\{44989D3C-CD8C-4F65-B35C-1082BBDBB7FE} : DHCPNameServer = 192.168.254.254
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\ibiewnsb.default\
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?affID=110803&tt=031012_IKAN_4112_1&babsrc=HP_ss&mntrId=7818ce3400000000000000096b2ffbb7
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=110803&tt=031012_IKAN_4112_1&babsrc=KW_ss&mntrId=7818ce3400000000000000096b2ffbb7&q=
FF - plugin: c:\documents and settings\all users\application data\realarcade\npraclient.dll
FF - plugin: c:\documents and settings\all users\application data\zylom\zylomgamesplayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mapsgalaxy_39\bar\1.bin\NP39Stub.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npraclient.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npzylomgamesplayer.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=7818ce3400000000000000096b2ffbb7&q=
FF - user.js: extensions.BabylonToolbar.id - 7818ce3400000000000000096b2ffbb7
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15627
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.0.7
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.0.7
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.0.79:17:31
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110803&tt=031012_IKAN_4112_1
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extentions.y2layers.installId - 9377cdcc-0de9-40f9-8df5-ca2ace0b9809
FF - user.js: extentions.y2layers.defaultEnableAppsList - easyinline,YontooNewOffers
.
.
============= SERVICES / DRIVERS ===============
.
R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [2009-4-3 40464]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-11-29 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-11-29 361032]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-6-29 116608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-11-29 21256]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-11-29 44808]
R2 DefaultTabUpdate;DefaultTabUpdate;c:\documents and settings\owner\application data\defaulttab\defaulttab\DTUpdate.exe [2012-11-23 107520]
R2 iWinTrusted;iWinTrusted;c:\program files\iwin games\iWinTrusted.exe [2011-4-8 176848]
S0 Lbd;Lbd; [x]
S1 SABKUTIL;SABKUTIL; [x]
S2 gupdate1c9cad0f3b9b694;Google Update Service (gupdate1c9cad0f3b9b694);c:\program files\google\update\GoogleUpdate.exe [2009-5-1 133104]
.
=============== Created Last 30 ================
.
2012-12-16 19:21:20 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2012-12-16 19:21:20 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2012-12-11 23:27:20 -------- dc----w- c:\documents and settings\all users\application data\Grey Alien Games
2012-12-04 10:49:39 -------- d-----w- c:\program files\Microsoft
2012-11-30 03:25:24 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-11-30 03:24:35 41224 ----a-w- c:\windows\avastSS.scr
2012-11-27 21:59:08 -------- d-----w- c:\windows\system32\wbem\repository\FS
2012-11-27 21:59:08 -------- d-----w- c:\windows\system32\wbem\Repository
2012-11-23 17:09:07 -------- d-----w- c:\documents and settings\owner\application data\DefaultTab
2012-11-23 17:08:44 -------- d-----w- c:\program files\Freeze.com
2012-11-23 17:08:41 -------- d-----w- c:\program files\Yontoo
2012-11-23 17:08:13 -------- dc----w- c:\documents and settings\all users\application data\Tarma Installer
2012-11-23 17:07:59 -------- d-----w- c:\program files\Yahoo!
2012-11-23 16:52:45 -------- d-----w- c:\documents and settings\owner\application data\DriverCure
2012-11-23 16:52:43 -------- d-----w- c:\documents and settings\owner\application data\PC Utility Kit
2012-11-23 16:52:06 -------- dc----w- c:\documents and settings\all users\application data\PC Utility Kit
2012-11-22 18:12:55 -------- dc----w- c:\documents and settings\all users\application data\AVAST Software
2012-11-22 18:12:55 -------- d-----w- c:\program files\AVAST Software
2012-11-17 12:23:13 -------- d-----w- c:\documents and settings\owner\application data\My Games
.
==================== Find3M ====================
.
2012-12-11 21:49:23 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-11 21:49:23 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
1999-10-31 03:54:32 561152 -c--a-w- c:\program files\Convert.exe
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD400BB-23JHA1 rev.06.01C06 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x85E654B1]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x85e6c93c]; MOV EAX, [0x85e6cab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x86383AB8]
3 CLASSPNP[0xF7649FD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\0000005f[0x863C7A08]
5 ACPI[0xF75C0620] -> nt!IofCallDriver[0x804E37D5] -> [0x863DF940]
\Driver\atapi[0x8613C030] -> IRP_MJ_CREATE -> 0x85E654B1
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x85E652E2
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 16:56:45.56 ===============

JAK · 2012/12/16

Surprised I was able to run all of this in regular mode and not safemode. Just couldn't get the log from MB till I went over to safemode.
thanks!

broni · 2012/12/16

At the beginning of your previous topic I clearly stated:

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
Click to expand...

This time I merged both topics.

==========================================

Download TDSSKiller and save it to your desktop.

Extract (unzip) its contents to your desktop.

Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

If an infected file is detected, the default action will be Cure, click on Continue.

If a suspicious file is detected, the default action will be Skip, click on Continue.

It may ask you to reboot the computer to complete the process. Click on Reboot Now.

If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.

If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

JAK · 2012/12/16

Sorry, didn't catch that line.

JAK · 2012/12/16

tdsskiller log part 1

17:37:09.0968 4056 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
17:37:11.0781 4056 ============================================================
17:37:11.0781 4056 Current date / time: 2012/12/16 17:37:11.0781
17:37:11.0781 4056 SystemInfo:
17:37:11.0781 4056
17:37:11.0781 4056 OS Version: 5.1.2600 ServicePack: 3.0
17:37:11.0781 4056 Product type: Workstation
17:37:11.0781 4056 ComputerName: S50
17:37:11.0781 4056 UserName: OWNER
17:37:11.0781 4056 Windows directory: C:\WINDOWS
17:37:11.0781 4056 System windows directory: C:\WINDOWS
17:37:11.0781 4056 Processor architecture: Intel x86
17:37:11.0781 4056 Number of processors: 1
17:37:11.0781 4056 Page size: 0x1000
17:37:11.0781 4056 Boot type: Normal boot
17:37:11.0781 4056 ============================================================
17:37:13.0093 4056 BG loaded
17:37:13.0953 4056 Drive \Device\Harddisk0\DR0 - Size: 0x951240000 (37.27 Gb), SectorSize: 0x200, Cylinders: 0x1301, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:37:13.0984 4056 ============================================================
17:37:13.0984 4056 \Device\Harddisk0\DR0:
17:37:13.0984 4056 MBR partitions:
17:37:13.0984 4056 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A852C1
17:37:13.0984 4056 ============================================================
17:37:14.0015 4056 C: <-> \Device\Harddisk0\DR0\Partition1
17:37:14.0015 4056 ============================================================
17:37:14.0015 4056 Initialize success
17:37:14.0015 4056 ============================================================
17:37:25.0250 1520 ============================================================
17:37:25.0250 1520 Scan started
17:37:25.0250 1520 Mode: Manual;
17:37:25.0250 1520 ============================================================
17:37:25.0515 1520 ================ Scan system memory ========================
17:37:25.0531 1520 System memory - ok
17:37:25.0531 1520 ================ Scan services =============================
17:37:25.0609 1520 [ 01E81C84AD1D0ACC61CF3CFD06632210 ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
17:37:25.0625 1520 !SASCORE - ok
17:37:25.0828 1520 [ 149A8F7ADF9742554DC323E290551E3E ] Aavmker4 C:\WINDOWS\system32\drivers\Aavmker4.sys
17:37:25.0828 1520 Aavmker4 - ok
17:37:25.0843 1520 Abiosdsk - ok
17:37:25.0859 1520 abp480n5 - ok
17:37:25.0890 1520 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:37:25.0906 1520 ACPI - ok
17:37:25.0953 1520 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
17:37:25.0968 1520 ACPIEC - ok
17:37:26.0046 1520 [ 95CE557D16A75606CCC2D7F3B0B0BCCB ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
17:37:26.0062 1520 AdobeFlashPlayerUpdateSvc - ok
17:37:26.0078 1520 adpu160m - ok
17:37:26.0109 1520 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
17:37:26.0125 1520 aec - ok
17:37:26.0187 1520 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
17:37:26.0187 1520 AFD - ok
17:37:26.0203 1520 Aha154x - ok
17:37:26.0218 1520 aic78u2 - ok
17:37:26.0218 1520 aic78xx - ok
17:37:26.0250 1520 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
17:37:26.0250 1520 Alerter - ok
17:37:26.0281 1520 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
17:37:26.0281 1520 ALG - ok
17:37:26.0296 1520 AliIde - ok
17:37:26.0312 1520 amsint - ok
17:37:26.0406 1520 [ 367592EFCA7FF8B4CE11AB6B0744E1E2 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
17:37:26.0406 1520 Apple Mobile Device - ok
17:37:26.0453 1520 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
17:37:26.0453 1520 AppMgmt - ok
17:37:26.0453 1520 asc - ok
17:37:26.0468 1520 asc3350p - ok
17:37:26.0484 1520 asc3550 - ok
17:37:26.0609 1520 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
17:37:26.0609 1520 aspnet_state - ok
17:37:26.0656 1520 [ DE6ED95AEF259979B2830450072A627B ] aswFsBlk C:\WINDOWS\system32\drivers\aswFsBlk.sys
17:37:26.0656 1520 aswFsBlk - ok
17:37:26.0703 1520 [ 84F0BE324EE111338589F448C3E8BAB2 ] aswMon2 C:\WINDOWS\system32\drivers\aswMon2.sys
17:37:26.0703 1520 aswMon2 - ok
17:37:26.0718 1520 [ 7C9F0A2AB17D52261A9252A2EB320884 ] AswRdr C:\WINDOWS\system32\drivers\AswRdr.sys
17:37:26.0718 1520 AswRdr - ok
17:37:26.0859 1520 [ B32E9AD44A1DBB3E8095E80F8DF32B03 ] aswSnx C:\WINDOWS\system32\drivers\aswSnx.sys
17:37:26.0875 1520 aswSnx - ok
17:37:26.0906 1520 [ 67B558895695545FB0568B7541F3BCA7 ] aswSP C:\WINDOWS\system32\drivers\aswSP.sys
17:37:26.0906 1520 aswSP - ok
17:37:26.0953 1520 [ E3E73B2B73A4DFADFDDF557192C4B08A ] aswTdi C:\WINDOWS\system32\drivers\aswTdi.sys
17:37:26.0953 1520 aswTdi - ok
17:37:26.0984 1520 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:37:27.0015 1520 AsyncMac - ok
17:37:27.0046 1520 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
17:37:27.0046 1520 atapi - ok
17:37:27.0062 1520 Atdisk - ok
17:37:27.0078 1520 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:37:27.0078 1520 Atmarpc - ok
17:37:27.0093 1520 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
17:37:27.0093 1520 AudioSrv - ok
17:37:27.0125 1520 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
17:37:27.0125 1520 audstub - ok
17:37:27.0187 1520 [ 8FA553E9AE69808D99C164733A0F9590 ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
17:37:27.0187 1520 avast! Antivirus - ok
17:37:27.0234 1520 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
17:37:27.0234 1520 Beep - ok
17:37:27.0281 1520 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll
17:37:27.0328 1520 BITS - ok
17:37:27.0359 1520 [ 3F56903E124E820AEECE6D471583C6C1 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
17:37:27.0359 1520 Bonjour Service - ok
17:37:27.0406 1520 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll
17:37:27.0406 1520 Browser - ok
17:37:27.0437 1520 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
17:37:27.0437 1520 cbidf2k - ok
17:37:27.0453 1520 cd20xrnt - ok
17:37:27.0484 1520 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
17:37:27.0484 1520 Cdaudio - ok
17:37:27.0515 1520 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
17:37:27.0515 1520 Cdfs - ok
17:37:27.0531 1520 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:37:27.0531 1520 Cdrom - ok
17:37:27.0546 1520 Changer - ok
17:37:27.0562 1520 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
17:37:27.0562 1520 CiSvc - ok
17:37:27.0578 1520 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
17:37:27.0593 1520 ClipSrv - ok
17:37:27.0625 1520 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:37:27.0625 1520 clr_optimization_v2.0.50727_32 - ok
17:37:27.0640 1520 CmdIde - ok
17:37:27.0656 1520 COMSysApp - ok
17:37:27.0671 1520 Cpqarray - ok
17:37:27.0703 1520 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
17:37:27.0703 1520 CryptSvc - ok
17:37:27.0718 1520 dac2w2k - ok
17:37:27.0734 1520 dac960nt - ok
17:37:27.0765 1520 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
17:37:27.0781 1520 DcomLaunch - ok
17:37:27.0875 1520 [ 34AE0DFA3EE3B5B9975042D87332D0B7 ] DefaultTabUpdate C:\Documents and Settings\OWNER\Application Data\DefaultTab\DefaultTab\DTUpdate.exe
17:37:27.0875 1520 DefaultTabUpdate - ok
17:37:27.0906 1520 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
17:37:27.0906 1520 Dhcp - ok
17:37:27.0921 1520 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
17:37:27.0921 1520 Disk - ok
17:37:28.0015 1520 [ 54F9BD9B99A6A1ADB030AD503707CA55 ] Diskeeper C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
17:37:28.0031 1520 Diskeeper - ok
17:37:28.0031 1520 dmadmin - ok
17:37:28.0093 1520 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
17:37:28.0109 1520 dmboot - ok
17:37:28.0140 1520 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
17:37:28.0140 1520 dmio - ok
17:37:28.0187 1520 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
17:37:28.0187 1520 dmload - ok
17:37:28.0203 1520 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
17:37:28.0218 1520 dmserver - ok
17:37:28.0250 1520 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
17:37:28.0250 1520 DMusic - ok
17:37:28.0281 1520 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
17:37:28.0281 1520 Dnscache - ok
17:37:28.0312 1520 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
17:37:28.0312 1520 Dot3svc - ok
17:37:28.0328 1520 dpti2o - ok
17:37:28.0359 1520 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
17:37:28.0359 1520 drmkaud - ok
17:37:28.0390 1520 [ AC9CF17EE2AE003C98EB4F5336C38058 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys
17:37:28.0390 1520 E100B - ok
17:37:28.0421 1520 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
17:37:28.0421 1520 EapHost - ok
17:37:28.0437 1520 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
17:37:28.0437 1520 ERSvc - ok
17:37:28.0468 1520 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
17:37:28.0484 1520 Eventlog - ok
17:37:28.0515 1520 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
17:37:28.0531 1520 EventSystem - ok
17:37:28.0546 1520 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
17:37:28.0562 1520 Fastfat - ok
17:37:28.0578 1520 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
17:37:28.0593 1520 FastUserSwitchingCompatibility - ok
17:37:28.0609 1520 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
17:37:28.0625 1520 Fdc - ok
17:37:28.0656 1520 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
17:37:28.0656 1520 Fips - ok
17:37:28.0671 1520 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
17:37:28.0671 1520 Flpydisk - ok
17:37:28.0718 1520 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
17:37:28.0718 1520 FltMgr - ok
17:37:28.0765 1520 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
17:37:28.0765 1520 FontCache3.0.0.0 - ok
17:37:28.0796 1520 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:37:28.0796 1520 Fs_Rec - ok
17:37:28.0828 1520 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:37:28.0828 1520 Ftdisk - ok
17:37:28.0859 1520 [ F2F431D1573EE632975C524418655B84 ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
17:37:28.0859 1520 GEARAspiWDM - ok
17:37:28.0875 1520 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:37:28.0875 1520 Gpc - ok
17:37:28.0953 1520 [ 626A24ED1228580B9518C01930936DF9 ] gupdate1c9cad0f3b9b694 C:\Program Files\Google\Update\GoogleUpdate.exe
17:37:28.0953 1520 gupdate1c9cad0f3b9b694 - ok
17:37:28.0968 1520 [ 626A24ED1228580B9518C01930936DF9 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
17:37:28.0968 1520 gupdatem - ok
17:37:29.0000 1520 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
17:37:29.0000 1520 gusvc - ok
17:37:29.0062 1520 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
17:37:29.0062 1520 helpsvc - ok
17:37:29.0062 1520 HidServ - ok
17:37:29.0109 1520 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:37:29.0109 1520 hidusb - ok
17:37:29.0140 1520 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
17:37:29.0140 1520 hkmsvc - ok
17:37:29.0171 1520 [ C0ED270475FC2ECB21019BB7728FA1C2 ] hotcore3 C:\WINDOWS\system32\DRIVERS\hotcore3.sys
17:37:29.0171 1520 hotcore3 - ok
17:37:29.0187 1520 hpn - ok
17:37:29.0218 1520 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
17:37:29.0234 1520 HTTP - ok
17:37:29.0265 1520 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
17:37:29.0281 1520 HTTPFilter - ok
17:37:29.0281 1520 i2omgmt - ok
17:37:29.0296 1520 i2omp - ok
17:37:29.0328 1520 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:37:29.0328 1520 i8042prt - ok
17:37:29.0390 1520 [ 9A883C3C4D91292C0D09DE7C728E781C ] ialm C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
17:37:29.0406 1520 ialm - ok
17:37:29.0468 1520 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
17:37:29.0500 1520 idsvc - ok
17:37:29.0531 1520 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
17:37:29.0531 1520 Imapi - ok
17:37:29.0562 1520 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
17:37:29.0562 1520 ImapiService - ok
17:37:29.0578 1520 ini910u - ok
17:37:29.0609 1520 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
17:37:29.0609 1520 IntelIde - ok
17:37:29.0640 1520 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:37:29.0640 1520 intelppm - ok
17:37:29.0671 1520 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
17:37:29.0671 1520 Ip6Fw - ok
17:37:29.0734 1520 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:37:29.0734 1520 IpFilterDriver - ok
17:37:29.0750 1520 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:37:29.0750 1520 IpInIp - ok
17:37:29.0796 1520 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:37:29.0796 1520 IpNat - ok
17:37:29.0843 1520 [ F055C1760ABFA52B159985E551EA0EDC ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
17:37:29.0859 1520 iPod Service - ok
17:37:29.0890 1520 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:37:29.0890 1520 IPSec - ok
17:37:29.0921 1520 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
17:37:29.0921 1520 IRENUM - ok
17:37:29.0953 1520 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:37:29.0953 1520 isapnp - ok
17:37:30.0015 1520 [ FE1A970E7CE330BB844E333C374C6599 ] iWinTrusted C:\Program Files\iWin Games\iWinTrusted.exe
17:37:30.0015 1520 iWinTrusted - ok
17:37:30.0093 1520 [ 9DBA73C2F1E76EC4CB837E67C5743596 ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
17:37:30.0093 1520 JavaQuickStarterService - ok
17:37:30.0109 1520 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:37:30.0125 1520 Kbdclass - ok
17:37:30.0156 1520 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:37:30.0156 1520 kbdhid - ok
17:37:30.0187 1520 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
17:37:30.0187 1520 kmixer - ok
17:37:30.0218 1520 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
17:37:30.0218 1520 KSecDD - ok
17:37:30.0250 1520 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
17:37:30.0265 1520 LanmanServer - ok
17:37:30.0312 1520 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
17:37:30.0328 1520 lanmanworkstation - ok
17:37:30.0328 1520 Lbd - ok
17:37:30.0343 1520 lbrtfdc - ok
17:37:30.0390 1520 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
17:37:30.0390 1520 LmHosts - ok
17:37:30.0453 1520 [ 7CF1B716372B89568AE4C0FE769F5869 ] MDM C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
17:37:30.0453 1520 MDM - ok
17:37:30.0484 1520 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
17:37:30.0484 1520 Messenger - ok
17:37:30.0515 1520 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
17:37:30.0515 1520 mnmdd - ok
17:37:30.0546 1520 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
17:37:30.0546 1520 mnmsrvc - ok
17:37:30.0578 1520 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
17:37:30.0578 1520 Modem - ok
17:37:30.0609 1520 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:37:30.0609 1520 Mouclass - ok
17:37:30.0625 1520 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:37:30.0625 1520 mouhid - ok
17:37:30.0656 1520 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
17:37:30.0656 1520 MountMgr - ok
17:37:30.0656 1520 mraid35x - ok
17:37:30.0687 1520 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:37:30.0687 1520 MRxDAV - ok
17:37:30.0734 1520 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:37:30.0734 1520 MRxSmb - ok
17:37:30.0781 1520 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
17:37:30.0781 1520 MSDTC - ok
17:37:30.0828 1520 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
17:37:30.0828 1520 Msfs - ok
17:37:30.0843 1520 MSIServer - ok
17:37:30.0875 1520 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:37:30.0875 1520 MSKSSRV - ok
17:37:30.0906 1520 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:37:30.0906 1520 MSPCLOCK - ok
17:37:30.0921 1520 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
17:37:30.0921 1520 MSPQM - ok
17:37:30.0953 1520 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:37:30.0953 1520 mssmbios - ok
17:37:30.0984 1520 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
17:37:30.0984 1520 Mup - ok
17:37:31.0031 1520 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
17:37:31.0062 1520 napagent - ok
17:37:31.0093 1520 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
17:37:31.0109 1520 NDIS - ok
17:37:31.0140 1520 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:37:31.0140 1520 NdisTapi - ok
17:37:31.0156 1520 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:37:31.0156 1520 Ndisuio - ok
17:37:31.0187 1520 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:37:31.0187 1520 NdisWan - ok
17:37:31.0218 1520 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
17:37:31.0218 1520 NDProxy - ok
17:37:31.0296 1520 [ B90E093E7A7250906F1054418B5339C0 ] Nero BackItUp Scheduler 4.0 C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
17:37:31.0296 1520 Nero BackItUp Scheduler 4.0 - ok
17:37:31.0328 1520 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
17:37:31.0328 1520 NetBIOS - ok
17:37:31.0359 1520 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
17:37:31.0359 1520 NetBT - ok
17:37:31.0390 1520 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
17:37:31.0390 1520 NetDDE - ok
17:37:31.0406 1520 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
17:37:31.0406 1520 NetDDEdsdm - ok
17:37:31.0453 1520 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
17:37:31.0453 1520 Netlogon - ok
17:37:31.0468 1520 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
17:37:31.0484 1520 Netman - ok
17:37:31.0515 1520 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
17:37:31.0531 1520 NetTcpPortSharing - ok
17:37:31.0562 1520 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
17:37:31.0578 1520 Nla - ok
17:37:31.0609 1520 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
17:37:31.0609 1520 Npfs - ok
17:37:31.0640 1520 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
17:37:31.0656 1520 Ntfs - ok
17:37:31.0671 1520 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
17:37:31.0671 1520 NtLmSsp - ok
17:37:31.0750 1520 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
17:37:31.0781 1520 NtmsSvc - ok
17:37:31.0828 1520 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
17:37:31.0828 1520 Null - ok
17:37:31.0843 1520 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:37:31.0843 1520 NwlnkFlt - ok
17:37:31.0875 1520 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:37:31.0875 1520 NwlnkFwd - ok
17:37:31.0937 1520 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
17:37:31.0953 1520 odserv - ok
17:37:31.0984 1520 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
17:37:31.0984 1520 ose - ok
17:37:32.0015 1520 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
17:37:32.0015 1520 Parport - ok
17:37:32.0031 1520 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
17:37:32.0031 1520 PartMgr - ok
17:37:32.0062 1520 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
17:37:32.0062 1520 ParVdm - ok
17:37:32.0093 1520 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
17:37:32.0093 1520 PCI - ok
17:37:32.0109 1520 PCIDump - ok
17:37:32.0140 1520 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\drivers\PCIIde.sys
17:37:32.0140 1520 PCIIde - ok
17:37:32.0156 1520 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
17:37:32.0156 1520 Pcmcia - ok
17:37:32.0171 1520 PDCOMP - ok
17:37:32.0187 1520 PDFRAME - ok
17:37:32.0187 1520 PDRELI - ok
17:37:32.0203 1520 PDRFRAME - ok
17:37:32.0218 1520 perc2 - ok
17:37:32.0218 1520 perc2hib - ok
17:37:32.0265 1520 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
17:37:32.0281 1520 PlugPlay - ok
17:37:32.0296 1520 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
17:37:32.0296 1520 PolicyAgent - ok
17:37:32.0328 1520 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:37:32.0343 1520 PptpMiniport - ok
17:37:32.0343 1520 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
17:37:32.0359 1520 ProtectedStorage - ok
17:37:32.0375 1520 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
17:37:32.0375 1520 PSched - ok
17:37:32.0406 1520 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:37:32.0406 1520 Ptilink - ok
17:37:32.0421 1520 ql1080 - ok
17:37:32.0437 1520 Ql10wnt - ok
17:37:32.0437 1520 ql12160 - ok
17:37:32.0453 1520 ql1240 - ok
17:37:32.0468 1520 ql1280 - ok
17:37:32.0484 1520 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:37:32.0484 1520 RasAcd - ok
17:37:32.0500 1520 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
17:37:32.0515 1520 RasAuto - ok
17:37:32.0546 1520 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:37:32.0546 1520 Rasl2tp - ok
17:37:32.0578 1520 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
17:37:32.0593 1520 RasMan - ok
17:37:32.0593 1520 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:37:32.0593 1520 RasPppoe - ok
17:37:32.0640 1520 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
17:37:32.0640 1520 Raspti - ok
17:37:32.0656 1520 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:37:32.0656 1520 Rdbss - ok
17:37:32.0671 1520 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:37:32.0671 1520 RDPCDD - ok
17:37:32.0734 1520 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:37:32.0734 1520 rdpdr - ok
17:37:32.0781 1520 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
17:37:32.0796 1520 RDPWD - ok
17:37:32.0828 1520 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
17:37:32.0843 1520 RDSessMgr - ok
17:37:32.0890 1520 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
17:37:32.0890 1520 redbook - ok
17:37:32.0921 1520 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
17:37:32.0921 1520 RemoteAccess - ok
17:37:32.0953 1520 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
17:37:32.0968 1520 RemoteRegistry - ok
17:37:33.0000 1520 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
17:37:33.0000 1520 RpcLocator - ok
17:37:33.0046 1520 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\system32\rpcss.dll
17:37:33.0046 1520 RpcSs - ok
17:37:33.0093 1520 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
17:37:33.0109 1520 RSVP - ok
17:37:33.0125 1520 SABKUTIL - ok
17:37:33.0140 1520 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
17:37:33.0140 1520 SamSs - ok
17:37:33.0156 1520 [ 39763504067962108505BFF25F024345 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
17:37:33.0156 1520 SASDIFSV - ok
17:37:33.0187 1520 [ 77B9FC20084B48408AD3E87570EB4A85 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
17:37:33.0187 1520 SASKUTIL - ok
17:37:33.0218 1520 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
17:37:33.0234 1520 SCardSvr - ok
17:37:33.0265 1520 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
17:37:33.0281 1520 Schedule - ok
17:37:33.0296 1520 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:37:33.0312 1520 Secdrv - ok
17:37:33.0328 1520 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
17:37:33.0328 1520 seclogon - ok
17:37:33.0359 1520 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
17:37:33.0375 1520 SENS - ok
17:37:33.0406 1520 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
17:37:33.0406 1520 serenum - ok
17:37:33.0421 1520 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
17:37:33.0421 1520 Serial - ok
17:37:33.0468 1520 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
17:37:33.0468 1520 Sfloppy - ok
17:37:33.0500 1520 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
17:37:33.0515 1520 SharedAccess - ok
17:37:33.0531 1520 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
17:37:33.0546 1520 ShellHWDetection - ok
17:37:33.0546 1520 Simbad - ok
17:37:33.0593 1520 [ 1319EA66A96250D59665D133C0FF7CD0 ] smwdm C:\WINDOWS\system32\drivers\smwdm.sys
17:37:33.0593 1520 smwdm - ok
17:37:33.0609 1520 Sparrow - ok
17:37:33.0625 1520 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
17:37:33.0625 1520 splitter - ok
17:37:33.0656 1520 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
17:37:33.0671 1520 Spooler - ok
17:37:33.0687 1520 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
17:37:33.0703 1520 sr - ok
17:37:33.0718 1520 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
17:37:33.0734 1520 srservice - ok
17:37:33.0781 1520 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
17:37:33.0781 1520 Srv - ok
17:37:33.0812 1520 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
17:37:33.0828 1520 SSDPSRV - ok
17:37:33.0859 1520 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
17:37:33.0890 1520 stisvc - ok
17:37:33.0921 1520 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
17:37:33.0921 1520 swenum - ok
17:37:33.0937 1520 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
17:37:33.0937 1520 swmidi - ok
17:37:33.0953 1520 SwPrv - ok
17:37:33.0968 1520 symc810 - ok
17:37:33.0968 1520 symc8xx - ok
17:37:33.0984 1520 sym_hi - ok
17:37:34.0000 1520 sym_u3 - ok
17:37:34.0015 1520 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
17:37:34.0015 1520 sysaudio - ok
17:37:34.0046 1520 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
17:37:34.0062 1520 SysmonLog - ok
17:37:34.0093 1520 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
17:37:34.0109 1520 TapiSrv - ok
17:37:34.0156 1520 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:37:34.0156 1520 Tcpip - ok
17:37:34.0203 1520 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
17:37:34.0203 1520 TDPIPE - ok
17:37:34.0218 1520 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
17:37:34.0218 1520 TDTCP - ok
17:37:34.0250 1520 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
17:37:34.0250 1520 TermDD - ok
17:37:34.0281 1520 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
17:37:34.0296 1520 TermService - ok
17:37:34.0312 1520 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
17:37:34.0328 1520 Themes - ok
17:37:34.0359 1520 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
17:37:34.0375 1520 TlntSvr - ok
17:37:34.0375 1520 TosIde - ok
17:37:34.0406 1520 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
17:37:34.0421 1520 TrkWks - ok
17:37:34.0437 1520 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
17:37:34.0453 1520 Udfs - ok
17:37:34.0484 1520 [ BEC6B6158C180B974559294EE76B1290 ] UimBus C:\WINDOWS\system32\DRIVERS\UimBus.sys
17:37:34.0484 1520 UimBus - ok
17:37:34.0515 1520 [ 6E50091B6A7C6D085D2B81C9068962BB ] Uim_IM C:\WINDOWS\system32\Drivers\Uim_IM.sys
17:37:34.0515 1520 Uim_IM - ok
17:37:34.0531 1520 ultra - ok
17:37:34.0578 1520 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
17:37:34.0578 1520 Update - ok
17:37:34.0625 1520 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
17:37:34.0640 1520 upnphost - ok
17:37:34.0656 1520 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
17:37:34.0671 1520 UPS - ok
17:37:34.0687 1520 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:37:34.0687 1520 usbehci - ok
17:37:34.0718 1520 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:37:34.0718 1520 usbhub - ok
17:37:34.0750 1520 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:37:34.0765 1520 usbprint - ok
17:37:34.0796 1520 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:37:34.0796 1520 USBSTOR - ok
17:37:34.0812 1520 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:37:34.0812 1520 usbuhci - ok
17:37:34.0843 1520 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
17:37:34.0843 1520 VgaSave - ok
17:37:34.0859 1520 ViaIde - ok
17:37:34.0890 1520 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
17:37:34.0890 1520 VolSnap - ok
17:37:34.0921 1520 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
17:37:34.0953 1520 VSS - ok
17:37:34.0968 1520 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
17:37:34.0984 1520 W32Time - ok
17:37:35.0015 1520 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:37:35.0015 1520 Wanarp - ok
17:37:35.0031 1520 WDICA - ok
17:37:35.0046 1520 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
17:37:35.0062 1520 wdmaud - ok
17:37:35.0078 1520 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
17:37:35.0078 1520 WebClient - ok
17:37:35.0140 1520 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
17:37:35.0140 1520 winmgmt - ok
17:37:35.0187 1520 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
17:37:35.0203 1520 WmdmPmSN - ok
17:37:35.0234 1520 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll
17:37:35.0250 1520 Wmi - ok
17:37:35.0296 1520 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
17:37:35.0296 1520 WmiApSrv - ok
17:37:35.0359 1520 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
17:37:35.0390 1520 WMPNetworkSvc - ok
17:37:35.0421 1520 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
17:37:35.0437 1520 wscsvc - ok
17:37:35.0468 1520 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
17:37:35.0484 1520 wuauserv - ok
17:37:35.0515 1520 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:37:35.0515 1520 WudfPf - ok
17:37:35.0531 1520 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:37:35.0531 1520 WudfRd - ok
17:37:35.0562 1520 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
17:37:35.0578 1520 WudfSvc - ok
17:37:35.0609 1520 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
17:37:35.0656 1520 WZCSVC - ok
17:37:35.0687 1520 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
17:37:35.0734 1520 xmlprov - ok
17:37:35.0781 1520 [ DD0042F0C3B606A6A8B92D49AFB18AD6 ] YahooAUService C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
17:37:35.0781 1520 YahooAUService - ok
17:37:35.0796 1520 ================ Scan global ===============================
17:37:35.0828 1520 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
17:37:35.0875 1520 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
17:37:35.0921 1520 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
17:37:35.0937 1520 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
17:37:35.0953 1520 [Global] - ok
17:37:35.0953 1520 ================ Scan MBR ==================================
17:37:35.0968 1520 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
17:37:36.0156 1520 \Device\Harddisk0\DR0 - ok
17:37:36.0171 1520 ================ Scan VBR ==================================
17:37:36.0171 1520 [ 72FFD96FCA9F978A0078AB9517290800 ] \Device\Harddisk0\DR0\Partition1
17:37:36.0171 1520 \Device\Harddisk0\DR0\Partition1 - ok
17:37:36.0171 1520 ============================================================
17:37:36.0171 1520 Scan finished
17:37:36.0171 1520 ============================================================
17:37:36.0187 0524 Detected object count: 0
17:37:36.0187 0524 Actual detected object count: 0
17:37:40.0968 2268 ============================================================
17:37:40.0968 2268 Scan started
17:37:40.0968 2268 Mode: Manual;
17:37:40.0968 2268 ============================================================

JAK · 2012/12/16

tdsskiller log part 2

17:37:41.0109 2268 ================ Scan system memory ========================
17:37:41.0109 2268 System memory - ok
17:37:41.0109 2268 ================ Scan services =============================
17:37:41.0187 2268 [ 01E81C84AD1D0ACC61CF3CFD06632210 ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
17:37:41.0187 2268 !SASCORE - ok
17:37:41.0328 2268 [ 149A8F7ADF9742554DC323E290551E3E ] Aavmker4 C:\WINDOWS\system32\drivers\Aavmker4.sys
17:37:41.0328 2268 Aavmker4 - ok
17:37:41.0343 2268 Abiosdsk - ok
17:37:41.0343 2268 abp480n5 - ok
17:37:41.0375 2268 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:37:41.0390 2268 ACPI - ok
17:37:41.0406 2268 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
17:37:41.0421 2268 ACPIEC - ok
17:37:41.0468 2268 [ 95CE557D16A75606CCC2D7F3B0B0BCCB ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
17:37:41.0468 2268 AdobeFlashPlayerUpdateSvc - ok
17:37:41.0484 2268 adpu160m - ok
17:37:41.0515 2268 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
17:37:41.0515 2268 aec - ok
17:37:41.0546 2268 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
17:37:41.0562 2268 AFD - ok
17:37:41.0562 2268 Aha154x - ok
17:37:41.0578 2268 aic78u2 - ok
17:37:41.0593 2268 aic78xx - ok
17:37:41.0609 2268 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
17:37:41.0609 2268 Alerter - ok
17:37:41.0640 2268 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
17:37:41.0640 2268 ALG - ok
17:37:41.0656 2268 AliIde - ok
17:37:41.0656 2268 amsint - ok
17:37:41.0734 2268 [ 367592EFCA7FF8B4CE11AB6B0744E1E2 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
17:37:41.0750 2268 Apple Mobile Device - ok
17:37:41.0781 2268 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
17:37:41.0781 2268 AppMgmt - ok
17:37:41.0796 2268 asc - ok
17:37:41.0796 2268 asc3350p - ok
17:37:41.0812 2268 asc3550 - ok
17:37:41.0890 2268 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
17:37:41.0890 2268 aspnet_state - ok
17:37:41.0921 2268 [ DE6ED95AEF259979B2830450072A627B ] aswFsBlk C:\WINDOWS\system32\drivers\aswFsBlk.sys
17:37:41.0921 2268 aswFsBlk - ok
17:37:41.0968 2268 [ 84F0BE324EE111338589F448C3E8BAB2 ] aswMon2 C:\WINDOWS\system32\drivers\aswMon2.sys
17:37:41.0968 2268 aswMon2 - ok
17:37:41.0984 2268 [ 7C9F0A2AB17D52261A9252A2EB320884 ] AswRdr C:\WINDOWS\system32\drivers\AswRdr.sys
17:37:41.0984 2268 AswRdr - ok
17:37:42.0031 2268 [ B32E9AD44A1DBB3E8095E80F8DF32B03 ] aswSnx C:\WINDOWS\system32\drivers\aswSnx.sys
17:37:42.0031 2268 aswSnx - ok
17:37:42.0062 2268 [ 67B558895695545FB0568B7541F3BCA7 ] aswSP C:\WINDOWS\system32\drivers\aswSP.sys
17:37:42.0078 2268 aswSP - ok
17:37:42.0109 2268 [ E3E73B2B73A4DFADFDDF557192C4B08A ] aswTdi C:\WINDOWS\system32\drivers\aswTdi.sys
17:37:42.0109 2268 aswTdi - ok
17:37:42.0125 2268 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:37:42.0125 2268 AsyncMac - ok
17:37:42.0171 2268 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
17:37:42.0171 2268 atapi - ok
17:37:42.0171 2268 Atdisk - ok
17:37:42.0187 2268 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:37:42.0187 2268 Atmarpc - ok
17:37:42.0203 2268 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
17:37:42.0218 2268 AudioSrv - ok
17:37:42.0250 2268 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
17:37:42.0250 2268 audstub - ok
17:37:42.0296 2268 [ 8FA553E9AE69808D99C164733A0F9590 ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
17:37:42.0296 2268 avast! Antivirus - ok
17:37:42.0328 2268 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
17:37:42.0343 2268 Beep - ok
17:37:42.0375 2268 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll
17:37:42.0390 2268 BITS - ok
17:37:42.0421 2268 [ 3F56903E124E820AEECE6D471583C6C1 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
17:37:42.0437 2268 Bonjour Service - ok
17:37:42.0453 2268 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll
17:37:42.0453 2268 Browser - ok
17:37:42.0484 2268 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
17:37:42.0484 2268 cbidf2k - ok
17:37:42.0500 2268 cd20xrnt - ok
17:37:42.0515 2268 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
17:37:42.0531 2268 Cdaudio - ok
17:37:42.0562 2268 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
17:37:42.0562 2268 Cdfs - ok
17:37:42.0578 2268 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:37:42.0578 2268 Cdrom - ok
17:37:42.0593 2268 Changer - ok
17:37:42.0609 2268 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
17:37:42.0609 2268 CiSvc - ok
17:37:42.0625 2268 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
17:37:42.0625 2268 ClipSrv - ok
17:37:42.0656 2268 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:37:42.0671 2268 clr_optimization_v2.0.50727_32 - ok
17:37:42.0671 2268 CmdIde - ok
17:37:42.0687 2268 COMSysApp - ok
17:37:42.0703 2268 Cpqarray - ok
17:37:42.0734 2268 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
17:37:42.0750 2268 CryptSvc - ok
17:37:42.0750 2268 dac2w2k - ok
17:37:42.0765 2268 dac960nt - ok
17:37:42.0812 2268 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
17:37:42.0812 2268 DcomLaunch - ok
17:37:42.0906 2268 [ 34AE0DFA3EE3B5B9975042D87332D0B7 ] DefaultTabUpdate C:\Documents and Settings\OWNER\Application Data\DefaultTab\DefaultTab\DTUpdate.exe
17:37:42.0906 2268 DefaultTabUpdate - ok
17:37:42.0937 2268 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
17:37:42.0937 2268 Dhcp - ok
17:37:42.0968 2268 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
17:37:42.0968 2268 Disk - ok
17:37:43.0062 2268 [ 54F9BD9B99A6A1ADB030AD503707CA55 ] Diskeeper C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
17:37:43.0062 2268 Diskeeper - ok
17:37:43.0078 2268 dmadmin - ok
17:37:43.0140 2268 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
17:37:43.0140 2268 dmboot - ok
17:37:43.0171 2268 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
17:37:43.0187 2268 dmio - ok
17:37:43.0218 2268 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
17:37:43.0218 2268 dmload - ok
17:37:43.0234 2268 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
17:37:43.0234 2268 dmserver - ok
17:37:43.0265 2268 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
17:37:43.0265 2268 DMusic - ok
17:37:43.0296 2268 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
17:37:43.0296 2268 Dnscache - ok
17:37:43.0328 2268 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
17:37:43.0343 2268 Dot3svc - ok
17:37:43.0343 2268 dpti2o - ok
17:37:43.0390 2268 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
17:37:43.0390 2268 drmkaud - ok
17:37:43.0421 2268 [ AC9CF17EE2AE003C98EB4F5336C38058 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys
17:37:43.0421 2268 E100B - ok
17:37:43.0453 2268 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
17:37:43.0453 2268 EapHost - ok
17:37:43.0484 2268 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
17:37:43.0484 2268 ERSvc - ok
17:37:43.0515 2268 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
17:37:43.0515 2268 Eventlog - ok
17:37:43.0562 2268 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
17:37:43.0562 2268 EventSystem - ok
17:37:43.0593 2268 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
17:37:43.0593 2268 Fastfat - ok
17:37:43.0609 2268 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
17:37:43.0625 2268 FastUserSwitchingCompatibility - ok
17:37:43.0656 2268 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
17:37:43.0656 2268 Fdc - ok
17:37:43.0687 2268 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
17:37:43.0687 2268 Fips - ok
17:37:43.0718 2268 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
17:37:43.0718 2268 Flpydisk - ok
17:37:43.0750 2268 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
17:37:43.0750 2268 FltMgr - ok
17:37:43.0796 2268 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
17:37:43.0812 2268 FontCache3.0.0.0 - ok
17:37:43.0828 2268 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:37:43.0843 2268 Fs_Rec - ok
17:37:43.0843 2268 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:37:43.0859 2268 Ftdisk - ok
17:37:43.0890 2268 [ F2F431D1573EE632975C524418655B84 ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
17:37:43.0890 2268 GEARAspiWDM - ok
17:37:43.0906 2268 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:37:43.0906 2268 Gpc - ok
17:37:43.0968 2268 [ 626A24ED1228580B9518C01930936DF9 ] gupdate1c9cad0f3b9b694 C:\Program Files\Google\Update\GoogleUpdate.exe
17:37:43.0984 2268 gupdate1c9cad0f3b9b694 - ok
17:37:44.0000 2268 [ 626A24ED1228580B9518C01930936DF9 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
17:37:44.0000 2268 gupdatem - ok
17:37:44.0031 2268 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
17:37:44.0031 2268 gusvc - ok
17:37:44.0078 2268 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
17:37:44.0078 2268 helpsvc - ok
17:37:44.0093 2268 HidServ - ok
17:37:44.0109 2268 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:37:44.0125 2268 hidusb - ok
17:37:44.0156 2268 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
17:37:44.0156 2268 hkmsvc - ok
17:37:44.0187 2268 [ C0ED270475FC2ECB21019BB7728FA1C2 ] hotcore3 C:\WINDOWS\system32\DRIVERS\hotcore3.sys
17:37:44.0187 2268 hotcore3 - ok
17:37:44.0203 2268 hpn - ok
17:37:44.0234 2268 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
17:37:44.0234 2268 HTTP - ok
17:37:44.0265 2268 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
17:37:44.0265 2268 HTTPFilter - ok
17:37:44.0281 2268 i2omgmt - ok
17:37:44.0296 2268 i2omp - ok
17:37:44.0328 2268 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:37:44.0328 2268 i8042prt - ok
17:37:44.0390 2268 [ 9A883C3C4D91292C0D09DE7C728E781C ] ialm C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
17:37:44.0390 2268 ialm - ok
17:37:44.0468 2268 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
17:37:44.0484 2268 idsvc - ok
17:37:44.0515 2268 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
17:37:44.0515 2268 Imapi - ok
17:37:44.0531 2268 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
17:37:44.0546 2268 ImapiService - ok
17:37:44.0562 2268 ini910u - ok
17:37:44.0593 2268 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
17:37:44.0593 2268 IntelIde - ok
17:37:44.0625 2268 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:37:44.0625 2268 intelppm - ok
17:37:44.0640 2268 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
17:37:44.0640 2268 Ip6Fw - ok
17:37:44.0671 2268 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:37:44.0671 2268 IpFilterDriver - ok
17:37:44.0703 2268 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:37:44.0703 2268 IpInIp - ok
17:37:44.0750 2268 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:37:44.0750 2268 IpNat - ok
17:37:44.0796 2268 [ F055C1760ABFA52B159985E551EA0EDC ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
17:37:44.0796 2268 iPod Service - ok
17:37:44.0828 2268 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:37:44.0828 2268 IPSec - ok
17:37:44.0859 2268 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
17:37:44.0859 2268 IRENUM - ok
17:37:44.0890 2268 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:37:44.0890 2268 isapnp - ok
17:37:44.0953 2268 [ FE1A970E7CE330BB844E333C374C6599 ] iWinTrusted C:\Program Files\iWin Games\iWinTrusted.exe
17:37:44.0953 2268 iWinTrusted - ok
17:37:45.0015 2268 [ 9DBA73C2F1E76EC4CB837E67C5743596 ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
17:37:45.0015 2268 JavaQuickStarterService - ok
17:37:45.0046 2268 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:37:45.0046 2268 Kbdclass - ok
17:37:45.0093 2268 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:37:45.0093 2268 kbdhid - ok
17:37:45.0109 2268 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
17:37:45.0125 2268 kmixer - ok
17:37:45.0156 2268 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
17:37:45.0156 2268 KSecDD - ok
17:37:45.0187 2268 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
17:37:45.0187 2268 LanmanServer - ok
17:37:45.0234 2268 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
17:37:45.0234 2268 lanmanworkstation - ok
17:37:45.0250 2268 Lbd - ok
17:37:45.0265 2268 lbrtfdc - ok
17:37:45.0312 2268 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
17:37:45.0312 2268 LmHosts - ok
17:37:45.0375 2268 [ 7CF1B716372B89568AE4C0FE769F5869 ] MDM C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
17:37:45.0375 2268 MDM - ok
17:37:45.0406 2268 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
17:37:45.0406 2268 Messenger - ok
17:37:45.0437 2268 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
17:37:45.0437 2268 mnmdd - ok
17:37:45.0468 2268 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
17:37:45.0468 2268 mnmsrvc - ok
17:37:45.0500 2268 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
17:37:45.0500 2268 Modem - ok
17:37:45.0531 2268 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:37:45.0531 2268 Mouclass - ok
17:37:45.0546 2268 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:37:45.0546 2268 mouhid - ok
17:37:45.0562 2268 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
17:37:45.0562 2268 MountMgr - ok
17:37:45.0578 2268 mraid35x - ok
17:37:45.0593 2268 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:37:45.0593 2268 MRxDAV - ok
17:37:45.0625 2268 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:37:45.0640 2268 MRxSmb - ok
17:37:45.0671 2268 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
17:37:45.0671 2268 MSDTC - ok
17:37:45.0703 2268 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
17:37:45.0703 2268 Msfs - ok
17:37:45.0718 2268 MSIServer - ok
17:37:45.0765 2268 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:37:45.0765 2268 MSKSSRV - ok
17:37:45.0796 2268 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:37:45.0796 2268 MSPCLOCK - ok
17:37:45.0812 2268 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
17:37:45.0812 2268 MSPQM - ok
17:37:45.0843 2268 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:37:45.0843 2268 mssmbios - ok
17:37:45.0859 2268 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
17:37:45.0875 2268 Mup - ok
17:37:45.0906 2268 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
17:37:45.0921 2268 napagent - ok
17:37:45.0968 2268 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
17:37:45.0968 2268 NDIS - ok
17:37:46.0000 2268 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:37:46.0000 2268 NdisTapi - ok
17:37:46.0015 2268 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:37:46.0015 2268 Ndisuio - ok
17:37:46.0031 2268 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:37:46.0031 2268 NdisWan - ok
17:37:46.0062 2268 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
17:37:46.0078 2268 NDProxy - ok
17:37:46.0140 2268 [ B90E093E7A7250906F1054418B5339C0 ] Nero BackItUp Scheduler 4.0 C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
17:37:46.0156 2268 Nero BackItUp Scheduler 4.0 - ok
17:37:46.0187 2268 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
17:37:46.0203 2268 NetBIOS - ok
17:37:46.0218 2268 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
17:37:46.0218 2268 NetBT - ok
17:37:46.0250 2268 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
17:37:46.0250 2268 NetDDE - ok
17:37:46.0265 2268 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
17:37:46.0281 2268 NetDDEdsdm - ok
17:37:46.0312 2268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
17:37:46.0312 2268 Netlogon - ok
17:37:46.0343 2268 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
17:37:46.0343 2268 Netman - ok
17:37:46.0375 2268 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
17:37:46.0375 2268 NetTcpPortSharing - ok
17:37:46.0406 2268 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
17:37:46.0421 2268 Nla - ok
17:37:46.0453 2268 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
17:37:46.0453 2268 Npfs - ok
17:37:46.0484 2268 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
17:37:46.0500 2268 Ntfs - ok
17:37:46.0515 2268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
17:37:46.0515 2268 NtLmSsp - ok
17:37:46.0546 2268 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
17:37:46.0562 2268 NtmsSvc - ok
17:37:46.0609 2268 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
17:37:46.0609 2268 Null - ok
17:37:46.0625 2268 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:37:46.0625 2268 NwlnkFlt - ok
17:37:46.0656 2268 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:37:46.0656 2268 NwlnkFwd - ok
17:37:46.0750 2268 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
17:37:46.0750 2268 odserv - ok
17:37:46.0781 2268 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
17:37:46.0781 2268 ose - ok
17:37:46.0828 2268 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
17:37:46.0828 2268 Parport - ok
17:37:46.0843 2268 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
17:37:46.0843 2268 PartMgr - ok
17:37:46.0875 2268 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
17:37:46.0875 2268 ParVdm - ok
17:37:46.0890 2268 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
17:37:46.0890 2268 PCI - ok
17:37:46.0906 2268 PCIDump - ok
17:37:46.0937 2268 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\drivers\PCIIde.sys
17:37:46.0937 2268 PCIIde - ok
17:37:46.0968 2268 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
17:37:46.0968 2268 Pcmcia - ok
17:37:46.0984 2268 PDCOMP - ok
17:37:46.0984 2268 PDFRAME - ok
17:37:47.0000 2268 PDRELI - ok
17:37:47.0015 2268 PDRFRAME - ok
17:37:47.0031 2268 perc2 - ok
17:37:47.0031 2268 perc2hib - ok
17:37:47.0062 2268 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
17:37:47.0078 2268 PlugPlay - ok
17:37:47.0093 2268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
17:37:47.0109 2268 PolicyAgent - ok
17:37:47.0140 2268 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:37:47.0140 2268 PptpMiniport - ok
17:37:47.0156 2268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
17:37:47.0156 2268 ProtectedStorage - ok
17:37:47.0187 2268 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
17:37:47.0187 2268 PSched - ok
17:37:47.0218 2268 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:37:47.0218 2268 Ptilink - ok
17:37:47.0234 2268 ql1080 - ok
17:37:47.0234 2268 Ql10wnt - ok
17:37:47.0250 2268 ql12160 - ok
17:37:47.0265 2268 ql1240 - ok
17:37:47.0265 2268 ql1280 - ok
17:37:47.0281 2268 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:37:47.0296 2268 RasAcd - ok
17:37:47.0312 2268 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
17:37:47.0328 2268 RasAuto - ok
17:37:47.0343 2268 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:37:47.0343 2268 Rasl2tp - ok
17:37:47.0359 2268 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
17:37:47.0375 2268 RasMan - ok
17:37:47.0390 2268 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:37:47.0390 2268 RasPppoe - ok
17:37:47.0406 2268 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
17:37:47.0406 2268 Raspti - ok
17:37:47.0437 2268 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:37:47.0453 2268 Rdbss - ok
17:37:47.0468 2268 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:37:47.0468 2268 RDPCDD - ok
17:37:47.0515 2268 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:37:47.0515 2268 rdpdr - ok
17:37:47.0562 2268 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
17:37:47.0562 2268 RDPWD - ok
17:37:47.0593 2268 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
17:37:47.0593 2268 RDSessMgr - ok
17:37:47.0625 2268 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
17:37:47.0640 2268 redbook - ok
17:37:47.0671 2268 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
17:37:47.0671 2268 RemoteAccess - ok
17:37:47.0703 2268 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
17:37:47.0718 2268 RemoteRegistry - ok
17:37:47.0750 2268 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
17:37:47.0750 2268 RpcLocator - ok
17:37:47.0781 2268 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\system32\rpcss.dll
17:37:47.0796 2268 RpcSs - ok
17:37:47.0828 2268 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
17:37:47.0843 2268 RSVP - ok
17:37:47.0843 2268 SABKUTIL - ok
17:37:47.0875 2268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
17:37:47.0875 2268 SamSs - ok
17:37:47.0906 2268 [ 39763504067962108505BFF25F024345 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
17:37:47.0906 2268 SASDIFSV - ok
17:37:47.0937 2268 [ 77B9FC20084B48408AD3E87570EB4A85 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
17:37:47.0937 2268 SASKUTIL - ok
17:37:47.0968 2268 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
17:37:47.0984 2268 SCardSvr - ok
17:37:48.0015 2268 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
17:37:48.0031 2268 Schedule - ok
17:37:48.0062 2268 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:37:48.0062 2268 Secdrv - ok
17:37:48.0078 2268 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
17:37:48.0093 2268 seclogon - ok
17:37:48.0109 2268 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
17:37:48.0125 2268 SENS - ok
17:37:48.0140 2268 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
17:37:48.0140 2268 serenum - ok
17:37:48.0156 2268 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
17:37:48.0156 2268 Serial - ok
17:37:48.0203 2268 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
17:37:48.0203 2268 Sfloppy - ok
17:37:48.0234 2268 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
17:37:48.0234 2268 SharedAccess - ok
17:37:48.0265 2268 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
17:37:48.0265 2268 ShellHWDetection - ok
17:37:48.0281 2268 Simbad - ok
17:37:48.0328 2268 [ 1319EA66A96250D59665D133C0FF7CD0 ] smwdm C:\WINDOWS\system32\drivers\smwdm.sys
17:37:48.0328 2268 smwdm - ok
17:37:48.0343 2268 Sparrow - ok
17:37:48.0343 2268 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
17:37:48.0359 2268 splitter - ok
17:37:48.0390 2268 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
17:37:48.0390 2268 Spooler - ok
17:37:48.0437 2268 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
17:37:48.0437 2268 sr - ok
17:37:48.0453 2268 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
17:37:48.0468 2268 srservice - ok
17:37:48.0500 2268 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
17:37:48.0515 2268 Srv - ok
17:37:48.0531 2268 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
17:37:48.0546 2268 SSDPSRV - ok
17:37:48.0593 2268 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
17:37:48.0593 2268 stisvc - ok
17:37:48.0625 2268 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
17:37:48.0625 2268 swenum - ok
17:37:48.0640 2268 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
17:37:48.0640 2268 swmidi - ok
17:37:48.0656 2268 SwPrv - ok
17:37:48.0671 2268 symc810 - ok
17:37:48.0671 2268 symc8xx - ok
17:37:48.0687 2268 sym_hi - ok
17:37:48.0703 2268 sym_u3 - ok
17:37:48.0734 2268 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
17:37:48.0734 2268 sysaudio - ok
17:37:48.0765 2268 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
17:37:48.0781 2268 SysmonLog - ok
17:37:48.0828 2268 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
17:37:48.0828 2268 TapiSrv - ok
17:37:48.0875 2268 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:37:48.0875 2268 Tcpip - ok
17:37:48.0921 2268 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
17:37:48.0921 2268 TDPIPE - ok
17:37:48.0937 2268 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
17:37:48.0937 2268 TDTCP - ok
17:37:48.0984 2268 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
17:37:48.0984 2268 TermDD - ok
17:37:49.0000 2268 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
17:37:49.0015 2268 TermService - ok
17:37:49.0031 2268 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
17:37:49.0046 2268 Themes - ok
17:37:49.0078 2268 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
17:37:49.0078 2268 TlntSvr - ok
17:37:49.0093 2268 TosIde - ok
17:37:49.0109 2268 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
17:37:49.0125 2268 TrkWks - ok
17:37:49.0156 2268 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
17:37:49.0156 2268 Udfs - ok
17:37:49.0203 2268 [ BEC6B6158C180B974559294EE76B1290 ] UimBus C:\WINDOWS\system32\DRIVERS\UimBus.sys
17:37:49.0203 2268 UimBus - ok
17:37:49.0234 2268 [ 6E50091B6A7C6D085D2B81C9068962BB ] Uim_IM C:\WINDOWS\system32\Drivers\Uim_IM.sys
17:37:49.0234 2268 Uim_IM - ok
17:37:49.0250 2268 ultra - ok
17:37:49.0281 2268 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
17:37:49.0296 2268 Update - ok
17:37:49.0328 2268 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
17:37:49.0343 2268 upnphost - ok
17:37:49.0375 2268 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
17:37:49.0390 2268 UPS - ok
17:37:49.0406 2268 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:37:49.0406 2268 usbehci - ok
17:37:49.0437 2268 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:37:49.0437 2268 usbhub - ok
17:37:49.0468 2268 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:37:49.0468 2268 usbprint - ok
17:37:49.0500 2268 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:37:49.0500 2268 USBSTOR - ok
17:37:49.0531 2268 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:37:49.0531 2268 usbuhci - ok
17:37:49.0562 2268 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
17:37:49.0562 2268 VgaSave - ok
17:37:49.0562 2268 ViaIde - ok
17:37:49.0593 2268 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
17:37:49.0593 2268 VolSnap - ok
17:37:49.0625 2268 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
17:37:49.0640 2268 VSS - ok
17:37:49.0671 2268 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
17:37:49.0671 2268 W32Time - ok
17:37:49.0703 2268 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:37:49.0703 2268 Wanarp - ok
17:37:49.0718 2268 WDICA - ok
17:37:49.0750 2268 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
17:37:49.0750 2268 wdmaud - ok
17:37:49.0781 2268 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
17:37:49.0796 2268 WebClient - ok
17:37:49.0843 2268 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
17:37:49.0859 2268 winmgmt - ok
17:37:49.0890 2268 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
17:37:49.0906 2268 WmdmPmSN - ok
17:37:49.0937 2268 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll
17:37:49.0937 2268 Wmi - ok
17:37:49.0984 2268 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
17:37:49.0984 2268 WmiApSrv - ok
17:37:50.0046 2268 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
17:37:50.0062 2268 WMPNetworkSvc - ok
17:37:50.0109 2268 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
17:37:50.0109 2268 wscsvc - ok
17:37:50.0140 2268 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
17:37:50.0156 2268 wuauserv - ok
17:37:50.0187 2268 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:37:50.0187 2268 WudfPf - ok
17:37:50.0203 2268 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:37:50.0203 2268 WudfRd - ok
17:37:50.0234 2268 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
17:37:50.0234 2268 WudfSvc - ok
17:37:50.0281 2268 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
17:37:50.0296 2268 WZCSVC - ok
17:37:50.0328 2268 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
17:37:50.0343 2268 xmlprov - ok
17:37:50.0390 2268 [ DD0042F0C3B606A6A8B92D49AFB18AD6 ] YahooAUService C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
17:37:50.0406 2268 YahooAUService - ok
17:37:50.0406 2268 ================ Scan global ===============================
17:37:50.0437 2268 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
17:37:50.0484 2268 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
17:37:50.0515 2268 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
17:37:50.0546 2268 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
17:37:50.0546 2268 [Global] - ok
17:37:50.0562 2268 ================ Scan MBR ==================================
17:37:50.0578 2268 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
17:37:50.0750 2268 \Device\Harddisk0\DR0 - ok
17:37:50.0750 2268 ================ Scan VBR ==================================
17:37:50.0765 2268 [ 72FFD96FCA9F978A0078AB9517290800 ] \Device\Harddisk0\DR0\Partition1
17:37:50.0765 2268 \Device\Harddisk0\DR0\Partition1 - ok
17:37:50.0765 2268 ============================================================
17:37:50.0765 2268 Scan finished
17:37:50.0765 2268 ============================================================
17:37:50.0781 0460 Detected object count: 0
17:37:50.0781 0460 Actual detected object count: 0
17:40:00.0625 4004 Deinitialize success

broni · 2012/12/16

Create new restore point before proceeding with the next step....
How to:
- Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
- Windows 7: http://www.howtogeek.com/howto/3195/create-a-system-restore-point-in-windows-7/
- Vista: http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/
- XP: http://support.microsoft.com/kb/948247

********************************************

Download Malwarebytes Anti-Rootkit (MBAR) from HERE

Unzip downloaded file.

Open the folder where the contents were unzipped and run mbar.exe

Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

Click on the Cleanup button to remove any threats and reboot if prompted to do so.

Wait while the system shuts down and the cleanup process is performed.

Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

JAK · 2012/12/16

system log #1

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1011

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_26

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.659000 GHz
Memory total: 1064288256, free: 563527680

------------ Kernel report ------------
12/16/2012 18:02:44
------------ Loaded modules -----------
\WINDOWS\system32\ntoskrnl.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
06248820.sys
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
\WINDOWS\System32\Drivers\PCIIDEX.SYS
intelide.sys
MountMgr.sys
ftdisk.sys
dmload.sys
dmio.sys
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltMgr.sys
sr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
Mup.sys
hotcore3.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\ialmnt5.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\e100b325.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\drivers\smwdm.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\rdpdr.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\UimBus.sys
\SystemRoot\System32\Drivers\Uim_IM.sys
\SystemRoot\System32\Drivers\UimFIO.SYS
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\system32\DRIVERS\ipnat.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\System32\Drivers\AswRdr.SYS
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\System32\Drivers\aswSnx.SYS
\SystemRoot\System32\Drivers\Aavmker4.SYS
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\ialmdnt5.dll
\SystemRoot\System32\ialmrnt5.dll
\SystemRoot\System32\ialmdev5.DLL
\SystemRoot\System32\ialmdd5.DLL
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\System32\Drivers\aswMon2.SYS
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\kmixer.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff86325ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-4\
Lower Device Object: 0xffffffff863a6940
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
DriverEntry returned 0x0
Function returned 0x0
Downloaded database version: v2012.12.16.11
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff86325ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff863e1b70, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff86325ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff863c87b0, DeviceName: \Device\0000005f\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff863a6940, DeviceName: \Device\Ide\IdeDeviceP0T0L0-4\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffffe1bb2d18, 0xffffffff86325ab8, 0xffffffff8595e900
Lower DeviceData: 0xffffffffe1370058, 0xffffffff863a6940, 0xffffffff85985ca8
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\WINDOWS\system32\drivers...
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: DACB3B70

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 78140097
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 40016019456 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-78136288-78156288)...
Done!
Performing system, memory and registry scan...
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\cache16\_Fireballs.bun" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\cache16\_Special16.bun" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\cache16\_Special17.bun" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\cache16\_Special18.bun" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\Profiles5\folderCDocuments and SettingsAll UsersApplication Data7Wonders2cache16" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\Profiles5\foldergfx" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Apple Computer\QuickTime\com.apple.QuickTime.plist" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\IMShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\BehaviorShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\EmailShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\FileInfo2.db" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\FileSystemShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\Log.db" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\NetworkShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\P2PShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\ScriptShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\snx_lconfig.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\URL.db" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\WebShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast(2)\snx_lconfig.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Awem\Aquitania\Config.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Awem\Cradle of Persia\Config.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\BigFishGamesCache\Persistant\persistant.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\CropBusters\profiles\profiles.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\CropBusters\sys\settings.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation\Diskeeper\EsmLog.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\DivoGames\JewelBox\Config.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\DivoGames\JewelBox\Render.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f1.bin" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f2.bin" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f5.bin" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\PlayFirst\Route66\highscores.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Runes of Avalon 2\data\hiscores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Runes of Avalon 2\data\options.tsc" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\ann.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\hs.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\pat.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\settings.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\tom.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\users.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\zee.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes\Bots.sbe" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes\SystemInternals.sbe" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Funny Bear Studio\Wonders\options.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\GamePlastic\Laby\leaderboard.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Grey Alien Games\Holiday Bonus GOLD\hb.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Grey Alien Games\Holiday Bonus GOLD\HolidayBonusGOLD.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Intenium\EMII\.userbase" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Intenium\EMII\00000.profile" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\news.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSE.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\Hx.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\Hx_1033_MValidator.Lck" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.EXCEL.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.EXCEL.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.GRAPH.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSACCESS.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSACCESS.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSE.12.1033_1033_MValidator.Lck" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSPUB.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSPUB.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSTORE.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.OIS.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.OUTLOOK.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.OUTLOOK.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.POWERPNT.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.POWERPNT.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.RIBBON.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.SETLANG.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.WINWORD.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.WINWORD.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\TEMP\7D48DC2D.TMP" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{01AD3CFA-1B43-A1E6-79FA-55DD9D06A878}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{054BEF6E-77C0-16C3-2FE2-DB78D752034B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{07C60902-C692-3D91-65EF-FEC5A9B1F42B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{07F39E08-7253-098B-92C9-883B80B31F06}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{093B09A2-CF88-F95B-C9B4-E35C143ADA70}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{0E557A19-AA0E-FB8D-43B9-6310730987CF}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{642F2938-36D8-7D45-5D80-631B133C5E98}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{69E3AB4B-6C45-DE9D-A11C-1B010D8DCA8E}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{6AA64D86-58DA-B460-3BC2-E087C1E4A85A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{6AB79781-1A32-69C7-7E32-9F33AA0E064F}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{6E55CA8A-75B4-B98B-7B85-83ACB4EF4CA1}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{72D4570B-A7E1-BEF2-ED81-A462DC2FC621}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{7CDFFE70-093C-6F5D-CDD4-19AD772B5751}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{7CE1B03E-DB83-FCB7-088D-28821FB823EB}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{7E64F36D-DC37-7C5D-AE21-15FF1EA06993}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{80D743BF-9DFA-A020-0092-FBFC82C11AD9}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{86F28170-9A48-16AC-BDB7-DD2818B3EE52}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{87E004EB-3DE8-0ABD-671B-FA64FFB17EB6}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A4AC79F9-BBB3-560C-3951-5A52503791F3}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A992514C-8E14-8498-DBB9-2E9AEFF26485}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{AC3DB216-BD4D-684E-0A9F-FC91931955AC}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{B195F704-7523-63BC-590B-444CF1926D20}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{B75422DB-2D02-C106-5CA5-53574F8D2094}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{BD9A583D-35B3-2C84-F6FC-76BE96D908CB}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{C76091A5-84A2-CD95-E82E-110B8D7D5C25}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{CC73641B-4643-EA37-7E9C-5D794668A499}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{2EB5CB0C-1D44-D413-9FCA-36760360D87D}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{30EE23C0-4C11-A8FD-01B3-2B388837C9E2}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{335D4353-800E-AC2D-92DC-AB03381A059D}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{37437DFF-32DA-9544-B83D-CEF466B14F03}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{399632E4-F20C-FCCF-7F98-C19F52339501}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{3DEFF9C0-3908-BFF8-F4DC-CEC05E1BF55B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{4298F50C-EB5B-AC49-090C-C9AEA23F4E59}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{8A0A8960-2DE4-0091-B95C-CDE3F9564EA1}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{8A828171-DA70-9FE4-A820-46245D2687EC}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{90807C9D-29AB-0641-CF8B-9102A65FD839}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{933EDA94-F0C1-DC25-C442-6F10E3AB98F0}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9406C780-784B-4448-D9C9-26C2C61DF62A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9A9942EE-07EE-F498-4EF7-46B6B16FBD0B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9C99300B-8F6C-7A39-BA7D-489F5338CF9D}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9D4030C3-108F-28EC-F8F3-A7B6D52125ED}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9EAEA7FA-AB6E-1659-5F09-50AA9ED4763B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A120AC03-D871-AAD7-E4E9-968B92684E8A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A246D02E-0CB5-6685-7222-61A34B19CC54}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{10B1E31D-EB13-AB1F-17D6-8C15EB836B14}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{2A276513-C6B5-A177-B62C-DD13138F9E0E}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{4BBEE3D0-DDCA-BBE1-6C23-BFB5F2228768}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{6124E1B8-153C-270F-AA93-A9B41B2F65C7}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{890D7CE9-AD2E-93BF-077B-5E6404BB3CF7}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A2528EF1-6F3E-0DDA-781F-278A36FCC1E8}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{CDE6D33F-4467-962D-5665-C97A0F953D38}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{D080DCB1-1A7D-15C7-9C17-A60EE396580F}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{E1367D93-5E2A-CED1-7B5C-8DE85713CE50}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{E214A6E9-D3E8-39E2-D1E1-1FE19EFED47A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{E3E58FAA-910F-BE6C-8915-2F7FB9A63AA3}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{EB26F06B-21C4-C306-F22B-51259F625010}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{ED14A87A-0107-A2A2-ABF3-B8EF045BE616}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{F4C90ABB-A333-734C-A9F4-65ED1E7C571C}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{F5EC4915-566E-8E5F-97E1-7B5F3D263AB0}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{FBB14A9D-FA47-0974-322D-3801F589428A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{4F9103FD-73B4-7284-427C-59332E20393B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{53E1CC52-16C9-41AE-121D-3B051065B530}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{557D2A9C-79B8-9BE4-5764-35E4B295657B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{578DACD3-C6CD-3C70-2D62-1A79883CC3AB}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{585A0420-26E3-BA04-F3D9-1E33898ACA5A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{595DB4ED-8E5E-FC71-871B-B55073C9D73A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{5B1B9A0B-9A64-7CA9-092C-719B370B1BAD}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{159A8E27-F750-E1EF-C227-3A9C1166B9A2}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{1B4AD373-E390-3DB5-0FBF-6369E676B12E}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{1C3F1EFB-959C-0693-D37A-15D350345E2F}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{286156DC-3B2A-5593-EF48-BEA014ED5B6A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{28A1F17A-0ED7-D0E0-44EF-A1DD625DC471}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\3ae7850dac134f30246de20d911b2480.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\5eefe8b86c5ac5bf14401638b36e38f4.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\66ca185d9119f91781203b7b1f1d4e6f.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\719349c920439a5a5c47be2ed62356da.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\9411754c401c1d4825baed1872037d1c.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\da507fe965e9831cd9eb243b29f921f8.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\WildTangent\Users\OWNER" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\nsIZylomPlugin.xpt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Application Data\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_4.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_7.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_8.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_9.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_5rg_ottoman_castle_visit1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_5rg_ottoman_castle_visit2.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_5rg_warehouse_visit1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_5rg_warehouse_visit2.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_7.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_9.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332379221_3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332379221_5rg_warehouse_visit1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332379221_7.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332379221_9.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_2.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_4.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_8.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_9.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\score.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries_PremiumEdition\default_gamestate.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries_PremiumEdition\default_lostate.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries_PremiumEdition\hiscore.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries_PremiumEdition\score.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Ancient Quest of Saqqarah__iwin\general.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Ancient Quest of Saqqarah__iwin\paaaat.profile" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Ancient Quest of Saqqarah__iwin\settings.setting" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Ancient Quest of Saqqarah__iwin\tom.profile" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Angkor\angkor_cfg.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Awem\Cradle Of Egypt Collector's Edition\config.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Awem\Cradle Of Egypt Collector's Edition\profiles.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Awem\CradleOfRome2\config.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Babylonia\config.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Babylonia\highscores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Boomzap\jewels.lua" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\JewelMatch2\highscores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\JewelMatch2\mm_config.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\config.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\SavedPlayers\CurrentPlayer.weird" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\SavedPlayers\PAT.mar" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\SavedPlayers\TOM.mar" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\SavedPlayers\TOMZEE.mar" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Magic Match\data5.cnf" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\Mse\mse.sln" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\Office\CLView12.pip" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\Office\VB12.pip" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\Protect\CREDHIST" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\UProof\CUSTOM.DIC" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Purple Patch Games\World Adventure\Options.wao" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\ReelDealSlotQuest_TheMuseumEscape\Preferences\LocalPref.bin" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\ReelDealSlotQuest_TheMuseumEscape\Preferences\MP3Directory.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\ReelDealSlotQuest_TheMuseumEscape\SavedData\LastPlayerInfo.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\rokapublish\Safari Quest\settings.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\SpinTop Games\Vacation Quest - Australia\options.mso" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\SpinTop Games\Vacation Quest - Australia\players.mse" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\SulusGames\GemsQuest\pat_tfx.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\SulusGames\GemsQuest\settings.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match 2 Config\config.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match 2 Config\patch.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match 2 Config\scores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match 2 Config\User.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match Config\config.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match Config\patch.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match Config\scores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match Config\User.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\vlc\CACHEDIR.TAG" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\vlc\ml.xspf" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\vlc\vlc-qt-interface.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\WildTangent\Logs\GameConsole-wt.exe.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\Settings.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\User0.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\User1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\User2.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\User3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\Users.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints1.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints2.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints3.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints4.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints5.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\profiles.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\FairyTale\combos.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\FairyTale\config.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\FairyTale\highscores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\FlowPlay\Secrets of the Seas\data.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Goodsol\Pretty Good Solitaire\Ace of Hearts_ptty692.pgs" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Goodsol\Pretty Good Solitaire\Aces and Kings_ptty692.pgs" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Goodsol\Pretty Good Solitaire\ptty692_Ace of Hearts.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Goodsol\Pretty Good Solitaire\ptty692_Aces and Kings.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iMaxGen\HEXUS_GAMEHOUSE_PREMIUM_FB_1_0\config.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iMaxGen\HEXUS_GAMEHOUSE_PREMIUM_FB_1_0\default.pm" is compressed (flags = 1)

JAK · 2012/12/16

system log 2

Read File: File "C:\Program Files\Mozilla Firefox\browserconfig.properties" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\freebl3.chk" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\old-homepage-default.properties" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\platform.ini" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\README.txt" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\softokn3.chk" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\components\nsIZylomPlugin.xpt" is compressed (flags = 1)
Read File: File "C:\Program Files\Outlook Express\msoe.txt" is compressed (flags = 1)
Read File: File "C:\Program Files\Windows Media Player\npdrmv2.zip" is compressed (flags = 1)
Read File: File "C:\boot.ini" is compressed (flags = 1)
Read File: File "C:\eula.1041.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\perfwci.h" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\prodspec.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\pscript.sep" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\login.cmd" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\l_except.nls" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\pcl.sep" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\perfci.h" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\perffilt.h" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\cmos.ram" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\dsound.vxd" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\View Channels.scf" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\etc\networks" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\migip.dun" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\migrate.isp" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\msobe.isp" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\obeip.dun" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\oobeinfo.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\reg.isp" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\wbem\wmiclivalueformat.xsl" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\1YVS3PFZ\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\JUH1NTKF\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\OZE07LL3\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\RVGBPWQ8\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\FixitPatchRegistration.log" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT01d46.TMP" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT020df.TMP" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT02cb2.TMP" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT03280.TMP" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT03973.TMP" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT039af.TMP" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT03d2a.TMP" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT05ebc.TMP" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT0694d.TMP" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\ZLT0798a.TMP" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\ntuser.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\NetworkService\ntuser.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\ntuser.pol" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\explorer.scf" is compressed (flags = 1)
Read File: File "C:\WINDOWS\vb.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\vbaddin.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\wiaservc.log" is compressed (flags = 1)
Read File: File "C:\WINDOWS\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\dao\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\office\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\office\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Access\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Outlook\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.PowerPoint\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Access.Dao\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Excel\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Graph\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Outlook\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Outlook\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.OutlookViewCtl\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.OutlookViewCtl\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Owc\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.PowerPoint\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.PowerPoint\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Publisher\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.SmartTag\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Word\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Vbe.Interop\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Vbe.Interop.Forms\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Access\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Publisher\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Policy.11.0.office\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Debug\UserMode\gptext.log" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Downloaded Program Files\iefax.inf" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Downloaded Program Files\muweb.inf" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Downloaded Program Files\swflash.inf" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Downloaded Program Files\wuweb.inf" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\ciadmin.htm" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\conf.cnt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\connect.cnt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\mshearts.cnt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\msnauth.cnt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\nocontnt.cnt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\ratings.cnt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\update.cnt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\windows.cnt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Help\winhlp32.cnt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\cons5cWebUpdate2dWin2k.ico0.ico" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.rtm.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet.mof.uninstall" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\caspol.exe.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cvtres.exe.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ieexec.exe.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\jsc.exe.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\l_except.nlp" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\XPThemes.manifest" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\regasm.exe.config" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.htm" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Web\bullet.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\NetworkService\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TheLostIncaProphecy\data.tmp" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TheLostIncaProphecy\hs.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TheLostIncaProphecy\settings.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TheLostIncaProphecy\users.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\toolbar.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\VTShared\UnicodeMgr.dll" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Local Settings\History\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\Microsoft\Feeds Cache\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\Microsoft\Silverlight\mssl.lck" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\Oberon Games\Paradise Quest\System.prefs" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\Oberon Games\Vesuvia\System.prefs" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TheLostIncaProphecy\data.tmp" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TheLostIncaProphecy\hs.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TheLostIncaProphecy\settings.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TheLostIncaProphecy\users.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\toolbar.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_clear_history_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_contact_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_help_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_home_page_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_options_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_privacy_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_refresh_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_shrink_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_tell_a_friend_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_SearchEngines_ebay_search_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_SearchEngines_encyc_search_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_SearchEngines_images_search_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_SearchEngines_news_icon_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_searchengines_search_icon_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_SearchEngines_shopping_search_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_SearchEngines_weather_icon_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___oryte_com_content_icons_clock_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___oryte_com_content_icons_fax_16_png.png" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_about_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_main_menu_upgrade_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_LikeIcon_png.png" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Options_png.png" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_BankImages_RadioSkins_StarFleet_slider_bg_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_images_ClientImages_radio_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___oryte_com_content_icons_unitconverter_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\CacheIcons\http___storage_conduit_com_36_239_CT2392836_Images_633629754211018750_gif.gif" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\Dialogs\settings.js" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\TranslatorBar_1\Dialogs\version.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Local Settings\Application Data\VTShared\UnicodeMgr.dll" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Desktop\Accessories\Accessibility\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Desktop\Accessories\Entertainment\desktop.ini" is compressed (flags = 1)
Infected: C:\Documents and Settings\OWNER\Local Settings\Application Data\dealcabby\ie\dealcabby_20121014101001.dll --> [Adware.DealCabby]
Infected: HKLM\SOFTWARE\CLASSES\CLSID\{CF3EE69A-4099-46C8-A62E-ABB2FD5447BB}\InprocServer32 --> [Adware.DealCabby]
Infected: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|Start_ShowHelp --> [PUM.Hijack.StartMenu]
Infected: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|StartMenuLogoff --> [PUM.Hijack.StartMenu]
Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{CF3EE69A-4099-46C8-A62E-ABB2FD5447BB} --> [Adware.DealCabby]
Infected: HKLM\SOFTWARE\CLASSES\CLSID\{CF3EE69A-4099-46C8-A62E-ABB2FD5447BB} --> [Adware.DealCabby]
Infected: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{CF3EE69A-4099-46C8-A62E-ABB2FD5447BB} --> [Adware.DealCabby]
Infected: HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CF3EE69A-4099-46C8-A62E-ABB2FD5447BB} --> [Adware.DealCabby]
Infected: HKCU\SOFTWARE\CLASSES\CLSID\{CF3EE69A-4099-46C8-A62E-ABB2FD5447BB} --> [Adware.DealCabby]
Infected: HKCU\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CF3EE69A-4099-46C8-A62E-ABB2FD5447BB} --> [Adware.DealCabby]
Done!
Scan finished
Creating System Restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Removal scheduling successful. System shutdown needed.
System shutdown occurred
=======================================

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1011

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_26

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.660000 GHz
Memory total: 1064288256, free: 736968704

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1011

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_26

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.659000 GHz
Memory total: 1064288256, free: 704253952

------------ Kernel report ------------
12/16/2012 18:40:19
------------ Loaded modules -----------
\WINDOWS\system32\ntoskrnl.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
PCIIde.sys
\WINDOWS\System32\Drivers\PCIIDEX.SYS
intelide.sys
MountMgr.sys
ftdisk.sys
dmload.sys
dmio.sys
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltMgr.sys
sr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
Mup.sys
hotcore3.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\ialmnt5.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\e100b325.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\drivers\smwdm.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\rdpdr.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\UimBus.sys
\SystemRoot\System32\Drivers\Uim_IM.sys
\SystemRoot\System32\Drivers\UimFIO.SYS
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\Drivers\AswRdr.SYS
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\system32\DRIVERS\ipnat.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\System32\Drivers\aswSnx.SYS
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\System32\Drivers\Aavmker4.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\ialmdnt5.dll
\SystemRoot\System32\ialmrnt5.dll
\SystemRoot\System32\ialmdev5.DLL
\SystemRoot\System32\ialmdd5.DLL
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\System32\Drivers\aswMon2.SYS
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\kmixer.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff86383ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-4\
Lower Device Object: 0xffffffff863df940
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
DriverEntry returned 0x0
Function returned 0x0
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff86383ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff863c9950, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff86383ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff863c7a08, DeviceName: \Device\0000005f\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff863df940, DeviceName: \Device\Ide\IdeDeviceP0T0L0-4\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffffe11495e0, 0xffffffff86383ab8, 0xffffffff85a22ab8
Lower DeviceData: 0xffffffffe10e5258, 0xffffffff863df940, 0xffffffff85a80f18
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\WINDOWS\system32\drivers...
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: DACB3B70

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 78140097
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 40016019456 bytes
Sector size: 512 bytes

JAK · 2012/12/16

system log 3

Scanning physical sectors of unpartitioned space on drive 0 (1-62-78136288-78156288)...
Done!
Performing system, memory and registry scan...
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\cache16\_Fireballs.bun" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\cache16\_Special16.bun" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\cache16\_Special17.bun" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\cache16\_Special18.bun" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\Profiles5\folderCDocuments and SettingsAll UsersApplication Data7Wonders2cache16" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\7Wonders2\Profiles5\foldergfx" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Apple Computer\QuickTime\com.apple.QuickTime.plist" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\IMShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\BehaviorShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\EmailShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\FileInfo2.db" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\FileSystemShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\Log.db" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\NetworkShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\P2PShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\ScriptShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\snx_lconfig.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\URL.db" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\WebShield.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast(2)\snx_lconfig.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Awem\Aquitania\Config.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Awem\Cradle of Persia\Config.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\BigFishGamesCache\Persistant\persistant.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\CropBusters\profiles\profiles.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\CropBusters\sys\settings.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation\Diskeeper\EsmLog.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\DivoGames\JewelBox\Config.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\DivoGames\JewelBox\Render.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f1.bin" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f2.bin" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f5.bin" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\PlayFirst\Route66\highscores.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Runes of Avalon 2\data\hiscores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Runes of Avalon 2\data\options.tsc" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\ann.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\hs.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\pat.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\settings.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\tom.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\users.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\SecretsOfOlympus\zee.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes\Bots.sbe" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes\SystemInternals.sbe" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Funny Bear Studio\Wonders\options.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\GamePlastic\Laby\leaderboard.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Grey Alien Games\Holiday Bonus GOLD\hb.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Grey Alien Games\Holiday Bonus GOLD\HolidayBonusGOLD.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Intenium\EMII\.userbase" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Intenium\EMII\00000.profile" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\news.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSE.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\Hx.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\Hx_1033_MValidator.Lck" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.EXCEL.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.EXCEL.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.GRAPH.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSACCESS.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSACCESS.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSE.12.1033_1033_MValidator.Lck" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSPUB.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSPUB.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.MSTORE.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.OIS.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.OUTLOOK.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.OUTLOOK.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.POWERPNT.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.POWERPNT.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.RIBBON.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.SETLANG.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.WINWORD.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Microsoft Help\MS.WINWORD.DEV.12.1033.hxn" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\TEMP\7D48DC2D.TMP" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{01AD3CFA-1B43-A1E6-79FA-55DD9D06A878}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{054BEF6E-77C0-16C3-2FE2-DB78D752034B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{07C60902-C692-3D91-65EF-FEC5A9B1F42B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{07F39E08-7253-098B-92C9-883B80B31F06}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{093B09A2-CF88-F95B-C9B4-E35C143ADA70}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{0E557A19-AA0E-FB8D-43B9-6310730987CF}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{642F2938-36D8-7D45-5D80-631B133C5E98}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{69E3AB4B-6C45-DE9D-A11C-1B010D8DCA8E}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{6AA64D86-58DA-B460-3BC2-E087C1E4A85A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{6AB79781-1A32-69C7-7E32-9F33AA0E064F}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{6E55CA8A-75B4-B98B-7B85-83ACB4EF4CA1}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{72D4570B-A7E1-BEF2-ED81-A462DC2FC621}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{7CDFFE70-093C-6F5D-CDD4-19AD772B5751}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{7CE1B03E-DB83-FCB7-088D-28821FB823EB}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{7E64F36D-DC37-7C5D-AE21-15FF1EA06993}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{80D743BF-9DFA-A020-0092-FBFC82C11AD9}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{86F28170-9A48-16AC-BDB7-DD2818B3EE52}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{87E004EB-3DE8-0ABD-671B-FA64FFB17EB6}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A4AC79F9-BBB3-560C-3951-5A52503791F3}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A992514C-8E14-8498-DBB9-2E9AEFF26485}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{AC3DB216-BD4D-684E-0A9F-FC91931955AC}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{B195F704-7523-63BC-590B-444CF1926D20}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{B75422DB-2D02-C106-5CA5-53574F8D2094}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{BD9A583D-35B3-2C84-F6FC-76BE96D908CB}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{C76091A5-84A2-CD95-E82E-110B8D7D5C25}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{CC73641B-4643-EA37-7E9C-5D794668A499}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{2EB5CB0C-1D44-D413-9FCA-36760360D87D}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{30EE23C0-4C11-A8FD-01B3-2B388837C9E2}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{335D4353-800E-AC2D-92DC-AB03381A059D}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{37437DFF-32DA-9544-B83D-CEF466B14F03}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{399632E4-F20C-FCCF-7F98-C19F52339501}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{3DEFF9C0-3908-BFF8-F4DC-CEC05E1BF55B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{4298F50C-EB5B-AC49-090C-C9AEA23F4E59}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{8A0A8960-2DE4-0091-B95C-CDE3F9564EA1}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{8A828171-DA70-9FE4-A820-46245D2687EC}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{90807C9D-29AB-0641-CF8B-9102A65FD839}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{933EDA94-F0C1-DC25-C442-6F10E3AB98F0}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9406C780-784B-4448-D9C9-26C2C61DF62A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9A9942EE-07EE-F498-4EF7-46B6B16FBD0B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9C99300B-8F6C-7A39-BA7D-489F5338CF9D}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9D4030C3-108F-28EC-F8F3-A7B6D52125ED}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{9EAEA7FA-AB6E-1659-5F09-50AA9ED4763B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A120AC03-D871-AAD7-E4E9-968B92684E8A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A246D02E-0CB5-6685-7222-61A34B19CC54}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{10B1E31D-EB13-AB1F-17D6-8C15EB836B14}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{2A276513-C6B5-A177-B62C-DD13138F9E0E}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{4BBEE3D0-DDCA-BBE1-6C23-BFB5F2228768}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{6124E1B8-153C-270F-AA93-A9B41B2F65C7}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{890D7CE9-AD2E-93BF-077B-5E6404BB3CF7}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{A2528EF1-6F3E-0DDA-781F-278A36FCC1E8}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{CDE6D33F-4467-962D-5665-C97A0F953D38}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{D080DCB1-1A7D-15C7-9C17-A60EE396580F}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{E1367D93-5E2A-CED1-7B5C-8DE85713CE50}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{E214A6E9-D3E8-39E2-D1E1-1FE19EFED47A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{E3E58FAA-910F-BE6C-8915-2F7FB9A63AA3}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{EB26F06B-21C4-C306-F22B-51259F625010}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{ED14A87A-0107-A2A2-ABF3-B8EF045BE616}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{F4C90ABB-A333-734C-A9F4-65ED1E7C571C}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{F5EC4915-566E-8E5F-97E1-7B5F3D263AB0}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{FBB14A9D-FA47-0974-322D-3801F589428A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{4F9103FD-73B4-7284-427C-59332E20393B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{53E1CC52-16C9-41AE-121D-3B051065B530}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{557D2A9C-79B8-9BE4-5764-35E4B295657B}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{578DACD3-C6CD-3C70-2D62-1A79883CC3AB}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{585A0420-26E3-BA04-F3D9-1E33898ACA5A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{595DB4ED-8E5E-FC71-871B-B55073C9D73A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{5B1B9A0B-9A64-7CA9-092C-719B370B1BAD}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{159A8E27-F750-E1EF-C227-3A9C1166B9A2}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{1B4AD373-E390-3DB5-0FBF-6369E676B12E}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{1C3F1EFB-959C-0693-D37A-15D350345E2F}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{286156DC-3B2A-5593-EF48-BEA014ED5B6A}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\data\{28A1F17A-0ED7-D0E0-44EF-A1DD625DC471}" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\3ae7850dac134f30246de20d911b2480.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\5eefe8b86c5ac5bf14401638b36e38f4.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\66ca185d9119f91781203b7b1f1d4e6f.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\719349c920439a5a5c47be2ed62356da.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\9411754c401c1d4825baed1872037d1c.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Trymedia\stats\da507fe965e9831cd9eb243b29f921f8.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\WildTangent\Users\OWNER" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\nsIZylomPlugin.xpt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\Default User\Application Data\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_4.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_7.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_8.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1331997769_9.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_5rg_ottoman_castle_visit1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_5rg_ottoman_castle_visit2.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_5rg_warehouse_visit1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_5rg_warehouse_visit2.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_7.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332353500_9.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332379221_3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332379221_5rg_warehouse_visit1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332379221_7.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\1332379221_9.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_2.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_4.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_8.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\default_9.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries4_PremiumEdition\score.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries_PremiumEdition\default_gamestate.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries_PremiumEdition\default_lostate.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries_PremiumEdition\hiscore.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iWin\JewelQuestMysteries_PremiumEdition\score.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Ancient Quest of Saqqarah__iwin\general.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Ancient Quest of Saqqarah__iwin\paaaat.profile" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Ancient Quest of Saqqarah__iwin\settings.setting" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Ancient Quest of Saqqarah__iwin\tom.profile" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Angkor\angkor_cfg.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Awem\Cradle Of Egypt Collector's Edition\config.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Awem\Cradle Of Egypt Collector's Edition\profiles.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Awem\CradleOfRome2\config.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Babylonia\config.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Babylonia\highscores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Boomzap\jewels.lua" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\JewelMatch2\highscores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\JewelMatch2\mm_config.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\config.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\SavedPlayers\CurrentPlayer.weird" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\SavedPlayers\PAT.mar" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\SavedPlayers\TOM.mar" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\LTOA\SavedPlayers\TOMZEE.mar" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Magic Match\data5.cnf" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\Mse\mse.sln" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\Office\CLView12.pip" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\Office\VB12.pip" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\Protect\CREDHIST" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Microsoft\UProof\CUSTOM.DIC" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Purple Patch Games\World Adventure\Options.wao" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\ReelDealSlotQuest_TheMuseumEscape\Preferences\LocalPref.bin" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\ReelDealSlotQuest_TheMuseumEscape\Preferences\MP3Directory.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\ReelDealSlotQuest_TheMuseumEscape\SavedData\LastPlayerInfo.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\rokapublish\Safari Quest\settings.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\SpinTop Games\Vacation Quest - Australia\options.mso" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\SpinTop Games\Vacation Quest - Australia\players.mse" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\SulusGames\GemsQuest\pat_tfx.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\SulusGames\GemsQuest\settings.xml" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match 2 Config\config.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match 2 Config\patch.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match 2 Config\scores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match 2 Config\User.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match Config\config.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match Config\patch.cfg" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match Config\scores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\URSE Games\Season Match Config\User.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\vlc\CACHEDIR.TAG" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\vlc\ml.xspf" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\vlc\vlc-qt-interface.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\WildTangent\Logs\GameConsole-wt.exe.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\Settings.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\User0.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\User1.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\User2.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\User3.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern\Users.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints1.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints2.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints3.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints4.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\hints5.sav" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\EnchantedCavern2\profiles.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\FairyTale\combos.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\FairyTale\config.txt" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\FairyTale\highscores.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\FlowPlay\Secrets of the Seas\data.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Goodsol\Pretty Good Solitaire\Ace of Hearts_ptty692.pgs" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Goodsol\Pretty Good Solitaire\Aces and Kings_ptty692.pgs" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Goodsol\Pretty Good Solitaire\ptty692_Ace of Hearts.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\Goodsol\Pretty Good Solitaire\ptty692_Aces and Kings.log" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iMaxGen\HEXUS_GAMEHOUSE_PREMIUM_FB_1_0\config.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\OWNER\Application Data\iMaxGen\HEXUS_GAMEHOUSE_PREMIUM_FB_1_0\default.pm" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\browserconfig.properties" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\freebl3.chk" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\old-homepage-default.properties" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\platform.ini" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\README.txt" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\softokn3.chk" is compressed (flags = 1)
Read File: File "C:\Program Files\Mozilla Firefox\components\nsIZylomPlugin.xpt" is compressed (flags = 1)
Read File: File "C:\Program Files\Outlook Express\msoe.txt" is compressed (flags = 1)
Read File: File "C:\Program Files\Windows Media Player\npdrmv2.zip" is compressed (flags = 1)
Read File: File "C:\boot.ini" is compressed (flags = 1)
Read File: File "C:\eula.1041.txt" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\perfwci.h" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\prodspec.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\pscript.sep" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\login.cmd" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\l_except.nls" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\pcl.sep" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\perfci.h" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\perffilt.h" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\cmos.ram" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\dsound.vxd" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\View Channels.scf" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\drivers\etc\networks" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\migip.dun" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\migrate.isp" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\msobe.isp" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\obeip.dun" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\oobeinfo.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\oobe\reg.isp" is compressed (flags = 1)
Read File: File "C:\WINDOWS\system32\wbem\wmiclivalueformat.xsl" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\1YVS3PFZ\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\JUH1NTKF\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\OZE07LL3\desktop.ini" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\RVGBPWQ8\desktop.ini" is compressed (flags = 1)
Read File: File "C:\WINDOWS\Temp\FixitPatchRegistration.log" is compressed (flags = 1)

Log in or Sign up

Solved WIN xp bogs down; ok in safe mode

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

Share This Page

Log in or Sign up

Solved WIN xp bogs down; ok in safe mode

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

broni Moderator Malware Analyst

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

JAK Well-Known Member Thread Starter

Share This Page

Useful Searches