# 6666666 Virus/Malware/overwrites everything



## heidi87

As soon as there is a chance, my laptop/the virus types in "666666666.." - this happens when I open a browser, a document, want to rename a file etc.
(Now I'm using a friends laptop, I cannot access any website with my laptop)

Also, when I open "my computer", the cursor jumps to "6666666's documents" (which is "my documents" - after a system restore yesterday, the user name is "66666666666666". The system restore didn't help.) The cursor jumps right back to "66666666666 documents" whenever I try to open "C" or a different folder or device. Only if I'm really fast with clicking on "c" (or other) I can open a different folder/device. I also cannot delete the "66666666666 document" folder.

I did run "hijackThis" - nothing found. A booted from a USB stick with "Avira restore" on it - it found two things but everything stayed the same. 

I do have the three required files - there might be "6" in the file - like I said before, as soon as there is a change, the "6666..." will be entered anywhere. 
I couldn't save the third required file as .txt - therefore I cannot attach this file. I copied the content and paste it after the first file.

I really need help!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 
Thank you in advance!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

DDS (Ver_2012-11-20.01) - NTFS_x86 
Internet Explorer: 6.0.2900.2180
Run by 66666666666666666666 at 13:31:03 on 2014-08-04
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.702 [GMT -4:00]
.
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\msdtc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
uInternet Connection Wizard,ShellNext = hxxp://www.piriform.com/go/app_releasenotes?p=1&v=4.16.4763&l=1033&b=1&a=0
BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
TB: &Google: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: &Google: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_06\bin\jusched.exe
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [MsmqIntCert] regsvr32 /s mqrt.dll
mRun: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [QlbCtrl] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [RecGuard] c:\windows\sminst\RecGuard.exe
mRun: [Reminder] c:\windows\creator\Remind_XP.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\realte~1.lnk - c:\program files\realtek\rtl8187 wireless lan utility\RtWLan.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{8B48AE30-D099-438A-B92D-A6ED37D90394} : DHCPNameServer = 75.75.75.75 75.75.76.76
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-6 99328]
.
=============== Created Last 30 ================
.
2014-08-04 16:52:37 -------- d-----w- c:\windows\system32\appmgmt
2014-08-04 15:22:56 -------- d-sha-r- C:\cmdcons
2014-08-04 15:20:11 98816 ----a-w- c:\windows\sed.exe
2014-08-04 15:20:11 256000 ----a-w- c:\windows\PEV.exe
2014-08-04 15:20:11 208896 ----a-w- c:\windows\MBR.exe
2014-08-04 00:43:59 -------- d-----w- c:\documents and settings\66666666666666666666\local settings\application data\Mozilla
2014-08-04 00:39:04 -------- d-s---w- c:\documents and settings\66666666666666666666\Temporary Internet Files
2014-08-04 00:39:04 -------- d-s---w- c:\documents and settings\66666666666666666666\History
2014-08-04 00:31:58 185344 ----a-w- c:\windows\system32\Thawbrkr.dll
2014-08-04 00:31:57 6144 ----a-w- c:\windows\system32\ftlx041e.dll
2014-08-04 00:31:57 5632 ----a-w- c:\windows\system32\kbdusa.dll
2014-08-04 00:31:57 10752 ----a-w- c:\windows\system32\c_iscii.dll
2014-08-03 23:01:11 26496 ----a-w- c:\windows\system32\dllcache\usbstor.sys
.
==================== Find3M ====================
.
2010-02-11 00:52:14 27386256 ----a-w- c:\program files\AdbeRdr930_en_US.exe
2009-08-15 19:20:49 8050536 ----a-w- c:\program files\Firefox Setup 3.5.2.exe
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, GMER - Rootkit Detector and Remover
Windows 5.1.2600 
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR 
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys 
c:\windows\system32\drivers\iaStor.sys Intel Corporation Intel Matrix Storage Manager driver
1 ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\Harddisk0\DR0[0x86578AB8]
3 CLASSPNP[0xF761F05B] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\0000007b[0x86530A28]
5 ACPI[0xF7495620] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\Ide\IAAStorageDevice-0[0x865C6030]
kernel: MBR read successfully
_asm { XOR DI, DI; MOV SI, 0x200; MOV SS, DI; MOV SP, 0x7a00; MOV BX, 0x7a0; MOV CX, SI; MOV DS, BX; MOV ES, BX; REP MOVSB ; JMP FAR 0x7a0:0x7a; }
user != kernel MBR !!! 
.
============= FINISH: 13:31:48.59 ===============



GMER 2.1.19357 - GMER - Rootkit Detector and Remover
Rootkit scan 2014-08-04 15:06:45
Windows 5.1.2600 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 rev. 0.00MB
Running: gmer.exe; Driver: C:\DOCUME~1\666666~1\LOCALS~1\Temp\fgndrkod.sys


---- Kernel code sections - GMER 2.1 ----

init C:\WINDOWS\system32\drivers\tifm21.sys entry point in "init" section [0xBA84FEBF]
? C:\DOCUME~1\666666~1\LOCALS~1\Temp\mbr.sys The filename, directory name, or volume label syntax is incorrect. !

---- Devices - GMER 2.1 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 eabfiltr.sys

---- Disk sectors - GMER 2.1 ----

Disk \Device\Harddisk0\DR0 unknown MBR code
Disk \Device\Harddisk0\DR0 sector 0: rootkit-like behavior

---- EOF - GMER 2.1 ----


----------



## chemist

Hello and Welcome to TSF. 

If you haven't already, please *Subscribe to this Thread* to get immediate notification of replies as soon as they are posted. To do this click *Thread Tools*, then click *Subscribe to this Thread*. Make sure it is set to *Instant notification by email*, then click *Add Subscription*.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

Please explain why this computer has no antivirus program installed and running. This is an open invitation for infection. 

It can take as little as *eight seconds* to infect an unprotected computer. 

Let me know your intentions for an antivirus program, and/or if you need a suggestion. 

------------------------------------------------------

Please explain why this computer only has ServicePack 2 installed. Are you running a legal copy of Windows? 

------------------------------------------------------

Who instructed you to run ComboFix? As stated in the disclaimer you had to pass when running ComboFix, it is not intended for unsupervised use. 

As you also should have read here in *Step 2* of our *First Steps* thread: 

*Why we don't ask you to run ComboFix from the onset* 

As stated by the *author* of ComboFix:

ComboFix is a very powerful tool which when improperly used may render your machine to a doorstop. 

------------------------------------------------------

I need to see the log from your last ComboFix run. 

Go to Start > Run and copy/paste the following into the Run box and click OK:

*C:\ComboFix.txt* 

A text file should open. Please post the contents of that file in your next reply.

------------------------------------------------------


----------



## heidi87

Thank you so much for your response - now I have hope!

Service Pack 3 and security software (AVIRA and AVG) and other new software was installed when the laptop got infected.
I shut the computer down and couldn't restart Windows because as soon as the login screen popped up, the virus (or whatever it is) typed in "
666666666666666666". 
I made an USB stick with the Avira rescue software on it - this way I could manage to get a system restore but I couldn't pick a restore point. I guess it went back to the factory installation. This is why new software is missing. 

After installing and running some Antivirus software (Avira from usb stick, Malwarebytes/Antimalware) I could use the Laptop again. 

The virus is still there but the typing of the "66666666666" is slowing down. It also stops sometimes when I enter another letter. I installed service pack3 and COMODO suite (freeware).

Weird is, that the laptop starts beeping again when I turn it on. (It was like this at first, but didn't do it yesterday. The beeping is like morse signals. 
Also, the first screen which pops up is not the windows screen, it's the black screen (DOS?) with three options . If I don't chose any, windows starts automatically. (The laptop didn't beep when I restarted it a minute ago.

I did run ComboFix again and will paste the result. If you want to the see old ComboFix file, please let me know.
I only ran it to have a file - just in case the situation would get worse and I wouldn't be able to do anything. I heard that a lot of expert want a ComboFix file. I would never ever do anything with it myself - other the running it. 
Now I realize that I should have ask you for help in the first place....Sorry!

I really do appreciate your help!

Heidi


(The "666666666666666666666" in the first row in the file below were entered by the virus or whatever it is.)



ComboFix 14-08-02.02 - 66666666666666666666 08/06/2014 18:25:43.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.462 [GMT -4:00]
Running from: c:\documents and settings\66666666666666666666\Desktop\ComboFix.exe
AV: COMODO Antivirus *Disabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((( Files Created from 2014-07-06 to 2014-08-06 )))))))))))))))))))))))))))))))
.
.
2014-08-05 19:18 . 2014-08-06 22:18 36992 ----a-w- c:\windows\system32\drivers\sfi.dat
2014-08-05 19:16 . 2014-08-05 19:16 -------- d-s---w- c:\documents and settings\All Users\Application Data\Shared Space
2014-08-05 19:15 . 2014-08-05 19:15 -------- d-----w- c:\program files\COMODO
2014-08-05 19:14 . 2014-08-05 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2014-08-05 19:11 . 2014-08-05 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo
2014-08-05 18:44 . 2014-08-05 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2014-08-05 18:10 . 2014-08-05 18:10 -------- d-----w- c:\program files\MSECache
2014-08-05 16:12 . 2014-08-05 17:44 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 16:12 . 2014-08-05 16:12 -------- d-----w- C:\Malwarebytes Anti-Malware
2014-08-05 16:12 . 2014-08-05 16:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2014-08-05 16:12 . 2014-05-12 11:26 53208 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 16:12 . 2014-05-12 11:25 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-08-04 00:37 . 2014-08-05 17:05 -------- d-----w- c:\documents and settings\66666666666666666666
2014-08-04 00:31 . 2004-08-10 07:00 185344 ----a-w- c:\windows\system32\Thawbrkr.dll
2014-08-04 00:31 . 2004-08-10 07:00 6144 ----a-w- c:\windows\system32\ftlx041e.dll
2014-08-04 00:31 . 2004-08-10 07:00 5632 ----a-w- c:\windows\system32\kbdusa.dll
2014-08-04 00:31 . 2004-08-10 07:00 10752 ----a-w- c:\windows\system32\c_iscii.dll
2014-08-03 23:01 . 2004-08-04 03:08 26496 ----a-w- c:\windows\system32\dllcache\usbstor.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-11 00:52 . 2010-02-11 00:42 27386256 ----a-w- c:\program files\AdbeRdr930_en_US.exe
2009-08-15 19:20 . 2009-08-15 19:20 8050536 ----a-w- c:\program files\Firefox Setup 3.5.2.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OKAYFREEDOM_Agent"="c:\program files\OkayFreedom\OkayFreedomClient.exe" [2014-04-09 4656464]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-11 36975]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-15 454656]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"MsmqIntCert"="mqrt.dll" [2004-08-10 177152]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 61952]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-04 761948]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-04-12 102400]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-07 131072]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2014-03-26 1225944]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hp\Digital Imaging\bin\hpqthb08.exe -s [2005-9-24 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE -b -l [1999-2-17 65588]
REALTEK RTL8187 Wireless LAN Utility.lnk - c:\program files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe /H [2013-10-13 942080]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
.
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [3/25/2014 8:22 PM 15704]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [3/25/2014 8:22 PM 607448]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [3/25/2014 8:22 PM 29912]
S3 cmdvirth;COMODO Virtual Service Manager;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe [3/25/2014 8:22 PM 1663192]
.
Contents of the 'Scheduled Tasks' folder
.
2014-08-06 c:\windows\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-03-31 18:19]
.
2014-08-06 c:\windows\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-03-31 18:19]
.
2014-08-06 c:\windows\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-03-31 18:19]
.
2014-08-06 c:\windows\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-03-31 18:19]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
uInternet Connection Wizard,ShellNext = hxxp://www.piriform.com/go/app_releasenotes?p=1&v=4.16.4763&l=1033&b=1&a=0
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
.
.
------- File Associations -------
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2014-08-06 18:38
Windows 5.1.2600 Service Pack 2 NTFS
.
detected NTDLL code modification:
ZwClose
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? [email protected][email protected]? ????V??????([email protected][email protected] 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, GMER - Rootkit Detector and Remover
Windows 5.1.2600 
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR 
kernel: MBR read successfully
user != kernel MBR !!! 
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\COMODO\CIS\Installer\Sym_Cam\CIS]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CmdAgent\Mode\Configurations]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CmdAgent\Mode\Data]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CmdAgent\Mode\Options]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\System\Software\COMODO\Cam]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\System\Software\COMODO\Firewall Pro]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(1008)
c:\windows\system32\guard32.dll
c:\windows\system32\mswsock.dll
c:\windows\System32\wshtcpip.dll
.
- - - - - - - > 'explorer.exe'(228)
c:\windows\system32\guard32.dll
c:\windows\system32\WS2_32.dll
c:\windows\system32\WS2HELP.dll
c:\windows\system32\WSOCK32.dll
.
- - - - - - - > 'csrss.exe'(924)
c:\windows\system32\cmdcsr.dll
.
Completion time: 2014-08-06 18:42:49
ComboFix-quarantined-files.txt 2014-08-06 22:42
ComboFix2.txt 2014-08-04 17:05
ComboFix3.txt 2014-08-04 15:32
.
Pre-Run: 35,660,169,216 bytes free
Post-Run: 35,658,420,224 bytes free
.
- - End Of File - - BEB29445BA3427C01D38C1A9F1670DDD
5AE5A393505CFFD37FE98C4A7922908D


----------



## heidi87

chemist said:


> Hello and Welcome to TSF.
> 
> 
> Let me know your intentions for an antivirus program, and/or *if you need a* *suggestion*.
> 
> ------------------------------------------------------
> 
> Are you running a legal copy of Windows?
> 
> ------------------------------------------------------
> 
> 
> 
> ------------------------------------------------------


Sorry, forgot to reply to these aspects:
Yes, if you can recommend firewall/antivirus it would be great. I researched the Internet for freeware, but there are so many different rankings/ reviews out there....Comodo seemed fine to me but please let me know if you recommend a different one.

Yes, it's a legal Windows version - as far as I know- I bought this laptop kind of brand new from a friend of mine. She is also originally from Europe and couldn't get use to the different (US) keyboard. (I/m pretty sure that I have CD's and the serial # - I have to check when I'm back home)


----------



## heidi87

I just noticed that service pack 3 is NOT there. I did download and run it.

I double checked -downloaded and run it again - doesn't work...

This one
Office2003SP3-KB923618-FullFile-ENU
says :"This update has already been applied or is included in an update that has already been applied"

This one 
OfficeXPSp3-kb832671-fullfile-enu.exe
says :" The expected version of the product was not found on your system."

The system says it's still running on SP 2.

I checked at home I do have a/the legal Windows copy (CD, Case and serial numbers) . I also contacted my friend - she confirmed hat me that it's a legal copy. But reminded me that she bought the software in Europe - could this have anything to do with it?


Should I re-install Windows and try it again???????
I'm 100% positive that SP3 was installed before the infection.
Is it possible that the weird new computer name "666666666" has anything to with it?


I'm really lost.....


----------



## chemist

Hello Heidi. Not sure what's going on with SP3. Let's see what our tools find first. 



> Also, the first screen which pops up is not the windows screen, it's the black screen (DOS?) with three options . If I don't chose any, windows starts automatically


That's normal after ComboFix installed the Windows Recovery Console. Just let the machine boot up automatically. 

Before we continue, what is your normal Windows administrative account name? Is it still in your C:\Documents and Settings folder? 

------------------------------------------------------

Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

*cmd /c NET USER > log.txt&log.txt&del log.txt*

A Notepad file will open. Post the contents of *log.txt* in your next reply. 

------------------------------------------------------


----------



## heidi87

It took a while to run it. The are back - rea6lly hard to do anything6 with the laptop. Here is the result. I couldnt' chose my name - the "sixes" took over. (Weird, all of a sudden the "six" key is not working. It was working fine till today.

User accounts for \\YOUR-252739F5C3

-------------------------------------------------------------------------------
66666666666666666666 Administrator ASPNET 
Guest HelpAssistant SUPPORT_388945a0 
The command completed successfully.





-66666666666666666666666666666666666666fdfkjafaf66666666666666666666666666666666666666666666666666it6666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666;;;666666666666


----------



## heidi87

Sorry, the text got deleted. Here is the rest:

All of sudden the "six" key on the keyboard is not working. It was working fine till today. When I hit the "six" key, nothing happens.


----------



## chemist

What was/is the name of your normal account? Is it still in your C:\Documents and Settings folder?


----------



## heidi87

Hello Chemist, 
The regular one is now:

C:\Documents and Settings\66666666666666666666\My Documents\


These are also still available - I didn't know that I had two different users....

C:\Documents and Settings\heidi.PC139818592325
C:\Documents and Settings\heidi
C:\Documents and Settings\Administrator (no personal folders)


----------



## chemist

Hello again, Heidi. 

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. 

Please stay with me until given the 'all clear' even if symptoms seemingly abate. 

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. 

------------------------------------------------------

If there are any personal files, pics, etc. on your computer you cannot live without, back them up now just as a precaution. 

Emergency Backup Procedure - Tech Support Forum

------------------------------------------------------

*CCleaner*

We do not recommend the use of registry cleaners, or the registry cleaner feature of CCleaner. Our colleague *miekiemoes* has an excellent writeup here

------------------------------------------------------

*Disable all antivirus* and antispyware programs. Get help here

Open *Notepad* and copy/paste all the text in the codebox below into Notepad: 



Code:


ClearJavaCache::

Folder::
c:\documents and settings\66666666666666666666

DirLook::
c:\documents and settings\66666666666666666666

Save this Notepad file as *CFScript.txt* to your Desktop and then close the file. 












Referring to the picture above, drag CFScript onto ComboFix. 

If you are prompted to update ComboFix and have an internet connection, please choose *Yes*

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, *C:\ComboFix.txt*, in your next reply.

Please re-enable your antivirus before posting the ComboFix.txt log. 

------------------------------------------------------


----------



## heidi87

Done! Two comments: After the restart (by comboFix), Comodo turned itself back on automatically - which is fine I guess.
The program "OkayFreedom" produced a error message after the restart and the laptop was making the "clonk" sound (not the beeping sound like before) for about 30 seconds. I guess "OkayFreedom" tried to access the internet -it said something about a server connection....
I installed this software only for the soccer world cup - so I could watch the live streams from European TV stations. Haven't used it after the final game.

Thanks again for your time!
Here is the file: 

ComboFix 14-08-06.02 - 66666666666666666666 08/07/2014 22:29:21.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.534 [GMT -4:00]
Running from: c:\documents and settings\66666666666666666666\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\66666666666666666666\Desktop\CFScript.txt
AV: COMODO Antivirus *Disabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((( Files Created from 2014-07-08 to 2014-08-08 )))))))))))))))))))))))))))))))
.
.
2014-08-07 20:53 . 2014-08-07 20:53 -------- d-----w- C:\VTRoot
2014-08-07 20:53 . 2014-08-08 02:44 44028 ----a-w- c:\windows\system32\drivers\fvstore.dat
2014-08-07 01:32 . 2008-02-26 11:59 294912 ------w- c:\windows\system32\dllcache\msctf.dll
2014-08-05 19:18 . 2014-08-07 21:00 725264 ----a-w- c:\windows\system32\drivers\sfi.dat
2014-08-05 19:16 . 2014-08-05 19:16 -------- d-s---w- c:\documents and settings\All Users\Application Data\Shared Space
2014-08-05 19:15 . 2014-08-05 19:15 -------- d-----w- c:\program files\COMODO
2014-08-05 19:14 . 2014-08-05 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2014-08-05 19:11 . 2014-08-05 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo
2014-08-05 18:44 . 2014-08-05 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2014-08-05 18:10 . 2014-08-05 18:10 -------- d-----w- c:\program files\MSECache
2014-08-05 16:12 . 2014-08-07 00:20 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 16:12 . 2014-08-05 16:12 -------- d-----w- C:\Malwarebytes Anti-Malware
2014-08-05 16:12 . 2014-08-05 16:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2014-08-05 16:12 . 2014-05-12 11:26 53208 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 16:12 . 2014-05-12 11:25 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-08-04 00:37 . 2014-08-07 21:19 -------- d-----w- c:\documents and settings\66666666666666666666
2014-08-04 00:31 . 2004-08-10 07:00 185344 ----a-w- c:\windows\system32\Thawbrkr.dll
2014-08-04 00:31 . 2004-08-10 07:00 6144 ----a-w- c:\windows\system32\ftlx041e.dll
2014-08-04 00:31 . 2004-08-10 07:00 5632 ----a-w- c:\windows\system32\kbdusa.dll
2014-08-04 00:31 . 2004-08-10 07:00 10752 ----a-w- c:\windows\system32\c_iscii.dll
2014-08-03 23:01 . 2004-08-04 03:08 26496 ----a-w- c:\windows\system32\dllcache\usbstor.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-11 00:52 . 2010-02-11 00:42 27386256 ----a-w- c:\program files\AdbeRdr930_en_US.exe
2009-08-15 19:20 . 2009-08-15 19:20 8050536 ----a-w- c:\program files\Firefox Setup 3.5.2.exe
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\66666666666666666666 ----
.
2014-08-08 02:46 . 2014-08-08 02:46 16384 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Temp\~DF4320.tmp
2014-08-08 02:45 . 2014-08-08 02:45 67 --sh--w- c:\documents and settings\66666666666666666666\Temporary Internet Files\Content.IE5\desktop.ini
2014-08-08 02:23 . 2014-08-08 02:23 432 ----a-w- c:\documents and settings\66666666666666666666\Recent\CFScript.lnk
2014-08-08 02:16 . 2014-08-08 02:16 12 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-phish-shavar.cache
2014-08-08 02:16 . 2014-08-08 02:16 1099769 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-phish-shavar.sbstore
2014-08-08 02:16 . 2014-08-08 02:16 12 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-malware-shavar.cache
2014-08-08 02:16 . 2014-08-08 02:16 538893 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-malware-shavar.sbstore
2014-08-08 02:16 . 2014-08-08 02:16 12 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-badbinurl-shavar.cache
2014-08-08 02:16 . 2014-08-08 02:16 231802 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-badbinurl-shavar.sbstore
2014-08-08 02:16 . 2014-08-08 01:08 44 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\test-phish-simple.cache
2014-08-08 02:16 . 2014-08-08 01:08 16 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\test-phish-simple.pset
2014-08-08 02:16 . 2014-08-08 01:08 232 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\test-phish-simple.sbstore
2014-08-08 02:16 . 2014-08-08 01:08 44 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\test-malware-simple.cache
2014-08-08 02:16 . 2014-08-08 01:08 16 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\test-malware-simple.pset
2014-08-08 02:16 . 2014-08-08 01:08 232 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\test-malware-simple.sbstore
2014-08-08 02:16 . 2014-08-08 02:16 1307122 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-phish-shavar.pset
2014-08-08 02:16 . 2014-08-08 02:16 415752 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-malware-shavar.pset
2014-08-08 02:16 . 2014-08-03 21:45 13580 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-downloadwhite-digest256.sbstore
2014-08-08 02:16 . 2014-08-03 21:45 16 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-downloadwhite-digest256.pset
2014-08-08 02:16 . 2014-08-03 21:45 11052 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-downloadwhite-digest256.cache
2014-08-08 02:16 . 2014-08-08 02:16 272632 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\safebrowsing\goog-badbinurl-shavar.pset
2014-08-08 02:11 . 2014-08-08 02:11 3352 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\bookmarkbackups\bookmarks-2014-08-07_14_0KfGiDc091i5jOVG4x2-PQ==.json
2014-08-08 01:37 . 2014-08-08 01:37 0 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Money\15.0\au.ini
2014-08-08 01:36 . 2014-08-08 01:36 76 ----a-w- c:\documents and settings\66666666666666666666\Cookies\[email protected][1].txt
2014-08-08 01:36 . 2014-08-08 01:36 74 ----a-w- c:\documents and settings\66666666666666666666\Cookies\[email protected][1].txt
2014-08-08 01:31 . 2014-08-08 01:31 1002 ----a-w- c:\documents and settings\66666666666666666666\Recent\67QLMZUP.lnk
2014-08-08 01:31 . 2014-08-08 01:31 1478 ----a-w- c:\documents and settings\66666666666666666666\Recent\WMP61ff1788-7b93-4bc9-a79d-a47b63b5fe86[1]..lnk
2014-08-08 01:29 . 2014-08-08 01:29 1257 ----a-w- c:\documents and settings\66666666666666666666\Recent\sandisk_device_out[1].lnk
2014-08-08 01:29 . 2014-08-08 01:29 1367 ----a-w- c:\documents and settings\66666666666666666666\Recent\WMP881069ac-2b63-4550-9855-1c4279a8793f[1]..lnk
2014-08-08 01:28 . 2014-08-08 01:28 1367 ----a-w- c:\documents and settings\66666666666666666666\Recent\WMP65b64b08-2a6e-4c44-a37b-5b23a3417e77[1]..lnk
2014-08-08 01:28 . 2014-08-08 01:29 921 ----a-w- c:\documents and settings\66666666666666666666\Recent\A9W5QP4T.lnk
2014-08-08 01:28 . 2014-08-08 01:28 1222 ----a-w- c:\documents and settings\66666666666666666666\Recent\c04713y8mi3[1].lnk
2014-08-08 01:18 . 2014-08-08 01:18 142112 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\blocklist.xml
2014-08-08 01:18 . 2014-08-08 01:18 142112 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\Cache\3\05\F23B4d01
2014-08-08 01:16 . 2014-08-08 01:16 24 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\addons.json
2014-08-08 01:09 . 2014-08-08 01:09 66 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\crashes\store.json.mozlz4
2014-08-08 01:09 . 2014-08-08 01:09 6214 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\prefs.js
2014-08-08 01:09 . 2014-08-08 01:09 3490 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\localstore.rdf
2014-08-08 01:08 . 2014-08-08 02:26 4194304 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\Cache\_CACHE_002_
2014-08-08 01:08 . 2014-08-08 02:26 4194304 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\Cache\_CACHE_003_
2014-08-08 01:08 . 2014-08-08 02:26 4194304 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\Cache\_CACHE_001_
2014-08-08 01:08 . 2014-08-08 01:08 276 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\Cache\_CACHE_MAP_
2014-08-08 01:08 . 2014-08-08 01:08 90 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\sessionCheckpoints.json
2014-08-08 01:08 . 2014-08-08 01:08 2 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\webapps\webapps.json
2014-08-07 23:03 . 2014-08-07 23:03 5723 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Windows\Themes\Custom.theme
2014-08-07 21:03 . 2014-08-07 20:40 32768 ----a-w- c:\documents and settings\66666666666666666666\History\History.IE5\MSHist012014080720140808\index.dat
2014-08-07 21:03 . 2014-08-07 21:03 468 ----a-w- c:\documents and settings\66666666666666666666\Recent\log_08_07_2014.lnk
2014-08-07 21:03 . 2014-08-07 21:03 315 ----a-w- c:\documents and settings\66666666666666666666\Desktop\log_08_07_2014.txt
2014-08-07 20:52 . 2014-08-08 01:08 32768 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\cookies.sqlite-shm
2014-08-07 20:52 . 2014-08-08 02:16 98408 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\cookies.sqlite-wal
2014-08-07 20:52 . 2014-08-08 01:09 32768 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\healthreport.sqlite-shm
2014-08-07 20:52 . 2014-08-08 02:26 557496 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\healthreport.sqlite-wal
2014-08-07 20:47 . 2014-08-08 01:08 32768 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\webappsstore.sqlite-shm
2014-08-07 20:47 . 2014-08-07 20:47 0 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\webappsstore.sqlite-wal
2014-08-07 20:43 . 2014-08-08 01:08 32768 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\places.sqlite-shm
2014-08-07 20:43 . 2014-08-07 20:43 0 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\places.sqlite-wal
2014-08-07 20:40 . 2014-08-08 02:46 0 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse
2014-08-07 02:34 . 2014-08-07 02:34 3584 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-07 02:12 . 2014-08-07 02:13 404 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Leadertech\PowerRegister\PowerReg.dat
2014-08-07 02:08 . 2014-08-07 02:08 115 ----a-w- c:\documents and settings\66666666666666666666\Cookies\[email protected][2].txt
2014-08-07 02:08 . 2014-08-07 02:08 53 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
2014-08-07 02:06 . 2014-08-07 02:12 450 ----a-w- c:\documents and settings\66666666666666666666\Recent\Downloads.lnk
2014-08-07 02:06 . 2014-08-07 02:12 885 ----a-w- c:\documents and settings\66666666666666666666\Recent\xpsp3_5512.080413-2113_usa_x86fre_spcd.lnk
2014-08-07 01:48 . 2014-08-07 02:04 571322368 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\xpsp3_5512.080413-2113_usa_x86fre_spcd.iso
2014-08-07 01:47 . 2014-08-07 01:47 264 ----a-w- c:\documents and settings\66666666666666666666\Cookies\[email protected][1].txt
2014-08-07 01:39 . 2014-08-07 01:39 115 ----a-w- c:\documents and settings\66666666666666666666\Cookies\[email protected][1].txt
2014-08-07 01:38 . 2014-08-07 01:38 1684 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Office\Word11.pip
2014-08-07 01:38 . 2014-08-07 01:38 300 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
2014-08-07 01:38 . 2014-08-07 01:38 37814 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Office\MSO1033.acl
2014-08-07 01:30 . 2014-08-07 01:30 629288 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\WindowsXP-KB932823-v3-x86-ENU.exe
2014-08-07 01:26 . 2014-08-07 01:26 14326176 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\O2kSp3.exe
2014-08-07 01:21 . 2014-08-07 01:22 60338208 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\OfficeXpSp3-kb832671-fullfile-enu(2).exe
2014-08-07 01:17 . 2014-08-07 01:17 0 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\OfficeXpSp3-kb832671-fullfile-enu(1).exe
2014-08-07 01:15 . 2014-08-07 01:15 0 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\OfficeXpSp3-kb832671-fullfile-enu.exe
2014-08-07 00:16 . 2014-08-08 01:13 1418683 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\startupCache\startupCache.4.little
2014-08-07 00:15 . 2014-08-07 00:16 262144 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\OfflineCache\index.sqlite
2014-08-07 00:14 . 2014-08-07 00:14 628 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\sessionstore.js
2014-08-06 22:46 . 2014-08-06 22:46 299 ----a-w- c:\documents and settings\66666666666666666666\Recent\ComboFix_new.lnk
2014-08-06 22:45 . 2014-08-06 22:45 286 ----a-w- c:\documents and settings\66666666666666666666\Recent\log_combo.lnk
2014-08-06 22:04 . 2014-08-07 02:13 32768 ----a-w- c:\documents and settings\66666666666666666666\History\History.IE5\MSHist012014080620140807\index.dat
2014-08-06 22:04 . 2014-08-06 22:04 283 ----a-w- c:\documents and settings\66666666666666666666\Recent\ComboFix.lnk
2014-08-06 21:05 . 2014-08-07 21:11 205 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\red.png
2014-08-06 21:05 . 2014-08-07 21:11 579 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\progressbar_bg.png
2014-08-06 21:05 . 2014-08-07 21:11 205 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\orange.png
2014-08-06 21:05 . 2014-08-07 21:11 100637 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_traffic_exceeded_jp.png
2014-08-06 21:05 . 2014-08-07 21:11 81755 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_traffic_exceeded_en.png
2014-08-06 21:05 . 2014-08-07 21:11 76039 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_traffic_exceeded_de.jpg
2014-08-06 21:05 . 2014-08-07 21:11 117460 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_traffic_90pc_jp.png
2014-08-06 21:05 . 2014-08-07 21:11 84873 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_traffic_90pc_en.png
2014-08-06 21:05 . 2014-08-07 21:11 87271 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_traffic_90pc_de.jpg
2014-08-06 21:05 . 2014-08-07 21:11 107572 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_traffic_100mb_jp.png
2014-08-06 21:05 . 2014-08-07 21:11 81351 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_traffic_100mb_en.png
2014-08-06 21:05 . 2014-08-07 21:11 77458 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_traffic_100mb_de.jpg
2014-08-06 21:05 . 2014-08-07 21:11 69272 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_license_expired_jp.jpg
2014-08-06 21:05 . 2014-08-07 21:11 69272 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_license_expired_en.jpg
2014-08-06 21:05 . 2014-08-07 21:11 71313 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_license_expired_de.jpg
2014-08-06 21:05 . 2014-08-07 21:11 71141 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_license_3days_jp.jpg
2014-08-06 21:05 . 2014-08-07 21:11 71141 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_license_3days_en.jpg
2014-08-06 21:05 . 2014-08-07 21:11 73563 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_license_3days_de.jpg
2014-08-06 21:05 . 2014-08-07 21:11 130067 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_connect_jp.png
2014-08-06 21:05 . 2014-08-07 21:11 82533 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_connect_en.png
2014-08-06 21:05 . 2014-08-06 21:05 11472 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\okf_servers.xml.bak
2014-08-05 18:58 . 2014-08-05 18:58 74121 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404
2014-08-05 18:58 . 2014-08-05 18:58 126 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404
2014-08-05 18:58 . 2014-08-05 18:58 75433 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70
2014-08-05 18:58 . 2014-08-05 18:58 128 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70
2014-08-05 18:58 . 2014-08-05 18:58 494 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D
2014-08-05 18:58 . 2014-08-05 18:58 132 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D
2014-08-05 18:50 . 2014-08-05 18:58 230532272 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\cispremium_installer_7.0.exe
2014-08-05 18:44 . 2014-08-05 18:44 955 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7
2014-08-05 18:44 . 2014-08-05 18:44 140 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7
2014-08-05 18:44 . 2014-08-05 18:44 2008 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\5781E92BE36651A8ED64685F2F3CF507
2014-08-05 18:44 . 2014-08-05 18:44 110 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\5781E92BE36651A8ED64685F2F3CF507
2014-08-05 18:44 . 2014-08-05 18:44 543 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\2659C1A560AB92C9C29D4B2B25815AE8
2014-08-05 18:44 . 2014-08-05 18:44 146 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\2659C1A560AB92C9C29D4B2B25815AE8
2014-08-05 18:44 . 2014-08-05 18:44 4862664 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\avast_free_antivirus_setup_online.exe
2014-08-05 18:43 . 2014-08-05 18:43 147721 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\search.json
2014-08-05 18:43 . 2014-08-05 18:43 1034 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\extensions.json
2014-08-05 18:43 . 2014-08-05 18:43 57 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Mozilla Firefox\active-update.xml
2014-08-05 18:43 . 2014-08-05 18:43 1590 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Mozilla Firefox\updates.xml
2014-08-05 18:43 . 2014-08-05 18:43 135 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\extensions.ini
2014-08-05 18:43 . 2014-08-05 18:43 10 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Crash Reports\InstallTime20140716183446
2014-08-05 18:36 . 2014-08-07 21:11 87623 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_connect_de.jpg
2014-08-05 18:36 . 2014-08-07 21:11 945 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\green.png
2014-08-05 18:36 . 2014-08-07 21:11 4468 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_template_new.htm
2014-08-05 18:36 . 2014-08-07 21:11 6242 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedom\okf_template_new.htm.bak
2014-08-05 18:36 . 2014-08-05 18:36 1310 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos VPN\okayfreedom.crt
2014-08-05 18:36 . 2014-08-05 18:36 887 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos VPN\F29A-B5E1-51DA-1811-41F2-71F1-330C-69D7.key
2014-08-05 18:36 . 2014-08-05 18:36 3745 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos VPN\F29A-B5E1-51DA-1811-41F2-71F1-330C-69D7.crt
2014-08-05 18:36 . 2014-08-05 18:36 19254 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\res\IDI_FLAG_TR.ico
2014-08-05 18:36 . 2014-08-05 18:36 350 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\res\IDI_FLAG_SG.ico
2014-08-05 18:36 . 2014-08-05 18:36 19254 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\res\IDI_FLAG_RO.ico
2014-08-05 18:36 . 2014-08-05 18:36 350 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\res\IDI_FLAG_JP.ico
2014-08-05 18:36 . 2014-08-05 18:36 350 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\res\IDI_FLAG_EG.ico
2014-08-05 18:36 . 2014-08-08 02:46 0 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\okf_servers.xml
2014-08-05 18:36 . 2014-08-08 02:46 514 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\Updater.exe.log
2014-08-05 18:36 . 2014-08-08 02:46 3999 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Steganos\OkayFreedomClient.exe.log
2014-08-05 18:19 . 2014-08-05 18:19 558 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\A44F4E7CB3133FF765C39A53AD8FCFDD
2014-08-05 18:19 . 2014-08-05 18:19 146 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\A44F4E7CB3133FF765C39A53AD8FCFDD
2014-08-05 18:12 . 2014-08-05 18:19 123368360 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\Office2003SP3-KB923618-FullFile-ENU.exe
2014-08-05 17:43 . 2014-08-05 17:44 5511 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Mozilla Firefox\updates\backup-update.log
2014-08-05 17:43 . 2014-08-05 18:43 614 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Mozilla Firefox\updates\last-update.log
2014-08-05 17:23 . 2014-08-05 17:23 506 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
2014-08-05 17:23 . 2014-08-05 17:23 132 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
2014-08-05 17:23 . 2014-08-05 17:23 554 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21
2014-08-05 17:23 . 2014-08-05 17:23 168 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21
2014-08-05 17:21 . 2014-08-05 17:23 38808920 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\FileFormatConverters.exe
2014-08-05 17:21 . 2014-08-05 17:41 368945248 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\office2007sp3-kb2526086-fullfile-en-us.exe
2014-08-05 17:21 . 2014-08-05 17:24 28694720 ----a-w- c:\documents and settings\66666666666666666666\My Documents\Downloads\Windows-KB890830-V5.14.exe
2014-08-05 17:18 . 2014-08-05 17:18 28 ----a-w- c:\documents and settings\66666666666666666666\UserData\S84T29CQ\oWindowsUpdate[1].xml
2014-08-05 17:17 . 2014-08-05 17:17 356 ----a-w- c:\documents and settings\66666666666666666666\Cookies\[email protected][1].txt
2014-08-05 17:17 . 2014-08-05 17:17 173 ----a-w- c:\documents and settings\66666666666666666666\Cookies\[email protected][1].txt
2014-08-05 17:06 . 2014-08-05 17:06 561 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\B8CC409ACDBF2A2FE04C56F2875B1FD6
2014-08-05 17:06 . 2014-08-05 17:06 134 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\B8CC409ACDBF2A2FE04C56F2875B1FD6
2014-08-05 17:06 . 2014-08-05 17:06 813 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
2014-08-05 17:06 . 2014-08-05 17:06 156 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
2014-08-05 17:05 . 2014-08-05 17:17 32768 ----a-w- c:\documents and settings\66666666666666666666\UserData\index.dat
2014-08-05 17:00 . 2014-08-05 17:00 3352 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\bookmarkbackups\bookmarks-2014-08-05_14.json
2014-08-05 16:46 . 2014-08-05 16:46 425 ----a-w- c:\documents and settings\66666666666666666666\Recent\attachk.lnk
2014-08-05 16:46 . 2014-08-05 16:46 5463 ----a-w- c:\documents and settings\66666666666666666666\Desktop\attachk.txt
2014-08-05 16:45 . 2014-08-05 16:45 516 ----a-w- c:\documents and settings\66666666666666666666\Recent\attach.lnk
2014-08-05 16:45 . 2014-08-05 17:17 32768 ----a-w- c:\documents and settings\66666666666666666666\History\History.IE5\MSHist012014080520140806\index.dat
2014-08-05 16:45 . 2014-08-05 16:45 538 ----a-w- c:\documents and settings\66666666666666666666\Recent\hijackthis.lnk
2014-08-05 16:12 . 2014-08-05 16:12 61 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1000165644-2606398902-3109072702-1005\b3dd3d69943fa57862e8bd6309d9e7ce_f8bcd3fc-4bd9-4c4e-b10a-cab7a2d32c58
2014-08-05 16:12 . 2014-08-05 16:12 24 --sha-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Protect\S-1-5-21-1000165644-2606398902-3109072702-1005\Preferred
2014-08-05 16:12 . 2014-08-05 16:12 388 --sha-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Protect\S-1-5-21-1000165644-2606398902-3109072702-1005\92addd8f-d3d6-4363-8533-49c2208577fc
2014-08-04 19:06 . 2014-08-04 19:06 950 ----a-w- c:\documents and settings\66666666666666666666\Desktop\f.log
2014-08-04 19:06 . 2014-08-04 19:06 450 ----a-w- c:\documents and settings\66666666666666666666\Recent\f.lnk
2014-08-04 19:06 . 2014-08-04 19:10 553 ----a-w- c:\documents and settings\66666666666666666666\Recent\6g.lnk
2014-08-04 17:55 . 2014-08-04 17:55 96404 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30
2014-08-04 17:55 . 2014-08-04 17:55 124 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30
2014-08-04 17:55 . 2014-08-04 17:55 14795 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\6C68A73125F3238F044A8115D96841B6
2014-08-04 17:55 . 2014-08-04 17:55 132 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\6C68A73125F3238F044A8115D96841B6
2014-08-04 17:54 . 2014-08-04 17:54 70331 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\F482C95F83F1B59228F1B1E720F2EDF1
2014-08-04 17:54 . 2014-08-04 17:54 128 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\F482C95F83F1B59228F1B1E720F2EDF1
2014-08-04 17:54 . 2014-08-04 17:54 933 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
2014-08-04 17:54 . 2014-08-04 17:54 94 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
2014-08-04 17:51 . 2014-08-04 17:51 133556 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
2014-08-04 17:51 . 2014-08-04 17:51 124 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
2014-08-04 17:51 . 2014-08-04 17:51 533 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
2014-08-04 17:51 . 2014-08-04 17:51 100 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
2014-08-04 17:51 . 2014-08-04 17:51 54007 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2014-08-04 17:51 . 2014-08-04 17:51 216 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2014-08-04 17:51 . 2014-08-04 17:51 18 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
2014-08-04 17:51 . 2014-08-04 17:51 216 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
2014-08-04 17:43 . 2014-08-04 17:43 528 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\E04822AD18D472EA5B582E6E6F8C6B9A
2014-08-04 17:43 . 2014-08-04 17:43 140 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\E04822AD18D472EA5B582E6E6F8C6B9A
2014-08-04 17:43 . 2014-08-04 17:43 571 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\904590238400AD963F77FAAAADC9BAB5
2014-08-04 17:43 . 2014-08-04 17:43 136 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\904590238400AD963F77FAAAADC9BAB5
2014-08-04 17:43 . 2014-08-04 17:43 413 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\79841F8EF00FBA86D33CC5A47696F165
2014-08-04 17:43 . 2014-08-04 17:43 98 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\79841F8EF00FBA86D33CC5A47696F165
2014-08-04 17:43 . 2014-08-04 17:43 341 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\303572DF538EDD8B1D606185F1D559B8
2014-08-04 17:43 . 2014-08-04 17:43 126 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\303572DF538EDD8B1D606185F1D559B8
2014-08-04 17:43 . 2014-08-04 17:43 569 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\3C83474D61E624A4F9844DF935AFE217
2014-08-04 17:43 . 2014-08-04 17:43 142 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\3C83474D61E624A4F9844DF935AFE217
2014-08-04 17:43 . 2014-08-04 16:42 370943 ----a-w- c:\documents and settings\66666666666666666666\Desktop\gmer.zip
2014-08-04 17:32 . 2014-08-06 22:46 187 ----a-w- c:\documents and settings\66666666666666666666\Recent\USB DISK (F).lnk
2014-08-04 17:32 . 2014-08-04 17:21 32768 ----a-w- c:\documents and settings\66666666666666666666\History\History.IE5\MSHist012014080420140805\index.dat
2014-08-04 17:32 . 2014-08-04 17:32 262 ----a-w- c:\documents and settings\66666666666666666666\Recent\dds.lnk
2014-08-04 17:31 . 2014-08-04 17:31 5463 ----a-w- c:\documents and settings\66666666666666666666\Desktop\attach.txt
2014-08-04 17:31 . 2014-08-04 17:31 8600 ----a-w- c:\documents and settings\66666666666666666666\Desktop\dds.txt
2014-08-04 17:30 . 2014-08-04 16:28 688992 ------r- c:\documents and settings\66666666666666666666\Desktop\dds.scr
2014-08-04 17:23 . 2014-08-07 00:14 196608 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\formhistory.sqlite
2014-08-04 17:23 . 2014-08-04 17:23 229376 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\content-prefs.sqlite
2014-08-04 17:23 . 2014-08-08 02:26 65536 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\permissions.sqlite
2014-08-04 17:21 . 2014-08-04 17:21 67 --sh--w- c:\documents and settings\66666666666666666666\Temporary Internet Files\desktop.ini
2014-08-04 17:18 . 2014-08-04 17:18 150 --sha-w- c:\documents and settings\66666666666666666666\Recent\Desktop.ini
2014-08-04 17:15 . 2014-08-04 17:15 1141 ----a-w- c:\documents and settings\66666666666666666666\Cookies\[email protected][2].txt
2014-08-04 17:15 . 2014-08-04 17:15 333 ----a-w- c:\documents and settings\66666666666666666666\Cookies\[email protected][2].txt
2014-08-04 17:14 . 2014-08-04 16:07 4813544 ----a-w- c:\documents and settings\66666666666666666666\Desktop\ccsetup416.exe
2014-08-04 15:55 . 2014-08-04 15:55 104 ----a-w- c:\documents and settings\66666666666666666666\Desktop\backups\backup-20140804-115530-604
2014-08-04 15:55 . 2014-08-04 15:55 166 ----a-w- c:\documents and settings\66666666666666666666\Desktop\backups\backup-20140804-115530-687
2014-08-04 15:32 . 2014-08-08 02:46 114688 ----a-w- c:\documents and settings\66666666666666666666\Temporary Internet Files\Content.IE5\index.dat
2014-08-04 15:16 . 2014-08-04 15:16 75 ----a-w- c:\documents and settings\66666666666666666666\LuResult.txt
2014-08-04 15:00 . 2014-08-04 15:00 62 --sha-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Administrative Tools\desktop.ini
2014-08-04 14:48 . 2014-08-04 14:48 526 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\hotfix.v20140527.01.json
2014-08-04 14:45 . 2014-08-04 17:18 327680 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\signons.sqlite
2014-08-04 14:42 . 2014-08-07 00:55 7587 ----a-w- c:\documents and settings\66666666666666666666\Desktop\hijackthis.log
2014-08-04 14:42 . 2014-08-08 02:25 5568206 ------r- c:\documents and settings\66666666666666666666\Desktop\ComboFix.exe
2014-08-04 14:42 . 2014-08-04 13:09 388608 ----a-w- c:\documents and settings\66666666666666666666\Desktop\HijackThis.exe
2014-08-04 00:43 . 2014-08-07 00:12 194 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\compatibility.ini
2014-08-04 00:43 . 2014-08-04 00:43 111 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\profiles.ini
2014-08-04 00:43 . 2014-08-08 01:08 0 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\parent.lock
2014-08-04 00:43 . 2014-08-04 00:43 29 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\times.json
2014-08-04 00:43 . 2014-08-04 00:43 10 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Crash Reports\InstallTime20140605174243
2014-08-04 00:41 . 2014-08-04 00:41 16384 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT
2014-08-04 00:39 . 2014-08-04 00:39 113 --sh--w- c:\documents and settings\66666666666666666666\History\History.IE5\desktop.ini
2014-08-04 00:39 . 2014-08-08 02:46 49152 ----a-w- c:\documents and settings\66666666666666666666\History\History.IE5\index.dat
2014-08-04 00:39 . 2014-08-04 00:39 113 --sh--w- c:\documents and settings\66666666666666666666\History\desktop.ini
2014-08-04 00:37 . 2006-03-28 04:31 62 --sha-w- c:\documents and settings\66666666666666666666\Application Data\desktop.ini
2014-08-04 00:37 . 2006-05-11 12:39 26 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Intuit\Quicken\Log\qw.log
2014-08-04 00:37 . 2006-05-11 12:38 176594 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Address Book\Administrator.wab
2014-08-04 00:37 . 2006-05-11 12:38 176594 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Address Book\Administrator.wab~
2014-08-04 00:37 . 2006-03-28 12:39 21926 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CLR Security Config\v1.0.3705\security.config
2014-08-04 00:37 . 2006-05-11 12:30 31362 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CLR Security Config\v1.0.3705\security.config.cch
2014-08-04 00:37 . 2006-03-28 12:39 21926 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CLR Security Config\v1.0.3705\security.config.old
2014-08-04 00:37 . 2006-03-28 12:56 21768 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config
2014-08-04 00:37 . 2006-05-11 12:19 28616 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config.cch
2014-08-04 00:37 . 2014-08-07 02:25 558 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735
2014-08-04 00:37 . 2014-08-07 02:25 144 --s-a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735
2014-08-04 00:37 . 2006-03-28 12:53 10134 ----a-r- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Installer\{52FBAE98-D389-4281-8C14-21B4046CCB4E}\ARPPRODUCTICON.exe
2014-08-04 00:37 . 2006-05-11 12:12 45056 ----a-r- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Installer\{6815FCDD-401D-481E-BA88-31B4754C2B46}\ARPPRODUCTICON.exe
2014-08-04 00:37 . 2006-03-28 12:53 10134 ----a-r- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Installer\{B16AF568-A644-483C-A6DA-5028CD019C8C}\ARPPRODUCTICON.exe
2014-08-04 00:37 . 2006-05-11 11:54 10389 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Internet Explorer\brndlog.bak
2014-08-04 00:37 . 2014-08-04 00:39 18198 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Internet Explorer\brndlog.txt
2014-08-04 00:37 . 2014-08-04 00:40 2542 --sha-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Internet Explorer\Desktop.htt
2014-08-04 00:37 . 2014-08-04 00:42 170 --sha-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
2014-08-04 00:37 . 2006-05-11 12:48 663 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Internet Explorer\Quick Launch\HP Rhapsody.lnk
2014-08-04 00:37 . 2014-08-04 00:42 779 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
2014-08-04 00:37 . 2014-08-04 00:39 1478 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Internet Explorer\Quick Launch\Media Center.lnk
2014-08-04 00:37 . 2006-05-11 12:36 1765 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Internet Explorer\Quick Launch\Netscape Browser.lnk
2014-08-04 00:37 . 2006-03-28 12:49 79 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
2014-08-04 00:37 . 2006-03-28 13:02 24 --sha-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Protect\CREDHIST
2014-08-04 00:37 . 2006-05-11 11:56 388 --sha-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Protect\S-1-5-21-1098939028-1877747021-3617001093-500\b3c24771-71c3-4ab2-9296-6d054a6074a2
2014-08-04 00:37 . 2006-03-28 13:02 388 --sha-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Protect\S-1-5-21-2025429265-879983540-725345543-500\c0248e6f-a967-4d74-a269-d44ee6d9c9bd
2014-08-04 00:37 . 2006-05-11 11:56 24 --sha-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Protect\S-1-5-21-1098939028-1877747021-3617001093-500\Preferred
2014-08-04 00:37 . 2006-03-28 13:02 24 --sha-w- c:\documents and settings\66666666666666666666\Application Data\Microsoft\Protect\S-1-5-21-2025429265-879983540-725345543-500\Preferred
2014-08-04 00:37 . 2006-05-11 12:37 1648 ----a-w- c:\documents and settings\66666666666666666666\Desktop\3 Month Trial AOL Music Now.lnk
2014-08-04 00:37 . 2014-08-08 02:46 32768 ----a-w- c:\documents and settings\66666666666666666666\Cookies\index.dat
2014-08-04 00:37 . 2006-05-11 12:07 992 ----a-w- c:\documents and settings\66666666666666666666\Desktop\Help and Support.lnk
2014-08-04 00:37 . 2014-08-04 00:40 95 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Accessories.URL
2014-08-04 00:37 . 2014-08-04 00:40 247 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Blockbuster.URL
2014-08-04 00:37 . 2014-08-04 00:39 122 --sha-w- c:\documents and settings\66666666666666666666\Favorites\Desktop.ini
2014-08-04 00:37 . 2014-08-04 00:40 144 ----a-w- c:\documents and settings\66666666666666666666\Favorites\eBay.URL
2014-08-04 00:37 . 2014-08-04 00:40 196 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Extended Service.URL
2014-08-04 00:37 . 2014-08-04 00:40 147 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Home.URL
2014-08-04 00:37 . 2014-08-04 00:40 106 ----a-w- c:\documents and settings\66666666666666666666\Favorites\HP Music.URL
2014-08-04 00:37 . 2014-08-04 00:39 119 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Links\Customize Links.url
2014-08-04 00:37 . 2014-08-04 00:39 113 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Links\Free Hotmail.url
2014-08-04 00:37 . 2014-08-04 00:39 169 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Links\Windows Marketplace.url
2014-08-04 00:37 . 2014-08-04 00:39 118 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Links\Windows Media.url
2014-08-04 00:37 . 2014-08-04 00:39 119 ----a-w- c:\documents and settings\66666666666666666666\Favorites\MSN.com.url
2014-08-04 00:37 . 2014-08-04 00:39 113 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Links\Windows.url
2014-08-04 00:37 . 2014-08-04 00:40 105 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Online Photos First 25 Free.URL
2014-08-04 00:37 . 2014-08-04 00:39 197 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Radio Station Guide.url
2014-08-04 00:37 . 2014-08-04 00:40 149 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Search.URL
2014-08-04 00:37 . 2014-08-04 00:40 80 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Shop.URL
2014-08-04 00:37 . 2014-08-04 00:40 119 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Sonic Solutions.URL
2014-08-04 00:37 . 2014-08-04 00:40 116 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Spyware Protection.URL
2014-08-04 00:37 . 2014-08-04 00:40 111 ----a-w- c:\documents and settings\66666666666666666666\Favorites\Symantec Security.URL
2014-08-04 00:37 . 2006-05-11 11:54 1713 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\csc.exe.3e4ac0af.ini
2014-08-04 00:37 . 2014-08-07 02:48 10928 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini
2014-08-04 00:37 . 2014-08-08 02:46 803 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\hpqthb08.exe.a935d1e0.ini
2014-08-04 00:37 . 2006-05-11 12:37 749 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\IEActivex.exe.cccdbce.ini
2014-08-04 00:37 . 2006-03-28 13:09 2872 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
2014-08-04 00:37 . 2014-08-04 16:49 498 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\RegAsm.exe.ca35bcc8.ini
2014-08-04 00:37 . 2014-08-04 15:16 762 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\RegisterMCEApp.exe.19d07aaf.ini
2014-08-04 00:37 . 2006-03-28 12:54 792 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\SL168.tmp.161eca5c.ini
2014-08-04 00:37 . 2006-03-28 13:09 792 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\SL52E.tmp.6a5b291.ini
2014-08-04 00:37 . 2006-03-28 12:53 790 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\ApplicationHistory\SL8D.tmp.82d0ca15.ini
2014-08-04 00:37 . 2006-05-11 13:04 0 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\AtStart.txt
2014-08-04 00:37 . 2006-05-11 13:04 0 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\DSwitch.txt
2014-08-04 00:37 . 2014-08-04 00:40 143 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\fusioncache.dat
2014-08-04 00:37 . 2006-05-11 11:54 22 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\cache\LastWrite.txt
2014-08-04 00:37 . 2014-08-08 02:43 786 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf
2014-08-04 00:37 . 2006-05-11 11:54 7680 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx
2014-08-04 00:37 . 2006-05-11 11:54 424 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf
2014-08-04 00:37 . 2006-05-11 11:54 4608 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx
2014-08-04 00:37 . 2006-05-11 11:54 584 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf
2014-08-04 00:37 . 2014-08-08 02:46 0 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt
2014-08-04 00:37 . 2006-05-11 11:54 3072 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx
2014-08-04 00:37 . 2006-05-11 11:54 488 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf
2014-08-04 00:37 . 2006-05-11 11:54 9216 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx
2014-08-04 00:37 . 2006-05-11 11:54 936 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf
2014-08-04 00:37 . 2006-05-11 11:54 512 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt
2014-08-04 00:37 . 2006-05-11 11:54 6144 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx
2014-08-04 00:37 . 2006-05-11 11:54 360 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf
2014-08-04 00:37 . 2006-05-11 11:55 4608 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx
2014-08-04 00:37 . 2006-05-11 11:55 1509 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf
2014-08-04 00:37 . 2006-05-11 11:54 360 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf
2014-08-04 00:37 . 2006-05-11 11:54 4608 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx
2014-08-04 00:37 . 2006-05-11 11:54 424 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf
2014-08-04 00:37 . 2006-05-11 11:54 3072 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx
2014-08-04 00:37 . 2006-05-11 11:54 456 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf
2014-08-04 00:37 . 2006-05-11 11:54 6144 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx
2014-08-04 00:37 . 2006-05-11 11:54 360 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf
2014-08-04 00:37 . 2006-05-11 11:54 3072 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx
2014-08-04 00:37 . 2014-08-08 02:46 179 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\handle.dat
2014-08-04 00:37 . 2006-05-11 11:54 392 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf
2014-08-04 00:37 . 2005-02-22 09:15 5076 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\HP\Digital Imaging\oov1_skindefV3.dat
2014-08-04 00:37 . 2006-05-11 12:54 4307000 ---ha-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\IconCache.db
2014-08-04 00:37 . 2006-05-11 11:54 0 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\IsolatedStorage\hnmve34b.qlg\ioivuivk.mod\StrongName.xitmqsrqvpqpovqi5kx5u3ghwej4ru23\AssemFiles\hpqedit.settings
2014-08-04 00:37 . 2014-08-08 02:46 515 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\IsolatedStorage\hnmve34b.qlg\ioivuivk.mod\StrongName.xitmqsrqvpqpovqi5kx5u3ghwej4ru23\identity.dat
2014-08-04 00:37 . 2006-05-11 11:54 64 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\IsolatedStorage\hnmve34b.qlg\ioivuivk.mod\StrongName.xitmqsrqvpqpovqi5kx5u3ghwej4ru23\info.dat
2014-08-04 00:37 . 2006-03-28 12:44 720896 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb
2014-08-04 00:37 . 2014-08-07 02:41 262144 ---ha-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
2014-08-04 00:37 . 2014-08-08 02:45 1024 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
2014-08-04 00:37 . 2006-03-28 12:57 498 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNS.DTD
2014-08-04 00:37 . 2006-03-28 12:49 5760054 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
2014-08-04 00:37 . 2014-08-07 02:08 12787 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNS.XML
2014-08-04 00:37 . 2004-01-23 18:17 546816 ----a-r- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Microsoft\Works\Portfolio\wsbsamp.wsb
2014-08-04 00:37 . 2006-05-11 12:03 62 --sha-w- c:\documents and settings\66666666666666666666\Local Settings\desktop.ini
2014-08-04 00:37 . 2006-05-11 13:04 0 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\QSwitch.txt
2014-08-04 00:37 . 2006-03-28 13:09 3584 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}\1033.MST
2014-08-04 00:37 . 2006-03-28 13:09 12125696 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}\J2SE Runtime Environment 5.0 Update 6.msi
2014-08-04 00:37 . 2006-05-11 13:12 32768 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2014-08-04 00:37 . 2014-08-04 00:39 91 --sha-w- c:\documents and settings\66666666666666666666\My Documents\desktop.ini
2014-08-04 00:37 . 2014-08-04 00:39 196 --sha-w- c:\documents and settings\66666666666666666666\My Documents\My Music\Desktop.ini
2014-08-04 00:37 . 2006-03-28 12:49 638 ----a-w- c:\documents and settings\66666666666666666666\My Documents\My Music\Sample Music.lnk
2014-08-04 00:37 . 2006-05-11 12:38 1777 ----a-w- c:\documents and settings\66666666666666666666\My Documents\My Music\Samples.lnk
2014-08-04 00:37 . 2014-08-04 00:39 198 --sha-w- c:\documents and settings\66666666666666666666\My Documents\My Pictures\Desktop.ini
2014-08-04 00:37 . 2006-03-28 12:49 668 ----a-w- c:\documents and settings\66666666666666666666\My Documents\My Pictures\Sample Pictures.lnk
2014-08-04 00:37 . 2006-05-11 12:38 190 --sha-w- c:\documents and settings\66666666666666666666\My Documents\My Videos\Desktop.ini
2014-08-04 00:37 . 2006-05-11 12:38 1777 ----a-w- c:\documents and settings\66666666666666666666\My Documents\My Videos\Samples.lnk
2014-08-04 00:37 . 2006-05-11 12:38 1777 ----a-w- c:\documents and settings\66666666666666666666\My Documents\My Pictures\Samples.lnk
2014-08-04 00:37 . 2006-03-28 12:41 0 ----a-w- c:\documents and settings\66666666666666666666\SendTo\Compressed (zipped) Folder.ZFSendToTarget
2014-08-04 00:37 . 2006-03-28 12:41 0 ----a-w- c:\documents and settings\66666666666666666666\SendTo\Desktop (create shortcut).DeskLink
2014-08-04 00:37 . 2006-03-28 12:41 181 --sha-w- c:\documents and settings\66666666666666666666\SendTo\desktop.ini
2014-08-04 00:37 . 2006-03-28 12:41 0 ----a-w- c:\documents and settings\66666666666666666666\SendTo\Mail Recipient.MAPIMail
2014-08-04 00:37 . 2006-03-28 12:49 0 ----a-w- c:\documents and settings\66666666666666666666\SendTo\My Documents.mydocs
2014-08-04 00:37 . 2006-03-28 04:31 62 --sha-w- c:\documents and settings\66666666666666666666\Start Menu\desktop.ini
2014-08-04 00:37 . 2006-03-28 12:44 348 --sha-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Accessibility\desktop.ini
2014-08-04 00:37 . 2014-08-04 00:39 774 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Address Book.lnk
2014-08-04 00:37 . 2006-03-28 12:44 1459 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Command Prompt.lnk
2014-08-04 00:37 . 2014-08-04 00:39 542 --sha-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\desktop.ini
2014-08-04 00:37 . 2006-03-28 12:44 1429 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk
2014-08-04 00:37 . 2006-03-28 12:44 1436 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
2014-08-04 00:37 . 2006-03-28 12:44 1405 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
2014-08-04 00:37 . 2006-03-28 12:44 1443 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk
2014-08-04 00:37 . 2014-08-07 21:06 1519 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Notepad.lnk
2014-08-04 00:37 . 2006-03-28 12:44 386 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk
2014-08-04 00:37 . 2006-03-28 12:44 1423 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Synchronize.lnk
2014-08-04 00:37 . 2006-03-28 12:44 84 --sha-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Entertainment\desktop.ini
2014-08-04 00:37 . 2014-08-04 00:39 804 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk
2014-08-04 00:37 . 2006-03-28 12:44 1431 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Tour Windows XP.lnk
2014-08-04 00:37 . 2006-03-28 12:41 1391 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Accessories\Windows Explorer.lnk
2014-08-04 00:37 . 2014-08-04 00:42 234 --sha-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\desktop.ini
2014-08-04 00:37 . 2014-08-04 00:42 767 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Internet Explorer.lnk
2014-08-04 00:37 . 2014-08-04 00:39 738 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Outlook Express.lnk
2014-08-04 00:37 . 2006-03-28 12:44 1503 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Remote Assistance.lnk
2014-08-04 00:37 . 2006-05-11 12:19 1911 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Online Services\Easy Internet Sign-up.lnk
2014-08-04 00:37 . 2006-03-28 12:44 84 --sha-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Startup\desktop.ini
2014-08-04 00:37 . 2004-08-10 15:00 4570 ----a-w- c:\documents and settings\66666666666666666666\Templates\amipro.sam
2014-08-04 00:37 . 2014-08-04 00:39 792 ----a-w- c:\documents and settings\66666666666666666666\Start Menu\Programs\Windows Media Player.lnk
2014-08-04 00:37 . 2004-08-10 15:00 5632 ----a-w- c:\documents and settings\66666666666666666666\Templates\excel.xls
2014-08-04 00:37 . 2004-08-10 15:00 1518 ----a-w- c:\documents and settings\66666666666666666666\Templates\excel4.xls
2014-08-04 00:37 . 2004-08-10 15:00 2448 ----a-w- c:\documents and settings\66666666666666666666\Templates\lotus.wk4
2014-08-04 00:37 . 2004-08-10 15:00 12288 ----a-w- c:\documents and settings\66666666666666666666\Templates\powerpnt.ppt
2014-08-04 00:37 . 2004-08-10 15:00 461 ----a-w- c:\documents and settings\66666666666666666666\Templates\presenta.shw
2014-08-04 00:37 . 2004-08-10 15:00 4017 ----a-w- c:\documents and settings\66666666666666666666\Templates\quattro.wb2
2014-08-04 00:37 . 2004-08-10 15:00 58 ----a-w- c:\documents and settings\66666666666666666666\Templates\sndrec.wav
2014-08-04 00:37 . 2004-08-10 15:00 4608 ----a-w- c:\documents and settings\66666666666666666666\Templates\winword.doc
2014-08-04 00:37 . 2004-08-10 15:00 1769 ----a-w- c:\documents and settings\66666666666666666666\Templates\winword2.doc
2014-08-04 00:37 . 2004-08-10 15:00 30 ----a-w- c:\documents and settings\66666666666666666666\Templates\wordpfct.wpd
2014-08-04 00:37 . 2004-08-10 15:00 57 ----a-w- c:\documents and settings\66666666666666666666\Templates\wordpfct.wpg
2014-08-04 00:37 . 2014-08-08 02:43 178 --sh--w- c:\documents and settings\66666666666666666666\ntuser.ini
2014-08-04 00:37 . 2014-08-08 02:47 1024 ---ha-w- c:\documents and settings\66666666666666666666\ntuser.dat.LOG
2014-08-04 00:37 . 2014-08-08 02:44 1572864 ---ha-w- c:\documents and settings\66666666666666666666\NTUSER.DAT
2014-08-03 21:45 . 2014-08-08 01:23 1146880 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\healthreport.sqlite
2014-08-03 21:44 . 2014-08-03 21:44 0 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\storage\persistent\moz-safe-about+home\.metadata
2014-08-03 21:44 . 2014-08-07 00:13 589824 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\storage\persistent\moz-safe-about+home\idb\818200132aebmoouht.sqlite
2014-08-03 21:44 . 2014-08-07 00:16 131072 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\webappsstore.sqlite
2014-08-03 21:44 . 2014-08-08 02:02 1 ----a-w- c:\documents and settings\66666666666666666666\Local Settings\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\_CACHE_CLEAN_
2014-08-03 21:44 . 2014-08-07 02:30 524288 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\cookies.sqlite
2014-08-03 21:44 . 2014-08-07 02:30 10485760 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\places.sqlite
2014-08-03 21:44 . 2014-08-03 21:44 589 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\pluginreg.dat
2014-08-03 21:44 . 2014-08-03 21:44 3781 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\mimeTypes.rdf
2014-08-03 21:44 . 2014-08-07 02:30 16384 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\key3.db
2014-08-03 21:44 . 2014-08-07 02:30 131072 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\cert8.db
2014-08-03 21:44 . 2014-08-03 21:44 16384 ----a-w- c:\documents and settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default\secmod.db
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OKAYFREEDOM_Agent"="c:\program files\OkayFreedom\OkayFreedomClient.exe" [2014-04-09 4656464]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-11 36975]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-15 454656]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"MsmqIntCert"="mqrt.dll" [2004-08-10 177152]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 61952]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-04 761948]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-04-12 102400]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-07 131072]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2014-03-26 1225944]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hp\Digital Imaging\bin\hpqthb08.exe -s [2005-9-24 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE -b -l [1999-2-17 65588]
REALTEK RTL8187 Wireless LAN Utility.lnk - c:\program files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe /H [2013-10-13 942080]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
.
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [3/25/2014 8:22 PM 15704]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [3/25/2014 8:22 PM 607448]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [3/25/2014 8:22 PM 29912]
S3 cmdvirth;COMODO Virtual Service Manager;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe [3/25/2014 8:22 PM 1663192]
.
Contents of the 'Scheduled Tasks' folder
.
2014-08-08 c:\windows\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-03-31 21:12]
.
2014-08-08 c:\windows\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-03-31 21:12]
.
2014-08-08 c:\windows\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-03-31 21:12]
.
2014-08-08 c:\windows\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2014-03-31 21:12]
.
Supplementary scan did not complete!
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2014-08-07 22:46
Windows 5.1.2600 Service Pack 2 NTFS
.
detected NTDLL code modification:
ZwClose
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(1024)
c:\windows\system32\guard32.dll
c:\windows\system32\mswsock.dll
c:\windows\System32\wshtcpip.dll
.
- - - - - - - > 'explorer.exe'(3960)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'csrss.exe'(940)
c:\windows\system32\cmdcsr.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\windows\system32\msdtc.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\mqsvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\dllhost.exe
c:\program files\COMODO\COMODO Internet Security\cavwp.exe
c:\windows\eHome\ehmsas.exe
c:\program files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
c:\program files\COMODO\COMODO Internet Security\cis.exe
.
**************************************************************************
.
Completion time: 2014-08-07 22:51:51 - machine was rebooted
ComboFix-quarantined-files.txt 2014-08-08 02:51
ComboFix2.txt 2014-08-06 22:42
ComboFix3.txt 2014-08-04 17:05
ComboFix4.txt 2014-08-04 15:32
.
Pre-Run: 35,146,878,976 bytes free
Post-Run: 35,140,071,424 bytes free
.
- - End Of File - - 00B2C2EFF23CF199B77DA53D8102B4ED
5AE5A393505CFFD37FE98C4A7922908D


----------



## chemist

Hello again, Heidi. You can uninstall OkayFreedom if you dont' use it anymore. Let me know if you still get an error message on restart after uninstalling it. 

------------------------------------------------------

Are you trying to log into the heidi account when you startup the laptop? 

Can you go Start > Shutdown > Switch user and log in as heidi? 

------------------------------------------------------

Download and extract Malwarebytes Anti-Rootkit from here *mbar-1.07.0.1012.zip* and save it to your desktop.
Caution: This is a beta version so please be sure to read the disclaimer and back up any important data before using.
Double-click *mbar.exe* inside the *mbar* folder then click 'Next'. 
Note: Malwarebytes Anti-Rootkit requires administrative privileges to function properly.
Click 'Update'.
When finished updating, click 'Next' then 'Scan'.
If you are told you have the 'AppInit_Dlls rootkit', choose not to fix it and proceed with the scan. 
With some infections, you may see two messages boxes:
'Could not load protection driver'. Click 'OK'.
'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart, then continue with the rest of these instructions.

If malware is found, do *NOT* press the' Cleanup' button yet. Click 'Exit'. 
Please post the contents of the log created by the tool within the folder from which it was run.
The log will be named *system-log.txt*

------------------------------------------------------


----------



## heidi87

Sorry for not getting back to you sooner. 
My laptop cannot connect to the internet any longer. As soon as I open the "available wifi-box" I get the "DOS-clonk-sounds".
I have to borrow a friends laptop tomorrow and will work on it. (Here at work I cannot be online for long)


----------



## heidi87

Click 'Update'.
When finished updating, click 'Next' then 'Scan'.
I won't be able to update it,because I cannot go online with the laptop any longer. Is it possible to update the version on another computer, than safe the updated version and load it on a USB stick?


----------



## chemist

Hello again, heidi87. Sorry you are having trouble. 

Have you tried rebooting your computer again. Often that will get your internet connection back. 

If that doesn't work, right-click your network icon in your system tray and choose *Repair*

If still no joy, just run *mbar* without the update. Let me know. 

------------------------------------------------------


----------



## heidi87

I did update and run mbar ( The "repair" didn't help yesterday. Today the "DOS-clonk sound" is still there but less often than yesterday. I could connect to the internet (different Wifi-Network than yesterday)

mbar didn't find anything. I couldn't find any report for this. I do have the old "dds" file still on the desktop and it says it was accessed today but when I open it, it's still the old date (08/04) .

I cannot change the user. When I log off / switch user, only "66666666" is available.

The program "OkayFreedom" shows up under c:\Program Files" but not under "add or Remove Programs". 

The "six" key is still not working, but the "sixes" haven't pop up automatically today. (Maybe the virus takes of Sundays :wink:



Looking forward to the next step!


----------



## chemist

Hello again, Heidi. Is it possible that your 6 key got stuck a few days ago and now it isn't working? 

Have you tried hooking up an external keyboard? 

------------------------------------------------------

Please download Farbar Recovery Scan Tool and save it to your desktop.

Double-click to run it. When the tool opens click *Yes* to the disclaimer.
Make sure the *Addition.txt* button is ticked.
Press *Scan* button.
It will make a log (*FRST.txt*) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it also makes another log (*Addition.txt*). Please attach it to your reply.
-----------------------------------------------------


----------



## heidi87

The sixes were back today when I started the laptop - than they stopped... The "DOS-Clonk-Sound" is not back, it's back to the beeping sound when starting Windows.

I have to find an external keyboard and I'll try it. Before I posted my issue, I goggled it and found some posts describing the same issue - for example Loud beeping at Booting, also "Ghost" is typing 666666 - Tech Support Guy). Unfortunately, nobody posted a solution...


Thanks for staying with me!



Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:10-08-2014 01
Ran by 66666666666666666666 (ATTENTION: The logged in user is not administrator) on YOUR-252739F5C3 on 11-08-2014 12:25:07
Running from C:\Documents and Settings\66666666666666666666\My Documents\Downloads
Platform: Microsoft Windows XP Service Pack 2 (X86) OS Language: English (United States)
Internet Explorer Version 6
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink Corp.) C:\Program Files\Hp\QuickPlay\QPService.exe
(Hewlett-Packard Co.) C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
(Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe
(Steganos Software GmbH) C:\Program Files\OkayFreedom\OkayFreedomClient.exe
(Realtek Semiconductor Corp.) C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hp\Digital Imaging\bin\hpqimzone.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
() C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKU\S-1-5-21-1000165644-2606398902-3109072702-1005\...\Run: [OKAYFREEDOM_Agent] => C:\Program Files\OkayFreedom\OkayFreedomClient.exe [4656464 2014-04-09] (Steganos Software GmbH)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
ShortcutTarget: HP Photosmart Premier Fast Start.lnk -> C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\REALTEK RTL8187 Wireless LAN Utility.lnk
ShortcutTarget: REALTEK RTL8187 Wireless LAN Utility.lnk -> C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = AOL - News, Sports, Weather, Entertainment, Local & Lifestyle
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
SearchScopes: HKLM - DefaultScope value is missing.
BHO: AcroIEHlprObj Class -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> c:\program files\google\googletoolbar1.dll (Google Inc.)
Toolbar: HKLM - &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {C4069E3A-68F1-403E-B40E-20066696354B} - No File
Toolbar: HKCU - &Google - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate.microsoft.com/...ls/en/x86/client/wuweb_site.cab?1407258913187
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

FireFox:
========
FF ProfilePath: C:\Documents and Settings\66666666666666666666\Application Data\Mozilla\Firefox\Profiles\lvlalzg0.default
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-08-05]

Chrome: 
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

ATTENTION: => Could not perform signature verification. Cryptographic Service is not running.

Locked "TlntSvr" service could not be unlocked. <===== ATTENTION
Locked "WmiApRpl" service could not be unlocked. <===== ATTENTION

U2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5306504 2014-04-16] (COMODO)
U3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [1663192 2014-03-25] (COMODO)
U2 McrdSvc; C:\WINDOWS\ehome\mcrdsvc.exe [99328 2005-08-06] (Microsoft Corporation)
U3 MozillaMaintenance; C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe [119408 2014-08-05] (Mozilla Foundation)
U2 MSMQ; C:\WINDOWS\system32\mqsvc.exe [4608 2004-08-10] (Microsoft Corporation)
U2 MSMQTriggers; C:\WINDOWS\system32\mqtgsvc.exe [117248 2004-08-10] (Microsoft Corporation)
U4 HidServ; %SystemRoot%\System32\hidserv.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U4 abp480n5; C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS [23552 2001-08-18] (Microsoft Corporation)
U3 BTWUSB; C:\WINDOWS\System32\Drivers\btwusb.sys [57096 2006-03-02] (Broadcom Corporation.)
U1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [15704 2014-04-16] (COMODO)
U1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [607448 2014-04-16] (COMODO)
U1 cmdHlp; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [29912 2014-04-16] (COMODO)
U1 eabfiltr; C:\WINDOWS\System32\DRIVERS\eabfiltr.sys [7808 2005-09-19] (Hewlett-Packard Development Company, L.P.)
U3 eabusb; C:\WINDOWS\System32\DRIVERS\eabusb.sys [5760 2005-09-19] (Hewlett-Packard Development Company, L.P.)
U3 HdAudAddService; C:\WINDOWS\System32\drivers\CHDAud.sys [569856 2006-04-18] (Conexant Systems Inc.)
U3 HSFHWAZL; C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys [201600 2005-08-22] (Conexant Systems, Inc.)
U3 HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys [1035008 2005-08-22] (Conexant Systems, Inc.)
U0 Inspect; C:\WINDOWS\System32\DRIVERS\inspect.sys [104920 2014-04-16] (COMODO)
U3 MQAC; C:\WINDOWS\system32\drivers\mqac.sys [72960 2004-08-10] (Microsoft Corporation)
U3 rtl8139; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [20992 2004-08-04] (Realtek Semiconductor Corporation)
U3 Secdrv; C:\WINDOWS\System32\DRIVERS\secdrv.sys [27440 2004-08-10] ()
U3 w39n51; C:\WINDOWS\System32\DRIVERS\w39n51.sys [1428480 2006-03-14] (Intel® Corporation)
U3 catchme; \??\C:\DOCUME~1\666666~1\LOCALS~1\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

NETSVC: MHN -> C:\Windows\System32\mhn.dll (Microsoft Corporation)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-11 12:24 - 2014-08-11 12:25 - 00000000 ____D () C:\FRST
2014-08-10 14:22 - 2014-08-10 15:09 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2014-08-10 14:16 - 2014-08-10 15:09 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Desktop\mbar
2014-08-10 14:14 - 2014-08-09 08:30 - 14349744 _____ (Malwarebytes Corp.) C:\Documents and Settings\66666666666666666666\Desktop\mbar-1.07.0.1012.exe
2014-08-07 22:51 - 2014-08-07 22:51 - 00073659 _____ () C:\ComboFix.txt
2014-08-07 16:53 - 2014-08-07 23:49 - 00052928 _____ () C:\WINDOWS\system32\Drivers\fvstore.dat
2014-08-07 16:53 - 2014-08-07 16:53 - 00000000 ___HD () C:\VTRoot
2014-08-06 22:34 - 2014-08-06 22:34 - 00003584 _____ () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-06 22:12 - 2014-08-06 22:12 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Leadertech
2014-08-06 22:08 - 2014-08-06 22:08 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Sonic
2014-08-06 21:38 - 2014-08-06 21:38 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Macromedia
2014-08-06 21:33 - 2014-08-06 21:33 - 00006615 _____ () C:\WINDOWS\iis6.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00006183 _____ () C:\WINDOWS\FaxSetup.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00002916 _____ () C:\WINDOWS\ocgen.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00002821 _____ () C:\WINDOWS\tsoc.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00002059 _____ () C:\WINDOWS\comsetup.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00001612 _____ () C:\WINDOWS\msmqinst.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00001355 _____ () C:\WINDOWS\imsins.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00001247 _____ () C:\WINDOWS\ntdtcsetup.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00001083 _____ () C:\WINDOWS\netfxocm.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000689 _____ () C:\WINDOWS\plusoc.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000430 _____ () C:\WINDOWS\MedCtrOC.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000342 _____ () C:\WINDOWS\ocmsn.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000338 _____ () C:\WINDOWS\ehOCGen.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000311 _____ () C:\WINDOWS\tabletoc.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000309 _____ () C:\WINDOWS\msgsocm.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB932823-v3$
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 _____ () C:\WINDOWS\setuperr.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 _____ () C:\WINDOWS\setupact.log
2014-08-06 21:32 - 2014-08-06 22:16 - 00010578 _____ () C:\WINDOWS\KB932823-v3.log
2014-08-05 15:18 - 2014-08-11 12:20 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
2014-08-05 15:18 - 2014-08-11 12:20 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
2014-08-05 15:18 - 2014-08-11 12:20 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
2014-08-05 15:18 - 2014-08-11 12:20 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
2014-08-05 15:18 - 2014-08-07 17:00 - 00725264 _____ () C:\WINDOWS\system32\Drivers\sfi.dat
2014-08-05 15:16 - 2014-08-10 16:12 - 00065536 _____ () C:\WINDOWS\system32\config\COMODO I.evt
2014-08-05 15:16 - 2014-08-06 22:38 - 00001878 _____ () C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
2014-08-05 15:16 - 2014-08-05 15:16 - 00000000 ___SD () C:\Documents and Settings\All Users\Application Data\Shared Space
2014-08-05 15:16 - 2014-08-05 15:16 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\COMODO
2014-08-05 15:15 - 2014-08-05 15:15 - 00000000 ____D () C:\Program Files\COMODO
2014-08-05 15:14 - 2014-08-05 15:14 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Comodo Downloader
2014-08-05 15:11 - 2014-08-05 15:18 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Comodo
2014-08-05 14:44 - 2014-08-05 14:44 - 04862664 _____ (AVAST Software) C:\Documents and Settings\All Users\Desktop\avast_free_antivirus_setup_online.exe
2014-08-05 14:44 - 2014-08-05 14:44 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVAST Software
2014-08-05 14:36 - 2014-08-06 17:05 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Steganos
2014-08-05 14:36 - 2014-08-05 14:36 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Steganos VPN
2014-08-05 14:13 - 2014-06-26 17:38 - 93585272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-08-05 14:10 - 2014-08-05 14:10 - 00000000 ____D () C:\Program Files\MSECache
2014-08-05 13:43 - 2014-08-05 13:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-05 13:15 - 2014-08-09 18:40 - 00009250 _____ () C:\WINDOWS\setupapi.log
2014-08-05 13:05 - 2014-08-05 13:05 - 00000000 ___SD () C:\Documents and Settings\66666666666666666666\UserData
2014-08-05 12:46 - 2014-08-05 12:46 - 00005463 _____ () C:\Documents and Settings\66666666666666666666\Desktop\attachk.txt
2014-08-05 12:12 - 2014-08-10 14:22 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-05 12:12 - 2014-08-10 14:17 - 00054232 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-05 12:12 - 2014-08-05 12:12 - 00000617 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Malwarebytes Anti-Malware
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes
2014-08-05 12:12 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-08-04 15:06 - 2014-08-04 15:06 - 00000950 _____ () C:\Documents and Settings\66666666666666666666\Desktop\f.log
2014-08-04 13:43 - 2014-08-04 12:42 - 00370943 _____ () C:\Documents and Settings\66666666666666666666\Desktop\gmer.zip
2014-08-04 13:31 - 2014-08-04 13:31 - 00008600 _____ () C:\Documents and Settings\66666666666666666666\Desktop\dds.txt
2014-08-04 13:31 - 2014-08-04 13:31 - 00005463 _____ () C:\Documents and Settings\66666666666666666666\Desktop\attach.txt
2014-08-04 13:30 - 2014-08-04 12:28 - 00688992 ____R (Swearware) C:\Documents and Settings\66666666666666666666\Desktop\dds.scr
2014-08-04 13:21 - 2014-08-05 15:18 - 00275760 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-08-04 13:15 - 2014-08-04 13:15 - 00000682 _____ () C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
2014-08-04 13:14 - 2014-08-04 12:07 - 04813544 _____ (Piriform Ltd) C:\Documents and Settings\66666666666666666666\Desktop\ccsetup416.exe
2014-08-04 12:52 - 2014-08-04 12:52 - 00000000 ____D () C:\WINDOWS\system32\appmgmt
2014-08-04 11:55 - 2014-08-04 11:55 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Desktop\backups
2014-08-04 11:23 - 2014-08-03 20:35 - 00000209 _____ () C:\Boot.bak
2014-08-04 11:22 - 2014-08-04 11:23 - 00000000 _RSHD () C:\cmdcons
2014-08-04 11:22 - 2004-08-03 23:00 - 00260272 __RSH () C:\cmldr
2014-08-04 11:20 - 2011-06-26 02:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-08-04 11:20 - 2010-11-07 13:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-08-04 11:20 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-08-04 11:16 - 2014-08-04 11:16 - 00000075 _____ () C:\Documents and Settings\66666666666666666666\LuResult.txt
2014-08-04 11:15 - 2014-08-04 11:16 - 00000075 _____ () C:\WINDOWS\system32\LuResult.txt
2014-08-04 11:00 - 2014-08-07 22:52 - 00000000 ____D () C:\Qoobox
2014-08-04 10:59 - 2014-08-04 11:32 - 00000000 ____D () C:\WINDOWS\erdnt
2014-08-04 10:42 - 2014-08-07 22:25 - 05568206 ____R (Swearware) C:\Documents and Settings\66666666666666666666\Desktop\ComboFix.exe
2014-08-04 10:42 - 2014-08-06 20:55 - 00007587 _____ () C:\Documents and Settings\66666666666666666666\Desktop\hijackthis.log
2014-08-04 10:42 - 2014-08-04 09:09 - 00388608 _____ (Trend Micro Inc.) C:\Documents and Settings\66666666666666666666\Desktop\HijackThis.exe
2014-08-03 20:43 - 2014-08-03 20:43 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\Mozilla
2014-08-03 20:43 - 2014-08-03 17:44 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Mozilla
2014-08-03 20:40 - 2014-08-03 20:40 - 00001424 _____ () C:\Documents and Settings\All Users\Desktop\Blockbuster.LNK
2014-08-03 20:40 - 2014-08-03 20:40 - 00001284 _____ () C:\Documents and Settings\All Users\Desktop\Extended Service.LNK
2014-08-03 20:40 - 2014-08-03 20:40 - 00001120 _____ () C:\Documents and Settings\All Users\Desktop\Online Photos First 25 Free.LNK
2014-08-03 20:40 - 2014-08-03 20:40 - 00001070 _____ () C:\Documents and Settings\All Users\Desktop\HP Music.LNK
2014-08-03 20:40 - 2014-08-03 20:40 - 00001062 _____ () C:\Documents and Settings\All Users\Desktop\Accessories.LNK
2014-08-03 20:38 - 2014-08-03 20:38 - 00001797 __RSH () C:\WINDOWS\system32\Drivers\103C_HP_NTBK_HP Pavilion dv5000 (EZ415UA#ABA)_YN_0Pavi_QCND6272969_E413908001_46_I30A8_SHP_V56.38_BF.15_T060613_WXP2_L409_M1015_J120_7Intel_8T2050_91.6_#140803_N80861092_(EZ415UA#ABA)_XMOBILE_CN10_Z_2F.15_G808627A2.MRK
2014-08-03 20:37 - 2014-08-11 12:25 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Temp
2014-08-03 20:37 - 2014-08-10 16:12 - 00000178 ___SH () C:\Documents and Settings\66666666666666666666\ntuser.ini
2014-08-03 20:37 - 2014-08-10 16:12 - 00000000 ____D () C:\Documents and Settings\66666666666666666666
2014-08-03 20:37 - 2014-08-03 20:42 - 00000767 _____ () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Internet Explorer.lnk
2014-08-03 20:37 - 2014-08-03 20:40 - 00000143 _____ () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\fusioncache.dat
2014-08-03 20:37 - 2014-08-03 20:39 - 00000792 _____ () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Windows Media Player.lnk
2014-08-03 20:37 - 2014-08-03 20:39 - 00000738 _____ () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Outlook Express.lnk
2014-08-03 20:37 - 2014-08-03 19:40 - 00000000 ___RD () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Accessories
2014-08-03 20:37 - 2014-08-03 19:40 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Online Services
2014-08-03 20:37 - 2014-08-03 19:40 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
2014-08-03 20:37 - 2006-05-11 09:06 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\BVRP Software
2014-08-03 20:37 - 2006-05-11 09:04 - 00000000 _____ () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\QSwitch.txt
2014-08-03 20:37 - 2006-05-11 09:04 - 00000000 _____ () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\DSwitch.txt
2014-08-03 20:37 - 2006-05-11 09:04 - 00000000 _____ () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\AtStart.txt
2014-08-03 20:37 - 2006-05-11 08:38 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Intuit
2014-08-03 20:37 - 2006-05-11 08:37 - 00001648 _____ () C:\Documents and Settings\66666666666666666666\Desktop\3 Month Trial AOL Music Now.lnk
2014-08-03 20:37 - 2006-05-11 08:35 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\Google
2014-08-03 20:37 - 2006-05-11 08:07 - 00000992 _____ () C:\Documents and Settings\66666666666666666666\Desktop\Help and Support.lnk
2014-08-03 20:37 - 2006-05-11 07:54 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\IsolatedStorage
2014-08-03 20:37 - 2006-05-11 07:54 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\HP
2014-08-03 20:37 - 2006-03-28 08:44 - 00001503 _____ () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Remote Assistance.lnk
2014-08-03 20:33 - 2014-08-03 20:35 - 00000353 _____ () C:\Documents and Settings\All Users\Desktop\Register your Notebook.URL
2014-08-03 20:31 - 2004-08-10 03:00 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Thawbrkr.dll
2014-08-03 20:31 - 2004-08-10 03:00 - 00066594 _____ () C:\WINDOWS\system32\c_864.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066594 _____ () C:\WINDOWS\system32\c_862.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066594 _____ () C:\WINDOWS\system32\c_720.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\c_708.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\C_28596.NLS
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\c_10021.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\c_10005.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\c_10004.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00010752 _____ (Microsoft Corporation) C:\WINDOWS\system32\c_iscii.dll
2014-08-03 20:31 - 2004-08-10 03:00 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\ftlx041e.dll
2014-08-03 20:31 - 2004-08-10 03:00 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\system32\kbdusa.dll
2014-08-03 19:01 - 2004-08-03 23:08 - 00026496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-11 12:25 - 2014-08-11 12:24 - 00000000 ____D () C:\FRST
2014-08-11 12:25 - 2014-08-03 20:37 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Temp
2014-08-11 12:25 - 2013-09-16 07:32 - 00000000 _____ () C:\WINDOWS\RTacDbg.txt
2014-08-11 12:20 - 2014-08-05 15:18 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
2014-08-11 12:20 - 2014-08-05 15:18 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
2014-08-11 12:20 - 2014-08-05 15:18 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
2014-08-11 12:20 - 2014-08-05 15:18 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
2014-08-11 12:20 - 2006-03-28 09:51 - 00116931 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-11 12:19 - 2006-05-11 08:17 - 00001153 _____ () C:\hpqp.ini
2014-08-11 12:19 - 2006-05-11 08:17 - 00000039 _____ () C:\XP_TV.ini
2014-08-11 12:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\Registration
2014-08-11 12:19 - 2006-03-28 09:51 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-10 16:12 - 2014-08-05 15:16 - 00065536 _____ () C:\WINDOWS\system32\config\COMODO I.evt
2014-08-10 16:12 - 2014-08-03 20:37 - 00000178 ___SH () C:\Documents and Settings\66666666666666666666\ntuser.ini
2014-08-10 16:12 - 2014-08-03 20:37 - 00000000 ____D () C:\Documents and Settings\66666666666666666666
2014-08-10 16:12 - 2006-03-28 09:51 - 00021724 _____ () C:\WINDOWS\SchedLgU.Txt
2014-08-10 15:09 - 2014-08-10 14:22 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2014-08-10 15:09 - 2014-08-10 14:16 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Desktop\mbar
2014-08-10 14:22 - 2014-08-05 12:12 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-10 14:17 - 2014-08-05 12:12 - 00054232 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-09 18:40 - 2014-08-05 13:15 - 00009250 _____ () C:\WINDOWS\setupapi.log
2014-08-09 18:35 - 2006-03-28 09:51 - 00001158 _____ () C:\WINDOWS\system32\wpa.dbl
2014-08-09 08:30 - 2014-08-10 14:14 - 14349744 _____ (Malwarebytes Corp.) C:\Documents and Settings\66666666666666666666\Desktop\mbar-1.07.0.1012.exe
2014-08-07 23:49 - 2014-08-07 16:53 - 00052928 _____ () C:\WINDOWS\system32\Drivers\fvstore.dat
2014-08-07 22:52 - 2014-08-04 11:00 - 00000000 ____D () C:\Qoobox
2014-08-07 22:51 - 2014-08-07 22:51 - 00073659 _____ () C:\ComboFix.txt
2014-08-07 22:46 - 2006-03-28 00:31 - 00000227 _____ () C:\WINDOWS\system.ini
2014-08-07 22:25 - 2014-08-04 10:42 - 05568206 ____R (Swearware) C:\Documents and Settings\66666666666666666666\Desktop\ComboFix.exe
2014-08-07 21:36 - 2006-05-11 08:19 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Online Services
2014-08-07 17:00 - 2014-08-05 15:18 - 00725264 _____ () C:\WINDOWS\system32\Drivers\sfi.dat
2014-08-07 16:53 - 2014-08-07 16:53 - 00000000 ___HD () C:\VTRoot
2014-08-06 22:38 - 2014-08-05 15:16 - 00001878 _____ () C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
2014-08-06 22:34 - 2014-08-06 22:34 - 00003584 _____ () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-06 22:16 - 2014-08-06 21:32 - 00010578 _____ () C:\WINDOWS\KB932823-v3.log
2014-08-06 22:12 - 2014-08-06 22:12 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Leadertech
2014-08-06 22:08 - 2014-08-06 22:08 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Sonic
2014-08-06 21:38 - 2014-08-06 21:38 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Macromedia
2014-08-06 21:33 - 2014-08-06 21:33 - 00006615 _____ () C:\WINDOWS\iis6.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00006183 _____ () C:\WINDOWS\FaxSetup.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00002916 _____ () C:\WINDOWS\ocgen.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00002821 _____ () C:\WINDOWS\tsoc.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00002059 _____ () C:\WINDOWS\comsetup.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00001612 _____ () C:\WINDOWS\msmqinst.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00001355 _____ () C:\WINDOWS\imsins.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00001247 _____ () C:\WINDOWS\ntdtcsetup.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00001083 _____ () C:\WINDOWS\netfxocm.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000689 _____ () C:\WINDOWS\plusoc.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000430 _____ () C:\WINDOWS\MedCtrOC.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000342 _____ () C:\WINDOWS\ocmsn.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000338 _____ () C:\WINDOWS\ehOCGen.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000311 _____ () C:\WINDOWS\tabletoc.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000309 _____ () C:\WINDOWS\msgsocm.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB932823-v3$
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 _____ () C:\WINDOWS\setuperr.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 _____ () C:\WINDOWS\setupact.log
2014-08-06 21:32 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$hf_mig$
2014-08-06 20:55 - 2014-08-04 10:42 - 00007587 _____ () C:\Documents and Settings\66666666666666666666\Desktop\hijackthis.log
2014-08-06 17:05 - 2014-08-05 14:36 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Steganos
2014-08-05 15:18 - 2014-08-05 15:11 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Comodo
2014-08-05 15:18 - 2014-08-04 13:21 - 00275760 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-08-05 15:18 - 2006-05-11 07:52 - 00000000 __SHD () C:\Documents and Settings\NetworkService
2014-08-05 15:16 - 2014-08-05 15:16 - 00000000 ___SD () C:\Documents and Settings\All Users\Application Data\Shared Space
2014-08-05 15:16 - 2014-08-05 15:16 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\COMODO
2014-08-05 15:15 - 2014-08-05 15:15 - 00000000 ____D () C:\Program Files\COMODO
2014-08-05 15:14 - 2014-08-05 15:14 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Comodo Downloader
2014-08-05 14:44 - 2014-08-05 14:44 - 04862664 _____ (AVAST Software) C:\Documents and Settings\All Users\Desktop\avast_free_antivirus_setup_online.exe
2014-08-05 14:44 - 2014-08-05 14:44 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVAST Software
2014-08-05 14:43 - 2013-10-16 19:30 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-05 14:36 - 2014-08-05 14:36 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Steganos VPN
2014-08-05 14:28 - 2006-03-28 08:43 - 00000573 _____ () C:\WINDOWS\win.ini
2014-08-05 14:27 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-08-05 14:10 - 2014-08-05 14:10 - 00000000 ____D () C:\Program Files\MSECache
2014-08-05 14:10 - 2006-05-11 08:13 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-08-05 13:44 - 2014-08-05 13:43 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-05 13:05 - 2014-08-05 13:05 - 00000000 ___SD () C:\Documents and Settings\66666666666666666666\UserData
2014-08-05 12:46 - 2014-08-05 12:46 - 00005463 _____ () C:\Documents and Settings\66666666666666666666\Desktop\attachk.txt
2014-08-05 12:40 - 2009-08-22 15:42 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB968389_0$
2014-08-05 12:12 - 2014-08-05 12:12 - 00000617 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Malwarebytes Anti-Malware
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes
2014-08-04 15:06 - 2014-08-04 15:06 - 00000950 _____ () C:\Documents and Settings\66666666666666666666\Desktop\f.log
2014-08-04 13:31 - 2014-08-04 13:31 - 00008600 _____ () C:\Documents and Settings\66666666666666666666\Desktop\dds.txt
2014-08-04 13:31 - 2014-08-04 13:31 - 00005463 _____ () C:\Documents and Settings\66666666666666666666\Desktop\attach.txt
2014-08-04 13:21 - 2006-05-11 08:27 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-08-04 13:21 - 2006-05-11 08:27 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Symantec
2014-08-04 13:16 - 2012-08-27 16:40 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Sierra
2014-08-04 13:15 - 2014-08-04 13:15 - 00000682 _____ () C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
2014-08-04 13:15 - 2012-08-13 13:46 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-04 12:52 - 2014-08-04 12:52 - 00000000 ____D () C:\WINDOWS\system32\appmgmt
2014-08-04 12:52 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Sonic
2014-08-04 12:52 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Sonic
2014-08-04 12:50 - 2006-05-11 05:47 - 00000000 ___RD () C:\Documents and Settings\All Users\Start Menu\Programs\Games
2014-08-04 12:49 - 2006-05-11 08:09 - 00000000 ____D () C:\Program Files\GemMaster
2014-08-04 12:42 - 2014-08-04 13:43 - 00370943 _____ () C:\Documents and Settings\66666666666666666666\Desktop\gmer.zip
2014-08-04 12:28 - 2014-08-04 13:30 - 00688992 ____R (Swearware) C:\Documents and Settings\66666666666666666666\Desktop\dds.scr
2014-08-04 12:07 - 2014-08-04 13:14 - 04813544 _____ (Piriform Ltd) C:\Documents and Settings\66666666666666666666\Desktop\ccsetup416.exe
2014-08-04 11:55 - 2014-08-04 11:55 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Desktop\backups
2014-08-04 11:32 - 2014-08-04 10:59 - 00000000 ____D () C:\WINDOWS\erdnt
2014-08-04 11:31 - 2009-08-14 23:35 - 00000000 ____D () C:\Documents and Settings\heidi
2014-08-04 11:23 - 2014-08-04 11:22 - 00000000 _RSHD () C:\cmdcons
2014-08-04 11:23 - 2006-03-28 08:36 - 00000325 __RSH () C:\boot.ini
2014-08-04 11:16 - 2014-08-04 11:16 - 00000075 _____ () C:\Documents and Settings\66666666666666666666\LuResult.txt
2014-08-04 11:16 - 2014-08-04 11:15 - 00000075 _____ () C:\WINDOWS\system32\LuResult.txt
2014-08-04 09:09 - 2014-08-04 10:42 - 00388608 _____ (Trend Micro Inc.) C:\Documents and Settings\66666666666666666666\Desktop\HijackThis.exe
2014-08-03 20:43 - 2014-08-03 20:43 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\Mozilla
2014-08-03 20:43 - 1999-03-30 14:17 - 00000000 ____D () C:\system.sav
2014-08-03 20:42 - 2014-08-03 20:37 - 00000767 _____ () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Internet Explorer.lnk
2014-08-03 20:42 - 2006-05-11 09:15 - 00000000 ____D () C:\WINDOWS\CREATOR
2014-08-03 20:42 - 2006-05-11 08:52 - 00000000 ____D () C:\WINDOWS\SMINST
2014-08-03 20:40 - 2014-08-03 20:40 - 00001424 _____ () C:\Documents and Settings\All Users\Desktop\Blockbuster.LNK
2014-08-03 20:40 - 2014-08-03 20:40 - 00001284 _____ () C:\Documents and Settings\All Users\Desktop\Extended Service.LNK
2014-08-03 20:40 - 2014-08-03 20:40 - 00001120 _____ () C:\Documents and Settings\All Users\Desktop\Online Photos First 25 Free.LNK
2014-08-03 20:40 - 2014-08-03 20:40 - 00001070 _____ () C:\Documents and Settings\All Users\Desktop\HP Music.LNK
2014-08-03 20:40 - 2014-08-03 20:40 - 00001062 _____ () C:\Documents and Settings\All Users\Desktop\Accessories.LNK
2014-08-03 20:40 - 2014-08-03 20:37 - 00000143 _____ () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\fusioncache.dat
2014-08-03 20:39 - 2014-08-03 20:37 - 00000792 _____ () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Windows Media Player.lnk
2014-08-03 20:39 - 2014-08-03 20:37 - 00000738 _____ () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Outlook Express.lnk
2014-08-03 20:38 - 2014-08-03 20:38 - 00001797 __RSH () C:\WINDOWS\system32\Drivers\103C_HP_NTBK_HP Pavilion dv5000 (EZ415UA#ABA)_YN_0Pavi_QCND6272969_E413908001_46_I30A8_SHP_V56.38_BF.15_T060613_WXP2_L409_M1015_J120_7Intel_8T2050_91.6_#140803_N80861092_(EZ415UA#ABA)_XMOBILE_CN10_Z_2F.15_G808627A2.MRK
2014-08-03 20:38 - 2006-05-11 08:05 - 00000000 ____D () C:\WINDOWS\system32\pcintro
2014-08-03 20:38 - 2006-05-11 08:05 - 00000000 ____D () C:\hp
2014-08-03 20:35 - 2014-08-04 11:23 - 00000209 _____ () C:\Boot.bak
2014-08-03 20:35 - 2014-08-03 20:33 - 00000353 _____ () C:\Documents and Settings\All Users\Desktop\Register your Notebook.URL
2014-08-03 20:31 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\HPQ
2014-08-03 20:19 - 2006-05-11 08:15 - 00000000 ____D () C:\WINDOWS\tiinst
2014-08-03 20:19 - 2006-05-11 07:58 - 00000000 ____D () C:\WINDOWS\system32\ReinstallBackups
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ___RD () C:\WINDOWS\Web
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\twain_32
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\usmt
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\URTTemp
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\spool
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\Restore
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\ras
2014-08-03 20:18 - 2006-05-11 07:56 - 00000000 ____D () C:\WINDOWS\system32\msmq
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\npp
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\mui
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\MsDtc
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\Macromed
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\IME
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\icsxml
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\ias
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\DirectX
2014-08-03 20:17 - 2006-05-11 08:14 - 00000000 ____D () C:\WINDOWS\ShellNew
2014-08-03 20:17 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\Com
2014-08-03 20:17 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\1033
2014-08-03 20:17 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system
2014-08-03 20:17 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\srchasst
2014-08-03 20:17 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\repair
2014-08-03 20:17 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\PeerNet
2014-08-03 20:16 - 2006-05-11 05:47 - 00000000 ___RD () C:\WINDOWS\Offline Web Pages
2014-08-03 20:16 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\mui
2014-08-03 20:16 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\msagent
2014-08-03 20:16 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\Media
2014-08-03 20:15 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\ime
2014-08-03 20:15 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\Help
2014-08-03 20:13 - 2006-05-11 07:58 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB915326$
2014-08-03 20:13 - 2006-05-11 07:58 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB912436$
2014-08-03 20:13 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB909095$
2014-08-03 20:13 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB896256$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB913446$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB912919$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB911927$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB911565$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB911564$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB908519$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB904706$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB903235$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB901214$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB896727$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB896423$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB896422$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB896358$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\Cursors
2014-08-03 20:12 - 2006-05-11 08:40 - 00000000 ____D () C:\vongo
2014-08-03 20:12 - 2006-05-11 08:27 - 00000000 __HDC () C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2014-08-03 20:12 - 2006-05-11 07:58 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB890546$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB889673$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB888402$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB888239$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB885464$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB884575$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB894391$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB893066$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB891781$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB888113$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB887472$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB886185$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB885250$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB873333$
2014-08-03 20:00 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Windows NT
2014-08-03 19:56 - 2006-05-11 08:23 - 00000000 ____D () C:\Program Files\WildTangent
2014-08-03 19:55 - 2006-05-11 08:11 - 00000000 ____D () C:\Program Files\RGB
2014-08-03 19:54 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Outlook Express
2014-08-03 19:54 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Online Services
2014-08-03 19:53 - 2006-05-11 09:06 - 00000000 ____D () C:\Program Files\NetWaiting
2014-08-03 19:53 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\NetMeeting
2014-08-03 19:52 - 2006-05-11 08:38 - 00000000 ____D () C:\Program Files\Microsoft Office Trial Wizard
2014-08-03 19:52 - 2006-05-11 08:37 - 00000000 ____D () C:\Program Files\music_now
2014-08-03 19:52 - 2006-05-11 08:13 - 00000000 ____D () C:\Program Files\Microsoft Works
2014-08-03 19:52 - 2006-05-11 08:12 - 00000000 ____D () C:\Program Files\MSN Encarta Plus
2014-08-03 19:52 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Movie Maker
2014-08-03 19:51 - 2006-05-11 08:15 - 00000000 ____D () C:\Program Files\Microsoft ActiveSync
2014-08-03 19:51 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Messenger
2014-08-03 19:50 - 2006-05-11 05:47 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-08-03 19:49 - 2006-05-11 08:35 - 00000000 ____D () C:\Program Files\Google
2014-08-03 19:48 - 2006-05-11 08:38 - 00000000 ____D () C:\Program Files\Common Files\Palo Alto Software
2014-08-03 19:48 - 2006-05-11 08:37 - 00000000 ____D () C:\Program Files\Common Files\muvee Technologies
2014-08-03 19:48 - 2006-05-11 08:09 - 00000000 ____D () C:\Program Files\ESPNMotion
2014-08-03 19:48 - 2006-05-11 08:09 - 00000000 ____D () C:\Program Files\DIGStream
2014-08-03 19:48 - 2006-05-11 07:59 - 00000000 ____D () C:\Program Files\CONEXANT
2014-08-03 19:48 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Common Files\System
2014-08-03 19:48 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Common Files\Sonic Shared
2014-08-03 19:48 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Common Files\Services
2014-08-03 19:47 - 2006-05-11 08:50 - 00000000 ____D () C:\Program Files\Common Files\LightScribe
2014-08-03 19:47 - 2006-05-11 08:15 - 00000000 ____D () C:\Program Files\Common Files\Designer
2014-08-03 19:46 - 2006-05-11 05:47 - 00000000 ____D () C:\I386
2014-08-03 19:43 - 2006-05-11 08:51 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\System Recovery
2014-08-03 19:43 - 2006-05-11 08:50 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\LightScribe Direct Disc Labeling
2014-08-03 19:43 - 2006-05-11 08:39 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Quicken 2006
2014-08-03 19:43 - 2006-05-11 08:37 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\muvee Technologies
2014-08-03 19:43 - 2006-05-11 08:36 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Netscape
2014-08-03 19:43 - 2006-05-11 08:15 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
2014-08-03 19:43 - 2006-05-11 08:13 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Works
2014-08-03 19:43 - 2006-05-11 08:06 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\PrintMe Internet Printing
2014-08-03 19:43 - 2006-05-11 08:00 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\NetWaiting
2014-08-03 19:43 - 2006-05-11 07:52 - 00000000 __SHD () C:\Documents and Settings\LocalService
2014-08-03 19:43 - 2006-05-11 05:47 - 00000000 __SHD () C:\Documents and Settings\All Users\DRM
2014-08-03 19:43 - 2006-05-11 05:47 - 00000000 ___RD () C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
2014-08-03 19:43 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Windows Digital Media Enhancements
2014-08-03 19:43 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\HP
2014-08-03 19:40 - 2014-08-03 20:37 - 00000000 ___RD () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Accessories
2014-08-03 19:40 - 2014-08-03 20:37 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Start Menu\Programs\Online Services
2014-08-03 19:40 - 2014-08-03 20:37 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
2014-08-03 19:40 - 2009-08-14 23:34 - 00000000 ____D () C:\Documents and Settings\Default User\Start Menu\Programs\Vongo
2014-08-03 19:40 - 2009-08-14 23:34 - 00000000 ____D () C:\Documents and Settings\Default User\Start Menu\Programs\Online Services
2014-08-03 19:40 - 2009-08-14 23:34 - 00000000 ____D () C:\Documents and Settings\Default User\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
2014-08-03 19:40 - 2006-05-11 05:47 - 00000000 ___RD () C:\Documents and Settings\Default User\Start Menu\Programs\Accessories
2014-08-03 19:40 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Sonic
2014-08-03 19:40 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\Administrator
2014-08-03 18:54 - 2006-03-28 08:56 - 00453442 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-03 17:51 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\security
2014-08-03 17:44 - 2014-08-03 20:43 - 00000000 ____D () C:\Documents and Settings\66666666666666666666\Application Data\Mozilla
2014-08-02 11:25 - 2012-11-27 12:53 - 00000000 ____D () C:\Documents and Settings\heidi.PC139818592325
2014-08-02 10:49 - 2014-02-05 13:27 - 00040828 _____ () C:\Documents and Settings\All Users\lxebscan.log

Some content of TEMP:
====================
C:\Documents and Settings\heidi.PC139818592325\Local Settings\Temp\BackupSetup.exe
C:\Documents and Settings\heidi.PC139818592325\Local Settings\Temp\dotnetfx.exe
C:\Documents and Settings\heidi.PC139818592325\Local Settings\Temp\hpzmsi01.exe
C:\Documents and Settings\heidi.PC139818592325\Local Settings\Temp\hpzscr01.exe
C:\Documents and Settings\heidi.PC139818592325\Local Settings\Temp\MFPL7014.DLL
C:\Documents and Settings\heidi.PC139818592325\Local Settings\Temp\mny1A.exe
C:\Documents and Settings\heidi.PC139818592325\Local Settings\Temp\mPlayer.cu.dll
C:\Documents and Settings\heidi.PC139818592325\Local Settings\Temp\SkypeSetup.exe
C:\Documents and Settings\heidi.PC139818592325\Local Settings\Temp\Uninstall.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe
[2004-08-10 11:00] - [2004-08-10 11:00] - 1032192 ____A (Microsoft Corporation) 

C:\WINDOWS\system32\winlogon.exe
[2004-08-10 11:00] - [2004-08-10 11:00] - 0502272 ____A (Microsoft Corporation) 

C:\WINDOWS\system32\svchost.exe
[2004-08-10 11:00] - [2004-08-10 11:00] - 0014336 ____A (Microsoft Corporation) 

C:\WINDOWS\system32\services.exe
[2004-08-10 11:00] - [2004-08-10 11:00] - 0108032 ____A (Microsoft Corporation) 

C:\WINDOWS\system32\User32.dll
[2004-08-10 11:00] - [2004-08-10 11:00] - 0577024 ____A (Microsoft Corporation) 

C:\WINDOWS\system32\userinit.exe
[2004-08-10 11:00] - [2004-08-10 11:00] - 0024576 ____A (Microsoft Corporation) 

C:\WINDOWS\system32\rpcss.dll
[2004-08-10 11:00] - [2005-04-28 23:31] - 0395776 ____A (Microsoft Corporation) 

ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\WINDOWS\system32\Drivers\volsnap.sys
[2004-08-10 11:00] - [2004-08-10 11:00] - 0052352 ____A (Microsoft Corporation) 


==================== End Of Log ============================


----------



## chemist

Hello again, Heidi. I'd rather wait on further fixes until after you rule out the keyboard. Let me know.


----------



## heidi87

I'll try it tonight.

One other thing: I tried to install the AWS03(sechs)H Alfa Wifi Antenna. (Only with this adapter and my outdoor antenna I can go online from home. The software was installed before and worked without any issue.)

The CD didn't work on my laptop. (I tried it on a different computer and the CD itself works). Than I downloaded the driver from the alfa-website. During the installation process my laptop crashed and shut down. The weird thing: Now the login window shows up again when I start the laptop. (Before this window did not show up.) 

Also, all of a sudden I CAN SWITCH THE USER NOW- at least the window pops up when I go to "log off". The user "heidi" seems to require a password now - I never had a password on it - I just left the password field blank and could log in! (I know, I should have had a password....) 

Also, I'm online with my laptop now, but the Wifi network connection is saying "Windows cannot configure this wireless connection". It shows NO available network at all - but I'm online.

Can the whole issue be related to the wifi-adapter? (The "DOS-clonk-sound" was there before every time I clicked on "view available networks".


----------



## chemist

Hello again, Heidi. I would have to say yes, but I'm no expert in Networking, Hardware, or Software, so I can't say for sure. 

How about the 6 key? Any change in behavior there? 

I assume you can now logon to the heidi account? If so, please run dds again in the heidi account and post/attach the logs as before. 

------------------------------------------------------


----------



## heidi87

I couldn't get a keyboard - I'm still looking for one I can borrow.

The "heidi" user account (under c:\ documents and settings) is still there but I cannot log on to it. Like I mentioned before, now all of the sudden the password window pops up. (It did it before the "crash" but I never had a password for my laptop - I just left it blank. Now it won't work this way). 

When I log myself in as "administrator" and go to "user accounts", there is NO user named "heidi". Only "guest" and the "66666666666666".


I did change the user name for 66666666666 to "six".


----------



## chemist

Hello again, Heidi. It appears you have problems beyond malware. Your WMI is borked. Have you received any error messages about WMI not working? 

Windows Management Instrumentation (Windows)

It may have been caused by malware though. Do you remember exactly what date you started having problems? 

------------------------------------------------------

Before we proceed any further, have you backed up any important data, pics, documents, etc., especially anything in the "six" account? 

Emergency Backup Procedure - Tech Support Forum

------------------------------------------------------

At the least, you will have to create a new Heidi account. 

At the most, you will have to reformat or revert your machine to factory settings and start all over. 

It appears you have a recovery partition that can be used to revert to factory conditions. 

------------------------------------------------------

Please run dds again, and post/attach the logs as you did when you first posted. 

------------------------------------------------------


----------



## heidi87

It started on August 2nd. Could start XP, the sixes took over the log in password.
Shut it down, restarted it - windows didn't start at all - black/Dos screen. I don't remember what was on it, but no warning about WMI.
Made boot stick (Avira) and run the recover option, because I thought I can pick a restore point - but I couldn't. I looked like factory modus but some of the software I installed later was there after the recovery (e.g. Skype, GPS adapter), some were missing (like the Wifi-Adapter software).

By the way: Windows was installed on the laptop when my friend bought it. The CD's I have (she bought) are MS Office CD's. Sorry for the confusion - I thought I was XP itself.

All files,folders I need are copied.

Thanks again for helping!

Here is the log file.

DDS (Ver_2012-11-20.01) - NTFS_x86 
Internet Explorer: 6.0.2900.2180
Run by 66666666666666666666 at 17:37:26 on 2014-08-13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.415 [GMT -4:00]
.
AV: COMODO Antivirus *Enabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *Enabled* 
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
uInternet Connection Wizard,ShellNext = hxxp://www.piriform.com/go/app_releasenotes?p=1&v=4.16.4763&l=1033&b=1&a=0
BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
TB: &Google: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: &Google: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_06\bin\jusched.exe
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [MsmqIntCert] regsvr32 /s mqrt.dll
mRun: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [QlbCtrl] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [RecGuard] c:\windows\sminst\RecGuard.exe
mRun: [Reminder] c:\windows\creator\Remind_XP.exe
mRun: [COMODO Internet Security] c:\program files\comodo\comodo internet security\cistray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\realte~1.lnk - c:\program files\realtek\rtl8187 wireless lan utility\RtWLan.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1407258913187
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{8B48AE30-D099-438A-B92D-A6ED37D90394} : DHCPNameServer = 75.75.75.75 75.75.76.76
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [2014-3-25 15704]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2014-3-25 607448]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2014-3-25 29912]
R2 CmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2014-3-25 5306504]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-6 99328]
S3 cmdvirth;COMODO Virtual Service Manager;c:\program files\comodo\comodo internet security\cmdvirth.exe [2014-3-25 1663192]
.
=============== Created Last 30 ================
.
2014-08-11 18:59:03 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys
2014-08-11 18:58:57 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe
2014-08-11 18:58:40 614400 ----a-w- c:\windows\system32\Rtlihvs.dll
2014-08-11 18:58:40 380928 ----a-w- c:\windows\system32\RtlUI2.exe
2014-08-11 18:58:40 323328 ----a-w- c:\windows\system32\drivers\rtl8187.sys
2014-08-11 18:58:40 188416 ----a-w- c:\windows\system32\RTLExtUI.dll
2014-08-11 18:58:38 451072 ----a-w- c:\windows\system32\ISSRemoveSP.exe
2014-08-11 18:58:38 -------- d-----w- c:\program files\AWUS036H Wireless LAN Utility
2014-08-11 18:58:34 -------- d-----w- c:\windows\system32\RtlGina
2014-08-11 18:28:35 81920 ----a-w- c:\windows\system32\ZDPN50.DLL
2014-08-11 18:28:35 31744 ----a-w- c:\windows\system32\drivers\ZDPSp50a64.sys
2014-08-11 18:28:35 29184 ----a-w- c:\windows\system32\drivers\BRGSp50a64.sys
2014-08-11 18:28:35 20608 ----a-w- c:\windows\system32\drivers\BRGSp50.sys
2014-08-11 18:28:35 17664 ----a-w- c:\windows\system32\drivers\ZDPSp50.sys
2014-08-11 18:28:35 17151 ----a-w- c:\windows\system32\ZDPNDIS5.SYS
2014-08-11 18:28:31 24576 ----a-w- c:\windows\system32\ZyDelReg.exe
2014-08-11 18:28:29 28672 ----a-w- c:\windows\system32\InsDrvZD.dll
2014-08-11 18:28:29 15872 ----a-w- c:\windows\system32\InsDrvZD64.DLL
2014-08-11 16:24:42 -------- d-----w- C:\FRST
2014-08-10 18:22:09 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes' Anti-Malware (portable)
2014-08-07 20:53:17 -------- d--h--w- C:\VTRoot
2014-08-07 20:53:14 53466 ----a-w- c:\windows\system32\drivers\fvstore.dat
2014-08-07 01:32:52 294912 ------w- c:\windows\system32\dllcache\msctf.dll
2014-08-05 19:18:20 793089 ----a-w- c:\windows\system32\drivers\sfi.dat
2014-08-05 19:16:27 -------- d-s---w- c:\documents and settings\all users\application data\Shared Space
2014-08-05 19:15:15 -------- d-----w- c:\program files\COMODO
2014-08-05 19:14:43 -------- d-----w- c:\documents and settings\all users\application data\Comodo Downloader
2014-08-05 19:11:37 -------- d-----w- c:\documents and settings\all users\application data\Comodo
2014-08-05 18:44:55 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2014-08-05 18:36:29 -------- d-----w- c:\documents and settings\66666666666666666666\application data\Steganos VPN
2014-08-05 18:36:00 -------- d-----w- c:\documents and settings\66666666666666666666\application data\Steganos
2014-08-05 18:10:42 -------- d-----w- c:\program files\MSECache
2014-08-05 17:05:59 -------- d-s---w- c:\documents and settings\66666666666666666666\UserData
2014-08-05 16:12:38 113880 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 16:12:14 54232 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 16:12:14 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-08-05 16:12:14 -------- d-----w- C:\Malwarebytes Anti-Malware
2014-08-05 16:12:14 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2014-08-04 16:52:37 -------- d-----w- c:\windows\system32\appmgmt
2014-08-04 15:22:56 -------- d-sha-r- C:\cmdcons
2014-08-04 15:20:11 98816 ----a-w- c:\windows\sed.exe
2014-08-04 15:20:11 256000 ----a-w- c:\windows\PEV.exe
2014-08-04 15:20:11 208896 ----a-w- c:\windows\MBR.exe
2014-08-04 00:43:59 -------- d-----w- c:\documents and settings\66666666666666666666\local settings\application data\Mozilla
2014-08-04 00:39:04 -------- d-s---w- c:\documents and settings\66666666666666666666\Temporary Internet Files
2014-08-04 00:39:04 -------- d-s---w- c:\documents and settings\66666666666666666666\History
2014-08-04 00:31:58 185344 ----a-w- c:\windows\system32\Thawbrkr.dll
2014-08-04 00:31:57 6144 ----a-w- c:\windows\system32\ftlx041e.dll
2014-08-04 00:31:57 5632 ----a-w- c:\windows\system32\kbdusa.dll
2014-08-04 00:31:57 10752 ----a-w- c:\windows\system32\c_iscii.dll
2014-08-03 23:01:11 26496 ----a-w- c:\windows\system32\dllcache\usbstor.sys
.
==================== Find3M ====================
.
2010-02-11 00:52:14 27386256 ----a-w- c:\program files\AdbeRdr930_en_US.exe
2009-08-15 19:20:49 8050536 ----a-w- c:\program files\Firefox Setup 3.5.2.exe
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, GMER - Rootkit Detector and Remover
Windows 5.1.2600 
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR 
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys 
c:\windows\system32\drivers\iaStor.sys Intel Corporation Intel Matrix Storage Manager driver
1 ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\Harddisk0\DR0[0x86D10AB8]
3 CLASSPNP[0xF75DF05B] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\00000080[0x86D549A0]
5 ACPI[0xF7455620] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\Ide\IAAStorageDevice-0[0x86D72030]
kernel: MBR read successfully
_asm { XOR DI, DI; MOV SI, 0x200; MOV SS, DI; MOV SP, 0x7a00; MOV BX, 0x7a0; MOV CX, SI; MOV DS, BX; MOV ES, BX; REP MOVSB ; JMP FAR 0x7a0:0x7a; }
user != kernel MBR !!! 
.
============= FINISH: 17:39:11.96 ===============


----------



## heidi87

By the way: Computer works without any issue today:
Booting without beeping or "clonk-sounds", no sixes...I can even see the available networks again...

_ I guess it won't last....._


----------



## heidi87

chemist said:


> Hello again, Heidi. It appears you have problems beyond malware. Your WMI is borked. Have you received any error messages about WMI not working?
> 
> Windows Management Instrumentation (Windows)
> 
> It may have been caused by malware though. Do you remember exactly what date you started having problems?
> 
> 
> ------------------------------------------------------


I just remembered: For the last 8 month or so, a message popped up every time I started the laptop - something with "win/32.exe ......" in it. I googled it once and couldn't figure it out. I really don't remember.... I just ignored it and the laptop started and worked fine...
Now I know I should have taken care of it right away....I'm learning....


----------



## heidi87

The Wifi-Adapter is also working again. Are you doing something to my computer without me noticing it?:wink:

The alfa Wifi adapter runs (now?) under "Realtek RTL8187". 
Just to let you know.


----------



## chemist

Hello again, Heidi. Go Start > Control Panel > User Accounts 

In the 'Pick an account to change' area of the User Accounts window, click on Heidi. 

Under the 'What do you want to change about [username]'s account' heading, click *Change the password*

Are you able to change the password for the Heidi account now? You can just leave the password boxes blank to have no password. Let me know.


----------



## heidi87

The "heidi" user account (under c:\ documents and settings) is still there but I cannot log on to it. 

When I log myself in as "administrator" and go to "user accounts", there is NO user named "heidi". Only "guest" and the "six " /"66666666666666".

Now the 2nd laptop - the one I used to go online - is down... 
http://www.techsupportforum.com/for...tarting-up-screen-2nd-laptop-down-880033.html
(Within the last 10years, I've never had any bad virus/trojaner or any other issue with my computer/laptop. Now XP is no longer supported and....Just coincidence or is it me?)


*It might not be able to go online as often as I could before. 
*


----------



## chemist

Hello again, Heidi. How are you communicating now? I don't think your current connecting issues are due to XP being no longer supported. Have you tried rebooting your 2nd laptop? 

Log in as admin, and see if you can create another user account with admin privileges, something like Heidi1, etc. 

Let me know if you were successful. 

------------------------------------------------------


----------



## heidi87

Thanks for your effort!
I'm using a desktop at work.
Got a reply saying to chose the safe mode with network - than I should be able to use the wifi. 

My laptop did start yesterday - the 66666 were only there once - in the log-in window (user name and password screen). After this laptop worked fine. Laptop is at home now - I'll try to create the "heidi1" account tomorrow evening and will let you know if it worked.


It's just so weird - two laptops with XP start having major issues within a few days....


----------



## chemist

You're welcome! Thanks. Let me know.


----------



## heidi87

Will do it tomorrow- today I'm busy with the other laptop and forgot mine at home...


----------



## chemist

Still with us, Heidi?


----------



## heidi87

yes, sorry for not getting back to you sooner.
My friend uses my "666666" laptop now (His is messed up too - see my second post in this forum). At least the "66666' laptop works and has a security suite on it. He knows that there might be a mega virus etc on it - but it's good enough for him to look things up on the internet.

By tomorrow morning I'll let you know if I can create a new user on it.

Thanks for your patience!!!!


----------



## heidi87

chemist said:


> Log in as admin, and see if you can create another user account with admin privileges, something like Heidi1, etc.
> 
> Let me know if you were successful.
> 
> ------------------------------------------------------


I could create another user with admin privileges - not a problem!


----------



## chemist

Hello again, Heidi. Good job! Did you name it Heidi1? 

Can't remember, but have you backed up any personal files, music, pics, etc. you can't live without? 

Once you have, please delete the Heidi account. Reboot your machine, if not already prompted. 

If successful, please download(if necessary) *dds* again, and post/attach fresh logs as before.


----------



## heidi87

The new user is "heidinew" - the user "six" is deleted. 

I also delete all documents etc. from "heidi" and "heidi/PC 325475487535" (forgot the correct numbers after PC). These two "accounts" didn't show up under "users" but they had plenty of documents etc.



DDS (Ver_2012-11-20.01) - NTFS_x86 
Internet Explorer: 6.0.2900.2180
Run by heidinew at 19:10:15 on 2014-08-26
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.428 [GMT -4:00]
.
AV: COMODO Antivirus *Enabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *Enabled* 
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_06\bin\jusched.exe
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [MsmqIntCert] regsvr32 /s mqrt.dll
mRun: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [QlbCtrl] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [RecGuard] c:\windows\sminst\RecGuard.exe
mRun: [Reminder] c:\windows\creator\Remind_XP.exe
mRun: [COMODO Internet Security] c:\program files\comodo\comodo internet security\cistray.exe
StartupFolder: c:\docume~1\heidinew\startm~1\programs\startup\vongot~1.lnk - c:\program files\vongo\Tray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\realte~1.lnk - c:\program files\realtek\rtl8187 wireless lan utility\RtWLan.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1407258913187
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{8B48AE30-D099-438A-B92D-A6ED37D90394} : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{B0FFE3D7-2811-45E8-9FBF-2966EE3C9B79} : DHCPNameServer = 192.168.0.1 205.171.203.226
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [2014-3-25 15704]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2014-3-25 607448]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2014-3-25 29912]
R2 CmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2014-3-25 5306504]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-6 99328]
S3 cmdvirth;COMODO Virtual Service Manager;c:\program files\comodo\comodo internet security\cmdvirth.exe [2014-3-25 1663192]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [2014-8-11 323328]
.
=============== Created Last 30 ================
.
2014-08-26 22:59:56 -------- d-----w- c:\documents and settings\heidinew\local settings\application data\Mozilla
2014-08-26 22:35:21 -------- d-----w- c:\program files\Vongo
2014-08-15 20:04:59 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-08-15 20:04:59 699568 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-08-11 18:59:03 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys
2014-08-11 18:58:57 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe
2014-08-11 18:58:40 614400 ----a-w- c:\windows\system32\Rtlihvs.dll
2014-08-11 18:58:40 380928 ----a-w- c:\windows\system32\RtlUI2.exe
2014-08-11 18:58:40 323328 ----a-w- c:\windows\system32\drivers\RTL8187.sys
2014-08-11 18:58:40 188416 ----a-w- c:\windows\system32\RTLExtUI.dll
2014-08-11 18:58:38 451072 ----a-w- c:\windows\system32\ISSRemoveSP.exe
2014-08-11 18:58:38 -------- d-----w- c:\program files\AWUS036H Wireless LAN Utility
2014-08-11 18:58:34 -------- d-----w- c:\windows\system32\RtlGina
2014-08-11 18:28:35 81920 ----a-w- c:\windows\system32\ZDPN50.DLL
2014-08-11 18:28:35 31744 ----a-w- c:\windows\system32\drivers\ZDPSp50a64.sys
2014-08-11 18:28:35 29184 ----a-w- c:\windows\system32\drivers\BRGSp50a64.sys
2014-08-11 18:28:35 20608 ----a-w- c:\windows\system32\drivers\BRGSp50.sys
2014-08-11 18:28:35 17664 ----a-w- c:\windows\system32\drivers\ZDPSp50.sys
2014-08-11 18:28:35 17151 ----a-w- c:\windows\system32\ZDPNDIS5.SYS
2014-08-11 18:28:31 24576 ----a-w- c:\windows\system32\ZyDelReg.exe
2014-08-11 18:28:29 28672 ----a-w- c:\windows\system32\InsDrvZD.dll
2014-08-11 18:28:29 15872 ----a-w- c:\windows\system32\InsDrvZD64.DLL
2014-08-11 16:24:42 -------- d-----w- C:\FRST
2014-08-10 18:22:09 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes' Anti-Malware (portable)
2014-08-07 20:53:17 -------- d--h--w- C:\VTRoot
2014-08-07 20:53:14 51990 ----a-w- c:\windows\system32\drivers\fvstore.dat
2014-08-07 01:32:52 294912 ------w- c:\windows\system32\dllcache\msctf.dll
2014-08-05 19:18:20 1207136 ----a-w- c:\windows\system32\drivers\sfi.dat
2014-08-05 19:16:27 -------- d-s---w- c:\documents and settings\all users\application data\Shared Space
2014-08-05 19:15:15 -------- d-----w- c:\program files\COMODO
2014-08-05 19:14:43 -------- d-----w- c:\documents and settings\all users\application data\Comodo Downloader
2014-08-05 19:11:37 -------- d-----w- c:\documents and settings\all users\application data\Comodo
2014-08-05 18:44:55 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2014-08-05 18:10:42 -------- d-----w- c:\program files\MSECache
2014-08-05 16:12:38 113880 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 16:12:14 54232 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 16:12:14 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-08-05 16:12:14 -------- d-----w- C:\Malwarebytes Anti-Malware
2014-08-05 16:12:14 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2014-08-04 16:52:37 -------- d-----w- c:\windows\system32\appmgmt
2014-08-04 15:22:56 -------- d-sha-r- C:\cmdcons
2014-08-04 15:20:11 98816 ----a-w- c:\windows\sed.exe
2014-08-04 15:20:11 256000 ----a-w- c:\windows\PEV.exe
2014-08-04 15:20:11 208896 ----a-w- c:\windows\MBR.exe
2014-08-04 00:31:58 185344 ----a-w- c:\windows\system32\Thawbrkr.dll
2014-08-04 00:31:57 6144 ----a-w- c:\windows\system32\ftlx041e.dll
2014-08-04 00:31:57 5632 ----a-w- c:\windows\system32\kbdusa.dll
2014-08-04 00:31:57 10752 ----a-w- c:\windows\system32\c_iscii.dll
2014-08-03 23:01:11 26496 ----a-w- c:\windows\system32\dllcache\usbstor.sys
.
==================== Find3M ====================
.
2010-02-11 00:52:14 27386256 ----a-w- c:\program files\AdbeRdr930_en_US.exe
2009-08-15 19:20:49 8050536 ----a-w- c:\program files\Firefox Setup 3.5.2.exe
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, GMER - Rootkit Detector and Remover
Windows 5.1.2600 
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR 
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys 
c:\windows\system32\drivers\iaStor.sys Intel Corporation Intel Matrix Storage Manager driver
1 ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\Harddisk0\DR0[0x86D3FAB8]
3 CLASSPNP[0xF75DF05B] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\00000081[0x86D2D908]
5 ACPI[0xF7455620] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\Ide\IAAStorageDevice-0[0x86D3A030]
kernel: MBR read successfully
_asm { XOR DI, DI; MOV SI, 0x200; MOV SS, DI; MOV SP, 0x7a00; MOV BX, 0x7a0; MOV CX, SI; MOV DS, BX; MOV ES, BX; REP MOVSB ; JMP FAR 0x7a0:0x7a; }
user != kernel MBR !!! 
.
============= FINISH: 19:12:14.50 ===============


----------



## chemist

Hello again, Heidi. How is the machine behaving? Any problems?


----------



## heidi87

The sixes only show up when the log-screen pops up. I can stop the sixes being typed endlessly by pressing another key/letter.
After the log in, the sixes won't show up again.

So far no other issues.

I could live with this, as long as it's safe.
I'm afraid to use the USB sticks I have used with this laptop...do you think it's safe to use them with a different computer/laptop?


----------



## chemist

Hello again, Heidi. Please run FRST again and post/attach the logs as before. 

Make sure you tick the *Addition.txt* option. 

------------------------------------------------------


----------



## heidi87

Here is the result.
FYI: My friend installed SP3 and some security updates on my laptop (we swaped because his laptop is still not booting - see my 2nd/3rd post). I forgot to tell him that he shouldn't install/run anything - sorry!

I have to cut the FRST result. In total it's 103510 characters long and I can post only 100000 at once

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:26-08-2014
Ran by heidinew (administrator) on YOUR-252739F5C3 on 27-08-2014 19:53:11
Running from C:\Documents and Settings\heidinew\My Documents\Downloads
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English (United States)
Internet Explorer Version 6
Boot Mode: Normal

The only official download link for FRST:

Download link for32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\WINDOWS\system32\mqsvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\WINDOWS\system32\mqtgsvc.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink Corp.) C:\Program Files\Hp\QuickPlay\QPService.exe
(Hewlett-Packard Co.) C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
(Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe
(Microsoft Corporation) C:\Program Files\Messenger\msmsgs.exe
(Realtek Semiconductor Corp.) C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hp\Digital Imaging\bin\hpqimzone.exe
() C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Microsoft Corporation) C:\WINDOWS\system32\dllhost.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ehTray] => C:\WINDOWS\ehome\ehtray.exe [64512 2005-08-06] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [36975 2005-11-11] (Sun Microsystems, Inc.)
HKLM\...\Run: [hpWirelessAssistant] => C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [454656 2006-02-14] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [igfxhkcmd] => C:\WINDOWS\system32\hkcmd.exe [77824 2006-03-23] (Intel Corporation)
HKLM\...\Run: [igfxpers] => C:\WINDOWS\system32\igfxpers.exe [118784 2006-03-23] (Intel Corporation)
HKLM\...\Run: [MsmqIntCert] => regsvr32 /s mqrt.dll
HKLM\...\Run: [High Definition Audio Property Page Shortcut] => C:\WINDOWS\system32\CHDAudPropShortcut.exe [61952 2006-04-18] (Windows (R) Server 2003 DDK provider)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [761948 2006-03-04] (Synaptics, Inc.)
HKLM\...\Run: [QPService] => C:\Program Files\HP\QuickPlay\QPService.exe [102400 2006-04-12] (CyberLink Corp.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49152 2005-02-17] (Hewlett-Packard Co.)
HKLM\...\Run: [ISUSPM Startup] => C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe [249856 2005-08-11] (Macrovision Corporation)
HKLM\...\Run: [ISUSScheduler] => C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-08-11] (Macrovision Corporation)
HKLM\...\Run: [QlbCtrl] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [131072 2006-03-07] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [Cpqset] => C:\Program Files\HPQ\Default Settings\cpqset.exe 
Ì @  üx@ �\ (@ üx@
HKLM\...\Run: [RecGuard] => C:\Windows\SMINST\RecGuard.exe [1187840 2005-10-11] ()
HKLM\...\Run: [Reminder] => C:\Windows\CREATOR\Remind_XP.exe [643072 2006-02-09] (SoftThinks)
HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1225944 2014-03-25] (COMODO)
HKLM\...\RunOnce: [KB923561] => rundll32.exe apphelp.dll,ShimFlushCache
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKU\S-1-5-21-1000165644-2606398902-3109072702-1006\...\Run: [MSMSGS] => C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
ShortcutTarget: HP Photosmart Premier Fast Start.lnk -> C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\REALTEK RTL8187 Wireless LAN Utility.lnk
ShortcutTarget: REALTEK RTL8187 Wireless LAN Utility.lnk -> C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = AOL - News, Sports, Weather, Entertainment, Local & Lifestyle
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = AOL - News, Sports, Weather, Entertainment, Local & Lifestyle
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
SearchScopes: HKLM - DefaultScope value is missing.
BHO: AcroIEHlprObj Class -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {C4069E3A-68F1-403E-B40E-20066696354B} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate.microsoft.com/...ls/en/x86/client/wuweb_site.cab?1407258913187
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Documents and Settings\heidinew\Application Data\Mozilla\Firefox\Profiles\enynk49u.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-08-05]

Chrome: 
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 aspnet_state; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [32768 2004-07-15] (Microsoft Corporation) [File not signed]
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5306504 2014-04-16] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [1663192 2014-03-25] (COMODO)
R2 hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [135168 2006-03-15] (Hewlett-Packard Development Company, L.P.) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2006-02-17] (Hewlett-Packard Company) [File not signed]
R2 McrdSvc; C:\WINDOWS\ehome\mcrdsvc.exe [99328 2005-08-06] (Microsoft Corporation)
S3 MHN; C:\WINDOWS\System32\mhn.dll [85504 2004-08-10] (Microsoft Corporation) [File not signed]
S3 MozillaMaintenance; C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe [119408 2014-08-05] (Mozilla Foundation)
R2 MSMQ; C:\WINDOWS\system32\mqsvc.exe [4608 2008-04-14] (Microsoft Corporation)
R2 MSMQTriggers; C:\WINDOWS\system32\mqtgsvc.exe [117248 2008-04-14] (Microsoft Corporation)
S2 spupdsvc; C:\WINDOWS\system32\spupdsvc.exe [26488 2007-07-28] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 abp480n5; C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS [23552 2001-08-18] (Microsoft Corporation)
R2 AegisP; C:\WINDOWS\System32\DRIVERS\AegisP.sys [21361 2014-08-11] (Cisco Systems, Inc.) [File not signed]
S3 BTWUSB; C:\WINDOWS\System32\Drivers\btwusb.sys [57096 2006-03-02] (Broadcom Corporation.) [File not signed]
R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [15704 2014-04-16] (COMODO)
R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [607448 2014-04-16] (COMODO)
R1 cmdHlp; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [29912 2014-04-16] (COMODO)
R1 eabfiltr; C:\WINDOWS\System32\DRIVERS\eabfiltr.sys [7808 2005-09-19] (Hewlett-Packard Development Company, L.P.)
S3 eabusb; C:\WINDOWS\System32\DRIVERS\eabusb.sys [5760 2005-09-19] (Hewlett-Packard Development Company, L.P.)
R3 HdAudAddService; C:\WINDOWS\System32\drivers\CHDAud.sys [569856 2006-04-18] (Conexant Systems Inc.)
R3 HSFHWAZL; C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys [201600 2005-08-22] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys [1035008 2005-08-22] (Conexant Systems, Inc.)
R0 Inspect; C:\WINDOWS\System32\DRIVERS\inspect.sys [104920 2014-04-16] (COMODO)
S3 MHNDRV; C:\WINDOWS\System32\DRIVERS\mhndrv.sys [11008 2004-08-10] (Microsoft Corporation) [File not signed]
R3 MQAC; C:\WINDOWS\system32\drivers\mqac.sys [92544 2008-04-14] (Microsoft Corporation)
R0 PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [20640 2005-04-25] (Sonic Solutions) [File not signed]
S3 rtl8139; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [20992 2004-08-04] (Realtek Semiconductor Corporation)
S3 RTLWUSB; C:\WINDOWS\System32\DRIVERS\RTL8187.sys [323328 2009-06-26] (Realtek Semiconductor Corporation ) [File not signed]
R3 w39n51; C:\WINDOWS\System32\DRIVERS\w39n51.sys [1428480 2006-03-14] (Intel® Corporation)
S3 ZDPSp50; C:\WINDOWS\System32\Drivers\ZDPSp50.sys [17664 2004-10-25] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 catchme; \??\C:\DOCUME~1\666666~1\LOCALS~1\Temp\catchme.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

NETSVC: MHN -> C:\Windows\System32\mhn.dll (Microsoft Corporation)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-27 19:41 - 2014-08-27 19:44 - 00026665 _____ () C:\WINDOWS\KB2423089.log
2014-08-27 19:35 - 2014-08-27 19:38 - 00027344 _____ () C:\WINDOWS\KB2387149.log
2014-08-27 19:35 - 2014-08-27 19:35 - 00024518 _____ () C:\WINDOWS\KB2378111.log
2014-08-27 19:32 - 2014-08-27 19:35 - 00024266 _____ () C:\WINDOWS\KB2296011.log
2014-08-27 19:29 - 2014-08-27 19:29 - 00023487 _____ () C:\WINDOWS\KB975558.log
2014-08-27 19:22 - 2014-08-27 19:25 - 00024194 _____ () C:\WINDOWS\KB981997.log
2014-08-27 19:13 - 2014-08-27 19:16 - 00024231 _____ () C:\WINDOWS\KB2229593.log
2014-08-27 19:12 - 2014-08-27 19:13 - 00025635 _____ () C:\WINDOWS\KB979904.log
2014-08-27 19:09 - 2014-08-27 19:09 - 00022846 _____ () C:\WINDOWS\KB978695.log
2014-08-27 18:41 - 2014-08-27 18:44 - 00024129 _____ () C:\WINDOWS\KB973904.log
2014-08-27 18:35 - 2014-08-27 18:35 - 00025185 _____ () C:\WINDOWS\KB952069.log
2014-08-27 18:18 - 2014-08-27 18:18 - 00018323 _____ () C:\WINDOWS\KB954155.log
2014-08-27 18:15 - 2014-08-27 18:18 - 00019470 _____ () C:\WINDOWS\KB956844.log
2014-08-27 18:14 - 2014-08-27 18:15 - 00020889 _____ () C:\WINDOWS\KB973768.log
2014-08-27 17:57 - 2014-08-27 17:59 - 00018614 _____ () C:\WINDOWS\KB973869.log
2014-08-27 17:45 - 2014-08-27 17:48 - 00016556 _____ () C:\WINDOWS\KB956572.log
2014-08-27 17:42 - 2014-08-27 17:44 - 00011281 _____ () C:\WINDOWS\KB923561.log
2014-08-27 17:41 - 2014-08-27 17:42 - 00006416 _____ () C:\WINDOWS\KB923723.log
2014-08-27 17:39 - 2014-08-27 17:41 - 00009561 _____ () C:\WINDOWS\KB952287.log
2014-08-27 17:30 - 2014-08-27 17:33 - 00008747 _____ () C:\WINDOWS\KB946648.log
2014-08-27 17:25 - 2014-08-27 17:27 - 00008407 _____ () C:\WINDOWS\KB951376-v2.log
2014-08-27 17:21 - 2014-08-27 17:24 - 00008657 _____ () C:\WINDOWS\KB950762.log
2014-08-27 17:21 - 2014-08-27 17:21 - 00011081 _____ () C:\WINDOWS\KB941569.log
2014-08-27 17:20 - 2014-08-27 17:20 - 00006074 _____ () C:\WINDOWS\KB2909212.log
2014-08-27 17:20 - 2014-08-27 17:20 - 00005916 _____ () C:\WINDOWS\KB2930275.log
2014-08-27 17:20 - 2014-08-27 17:20 - 00005846 _____ () C:\WINDOWS\KB2936068.log
2014-08-27 17:20 - 2014-08-27 17:20 - 00005460 _____ () C:\WINDOWS\KB2922229.log
2014-08-27 17:20 - 2014-08-27 17:20 - 00005459 _____ () C:\WINDOWS\KB2929961.log
2014-08-27 17:19 - 2014-08-27 17:19 - 00005463 _____ () C:\WINDOWS\KB2898715.log
2014-08-27 17:19 - 2014-08-27 17:19 - 00005462 _____ () C:\WINDOWS\KB2916036.log
2014-08-27 17:19 - 2014-08-27 17:19 - 00005459 _____ () C:\WINDOWS\KB2892075.log
2014-08-27 17:19 - 2014-08-27 17:19 - 00005458 _____ () C:\WINDOWS\KB2893294.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005462 _____ () C:\WINDOWS\KB2868626.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005460 _____ () C:\WINDOWS\KB2876331.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005460 _____ () C:\WINDOWS\KB2862152.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005459 _____ () C:\WINDOWS\KB2876217.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005459 _____ () C:\WINDOWS\KB2864063.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005458 _____ () C:\WINDOWS\KB2847311.log
2014-08-27 17:17 - 2014-08-27 17:17 - 00006233 _____ () C:\WINDOWS\KB2813345.log
2014-08-27 17:17 - 2014-08-27 17:17 - 00005789 _____ () C:\WINDOWS\KB2859537.log
2014-08-27 17:17 - 2014-08-27 17:17 - 00005456 _____ () C:\WINDOWS\KB2850869.log
2014-08-27 17:17 - 2014-08-27 17:17 - 00005290 _____ () C:\WINDOWS\KB2820917.log
2014-08-27 17:16 - 2014-08-27 17:17 - 00005217 _____ () C:\WINDOWS\KB2780091.log
2014-08-27 17:16 - 2014-08-27 17:16 - 00005125 _____ () C:\WINDOWS\KB2802968.log
2014-08-27 17:16 - 2014-08-27 17:16 - 00005044 _____ () C:\WINDOWS\KB2757638.log
2014-08-27 17:16 - 2014-08-27 17:16 - 00004870 _____ () C:\WINDOWS\KB2727528.log
2014-08-27 17:16 - 2014-08-27 17:16 - 00004809 _____ () C:\WINDOWS\KB2705219-v2.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00004797 _____ () C:\WINDOWS\KB2719985.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00004796 _____ () C:\WINDOWS\KB2691442.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00004789 _____ () C:\WINDOWS\KB2655992.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00004788 _____ () C:\WINDOWS\KB2712808.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00003381 _____ () C:\WINDOWS\KB2749655.log
2014-08-27 17:14 - 2014-08-27 17:15 - 00006285 _____ () C:\WINDOWS\KB2676562.log
2014-08-27 17:14 - 2014-08-27 17:14 - 00004792 _____ () C:\WINDOWS\KB2585542.log
2014-08-27 17:14 - 2014-08-27 17:14 - 00004790 _____ () C:\WINDOWS\KB2653956.log
2014-08-27 17:14 - 2014-08-27 17:14 - 00004784 _____ () C:\WINDOWS\KB2598479.log
2014-08-27 17:13 - 2014-08-27 17:14 - 00004792 _____ () C:\WINDOWS\KB2631813.log
2014-08-27 17:13 - 2014-08-27 17:13 - 00004809 _____ () C:\WINDOWS\KB2544893-v2.log
2014-08-27 17:13 - 2014-08-27 17:13 - 00004792 _____ () C:\WINDOWS\KB2507938.log
2014-08-27 17:13 - 2014-08-27 17:13 - 00004785 _____ () C:\WINDOWS\KB2584146.log
2014-08-27 17:13 - 2014-08-27 17:13 - 00004784 _____ () C:\WINDOWS\KB2620712.log
2014-08-27 17:12 - 2014-08-27 17:13 - 00004795 _____ () C:\WINDOWS\KB2509553.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00006016 _____ () C:\WINDOWS\KB2510581.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00005640 _____ () C:\WINDOWS\KB2481109.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00004792 _____ () C:\WINDOWS\KB2506212.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00004791 _____ () C:\WINDOWS\KB2508429.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00004790 _____ () C:\WINDOWS\KB971029.log
2014-08-27 17:11 - 2014-08-27 19:50 - 00018151 _____ () C:\WINDOWS\KB2419632.log
2014-08-27 17:11 - 2014-08-27 19:47 - 00032014 _____ () C:\WINDOWS\KB2443105.log
2014-08-27 17:11 - 2014-08-27 19:41 - 00031980 _____ () C:\WINDOWS\KB982132.log
2014-08-27 17:11 - 2014-08-27 17:11 - 00004797 _____ () C:\WINDOWS\KB2483185.log
2014-08-27 17:11 - 2014-08-27 17:11 - 00004787 _____ () C:\WINDOWS\KB2478971.log
2014-08-27 17:11 - 2010-10-11 10:59 - 00045568 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wab.exe
2014-08-27 17:10 - 2014-08-27 19:32 - 00032196 _____ () C:\WINDOWS\KB979687.log
2014-08-27 17:10 - 2014-08-27 19:22 - 00029462 _____ () C:\WINDOWS\KB982665.log
2014-08-27 17:10 - 2014-08-27 19:19 - 00029504 _____ () C:\WINDOWS\KB2115168.log
2014-08-27 17:10 - 2010-09-18 02:53 - 00974848 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mfc42.dll
2014-08-27 17:10 - 2010-09-18 02:53 - 00974848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SET248.tmp
2014-08-27 17:10 - 2010-09-18 02:53 - 00954368 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mfc40.dll
2014-08-27 17:10 - 2010-09-18 02:53 - 00953856 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mfc40u.dll
2014-08-27 17:10 - 2010-08-23 12:12 - 00617472 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\comctl32.dll
2014-08-27 17:10 - 2010-06-18 09:36 - 03558912 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\moviemk.exe
2014-08-27 17:10 - 2010-06-14 10:31 - 00744448 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\helpsvc.exe
2014-08-27 17:10 - 2010-04-05 13:54 - 00384512 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mp4sdmod.dll
2014-08-27 17:10 - 2010-03-30 02:52 - 00262416 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mpg4ds32.ax
2014-08-27 17:09 - 2014-08-27 19:12 - 00029527 _____ () C:\WINDOWS\KB979482.log
2014-08-27 17:09 - 2014-08-27 19:09 - 00029668 _____ () C:\WINDOWS\KB978542.log
2014-08-27 17:09 - 2014-08-27 19:06 - 00029992 _____ () C:\WINDOWS\KB978338.log
2014-08-27 17:09 - 2014-08-27 19:04 - 00029525 _____ () C:\WINDOWS\KB979309.log
2014-08-27 17:09 - 2014-08-27 19:01 - 00029521 _____ () C:\WINDOWS\KB977816.log
2014-08-27 17:09 - 2014-08-27 18:58 - 00029528 _____ () C:\WINDOWS\KB978706.log
2014-08-27 17:09 - 2014-08-27 18:55 - 00030679 _____ () C:\WINDOWS\KB977914.log
2014-08-27 17:09 - 2009-11-27 12:07 - 00048128 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iyuv_32.dll
2014-08-27 17:09 - 2009-11-27 12:07 - 00008704 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\tsbyuv.dll
2014-08-27 17:08 - 2014-08-27 18:50 - 00029846 _____ () C:\WINDOWS\KB975713.log
2014-08-27 17:08 - 2014-08-27 18:41 - 00029312 _____ () C:\WINDOWS\KB974392.log
2014-08-27 17:08 - 2014-08-27 18:38 - 00028821 _____ () C:\WINDOWS\KB974318.log
2014-08-27 17:08 - 2014-08-27 18:35 - 00028337 _____ () C:\WINDOWS\KB975467.log
2014-08-27 17:08 - 2014-08-27 18:32 - 00028956 _____ () C:\WINDOWS\KB968389.log
2014-08-27 17:08 - 2010-08-27 04:02 - 00119808 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\t2embed.dll
2014-08-27 17:08 - 2010-04-03 06:27 - 02334720 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\WMVCore.dll
2014-08-27 17:08 - 2009-11-27 13:11 - 00017920 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\msyuv.dll
2014-08-27 17:08 - 2009-10-15 12:28 - 00081920 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\fontsub.dll
2014-08-27 17:08 - 2008-06-11 04:58 - 00988672 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\WMNetmgr.dll
2014-08-27 17:08 - 2008-06-11 04:47 - 00096768 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\logagent.exe
2014-08-27 17:07 - 2014-08-27 18:29 - 00025305 _____ () C:\WINDOWS\KB969059.log
2014-08-27 17:07 - 2014-08-27 18:26 - 00025309 _____ () C:\WINDOWS\KB974112.log
2014-08-27 17:07 - 2014-08-27 18:24 - 00025620 _____ () C:\WINDOWS\KB974571.log
2014-08-27 17:07 - 2014-08-27 18:21 - 00024718 _____ () C:\WINDOWS\KB975025.log
2014-08-27 17:07 - 2014-08-27 18:14 - 00025075 _____ () C:\WINDOWS\KB971657.log
2014-08-27 17:07 - 2014-08-27 18:08 - 00024547 _____ () C:\WINDOWS\KB973815.log
2014-08-27 17:07 - 2014-08-27 18:05 - 00024536 _____ () C:\WINDOWS\KB960859.log
2014-08-27 17:07 - 2014-08-27 18:02 - 00024736 _____ () C:\WINDOWS\KB973507.log
2014-08-27 17:07 - 2009-06-21 17:44 - 00153088 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\triedit.dll
2014-08-27 17:07 - 2009-04-10 03:01 - 00413544 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wmspdmod.dll
2014-08-27 17:06 - 2014-08-27 17:56 - 00024306 _____ () C:\WINDOWS\KB959426.log
2014-08-27 17:06 - 2014-08-27 17:53 - 00023346 _____ () C:\WINDOWS\KB960803.log
2014-08-27 17:06 - 2014-08-27 17:50 - 00023014 _____ () C:\WINDOWS\KB952004.log
2014-08-27 17:06 - 2014-08-27 17:38 - 00015188 _____ () C:\WINDOWS\KB950974.log
2014-08-27 17:06 - 2014-08-27 17:36 - 00014670 _____ () C:\WINDOWS\KB952954.log
2014-08-27 17:06 - 2010-08-25 09:23 - 05541888 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wmp.dll
2014-08-27 17:06 - 2010-07-12 08:55 - 00218112 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wordpad.exe
2014-08-27 17:06 - 2009-07-27 18:27 - 00128512 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\dhtmled.ocx
2014-08-27 17:06 - 2009-07-13 12:08 - 00286720 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wmpdxm.dll
2014-08-27 17:06 - 2009-06-25 04:25 - 00730112 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\lsasrv.dll
2014-08-27 17:06 - 2009-03-27 02:58 - 01203922 ____N () C:\WINDOWS\system32\dllcache\sysmain.sdb
2014-08-27 17:06 - 2009-03-06 10:22 - 00284160 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\pdh.dll
2014-08-27 17:06 - 2009-02-09 08:10 - 00714752 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ntdll.dll
2014-08-27 17:06 - 2009-02-09 08:10 - 00617472 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\advapi32.dll
2014-08-27 17:06 - 2009-02-09 08:10 - 00473600 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\fastprox.dll
2014-08-27 17:06 - 2009-02-09 08:10 - 00453120 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wmiprvsd.dll
2014-08-27 17:06 - 2009-02-09 08:10 - 00401408 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\rpcss.dll
2014-08-27 17:06 - 2009-02-09 08:10 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SET15E.tmp
2014-08-27 17:06 - 2009-02-06 07:11 - 00110592 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\services.exe
2014-08-27 17:06 - 2009-02-06 07:08 - 02189056 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2014-08-27 17:06 - 2009-02-06 07:06 - 02145280 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2014-08-27 17:06 - 2009-02-06 06:39 - 00035328 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\sc.exe
2014-08-27 17:06 - 2009-02-06 06:32 - 02023936 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2014-08-27 17:06 - 2009-02-06 06:10 - 00227840 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wmiprvse.exe
2014-08-27 17:06 - 2008-05-03 07:55 - 00002560 ____N (Microsoft Corporation) C:\WINDOWS\system32\xpsp4res.dll
2014-08-27 17:06 - 2008-05-01 10:33 - 00331776 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\msadce.dll
2014-08-27 17:05 - 2014-08-27 17:30 - 00015013 _____ () C:\WINDOWS\KB951978.log
2014-08-27 17:05 - 2008-06-13 07:05 - 00272128 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\bthport.sys
2014-08-27 17:05 - 2008-05-08 10:02 - 00203136 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\rmcast.sys
2014-08-27 17:05 - 2007-10-27 19:39 - 00228864 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wmasf.dll
2014-08-27 16:58 - 2014-08-27 16:58 - 00000000 ____D () C:\WINDOWS\system32\PreInstall
2014-08-27 16:55 - 2014-08-27 16:58 - 00007704 _____ () C:\WINDOWS\KB898461.log
2014-08-27 16:49 - 2014-08-27 16:55 - 00000000 ____D () C:\WINDOWS\LastGood
2014-08-27 16:49 - 2012-06-02 15:19 - 00045080 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2014-08-27 16:49 - 2012-06-02 15:19 - 00022040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltui.dll.mui
2014-08-27 16:49 - 2012-06-02 15:19 - 00017944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll.mui
2014-08-27 16:49 - 2012-06-02 15:19 - 00015384 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaucpl.cpl.mui
2014-08-27 16:48 - 2014-08-27 16:48 - 00000000 ___SD () C:\Documents and Settings\heidinew\UserData
2014-08-27 16:39 - 2014-08-27 16:39 - 00000226 _____ () C:\WINDOWS\DtcInstall.log
2014-08-27 16:39 - 2014-08-27 16:39 - 00000187 _____ () C:\WINDOWS\spupdsvc.log.1.log
2014-08-27 16:39 - 2014-08-27 16:39 - 00000090 _____ () C:\WINDOWS\system32\spupdwxp.log
2014-08-27 00:00 - 2014-08-27 00:00 - 00128140 _____ () C:\WINDOWS\system32\TZLog.log
2014-08-27 00:00 - 2014-08-27 00:00 - 00109604 _____ () C:\WINDOWS\KB955839.log
2014-08-27 00:00 - 2014-08-27 00:00 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2014-08-26 23:52 - 2014-08-27 19:35 - 00031389 _____ () C:\WINDOWS\spupdsvc.log
2014-08-26 23:52 - 2014-08-26 23:52 - 00000259 _____ () C:\WINDOWS\sessmgr.setup.log
2014-08-26 23:52 - 2014-08-26 23:52 - 00000200 _____ () C:\WINDOWS\cmsetacl.log
2014-08-26 23:51 - 2008-04-14 05:42 - 04274816 ____N (NVIDIA Corporation) C:\WINDOWS\system32\nv4_disp.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 01737856 ____N (Matrox Graphics Inc.) C:\WINDOWS\system32\mtxparhd.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 01306624 ____N (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 01306624 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\msxml6.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00712704 ____N (Microsoft Corporation) C:\WINDOWS\system32\windowscodecs.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00412160 ____N (Microsoft Corporation) C:\WINDOWS\system32\photometadatahandler.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00397056 ____N (S3 Graphics, Inc.) C:\WINDOWS\system32\s3gnb.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00346112 ____N (Microsoft Corporation) C:\WINDOWS\system32\windowscodecsext.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00291328 ____N (Microsoft Corporation) C:\WINDOWS\system32\qagentrt.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00290304 ____N (Microsoft Corporation) C:\WINDOWS\system32\rhttpaa.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00286792 ____N (Smart Link) C:\WINDOWS\system32\slextspk.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00276992 ____N (Microsoft Corporation) C:\WINDOWS\system32\wmphoto.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00193024 ____N (Microsoft Corporation) C:\WINDOWS\system32\napmontr.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00188508 ____N (Smart Link) C:\WINDOWS\system32\slgen.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00176640 ____N (Microsoft Corporation) C:\WINDOWS\system32\napstat.exe
2014-08-26 23:51 - 2008-04-14 05:42 - 00155136 ____N (Microsoft Corporation) C:\WINDOWS\system32\mssha.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00150528 ____N (Microsoft Corporation) C:\WINDOWS\system32\qagent.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00144384 ____N (Microsoft Corporation) C:\WINDOWS\system32\onex.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00121856 ____N (Microsoft Corporation) C:\WINDOWS\system32\xmllite.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00076800 ____N (Microsoft Corporation) C:\WINDOWS\system32\qutil.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00073832 ____N (Smart Link) C:\WINDOWS\system32\slcoinst.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00073796 ____N (Smart Link) C:\WINDOWS\system32\slserv.exe
2014-08-26 23:51 - 2008-04-14 05:42 - 00069120 ____N (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00062464 ____N (Microsoft Corporation) C:\WINDOWS\system32\qcliprov.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00061952 ____N (Microsoft Corporation) C:\WINDOWS\system32\rasqec.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00060416 ____N (Microsoft Corporation) C:\WINDOWS\system32\tzchange.exe
2014-08-26 23:51 - 2008-04-14 05:42 - 00053248 ____N (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00050688 ____N (Microsoft Corporation) C:\WINDOWS\system32\tspkg.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00033792 ____N (Microsoft Corporation) C:\WINDOWS\system32\mmcperf.exe
2014-08-26 23:51 - 2008-04-14 05:42 - 00032866 ____N (Smart Link) C:\WINDOWS\system32\slrundll.exe
2014-08-26 23:51 - 2008-04-14 05:42 - 00032768 ____N (Microsoft Corporation) C:\WINDOWS\system32\setupn.exe
2014-08-26 23:51 - 2008-04-14 05:42 - 00030208 ____N (Microsoft Corporation) C:\WINDOWS\system32\napipsec.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00028672 ____N (Microsoft Corporation) C:\WINDOWS\system32\vidcap.ax
2014-08-26 23:51 - 2008-04-14 05:42 - 00028672 ____N (Microsoft Corporation) C:\WINDOWS\system32\verclsid.exe
2014-08-26 23:51 - 2008-04-14 05:42 - 00023040 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\ativmvxx.ax
2014-08-26 23:51 - 2008-04-14 05:42 - 00010752 ____N (Microsoft Corporation) C:\WINDOWS\system32\smtpapi.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00009728 ____N (Microsoft Corporation) C:\WINDOWS\system32\rwnh.dll
2014-08-26 23:51 - 2008-04-14 05:42 - 00009728 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\ativdaxx.ax
2014-08-26 23:51 - 2008-04-14 05:41 - 01888992 ____N (ATI Technologies Inc. ) C:\WINDOWS\system32\ati3duag.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00870784 ____N (ATI Technologies Inc. ) C:\WINDOWS\system32\ati3d1ag.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00650752 ____N (Microsoft Corporation) C:\WINDOWS\system32\dot3ui.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00516768 ____N (ATI Technologies Inc. ) C:\WINDOWS\system32\ativvaxx.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00397312 ____N (Microsoft Corporation) C:\WINDOWS\system32\mmcex.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00377984 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\ati2dvaa.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00233472 ____N (Microsoft Corporation) C:\WINDOWS\system32\azroles.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00229376 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\ati2cqag.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00201728 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\ati2dvag.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00184832 ____N (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00184320 ____N (Microsoft Corporation) C:\WINDOWS\system32\microsoft.managementconsole.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00180224 ____N (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00136192 ____N (Microsoft Corporation) C:\WINDOWS\system32\aaclient.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00132096 ____N (Microsoft Corporation) C:\WINDOWS\system32\dot3svc.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00126976 ____N (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00106496 ____N (Microsoft Corporation) C:\WINDOWS\system32\mmcfxcommon.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00094208 ____N (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00061440 ____N (Microsoft Corporation) C:\WINDOWS\system32\kmsvc.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00059392 ____N (Microsoft Corporation) C:\WINDOWS\system32\eapqec.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00057856 ____N (Microsoft Corporation) C:\WINDOWS\system32\dot3cfg.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00056320 ____N (Microsoft Corporation) C:\WINDOWS\system32\dot3msm.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00048640 ____N (Microsoft Corporation) C:\WINDOWS\system32\dhcpqec.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00040960 ____N (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00039936 ____N (Microsoft Corporation) C:\WINDOWS\system32\dot3gpclnt.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00039936 ____N (Microsoft Corporation) C:\WINDOWS\system32\dimsroam.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00037376 ____N (Microsoft Corporation) C:\WINDOWS\system32\l2gpstore.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00033792 ____N (Microsoft Corporation) C:\WINDOWS\system32\eapsvc.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00032768 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\ativtmxx.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00032285 ____N (Conexant Systems, Inc.) C:\WINDOWS\system32\hsfcisp2.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00030720 ____N (Microsoft Corporation) C:\WINDOWS\system32\eapolqec.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00026112 ____N (Microsoft Corporation) C:\WINDOWS\system32\dot3api.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00019456 ____N (Microsoft Corporation) C:\WINDOWS\system32\dimsntfy.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00012800 ____N (Microsoft Corporation) C:\WINDOWS\system32\credssp.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00009216 ____N (Microsoft Corporation) C:\WINDOWS\system32\dot3dlg.dll
2014-08-26 23:51 - 2008-04-14 05:41 - 00007168 ____N (Microsoft Corporation) C:\WINDOWS\system32\bitsprx4.dll
2014-08-26 23:51 - 2008-04-14 05:39 - 00006144 ____N (Microsoft Corporation) C:\WINDOWS\system32\kbdpash.dll
2014-08-26 23:51 - 2008-04-14 05:39 - 00006144 ____N (Microsoft Corporation) C:\WINDOWS\system32\kbdnepr.dll
2014-08-26 23:51 - 2008-04-14 05:39 - 00006144 ____N (Microsoft Corporation) C:\WINDOWS\system32\kbdiultn.dll
2014-08-26 23:51 - 2008-04-14 05:39 - 00006144 ____N (Microsoft Corporation) C:\WINDOWS\system32\kbdbhc.dll
2014-08-26 23:51 - 2008-04-14 00:13 - 00009728 ____N (Microsoft Corporation) C:\WINDOWS\system32\comsdupd.exe
2014-08-26 23:51 - 2008-04-13 23:45 - 00076800 ____N (Microsoft Corporation) C:\WINDOWS\system32\msshavmsg.dll
2014-08-26 23:51 - 2008-04-13 22:57 - 00079872 ____N (Microsoft Corporation) C:\WINDOWS\system32\msxml6r.dll
2014-08-26 23:51 - 2008-04-13 22:57 - 00079872 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\msxml6r.dll
2014-08-26 23:50 - 2014-08-26 23:50 - 00000000 ____D () C:\WINDOWS\system32\scripting
2014-08-26 23:50 - 2014-08-26 23:50 - 00000000 ____D () C:\WINDOWS\system32\bits
2014-08-26 23:47 - 2014-08-27 19:38 - 00111682 _____ () C:\WINDOWS\updspapi.log
2014-08-26 23:47 - 2008-06-13 07:05 - 00272128 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2014-08-26 23:47 - 2008-04-14 05:42 - 00011325 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\vchnt5.dll
2014-08-26 23:47 - 2008-04-14 05:42 - 00003901 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\siint5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00025471 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\atv04nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00021183 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\atv01nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00017279 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\atv10nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00015423 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\ch7xxnt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00014143 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\atv06nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00011359 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\atv02nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00004255 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\adv01nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00003967 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\adv02nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00003775 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\adv11nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00003711 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\adv09nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00003647 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\adv07nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00003615 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\adv05nt5.dll
2014-08-26 23:47 - 2008-04-14 05:41 - 00003135 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\adv08nt5.dll
2014-08-26 23:47 - 2008-04-14 00:26 - 00030592 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rndismpx.sys
2014-08-26 23:47 - 2008-04-14 00:26 - 00012800 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usb8023x.sys
2014-08-26 23:47 - 2008-04-14 00:21 - 00101120 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthpan.sys
2014-08-26 23:47 - 2008-04-14 00:16 - 00121984 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbvideo.sys
2014-08-26 23:47 - 2008-04-14 00:16 - 00059136 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rfcomm.sys
2014-08-26 23:47 - 2008-04-14 00:16 - 00037888 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthmodem.sys
2014-08-26 23:47 - 2008-04-14 00:16 - 00036480 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthprint.sys
2014-08-26 23:47 - 2008-04-14 00:16 - 00025600 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys
2014-08-26 23:47 - 2008-04-14 00:16 - 00018944 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthusb.sys
2014-08-26 23:47 - 2008-04-14 00:16 - 00017024 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys
2014-08-26 23:47 - 2008-04-14 00:13 - 00014208 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wacompen.sys
2014-08-26 23:47 - 2008-04-14 00:13 - 00012672 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mutohpen.sys
2014-08-26 23:47 - 2008-04-14 00:10 - 00010240 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sffp_mmc.sys
2014-08-26 23:47 - 2008-04-14 00:06 - 00046464 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\gagp30kx.sys
2014-08-26 23:47 - 2008-04-14 00:06 - 00044672 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\uagp35.sys
2014-08-26 23:47 - 2008-04-14 00:06 - 00005888 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\smbali.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 01309184 ____N (Smart Link) C:\WINDOWS\system32\Drivers\mtlstrm.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 01041536 ____N (Conexant Systems, Inc.) C:\WINDOWS\system32\Drivers\hsfdpsp2.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 00685056 ____N (Conexant Systems, Inc.) C:\WINDOWS\system32\Drivers\hsfcxts2.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 00404990 ____N (Smart Link) C:\WINDOWS\system32\Drivers\slntamr.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 00220032 ____N (Conexant Systems, Inc.) C:\WINDOWS\system32\Drivers\hsfbs2s2.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 00180360 ____N (Smart Link) C:\WINDOWS\system32\Drivers\ntmtlfax.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 00129535 ____N (Smart Link) C:\WINDOWS\system32\Drivers\slnt7554.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 00126686 ____N (Smart Link) C:\WINDOWS\system32\Drivers\mtlmnt5.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 00095424 ____N (Smart Link) C:\WINDOWS\system32\Drivers\slnthal.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 00013776 ____N (Smart Link) C:\WINDOWS\system32\Drivers\recagent.sys
2014-08-26 23:47 - 2008-04-13 23:53 - 00013240 ____N (Smart Link) C:\WINDOWS\system32\Drivers\slwdmsup.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 01897408 ____N (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nv4_mini.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00701440 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati2mtag.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00452736 ____N (Matrox Graphics Inc.) C:\WINDOWS\system32\Drivers\mtxparhm.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00327040 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati2mtaa.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00166912 ____N (S3 Graphics, Inc.) C:\WINDOWS\system32\Drivers\s3gnbm.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00104960 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atinrvxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00073216 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atintuxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00063663 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1rvxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00063488 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atinxsxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00057856 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atinbtxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00056623 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1btxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00052224 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atinraxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00036463 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1tuxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00034735 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1xsxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00031744 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atinxbxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00030671 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1raxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00029455 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1xbxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00028672 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atinsnxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00026367 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1snxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00025471 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\watv10nt.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00022271 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\watv06nt.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00021343 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1ttxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00014336 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atinpdxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00013824 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atinttxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00013824 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\atinmdxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00012047 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1pdxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00011935 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\wadv11nt.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00011871 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\wadv09nt.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00011807 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\wadv07nt.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00011615 ____N (ATI Technologies Inc.) C:\WINDOWS\system32\Drivers\ati1mdxx.sys
2014-08-26 23:47 - 2008-04-13 22:04 - 00011295 ____N (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\wadv08nt.sys
2014-08-26 23:47 - 2007-04-02 21:36 - 00129045 ____N () C:\WINDOWS\system32\Drivers\cxthsfs2.cty
2014-08-26 23:47 - 2006-12-29 20:21 - 00064352 ____N () C:\WINDOWS\system32\Drivers\ativmc20.cod
2014-08-26 23:47 - 2006-12-29 20:02 - 00067866 ____N () C:\WINDOWS\system32\Drivers\netwlan5.img
2014-08-26 23:46 - 2006-12-29 00:31 - 00019569 _____ () C:\WINDOWS\005726_.tmp
2014-08-26 23:38 - 2014-08-26 23:59 - 00308612 _____ () C:\WINDOWS\svcpack.log
2014-08-26 23:37 - 2014-08-26 23:37 - 00000000 ____D () C:\85b6128e54d165c12e988fc04d50
2014-08-26 23:15 - 2014-08-26 23:15 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\Adobe
2014-08-26 23:15 - 2014-08-26 23:15 - 00000000 ____D () C:\Documents and Settings\heidinew\Application Data\AdobeUM
2014-08-26 23:14 - 2014-08-26 23:14 - 00000000 ____D () C:\Documents and Settings\heidinew\My Documents\My eBooks
2014-08-26 21:47 - 2014-08-26 21:47 - 00004608 _____ () C:\Documents and Settings\heidinew\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-26 19:12 - 2014-08-26 19:12 - 00012408 _____ () C:\Documents and Settings\heidinew\Desktop\dds.txt
2014-08-26 19:12 - 2014-08-26 19:12 - 00006647 _____ () C:\Documents and Settings\heidinew\Desktop\attach.txt
2014-08-26 19:05 - 2014-08-26 23:14 - 00000000 ____D () C:\Documents and Settings\heidinew\Application Data\Adobe
2014-08-26 19:05 - 2014-08-26 19:05 - 00000000 ____D () C:\Documents and Settings\heidinew\Application Data\Macromedia
2014-08-26 18:59 - 2014-08-26 19:00 - 00000000 ____D () C:\Documents and Settings\heidinew\Application Data\Mozilla
2014-08-26 18:59 - 2014-08-26 18:59 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\Mozilla
2014-08-26 18:34 - 2014-08-27 19:53 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Temp
2014-08-26 18:34 - 2014-08-27 16:48 - 00000000 ____D () C:\Documents and Settings\heidinew
2014-08-26 18:34 - 2014-08-27 16:37 - 00000767 _____ () C:\Documents and Settings\heidinew\Start Menu\Programs\Internet Explorer.lnk
2014-08-26 18:34 - 2014-08-27 16:37 - 00000738 _____ () C:\Documents and Settings\heidinew\Start Menu\Programs\Outlook Express.lnk
2014-08-26 18:34 - 2014-08-26 18:54 - 00000178 ___SH () C:\Documents and Settings\heidinew\ntuser.ini
2014-08-26 18:34 - 2014-08-26 18:34 - 00000792 _____ () C:\Documents and Settings\heidinew\Start Menu\Programs\Windows Media Player.lnk
2014-08-26 18:34 - 2014-08-26 18:34 - 00000786 _____ () C:\Documents and Settings\heidinew\Desktop\Windows Media Player.lnk
2014-08-26 18:34 - 2014-08-26 18:34 - 00000131 _____ () C:\Documents and Settings\heidinew\Local Settings\Application Data\fusioncache.dat
2014-08-26 18:34 - 2014-08-03 19:40 - 00000000 ___RD () C:\Documents and Settings\heidinew\Start Menu\Programs\Accessories
2014-08-26 18:34 - 2014-08-03 19:40 - 00000000 ____D () C:\Documents and Settings\heidinew\Start Menu\Programs\Online Services
2014-08-26 18:34 - 2014-08-03 19:40 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
2014-08-26 18:34 - 2006-05-11 09:06 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\BVRP Software
2014-08-26 18:34 - 2006-05-11 09:04 - 00000000 _____ () C:\Documents and Settings\heidinew\Local Settings\Application Data\QSwitch.txt
2014-08-26 18:34 - 2006-05-11 09:04 - 00000000 _____ () C:\Documents and Settings\heidinew\Local Settings\Application Data\DSwitch.txt
2014-08-26 18:34 - 2006-05-11 09:04 - 00000000 _____ () C:\Documents and Settings\heidinew\Local Settings\Application Data\AtStart.txt
2014-08-26 18:34 - 2006-05-11 09:03 - 00051192 _____ () C:\Documents and Settings\heidinew\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2014-08-26 18:34 - 2006-05-11 08:38 - 00000000 ____D () C:\Documents and Settings\heidinew\Application Data\Intuit
2014-08-26 18:34 - 2006-05-11 08:35 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\Google
2014-08-26 18:34 - 2006-05-11 08:07 - 00000992 _____ () C:\Documents and Settings\heidinew\Desktop\Help and Support.lnk
2014-08-26 18:34 - 2006-05-11 07:54 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\IsolatedStorage
2014-08-26 18:34 - 2006-05-11 07:54 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\HP
2014-08-26 18:34 - 2006-03-28 08:44 - 00001503 _____ () C:\Documents and Settings\heidinew\Start Menu\Programs\Remote Assistance.lnk
2014-08-15 16:04 - 2014-08-15 16:04 - 00699568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2014-08-15 16:04 - 2014-08-15 16:04 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2014-08-12 22:53 - 2014-08-12 22:53 - 00000000 ____D () C:\Documents and Settings\Administrator\My Documents\My eBooks
2014-08-12 22:53 - 2014-08-12 22:53 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Adobe
2014-08-12 22:51 - 2014-08-12 22:51 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla
2014-08-12 22:51 - 2014-08-12 22:51 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Mozilla
2014-08-12 22:11 - 2014-08-27 19:35 - 00001473 _____ () C:\WINDOWS\wmsetup.log
2014-08-12 22:11 - 2014-08-12 22:11 - 00000786 _____ () C:\Documents and Settings\Administrator\Desktop\Windows Media Player.lnk
2014-08-11 15:00 - 2014-08-11 15:00 - 00090112 _____ () C:\WINDOWS\Minidump\Mini081114-01.dmp
2014-08-11 14:59 - 2014-08-11 14:59 - 00021361 _____ (Cisco Systems, Inc.) C:\WINDOWS\system32\Drivers\AegisP.sys
2014-08-11 14:58 - 2014-08-27 16:34 - 00000000 ____D () C:\WINDOWS\system32\RtlGina
2014-08-11 14:58 - 2014-08-11 14:59 - 00376832 _____ () C:\WINDOWS\system32\AegisI5Installer.exe
2014-08-11 14:58 - 2014-08-11 14:59 - 00000000 ____D () C:\Program Files\AWUS036H Wireless LAN Utility
2014-08-11 14:58 - 2010-12-01 09:31 - 00451072 _____ () C:\WINDOWS\system32\ISSRemoveSP.exe
2014-08-11 14:58 - 2009-06-26 03:21 - 00323328 _____ (Realtek Semiconductor Corporation ) C:\WINDOWS\system32\Drivers\RTL8187.sys
2014-08-11 14:58 - 2009-04-01 22:27 - 00188416 _____ (Realtek Semiconductor Corp. ) C:\WINDOWS\system32\RTLExtUI.dll
2014-08-11 14:58 - 2009-03-31 02:31 - 00380928 _____ (Realtek) C:\WINDOWS\system32\RtlUI2.exe
2014-08-11 14:58 - 2008-07-01 00:31 - 00614400 _____ (Realtek Semiconductor Corp. ) C:\WINDOWS\system32\Rtlihvs.dll
2014-08-11 14:28 - 2005-07-12 14:44 - 00015872 _____ () C:\WINDOWS\system32\InsDrvZD64.DLL
2014-08-11 14:28 - 2005-06-08 18:44 - 00029184 _____ (Printing Communications Assoc., Inc. (PCAUSA)) C:\WINDOWS\system32\Drivers\BRGSp50a64.sys
2014-08-11 14:28 - 2005-06-08 18:44 - 00020608 _____ (Printing Communications Assoc., Inc. (PCAUSA)) C:\WINDOWS\system32\Drivers\BRGSp50.sys
2014-08-11 14:28 - 2005-03-18 15:35 - 00031744 _____ (Printing Communications Assoc., Inc. (PCAUSA)) C:\WINDOWS\system32\Drivers\ZDPSp50a64.sys
2014-08-11 14:28 - 2004-10-25 13:40 - 00017664 _____ (Printing Communications Assoc., Inc. (PCAUSA)) C:\WINDOWS\system32\Drivers\ZDPSp50.sys
2014-08-11 14:28 - 2004-03-23 16:38 - 00028672 _____ () C:\WINDOWS\system32\InsDrvZD.dll
2014-08-11 14:28 - 2004-01-14 11:30 - 00017151 _____ (Printing Communications Assoc., Inc. (PCAUSA)) C:\WINDOWS\system32\ZDPNDIS5.SYS
2014-08-11 14:28 - 2004-01-14 11:25 - 00081920 _____ (Printing Communications Assoc., Inc. (PCAUSA)) C:\WINDOWS\system32\ZDPN50.DLL
2014-08-11 14:28 - 2003-03-14 12:24 - 00024576 _____ () C:\WINDOWS\system32\ZyDelReg.exe
2014-08-11 12:24 - 2014-08-27 19:53 - 00000000 ____D () C:\FRST
2014-08-10 14:22 - 2014-08-10 15:09 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2014-08-07 22:52 - 2014-08-21 08:56 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\temp
2014-08-07 22:52 - 2014-08-07 22:52 - 00000000 ____D () C:\Documents and Settings\NetworkService\Local Settings\temp
2014-08-07 22:52 - 2014-08-07 22:52 - 00000000 ____D () C:\Documents and Settings\LocalService\Local Settings\temp
2014-08-07 22:51 - 2014-08-07 22:51 - 00073659 _____ () C:\ComboFix.txt
2014-08-07 16:53 - 2014-08-14 19:33 - 00051990 _____ () C:\WINDOWS\system32\Drivers\fvstore.dat
2014-08-07 16:53 - 2014-08-07 16:53 - 00000000 ___HD () C:\VTRoot
2014-08-06 21:33 - 2014-08-27 19:47 - 00408187 _____ () C:\WINDOWS\iis6.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00383365 _____ () C:\WINDOWS\FaxSetup.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00183141 _____ () C:\WINDOWS\ocgen.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00173947 _____ () C:\WINDOWS\tsoc.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00126479 _____ () C:\WINDOWS\comsetup.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00100814 _____ () C:\WINDOWS\msmqinst.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00076259 _____ () C:\WINDOWS\ntdtcsetup.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00066820 _____ () C:\WINDOWS\netfxocm.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00044868 _____ () C:\WINDOWS\MedCtrOC.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00042666 _____ () C:\WINDOWS\plusoc.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00020934 _____ () C:\WINDOWS\ocmsn.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00020903 _____ () C:\WINDOWS\ehOCGen.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00019002 _____ () C:\WINDOWS\msgsocm.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00018932 _____ () C:\WINDOWS\tabletoc.log
2014-08-06 21:33 - 2014-08-27 19:47 - 00001374 _____ () C:\WINDOWS\imsins.log
2014-08-06 21:33 - 2014-08-27 19:44 - 00001374 _____ () C:\WINDOWS\imsins.BAK
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB932823-v3$
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 _____ () C:\WINDOWS\setuperr.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 _____ () C:\WINDOWS\setupact.log
2014-08-06 21:32 - 2014-08-06 22:16 - 00010578 _____ () C:\WINDOWS\KB932823-v3.log
2014-08-05 15:18 - 2014-08-27 19:52 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
2014-08-05 15:18 - 2014-08-27 19:52 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
2014-08-05 15:18 - 2014-08-27 19:52 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
2014-08-05 15:18 - 2014-08-27 19:52 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
2014-08-05 15:18 - 2014-08-27 16:15 - 01300016 _____ () C:\WINDOWS\system32\Drivers\sfi.dat
2014-08-05 15:16 - 2014-08-26 18:54 - 00065536 _____ () C:\WINDOWS\system32\config\COMODO I.evt
2014-08-05 15:16 - 2014-08-05 15:16 - 00000000 ___SD () C:\Documents and Settings\All Users\Application Data\Shared Space
2014-08-05 15:16 - 2014-08-05 15:16 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\COMODO
2014-08-05 15:15 - 2014-08-05 15:15 - 00000000 ____D () C:\Program Files\COMODO
2014-08-05 15:14 - 2014-08-05 15:14 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Comodo Downloader
2014-08-05 15:11 - 2014-08-05 15:18 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Comodo
2014-08-05 14:44 - 2014-08-05 14:44 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVAST Software
2014-08-05 14:13 - 2014-06-26 17:38 - 93585272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-08-05 14:10 - 2014-08-05 14:10 - 00000000 ____D () C:\Program Files\MSECache
2014-08-05 13:43 - 2014-08-05 13:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-05 13:15 - 2014-08-27 19:13 - 00147110 _____ () C:\WINDOWS\setupapi.log
2014-08-05 12:12 - 2014-08-10 14:22 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-05 12:12 - 2014-08-10 14:17 - 00054232 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-05 12:12 - 2014-08-05 12:12 - 00000617 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Malwarebytes Anti-Malware
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes
2014-08-05 12:12 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-08-04 13:21 - 2014-08-27 16:35 - 00275760 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-08-04 13:15 - 2014-08-04 13:15 - 00000682 _____ () C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
2014-08-04 12:52 - 2014-08-26 23:13 - 00000000 ____D () C:\WINDOWS\system32\appmgmt
2014-08-04 11:23 - 2014-08-03 20:35 - 00000209 _____ () C:\Boot.bak
2014-08-04 11:22 - 2014-08-04 11:23 - 00000000 _RSHD () C:\cmdcons
2014-08-04 11:22 - 2004-08-03 23:00 - 00260272 __RSH () C:\cmldr
2014-08-04 11:20 - 2011-06-26 02:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-08-04 11:20 - 2010-11-07 13:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-08-04 11:20 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-08-04 11:20 - 2000-08-30 20:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-08-04 11:15 - 2014-08-04 11:16 - 00000075 _____ () C:\WINDOWS\system32\LuResult.txt
2014-08-04 11:00 - 2014-08-07 22:52 - 00000000 ____D () C:\Qoobox
2014-08-04 10:59 - 2014-08-04 11:32 - 00000000 ____D () C:\WINDOWS\erdnt
2014-08-03 20:38 - 2014-08-03 20:38 - 00001797 __RSH () C:\WINDOWS\system32\Drivers\103C_HP_NTBK_HP Pavilion dv5000 (EZ415UA#ABA)_YN_0Pavi_QCND6272969_E413908001_46_I30A8_SHP_V56.38_BF.15_T060613_WXP2_L409_M1015_J120_7Intel_8T2050_91.6_#140803_N80861092_(EZ415UA#ABA)_XMOBILE_CN10_Z_2F.15_G808627A2.MRK
2014-08-03 20:31 - 2004-08-10 03:00 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Thawbrkr.dll
2014-08-03 20:31 - 2004-08-10 03:00 - 00066594 _____ () C:\WINDOWS\system32\c_864.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066594 _____ () C:\WINDOWS\system32\c_862.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066594 _____ () C:\WINDOWS\system32\c_720.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\c_708.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\C_28596.NLS
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\c_10021.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\c_10005.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00066082 _____ () C:\WINDOWS\system32\c_10004.nls
2014-08-03 20:31 - 2004-08-10 03:00 - 00010752 _____ (Microsoft Corporation) C:\WINDOWS\system32\c_iscii.dll
2014-08-03 20:31 - 2004-08-10 03:00 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\ftlx041e.dll
2014-08-03 20:31 - 2004-08-10 03:00 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\system32\kbdusa.dll
2014-08-03 19:01 - 2008-04-14 00:15 - 00026368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbstor.sys



First part end!!!!!


----------



## heidi87

Here is the second part.
Attached also the full file.

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-27 19:53 - 2014-08-26 18:34 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Temp
2014-08-27 19:53 - 2014-08-11 12:24 - 00000000 ____D () C:\FRST
2014-08-27 19:52 - 2014-08-05 15:18 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
2014-08-27 19:52 - 2014-08-05 15:18 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
2014-08-27 19:52 - 2014-08-05 15:18 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
2014-08-27 19:52 - 2014-08-05 15:18 - 00000440 _____ () C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
2014-08-27 19:50 - 2014-08-27 17:11 - 00018151 _____ () C:\WINDOWS\KB2419632.log
2014-08-27 19:50 - 2006-03-28 09:51 - 01218022 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-27 19:47 - 2014-08-27 17:11 - 00032014 _____ () C:\WINDOWS\KB2443105.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00408187 _____ () C:\WINDOWS\iis6.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00383365 _____ () C:\WINDOWS\FaxSetup.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00183141 _____ () C:\WINDOWS\ocgen.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00173947 _____ () C:\WINDOWS\tsoc.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00126479 _____ () C:\WINDOWS\comsetup.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00100814 _____ () C:\WINDOWS\msmqinst.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00076259 _____ () C:\WINDOWS\ntdtcsetup.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00066820 _____ () C:\WINDOWS\netfxocm.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00044868 _____ () C:\WINDOWS\MedCtrOC.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00042666 _____ () C:\WINDOWS\plusoc.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00020934 _____ () C:\WINDOWS\ocmsn.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00020903 _____ () C:\WINDOWS\ehOCGen.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00019002 _____ () C:\WINDOWS\msgsocm.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00018932 _____ () C:\WINDOWS\tabletoc.log
2014-08-27 19:47 - 2014-08-06 21:33 - 00001374 _____ () C:\WINDOWS\imsins.log
2014-08-27 19:47 - 2011-10-30 20:01 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2443105$
2014-08-27 19:44 - 2014-08-27 19:41 - 00026665 _____ () C:\WINDOWS\KB2423089.log
2014-08-27 19:44 - 2014-08-06 21:33 - 00001374 _____ () C:\WINDOWS\imsins.BAK
2014-08-27 19:44 - 2011-10-30 19:51 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2423089$
2014-08-27 19:44 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Outlook Express
2014-08-27 19:41 - 2014-08-27 17:11 - 00031980 _____ () C:\WINDOWS\KB982132.log
2014-08-27 19:41 - 2010-11-01 21:46 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB982132$
2014-08-27 19:38 - 2014-08-27 19:35 - 00027344 _____ () C:\WINDOWS\KB2387149.log
2014-08-27 19:38 - 2014-08-26 23:47 - 00111682 _____ () C:\WINDOWS\updspapi.log
2014-08-27 19:38 - 2010-11-01 21:47 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2387149$
2014-08-27 19:35 - 2014-08-27 19:35 - 00024518 _____ () C:\WINDOWS\KB2378111.log
2014-08-27 19:35 - 2014-08-27 19:32 - 00024266 _____ () C:\WINDOWS\KB2296011.log
2014-08-27 19:35 - 2014-08-26 23:52 - 00031389 _____ () C:\WINDOWS\spupdsvc.log
2014-08-27 19:35 - 2014-08-12 22:11 - 00001473 _____ () C:\WINDOWS\wmsetup.log
2014-08-27 19:35 - 2011-10-30 20:01 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2378111_WM9$
2014-08-27 19:35 - 2010-11-01 21:46 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2296011$
2014-08-27 19:32 - 2014-08-27 17:10 - 00032196 _____ () C:\WINDOWS\KB979687.log
2014-08-27 19:31 - 2010-11-01 21:45 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB979687$
2014-08-27 19:29 - 2014-08-27 19:29 - 00023487 _____ () C:\WINDOWS\KB975558.log
2014-08-27 19:29 - 2010-11-01 21:46 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB975558_WM8$
2014-08-27 19:28 - 2010-11-01 21:45 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2347290$
2014-08-27 19:25 - 2014-08-27 19:22 - 00024194 _____ () C:\WINDOWS\KB981997.log
2014-08-27 19:24 - 2010-11-01 21:41 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB981997$
2014-08-27 19:24 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Movie Maker
2014-08-27 19:22 - 2014-08-27 17:10 - 00029462 _____ () C:\WINDOWS\KB982665.log
2014-08-27 19:22 - 2010-11-01 21:40 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB982665$
2014-08-27 19:19 - 2014-08-27 17:10 - 00029504 _____ () C:\WINDOWS\KB2115168.log
2014-08-27 19:19 - 2010-11-01 21:46 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2115168$
2014-08-27 19:16 - 2014-08-27 19:13 - 00024231 _____ () C:\WINDOWS\KB2229593.log
2014-08-27 19:16 - 2010-07-26 12:56 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2229593$
2014-08-27 19:13 - 2014-08-27 19:12 - 00025635 _____ () C:\WINDOWS\KB979904.log
2014-08-27 19:13 - 2014-08-05 13:15 - 00147110 _____ () C:\WINDOWS\setupapi.log
2014-08-27 19:13 - 2010-06-21 18:14 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB979904$
2014-08-27 19:12 - 2014-08-27 17:09 - 00029527 _____ () C:\WINDOWS\KB979482.log
2014-08-27 19:12 - 2010-06-21 18:10 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB979482$
2014-08-27 19:09 - 2014-08-27 19:09 - 00022846 _____ () C:\WINDOWS\KB978695.log
2014-08-27 19:09 - 2014-08-27 17:09 - 00029668 _____ () C:\WINDOWS\KB978542.log
2014-08-27 19:09 - 2010-06-21 18:10 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB978695_WM9$
2014-08-27 19:09 - 2010-05-27 10:01 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB978542$
2014-08-27 19:06 - 2014-08-27 17:09 - 00029992 _____ () C:\WINDOWS\KB978338.log
2014-08-27 19:06 - 2010-05-09 14:04 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB978338$
2014-08-27 19:04 - 2014-08-27 17:09 - 00029525 _____ () C:\WINDOWS\KB979309.log
2014-08-27 19:03 - 2010-05-09 14:03 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB979309$
2014-08-27 19:01 - 2014-08-27 17:09 - 00029521 _____ () C:\WINDOWS\KB977816.log
2014-08-27 19:00 - 2010-05-09 14:04 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB977816$
2014-08-27 18:58 - 2014-08-27 17:09 - 00029528 _____ () C:\WINDOWS\KB978706.log
2014-08-27 18:58 - 2010-02-10 22:20 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB978706$
2014-08-27 18:55 - 2014-08-27 17:09 - 00030679 _____ () C:\WINDOWS\KB977914.log
2014-08-27 18:55 - 2010-02-10 22:20 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB977914$
2014-08-27 18:52 - 2010-02-10 22:20 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB975560$
2014-08-27 18:50 - 2014-08-27 17:08 - 00029846 _____ () C:\WINDOWS\KB975713.log
2014-08-27 18:49 - 2010-02-10 22:21 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB975713$
2014-08-27 18:46 - 2010-02-10 22:20 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB972270$
2014-08-27 18:44 - 2014-08-27 18:41 - 00024129 _____ () C:\WINDOWS\KB973904.log
2014-08-27 18:43 - 2010-02-10 22:20 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB973904$
2014-08-27 18:41 - 2014-08-27 17:08 - 00029312 _____ () C:\WINDOWS\KB974392.log
2014-08-27 18:41 - 2010-02-10 22:20 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB974392$
2014-08-27 18:38 - 2014-08-27 17:08 - 00028821 _____ () C:\WINDOWS\KB974318.log
2014-08-27 18:38 - 2010-02-10 22:21 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB974318$
2014-08-27 18:35 - 2014-08-27 18:35 - 00025185 _____ () C:\WINDOWS\KB952069.log
2014-08-27 18:35 - 2014-08-27 17:08 - 00028337 _____ () C:\WINDOWS\KB975467.log
2014-08-27 18:35 - 2009-10-21 13:54 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB975467$
2014-08-27 18:35 - 2009-08-23 11:20 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952069_WM9$
2014-08-27 18:32 - 2014-08-27 17:08 - 00028956 _____ () C:\WINDOWS\KB968389.log
2014-08-27 18:32 - 2009-09-10 14:29 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB968389$
2014-08-27 18:29 - 2014-08-27 17:07 - 00025305 _____ () C:\WINDOWS\KB969059.log
2014-08-27 18:29 - 2009-10-21 13:56 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB969059$
2014-08-27 18:26 - 2014-08-27 17:07 - 00025309 _____ () C:\WINDOWS\KB974112.log
2014-08-27 18:26 - 2009-10-21 13:56 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB974112$
2014-08-27 18:24 - 2014-08-27 17:07 - 00025620 _____ () C:\WINDOWS\KB974571.log
2014-08-27 18:23 - 2009-10-21 13:56 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB974571$
2014-08-27 18:21 - 2014-08-27 17:07 - 00024718 _____ () C:\WINDOWS\KB975025.log
2014-08-27 18:21 - 2009-10-21 13:56 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB975025$
2014-08-27 18:18 - 2014-08-27 18:18 - 00018323 _____ () C:\WINDOWS\KB954155.log
2014-08-27 18:18 - 2014-08-27 18:15 - 00019470 _____ () C:\WINDOWS\KB956844.log
2014-08-27 18:18 - 2009-10-21 13:56 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB954155_WM9$
2014-08-27 18:17 - 2009-09-10 14:44 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB956844$
2014-08-27 18:15 - 2014-08-27 18:14 - 00020889 _____ () C:\WINDOWS\KB973768.log
2014-08-27 18:15 - 2009-09-10 14:44 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB973768$
2014-08-27 18:14 - 2014-08-27 17:07 - 00025075 _____ () C:\WINDOWS\KB971657.log
2014-08-27 18:14 - 2009-09-10 14:29 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB971657$
2014-08-27 18:08 - 2014-08-27 17:07 - 00024547 _____ () C:\WINDOWS\KB973815.log
2014-08-27 18:08 - 2009-09-10 14:30 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB973815$
2014-08-27 18:05 - 2014-08-27 17:07 - 00024536 _____ () C:\WINDOWS\KB960859.log
2014-08-27 18:05 - 2009-09-10 14:28 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB960859$
2014-08-27 18:02 - 2014-08-27 17:07 - 00024736 _____ () C:\WINDOWS\KB973507.log
2014-08-27 18:02 - 2009-09-10 14:30 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB973507$
2014-08-27 17:59 - 2014-08-27 17:57 - 00018614 _____ () C:\WINDOWS\KB973869.log
2014-08-27 17:59 - 2009-09-10 14:30 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB973869$
2014-08-27 17:56 - 2014-08-27 17:06 - 00024306 _____ () C:\WINDOWS\KB959426.log
2014-08-27 17:56 - 2012-11-11 12:06 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB973540_WM9$
2014-08-27 17:56 - 2009-09-10 14:28 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB959426$
2014-08-27 17:53 - 2014-08-27 17:06 - 00023346 _____ () C:\WINDOWS\KB960803.log
2014-08-27 17:53 - 2009-09-10 14:28 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB960803$
2014-08-27 17:51 - 2006-03-28 09:51 - 00032606 _____ () C:\WINDOWS\SchedLgU.Txt
2014-08-27 17:50 - 2014-08-27 17:06 - 00023014 _____ () C:\WINDOWS\KB952004.log
2014-08-27 17:50 - 2009-09-10 14:27 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952004$
2014-08-27 17:48 - 2014-08-27 17:45 - 00016556 _____ () C:\WINDOWS\KB956572.log
2014-08-27 17:47 - 2009-09-10 14:28 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB956572$
2014-08-27 17:44 - 2014-08-27 17:42 - 00011281 _____ () C:\WINDOWS\KB923561.log
2014-08-27 17:44 - 2009-09-10 14:26 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB923561$
2014-08-27 17:42 - 2014-08-27 17:41 - 00006416 _____ () C:\WINDOWS\KB923723.log
2014-08-27 17:42 - 2009-08-23 11:22 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB923723$
2014-08-27 17:41 - 2014-08-27 17:39 - 00009561 _____ () C:\WINDOWS\KB952287.log
2014-08-27 17:41 - 2009-09-10 14:27 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952287$
2014-08-27 17:38 - 2014-08-27 17:06 - 00015188 _____ () C:\WINDOWS\KB950974.log
2014-08-27 17:38 - 2009-09-10 14:27 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB950974$
2014-08-27 17:36 - 2014-08-27 17:06 - 00014670 _____ () C:\WINDOWS\KB952954.log
2014-08-27 17:35 - 2009-09-10 14:27 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952954$
2014-08-27 17:33 - 2014-08-27 17:30 - 00008747 _____ () C:\WINDOWS\KB946648.log
2014-08-27 17:33 - 2009-09-10 14:26 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB946648$
2014-08-27 17:33 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Messenger
2014-08-27 17:30 - 2014-08-27 17:05 - 00015013 _____ () C:\WINDOWS\KB951978.log
2014-08-27 17:30 - 2009-09-13 17:16 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB951978$
2014-08-27 17:27 - 2014-08-27 17:25 - 00008407 _____ () C:\WINDOWS\KB951376-v2.log
2014-08-27 17:27 - 2009-09-10 14:27 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB951376-v2$
2014-08-27 17:24 - 2014-08-27 17:21 - 00008657 _____ () C:\WINDOWS\KB950762.log
2014-08-27 17:24 - 2009-09-10 14:26 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB950762$
2014-08-27 17:21 - 2014-08-27 17:21 - 00011081 _____ () C:\WINDOWS\KB941569.log
2014-08-27 17:21 - 2009-08-23 11:18 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB941569$
2014-08-27 17:20 - 2014-08-27 17:20 - 00006074 _____ () C:\WINDOWS\KB2909212.log
2014-08-27 17:20 - 2014-08-27 17:20 - 00005916 _____ () C:\WINDOWS\KB2930275.log
2014-08-27 17:20 - 2014-08-27 17:20 - 00005846 _____ () C:\WINDOWS\KB2936068.log
2014-08-27 17:20 - 2014-08-27 17:20 - 00005460 _____ () C:\WINDOWS\KB2922229.log
2014-08-27 17:20 - 2014-08-27 17:20 - 00005459 _____ () C:\WINDOWS\KB2929961.log
2014-08-27 17:19 - 2014-08-27 17:19 - 00005463 _____ () C:\WINDOWS\KB2898715.log
2014-08-27 17:19 - 2014-08-27 17:19 - 00005462 _____ () C:\WINDOWS\KB2916036.log
2014-08-27 17:19 - 2014-08-27 17:19 - 00005459 _____ () C:\WINDOWS\KB2892075.log
2014-08-27 17:19 - 2014-08-27 17:19 - 00005458 _____ () C:\WINDOWS\KB2893294.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005462 _____ () C:\WINDOWS\KB2868626.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005460 _____ () C:\WINDOWS\KB2876331.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005460 _____ () C:\WINDOWS\KB2862152.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005459 _____ () C:\WINDOWS\KB2876217.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005459 _____ () C:\WINDOWS\KB2864063.log
2014-08-27 17:18 - 2014-08-27 17:18 - 00005458 _____ () C:\WINDOWS\KB2847311.log
2014-08-27 17:17 - 2014-08-27 17:17 - 00006233 _____ () C:\WINDOWS\KB2813345.log
2014-08-27 17:17 - 2014-08-27 17:17 - 00005789 _____ () C:\WINDOWS\KB2859537.log
2014-08-27 17:17 - 2014-08-27 17:17 - 00005456 _____ () C:\WINDOWS\KB2850869.log
2014-08-27 17:17 - 2014-08-27 17:17 - 00005290 _____ () C:\WINDOWS\KB2820917.log
2014-08-27 17:17 - 2014-08-27 17:16 - 00005217 _____ () C:\WINDOWS\KB2780091.log
2014-08-27 17:17 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$hf_mig$
2014-08-27 17:16 - 2014-08-27 17:16 - 00005125 _____ () C:\WINDOWS\KB2802968.log
2014-08-27 17:16 - 2014-08-27 17:16 - 00005044 _____ () C:\WINDOWS\KB2757638.log
2014-08-27 17:16 - 2014-08-27 17:16 - 00004870 _____ () C:\WINDOWS\KB2727528.log
2014-08-27 17:16 - 2014-08-27 17:16 - 00004809 _____ () C:\WINDOWS\KB2705219-v2.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00004797 _____ () C:\WINDOWS\KB2719985.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00004796 _____ () C:\WINDOWS\KB2691442.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00004789 _____ () C:\WINDOWS\KB2655992.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00004788 _____ () C:\WINDOWS\KB2712808.log
2014-08-27 17:15 - 2014-08-27 17:15 - 00003381 _____ () C:\WINDOWS\KB2749655.log
2014-08-27 17:15 - 2014-08-27 17:14 - 00006285 _____ () C:\WINDOWS\KB2676562.log
2014-08-27 17:14 - 2014-08-27 17:14 - 00004792 _____ () C:\WINDOWS\KB2585542.log
2014-08-27 17:14 - 2014-08-27 17:14 - 00004790 _____ () C:\WINDOWS\KB2653956.log
2014-08-27 17:14 - 2014-08-27 17:14 - 00004784 _____ () C:\WINDOWS\KB2598479.log
2014-08-27 17:14 - 2014-08-27 17:13 - 00004792 _____ () C:\WINDOWS\KB2631813.log
2014-08-27 17:13 - 2014-08-27 17:13 - 00004809 _____ () C:\WINDOWS\KB2544893-v2.log
2014-08-27 17:13 - 2014-08-27 17:13 - 00004792 _____ () C:\WINDOWS\KB2507938.log
2014-08-27 17:13 - 2014-08-27 17:13 - 00004785 _____ () C:\WINDOWS\KB2584146.log
2014-08-27 17:13 - 2014-08-27 17:13 - 00004784 _____ () C:\WINDOWS\KB2620712.log
2014-08-27 17:13 - 2014-08-27 17:12 - 00004795 _____ () C:\WINDOWS\KB2509553.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00006016 _____ () C:\WINDOWS\KB2510581.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00005640 _____ () C:\WINDOWS\KB2481109.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00004792 _____ () C:\WINDOWS\KB2506212.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00004791 _____ () C:\WINDOWS\KB2508429.log
2014-08-27 17:12 - 2014-08-27 17:12 - 00004790 _____ () C:\WINDOWS\KB971029.log
2014-08-27 17:11 - 2014-08-27 17:11 - 00004797 _____ () C:\WINDOWS\KB2483185.log
2014-08-27 17:11 - 2014-08-27 17:11 - 00004787 _____ () C:\WINDOWS\KB2478971.log
2014-08-27 16:59 - 2006-03-28 09:51 - 00001158 _____ () C:\WINDOWS\system32\wpa.dbl
2014-08-27 16:58 - 2014-08-27 16:58 - 00000000 ____D () C:\WINDOWS\system32\PreInstall
2014-08-27 16:58 - 2014-08-27 16:55 - 00007704 _____ () C:\WINDOWS\KB898461.log
2014-08-27 16:58 - 2009-08-17 08:50 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB898461$
2014-08-27 16:55 - 2014-08-27 16:49 - 00000000 ____D () C:\WINDOWS\LastGood
2014-08-27 16:49 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\Help
2014-08-27 16:48 - 2014-08-27 16:48 - 00000000 ___SD () C:\Documents and Settings\heidinew\UserData
2014-08-27 16:48 - 2014-08-26 18:34 - 00000000 ____D () C:\Documents and Settings\heidinew
2014-08-27 16:46 - 2006-05-11 07:54 - 00070016 _____ () C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2014-08-27 16:39 - 2014-08-27 16:39 - 00000226 _____ () C:\WINDOWS\DtcInstall.log
2014-08-27 16:39 - 2014-08-27 16:39 - 00000187 _____ () C:\WINDOWS\spupdsvc.log.1.log
2014-08-27 16:39 - 2014-08-27 16:39 - 00000090 _____ () C:\WINDOWS\system32\spupdwxp.log
2014-08-27 16:39 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\Registration
2014-08-27 16:39 - 2006-03-28 08:57 - 00316640 _____ () C:\WINDOWS\WMSysPr9.prx
2014-08-27 16:39 - 2006-03-28 08:56 - 00453442 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-27 16:38 - 2013-09-16 07:32 - 00000000 _____ () C:\WINDOWS\RTacDbg.txt
2014-08-27 16:38 - 2006-05-11 08:17 - 00001153 _____ () C:\hpqp.ini
2014-08-27 16:37 - 2014-08-26 18:34 - 00000767 _____ () C:\Documents and Settings\heidinew\Start Menu\Programs\Internet Explorer.lnk
2014-08-27 16:37 - 2014-08-26 18:34 - 00000738 _____ () C:\Documents and Settings\heidinew\Start Menu\Programs\Outlook Express.lnk
2014-08-27 16:37 - 2006-05-11 08:17 - 00000039 _____ () C:\XP_TV.ini
2014-08-27 16:35 - 2014-08-04 13:21 - 00275760 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-08-27 16:35 - 2006-03-28 09:51 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-27 16:34 - 2014-08-11 14:58 - 00000000 ____D () C:\WINDOWS\system32\RtlGina
2014-08-27 16:15 - 2014-08-05 15:18 - 01300016 _____ () C:\WINDOWS\system32\Drivers\sfi.dat
2014-08-27 00:04 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\security
2014-08-27 00:00 - 2014-08-27 00:00 - 00128140 _____ () C:\WINDOWS\system32\TZLog.log
2014-08-27 00:00 - 2014-08-27 00:00 - 00109604 _____ () C:\WINDOWS\KB955839.log
2014-08-27 00:00 - 2014-08-27 00:00 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2014-08-26 23:59 - 2014-08-26 23:38 - 00308612 _____ () C:\WINDOWS\svcpack.log
2014-08-26 23:52 - 2014-08-26 23:52 - 00000259 _____ () C:\WINDOWS\sessmgr.setup.log
2014-08-26 23:52 - 2014-08-26 23:52 - 00000200 _____ () C:\WINDOWS\cmsetacl.log
2014-08-26 23:52 - 2006-05-11 05:47 - 00000000 ___RD () C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
2014-08-26 23:52 - 2006-03-28 08:44 - 00001563 _____ () C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
2014-08-26 23:51 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\inetsrv
2014-08-26 23:51 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\ime
2014-08-26 23:50 - 2014-08-26 23:50 - 00000000 ____D () C:\WINDOWS\system32\scripting
2014-08-26 23:50 - 2014-08-26 23:50 - 00000000 ____D () C:\WINDOWS\system32\bits
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\usmt
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\Restore
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\npp
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\Com
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\srchasst
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\PeerNet
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\mui
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\msagent
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Windows NT
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\NetMeeting
2014-08-26 23:50 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Common Files\System
2014-08-26 23:47 - 2002-08-29 16:00 - 00250048 __RSH () C:\ntldr
2014-08-26 23:46 - 2006-05-11 07:58 - 00000000 ____D () C:\WINDOWS\system32\ReinstallBackups
2014-08-26 23:45 - 2009-09-10 14:14 - 00000000 __HDC () C:\WINDOWS\$NtServicePackUninstall$
2014-08-26 23:37 - 2014-08-26 23:37 - 00000000 ____D () C:\85b6128e54d165c12e988fc04d50
2014-08-26 23:16 - 2006-05-11 08:06 - 00002377 _____ () C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 6.0.lnk
2014-08-26 23:15 - 2014-08-26 23:15 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\Adobe
2014-08-26 23:15 - 2014-08-26 23:15 - 00000000 ____D () C:\Documents and Settings\heidinew\Application Data\AdobeUM
2014-08-26 23:14 - 2014-08-26 23:14 - 00000000 ____D () C:\Documents and Settings\heidinew\My Documents\My eBooks
2014-08-26 23:14 - 2014-08-26 19:05 - 00000000 ____D () C:\Documents and Settings\heidinew\Application Data\Adobe
2014-08-26 23:13 - 2014-08-04 12:52 - 00000000 ____D () C:\WINDOWS\system32\appmgmt
2014-08-26 21:47 - 2014-08-26 21:47 - 00004608 _____ () C:\Documents and Settings\heidinew\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-26 19:41 - 2013-10-13 16:48 - 00000000 ____D () C:\Program Files\REALTEK
2014-08-26 19:41 - 2006-05-11 05:47 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-08-26 19:12 - 2014-08-26 19:12 - 00012408 _____ () C:\Documents and Settings\heidinew\Desktop\dds.txt
2014-08-26 19:12 - 2014-08-26 19:12 - 00006647 _____ () C:\Documents and Settings\heidinew\Desktop\attach.txt
2014-08-26 19:05 - 2014-08-26 19:05 - 00000000 ____D () C:\Documents and Settings\heidinew\Application Data\Macromedia
2014-08-26 19:00 - 2014-08-26 18:59 - 00000000 ____D () C:\Documents and Settings\heidinew\Application Data\Mozilla
2014-08-26 18:59 - 2014-08-26 18:59 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\Mozilla
2014-08-26 18:54 - 2014-08-26 18:34 - 00000178 ___SH () C:\Documents and Settings\heidinew\ntuser.ini
2014-08-26 18:54 - 2014-08-05 15:16 - 00065536 _____ () C:\WINDOWS\system32\config\COMODO I.evt
2014-08-26 18:34 - 2014-08-26 18:34 - 00000792 _____ () C:\Documents and Settings\heidinew\Start Menu\Programs\Windows Media Player.lnk
2014-08-26 18:34 - 2014-08-26 18:34 - 00000786 _____ () C:\Documents and Settings\heidinew\Desktop\Windows Media Player.lnk
2014-08-26 18:34 - 2014-08-26 18:34 - 00000131 _____ () C:\Documents and Settings\heidinew\Local Settings\Application Data\fusioncache.dat
2014-08-21 08:56 - 2014-08-07 22:52 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\temp
2014-08-21 08:56 - 2006-03-28 09:51 - 00000178 ___SH () C:\Documents and Settings\Administrator\ntuser.ini
2014-08-15 16:04 - 2014-08-15 16:04 - 00699568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2014-08-15 16:04 - 2014-08-15 16:04 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2014-08-14 19:33 - 2014-08-07 16:53 - 00051990 _____ () C:\WINDOWS\system32\Drivers\fvstore.dat
2014-08-13 20:41 - 2013-10-13 16:48 - 00000000 ____D () C:\Documents and Settings\heidinew\Desktop\REALTEK RTL8187 Wireless LAN Utility
2014-08-12 22:53 - 2014-08-12 22:53 - 00000000 ____D () C:\Documents and Settings\Administrator\My Documents\My eBooks
2014-08-12 22:53 - 2014-08-12 22:53 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Adobe
2014-08-12 22:51 - 2014-08-12 22:51 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla
2014-08-12 22:51 - 2014-08-12 22:51 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Mozilla
2014-08-12 22:12 - 2006-03-28 08:49 - 00000767 _____ () C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk
2014-08-12 22:12 - 2006-03-28 08:49 - 00000738 _____ () C:\Documents and Settings\Administrator\Start Menu\Programs\Outlook Express.lnk
2014-08-12 22:11 - 2014-08-12 22:11 - 00000786 _____ () C:\Documents and Settings\Administrator\Desktop\Windows Media Player.lnk
2014-08-12 22:11 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\Administrator
2014-08-11 15:00 - 2014-08-11 15:00 - 00090112 _____ () C:\WINDOWS\Minidump\Mini081114-01.dmp
2014-08-11 15:00 - 2011-06-06 19:38 - 00000000 ____D () C:\WINDOWS\Minidump
2014-08-11 14:59 - 2014-08-11 14:59 - 00021361 _____ (Cisco Systems, Inc.) C:\WINDOWS\system32\Drivers\AegisP.sys
2014-08-11 14:59 - 2014-08-11 14:58 - 00376832 _____ () C:\WINDOWS\system32\AegisI5Installer.exe
2014-08-11 14:59 - 2014-08-11 14:58 - 00000000 ____D () C:\Program Files\AWUS036H Wireless LAN Utility
2014-08-11 13:32 - 2006-03-28 08:44 - 00001599 _____ () C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk
2014-08-10 15:09 - 2014-08-10 14:22 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2014-08-10 14:22 - 2014-08-05 12:12 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-10 14:17 - 2014-08-05 12:12 - 00054232 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-07 22:52 - 2014-08-07 22:52 - 00000000 ____D () C:\Documents and Settings\NetworkService\Local Settings\temp
2014-08-07 22:52 - 2014-08-07 22:52 - 00000000 ____D () C:\Documents and Settings\LocalService\Local Settings\temp
2014-08-07 22:52 - 2014-08-04 11:00 - 00000000 ____D () C:\Qoobox
2014-08-07 22:51 - 2014-08-07 22:51 - 00073659 _____ () C:\ComboFix.txt
2014-08-07 22:46 - 2006-03-28 00:31 - 00000227 _____ () C:\WINDOWS\system.ini
2014-08-07 21:36 - 2006-05-11 08:19 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Online Services
2014-08-07 16:53 - 2014-08-07 16:53 - 00000000 ___HD () C:\VTRoot
2014-08-06 22:16 - 2014-08-06 21:32 - 00010578 _____ () C:\WINDOWS\KB932823-v3.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB932823-v3$
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 _____ () C:\WINDOWS\setuperr.log
2014-08-06 21:33 - 2014-08-06 21:33 - 00000000 _____ () C:\WINDOWS\setupact.log
2014-08-05 15:18 - 2014-08-05 15:11 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Comodo
2014-08-05 15:18 - 2006-05-11 07:52 - 00000000 __SHD () C:\Documents and Settings\NetworkService
2014-08-05 15:16 - 2014-08-05 15:16 - 00000000 ___SD () C:\Documents and Settings\All Users\Application Data\Shared Space
2014-08-05 15:16 - 2014-08-05 15:16 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\COMODO
2014-08-05 15:15 - 2014-08-05 15:15 - 00000000 ____D () C:\Program Files\COMODO
2014-08-05 15:14 - 2014-08-05 15:14 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Comodo Downloader
2014-08-05 14:44 - 2014-08-05 14:44 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVAST Software
2014-08-05 14:43 - 2013-10-16 19:30 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-05 14:28 - 2006-03-28 08:43 - 00000573 _____ () C:\WINDOWS\win.ini
2014-08-05 14:27 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-08-05 14:10 - 2014-08-05 14:10 - 00000000 ____D () C:\Program Files\MSECache
2014-08-05 14:10 - 2006-05-11 08:13 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-08-05 13:44 - 2014-08-05 13:43 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-05 12:40 - 2009-08-22 15:42 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB968389_0$
2014-08-05 12:12 - 2014-08-05 12:12 - 00000617 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Malwarebytes Anti-Malware
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666
2014-08-05 12:12 - 2014-08-05 12:12 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes
2014-08-04 13:21 - 2006-05-11 08:27 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-08-04 13:21 - 2006-05-11 08:27 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Symantec
2014-08-04 13:16 - 2012-08-27 16:40 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Sierra
2014-08-04 13:15 - 2014-08-04 13:15 - 00000682 _____ () C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
2014-08-04 13:15 - 2012-08-13 13:46 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-04 12:52 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Sonic
2014-08-04 12:52 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Sonic
2014-08-04 12:50 - 2006-05-11 05:47 - 00000000 ___RD () C:\Documents and Settings\All Users\Start Menu\Programs\Games
2014-08-04 12:49 - 2006-05-11 08:09 - 00000000 ____D () C:\Program Files\GemMaster
2014-08-04 11:32 - 2014-08-04 10:59 - 00000000 ____D () C:\WINDOWS\erdnt
2014-08-04 11:23 - 2014-08-04 11:22 - 00000000 _RSHD () C:\cmdcons
2014-08-04 11:23 - 2006-03-28 08:36 - 00000325 __RSH () C:\boot.ini
2014-08-04 11:16 - 2014-08-04 11:15 - 00000075 _____ () C:\WINDOWS\system32\LuResult.txt
2014-08-03 20:43 - 1999-03-30 14:17 - 00000000 ____D () C:\system.sav
2014-08-03 20:42 - 2006-05-11 09:15 - 00000000 ____D () C:\WINDOWS\CREATOR
2014-08-03 20:42 - 2006-05-11 08:52 - 00000000 ____D () C:\WINDOWS\SMINST
2014-08-03 20:38 - 2014-08-03 20:38 - 00001797 __RSH () C:\WINDOWS\system32\Drivers\103C_HP_NTBK_HP Pavilion dv5000 (EZ415UA#ABA)_YN_0Pavi_QCND6272969_E413908001_46_I30A8_SHP_V56.38_BF.15_T060613_WXP2_L409_M1015_J120_7Intel_8T2050_91.6_#140803_N80861092_(EZ415UA#ABA)_XMOBILE_CN10_Z_2F.15_G808627A2.MRK
2014-08-03 20:38 - 2006-05-11 08:05 - 00000000 ____D () C:\WINDOWS\system32\pcintro
2014-08-03 20:38 - 2006-05-11 08:05 - 00000000 ____D () C:\hp
2014-08-03 20:35 - 2014-08-04 11:23 - 00000209 _____ () C:\Boot.bak
2014-08-03 20:31 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\HPQ
2014-08-03 20:19 - 2006-05-11 08:15 - 00000000 ____D () C:\WINDOWS\tiinst
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ___RD () C:\WINDOWS\Web
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\twain_32
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\URTTemp
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\spool
2014-08-03 20:19 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\ras
2014-08-03 20:18 - 2006-05-11 07:56 - 00000000 ____D () C:\WINDOWS\system32\msmq
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\mui
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\MsDtc
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\Macromed
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\IME
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\icsxml
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\ias
2014-08-03 20:18 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\DirectX
2014-08-03 20:17 - 2006-05-11 08:14 - 00000000 ____D () C:\WINDOWS\ShellNew
2014-08-03 20:17 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\system32\1033
2014-08-03 20:17 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\repair
2014-08-03 20:16 - 2006-05-11 05:47 - 00000000 ___RD () C:\WINDOWS\Offline Web Pages
2014-08-03 20:16 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\Media
2014-08-03 20:13 - 2006-05-11 07:58 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB915326$
2014-08-03 20:13 - 2006-05-11 07:58 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB912436$
2014-08-03 20:13 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB909095$
2014-08-03 20:13 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB896256$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB913446$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB912919$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB911927$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB911565$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB911564$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB908519$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB904706$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB903235$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB901214$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB896727$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB896423$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB896422$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB896358$
2014-08-03 20:13 - 2006-05-11 05:47 - 00000000 ____D () C:\WINDOWS\Cursors
2014-08-03 20:12 - 2006-05-11 08:40 - 00000000 ____D () C:\vongo
2014-08-03 20:12 - 2006-05-11 08:27 - 00000000 __HDC () C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2014-08-03 20:12 - 2006-05-11 07:58 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB890546$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB889673$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB888402$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB888239$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB885464$
2014-08-03 20:12 - 2006-05-11 07:57 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB884575$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB894391$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB893066$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB891781$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB888113$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB887472$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB886185$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB885250$
2014-08-03 20:12 - 2006-05-11 05:47 - 00000000 ___HD () C:\WINDOWS\$NtUninstallKB873333$
2014-08-03 19:56 - 2006-05-11 08:23 - 00000000 ____D () C:\Program Files\WildTangent
2014-08-03 19:55 - 2006-05-11 08:11 - 00000000 ____D () C:\Program Files\RGB
2014-08-03 19:54 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Online Services
2014-08-03 19:53 - 2006-05-11 09:06 - 00000000 ____D () C:\Program Files\NetWaiting
2014-08-03 19:52 - 2006-05-11 08:38 - 00000000 ____D () C:\Program Files\Microsoft Office Trial Wizard
2014-08-03 19:52 - 2006-05-11 08:37 - 00000000 ____D () C:\Program Files\music_now
2014-08-03 19:52 - 2006-05-11 08:13 - 00000000 ____D () C:\Program Files\Microsoft Works
2014-08-03 19:52 - 2006-05-11 08:12 - 00000000 ____D () C:\Program Files\MSN Encarta Plus
2014-08-03 19:51 - 2006-05-11 08:15 - 00000000 ____D () C:\Program Files\Microsoft ActiveSync
2014-08-03 19:49 - 2006-05-11 08:35 - 00000000 ____D () C:\Program Files\Google
2014-08-03 19:48 - 2006-05-11 08:38 - 00000000 ____D () C:\Program Files\Common Files\Palo Alto Software
2014-08-03 19:48 - 2006-05-11 08:37 - 00000000 ____D () C:\Program Files\Common Files\muvee Technologies
2014-08-03 19:48 - 2006-05-11 08:09 - 00000000 ____D () C:\Program Files\ESPNMotion
2014-08-03 19:48 - 2006-05-11 08:09 - 00000000 ____D () C:\Program Files\DIGStream
2014-08-03 19:48 - 2006-05-11 07:59 - 00000000 ____D () C:\Program Files\CONEXANT
2014-08-03 19:48 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Common Files\Sonic Shared
2014-08-03 19:48 - 2006-05-11 05:47 - 00000000 ____D () C:\Program Files\Common Files\Services
2014-08-03 19:47 - 2006-05-11 08:50 - 00000000 ____D () C:\Program Files\Common Files\LightScribe
2014-08-03 19:47 - 2006-05-11 08:15 - 00000000 ____D () C:\Program Files\Common Files\Designer
2014-08-03 19:46 - 2006-05-11 05:47 - 00000000 ____D () C:\I386
2014-08-03 19:43 - 2006-05-11 08:51 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\System Recovery
2014-08-03 19:43 - 2006-05-11 08:50 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\LightScribe Direct Disc Labeling
2014-08-03 19:43 - 2006-05-11 08:39 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Quicken 2006
2014-08-03 19:43 - 2006-05-11 08:37 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\muvee Technologies
2014-08-03 19:43 - 2006-05-11 08:36 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Netscape
2014-08-03 19:43 - 2006-05-11 08:15 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
2014-08-03 19:43 - 2006-05-11 08:13 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Works
2014-08-03 19:43 - 2006-05-11 08:06 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\PrintMe Internet Printing
2014-08-03 19:43 - 2006-05-11 08:00 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\NetWaiting
2014-08-03 19:43 - 2006-05-11 07:52 - 00000000 __SHD () C:\Documents and Settings\LocalService
2014-08-03 19:43 - 2006-05-11 05:47 - 00000000 __SHD () C:\Documents and Settings\All Users\DRM
2014-08-03 19:43 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Windows Digital Media Enhancements
2014-08-03 19:43 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\HP
2014-08-03 19:40 - 2014-08-26 18:34 - 00000000 ___RD () C:\Documents and Settings\heidinew\Start Menu\Programs\Accessories
2014-08-03 19:40 - 2014-08-26 18:34 - 00000000 ____D () C:\Documents and Settings\heidinew\Start Menu\Programs\Online Services
2014-08-03 19:40 - 2014-08-26 18:34 - 00000000 ____D () C:\Documents and Settings\heidinew\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
2014-08-03 19:40 - 2009-08-14 23:34 - 00000000 ____D () C:\Documents and Settings\Default User\Start Menu\Programs\Vongo
2014-08-03 19:40 - 2009-08-14 23:34 - 00000000 ____D () C:\Documents and Settings\Default User\Start Menu\Programs\Online Services
2014-08-03 19:40 - 2009-08-14 23:34 - 00000000 ____D () C:\Documents and Settings\Default User\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
2014-08-03 19:40 - 2006-05-11 08:40 - 00000000 ____D () C:\Documents and Settings\Administrator\Start Menu\Programs\Vongo
2014-08-03 19:40 - 2006-05-11 05:47 - 00000000 ___RD () C:\Documents and Settings\Default User\Start Menu\Programs\Accessories
2014-08-03 19:40 - 2006-05-11 05:47 - 00000000 ___RD () C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories
2014-08-03 19:40 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Sonic
2014-08-03 19:40 - 2006-05-11 05:47 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
2014-08-02 10:49 - 2014-02-05 13:27 - 00040828 _____ () C:\Documents and Settings\All Users\lxebscan.log

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================


----------



## chemist

Hello again, Heidi. 


Open Notepad (Start > All Programs > Accessories > Notepad). 

Please copy all the text in the codebox below. (To do this highlight the contents of the box, right-click on it and select Copy. Right-click in the open Notepad and select Paste). 
Save it as *fixlist.txt* next to *FRST.exe*

NOTE: Both *FRST.exe* and the *fixlist.txt* must be in the same location or the fix will not work.




Code:


start
C:\Documents and Settings\All Users\Start Menu\Programs\66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666
c:\documents and settings\66666666666666666666
C:\WINDOWS\005726_.tmp
EmptyTemp:
end


Double-click *FRST* to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the *Fix* button just once, and wait.

If you receive a message that a reboot is required, please make sure you allow it to restart normally. 

The tool will complete its run after the restart.
When finished, the tool will make a log (Fixlog.txt) in the same location from where it was run. Please post the Fixlog.txt log in your reply.

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

------------------------------------------------------


----------



## heidi87

Thanks so much! it might take a day or two till I can do it.
I really appreciate your help!


The other laptop (also) fixed itself. Do you have any idea how this can happen? Is there any "self destroying malware" out there? 
See my other post
http://www.techsupportforum.com/forums/newreply.php?do=newreply&noquote=1&p=5529377


----------



## chemist

heidi87 said:


> Is there any "self destroying malware" out there?


You're welcome! It does happen from time to time. Not sure why in this particular case. Let me know.


----------



## heidi87

Thanks! Here is the fixlog.txt. Under "C/documents and settings" I have only "administrator", "heidinew" and "all users" left. I think I deleted the "66666666666666666666" under "documents and settings" when I deleted the other users. I guess I shouldn't have done this - SORRY.


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:30-08-2014 01
Ran by heidinew at 2014-08-30 18:24:48 Run:1
Running from C:\Documents and Settings\heidinew\My Documents\Downloads
Boot Mode: Normal

==============================================


Content of fixlist:
*****************
start
C:\Documents and Settings\All Users\Start Menu\Programs\66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666
c:\documents and settings\66666666666666666666
C:\WINDOWS\005726_.tmp
EmptyTemp:
end
*****************

C:\Documents and Settings\All Users\Start Menu\Programs\66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666 => Moved successfully.
"c:\documents and settings\66666666666666666666" => File/Directory not found.
C:\WINDOWS\005726_.tmp => Moved successfully.
EmptyTemp: => Removed 101.9 MB temporary data.


The system needed a reboot. 

==== End of Fixlog ====


----------



## heidi87

chemist said:


> You're welcome! It does happen from time to time. Not sure why in this particular case. Let me know.



Thanks! This made me feel a little better! I really appreciate your input and help!


----------



## chemist

Hello again, Heidi. I just listed that folder to make sure. 

Do you still get 6's when you log in? 

------------------------------------------------------


----------



## heidi87

Yes, the sixes still show up in the "log-in" window - but only there.
No beeping, no clonking noises - everything is working fine.

I really can live with the sixes in the log-in window. Do you think its safe enough for now to use the laptop like before? (sharing USB-sticks, cards)?

Thank you again so much for your help!!!!!!!!!!!!!!!!


----------



## chemist

You're very welcome, Heidi! Yes, you can use the laptop as normal. Still, I'd like to fix the remaining 6s at login. I'll have to do some research. I'll get back to you as quick as I can.


----------



## heidi87

chemist said:


> You're very welcome, Heidi! Yes, you can use the laptop as normal. Still, I'd like to fix the remaining 6s at login. I'll have to do some research. I'll get back to you as quick as I can.


Wow, you are a perfectionist - which is great for me and all the other people asking you for help!!!!!!!!!

I'm only curious what is was - malware, virus, hardware? (unfortunately the room where the laptop is stored/used gets up to 100degree in summer - maybe it's not only me suffering in this heat....:wink:
Maybe you know...

I'll keep this thread open till I hear from you again.


----------



## chemist

Hello again, Heidi. Thanks for the kind words. 

Please download *SystemLook* from one of the links below and save it to your Desktop. 
*Download Mirror #1
Download Mirror #2*

Double-click *SystemLook.exe* to run it. (Vista/Win7/Win8 users, right-click > Run as Administrator)
Copy/paste the contents of the following codebox into the main textfield:


Code:


:filefind
666666*

:folderfind
666666*

:regfind
666666*


Click the *Look* button to start the scan. 
Please be patient, as it may take a while. 
When finished, a Notepad file will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*

------------------------------------------------------


----------



## chemist

Still with us, Heidi? Any trouble with those last instructions?


----------



## chemist

Still with us, Heidi? Any trouble with those last instructions?


----------



## heidi87

Sorry, I didn't receive any note about your new posts! I'll work on it tomorrow night and let you know! Thanks so much for your patient!

Update on the "devil laptop":

So far the 6666 are popping up in the log-in window and in any online "fill out form" (e.g. when you have to enter your name, address etc.). NO 6666 when working with files.
I lost MS office - I do have the original MS office CD but it won't install. Laptop does not recognize the CD (also nothing under "DVD drive" when I go to "my computer" (other CD's and DVD's are working fine). 
On the keyboard I lost the capital "M" and the cursors (up, down. left, right) are acting weird. Finally I got a keyboard yesterday and will try to use this one tomorrow. 

The other laptop "died". It worked fine for weeks, I shut if of without problems one night, the next morning it was dead... Not even the little light showing that it's connected to the socket/electric...

Thanks again - "talk" to you tomorrow night


----------



## heidi87

Sorry for the delay. Here is the log.



SystemLook 30.07.11 by jpshortstuff
Log created at 09:35 on 01/10/2014 by heidinew
Administrator - Elevation successful

========== filefind ==========

Searching for "666666*"
No files found.

========== folderfind ==========

Searching for "666666*"
C:\FRST\Quarantine\C\Documents and Settings\All Users\Start Menu\Programs\66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666 d------ [16:12 05/08/2014]
C:\VTRoot\HarddiskVolume1\Documents and Settings\66666666666666666666 d------ [20:53 07/08/2014]

========== regfind ==========

Searching for "666666*"
No data found.

-= EOF =-


----------



## chemist

Hello again, Heidi. 

Open *Notepad* and copy/paste the entire contents of the codebox below into Notepad:



Code:


@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"C:\FRST\Quarantine\C\Documents and Settings\All Users\Start Menu\Programs\66666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666"
"C:\VTRoot\HarddiskVolume1\Documents and Settings\66666666666666666666"

) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0

Save this Notepad file as *fix.bat* and choose to *Save as type: - All Files* to your desktop then close the Notepad file.
It should look like this:









Double-click on *fix.bat* to run it. 

Tell me what it says in your next reply. Press any key to continue. 

------------------------------------------------------

Reboot. Do you still get 6's at login? 

------------------------------------------------------


----------



## heidi87

The sixes are still there in the log-in window after running "fix.bat". 
(They are very persistence - I guess they like the log-in window :wink 

(I forgot to mention: Even before I run the fix.bat, the sixes wouldn't show up at any online "fill out form". I guess it was only one website were they showed up - but I don't remember the side)

When I first double-clicked on "fix.bat" it was saying something like "not enough space..." and a Comodo security warning popped up. I clicked on "don't sandbox it again" and double-clicked on "fix.bat" again. The message from before didn't show up again.


----------



## chemist

Hello again, Heidi. Would you mind resetting your Sandbox? 

Open COMODO and go Tasks > Reset Sandbox > Erase Changes > Continue 

Reboot and see if the 6's are still there. 

------------------------------------------------------


----------



## heidi87

I did reset the Sandbox - sixes are still there...

Since yesterday the computer beeps, black screen when turning it on. If I shut off the power right away and turn it back on, laptop starts fine.

It looks like the condition of the the patient is getting worse...


----------



## chemist

Hello again, Heidi. Have you thought of using your recovery partition to restore the laptop to factory settings? I know it is a lot of work, but it might be the fastest way to get the laptop back to normal, that is if your hardware is not damaged. 

------------------------------------------------------


----------



## heidi87

The sixes upon log-in aren't bothering me but if the restore would fix or prevent any other issue I would do a restore.
It wouldn't be so much work: There is nothing left on the laptop which is not saved somewhere else. Also by now there are not many installed programs left.

How do I use the recovery partition to restore the laptop to factory settings? Do I just pick my first created "restore/recovery point?


How can I find out if the hardware is damaged? 

Thanks again for your help and patience!

Heidi


----------



## chemist

Hello again, Heidi. You're very welcome! The only reason I suggested the factory restore is the startup/black screen issues you keep mentioning. 

The quickest way is probably just try the factory restore: 

http://www.techsupportforum.com/forums/f10/how-to-factory-restore-your-computer-637463.html

Let me know how it goes.


----------



## heidi87

I did reset the laptop to "factory settings" (with F10 etc.) but the "DOS clonk sounds" are back upon start, also DOS-beeping for about 30 sec before Windows XP starts. 
So far no 6666 (I'm using wordpad and notepad for now)
Is there any way to disable the keyboard on the laptop? (I'm using an external keyboard because by now about 4 keys on the laptop keyboard are not working).


----------



## chemist

I could be wrong, but I believe since it is a built-in device you can't disable it. You could uninstall the driver for the keyboard, but again since it is a built-in device, your computer would just re-install the driver every time you restart the machine. 

To totally disable it, you would have to open up the cover and disconnect the cable to the keyboard.


----------

