[code] OTScanIt logfile created on: 8/26/2008 3:08:34 PM OTScanIt by OldTimer - Version 1.0.16.2 Folder = C:\temp\OTScanIt Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.99 Gb Total Physical Memory | 1.43 Gb Available Physical Memory | 71.95% Memory free 3.84 Gb Paging File | 3.37 Gb Available in Paging File | 87.74% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092; %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 111.49 Gb Total Space | 93.27 Gb Free Space | 83.66% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: TOSHIBA-USER Current User Name: Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users [Processes - Non-Microsoft Only] evteng.exe -> %ProgramFiles%\Intel\Wireless\Bin\EvtEng.exe -> MD5 = 2B1284C4EC97CC204F8430F5CCC2992F | Intel Corporation [Ver = 10.5.0.20 | Size = 434176 bytes | Modified Date = 7/3/2006 12:57:12 AM | Attr = ] s24evmon.exe -> %ProgramFiles%\Intel\Wireless\Bin\S24EvMon.exe -> MD5 = D72566C2E6A9EE9BA5B0D1F855AF74CF | Intel Corporation [Ver = 10.5.0.34 | Size = 937984 bytes | Modified Date = 7/3/2006 12:49:10 AM | Attr = ] applemobiledeviceservice.exe -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> MD5 = 1961CB10BB48EB4D97E37DB6373E9E63 | Apple, Inc. [Ver = 1, 14, 0, 0 | Size = 110592 bytes | Modified Date = 1/15/2008 3:40:04 AM | Attr = ] avgwdsvc.exe -> %ProgramFiles%\AVG\AVG8\avgwdsvc.exe -> MD5 = F43C8FCC7FDB984FD06FE29BAA741947 | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 231192 bytes | Modified Date = 8/21/2008 5:01:23 PM | Attr = ] dvdramsv.exe -> %SystemRoot%\system32\DVDRAMSV.exe -> MD5 = C9FFBD6B8EDC46CD3D13E3C6DB914FB7 | Matsushita Electric Industrial Co., Ltd. [Ver = 3, 0, 0, 0 | Size = 110592 bytes | Modified Date = 8/28/2004 2:33:00 AM | Attr = ] regsrvc.exe -> %ProgramFiles%\Intel\Wireless\Bin\RegSrvc.exe -> MD5 = C35EC743558ED20FBC99C47616F9415E | Intel Corporation [Ver = 10.5.0.4 | Size = 327680 bytes | Modified Date = 7/3/2006 12:42:14 AM | Attr = ] swupdtmr.exe -> %SystemDrive%\TOSHIBA\IVP\swupdate\swupdtmr.exe -> MD5 = 486A64AABD88E4E174681E89E9736BC9 | [Ver = | Size = 40960 bytes | Modified Date = 7/12/2005 7:14:42 PM | Attr = ] tappsrv.exe -> %ProgramFiles%\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe -> MD5 = 36772B5EAAAF42DB5C5EE6EEB0EC0AF7 | TOSHIBA Corp. [Ver = 1, 0, 0, 14M | Size = 35840 bytes | Modified Date = 2/7/2006 6:30:40 PM | Attr = ] toddsrv.exe -> %SystemRoot%\system32\TODDSrv.exe -> MD5 = D540858E65BFA6FDED41AD2495ECE344 | TOSHIBA Corporation [Ver = 1, 0, 0, 3 | Size = 114688 bytes | Modified Date = 5/25/2006 8:30:16 PM | Attr = ] avgrsx.exe -> %ProgramFiles%\AVG\AVG8\avgrsx.exe -> MD5 = BA1CE056CE1466CA28CE118585EA86C4 | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 287000 bytes | Modified Date = 8/21/2008 5:01:27 PM | Attr = ] ddwmon.exe -> %ProgramFiles%\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe -> MD5 = 14273A29CC670F43E3CE931B38C3729D | TOSHIBA Corporation [Ver = 1.0.0.9 | Size = 299008 bytes | Modified Date = 4/25/2006 7:57:00 PM | Attr = ] rthdcpl.exe -> %SystemRoot%\RTHDCPL.exe -> MD5 = 94897A21D751D72DA0F34421DE17FB9D | Realtek Semiconductor Corp. [Ver = 2.0.9.1 | Size = 16050688 bytes | Modified Date = 8/23/2006 7:08:04 AM | Attr = ] hkcmd.exe -> %SystemRoot%\system32\hkcmd.exe -> MD5 = D9F3DB62D1B361D82CD82A347EA6218D | Intel Corporation [Ver = 3.0.0.4543 | Size = 77824 bytes | Modified Date = 3/22/2006 11:13:40 PM | Attr = ] igfxpers.exe -> %SystemRoot%\system32\igfxpers.exe -> MD5 = 32FB9368F485A7FE944EB6678B61734B | Intel Corporation [Ver = 3.0.0.4543 | Size = 118784 bytes | Modified Date = 3/22/2006 11:17:50 PM | Attr = ] psqltray.exe -> %ProgramFiles%\Protector Suite QL\psqltray.exe -> MD5 = 67ECEA13D85AC352E1919774A933AC7B | UPEK Inc. [Ver = 5.4.0.2934 | Size = 46592 bytes | Modified Date = 5/5/2006 7:39:54 PM | Attr = ] syntpenh.exe -> %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe -> MD5 = 6668B0E0B95E75CE3F3C8F737830F320 | Synaptics, Inc. [Ver = 8.2.13.2 02Mar06 | Size = 761948 bytes | Modified Date = 3/2/2006 6:02:08 PM | Attr = ] agrsmmsg.exe -> %SystemRoot%\agrsmmsg.exe -> MD5 = D6E32F433FDC70670DD50CCBC1923789 | Agere Systems [Ver = 2.1.68 2.1.68 03/17/2006 15:22:25 | Size = 89541 bytes | Modified Date = 3/18/2006 10:22:26 AM | Attr = ] toshiba.exe -> %ProgramFiles%\Synaptics\SynTP\Toshiba.exe -> MD5 = 5B935E585843F667561A794BA59978D0 | Synaptics, Inc. [Ver = 8.2.13.2 02Mar06 | Size = 151552 bytes | Modified Date = 3/2/2006 5:50:52 PM | Attr = ] tpsmain.exe -> %SystemRoot%\system32\TPSMain.exe -> MD5 = 1812D1BB1FAD95017C613F927EAC8147 | TOSHIBA Corporation [Ver = 1, 0, 15, 0 | Size = 282624 bytes | Modified Date = 5/31/2005 11:00:12 PM | Attr = ] tvstray.exe -> %ProgramFiles%\TOSHIBA\Tvs\TvsTray.exe -> MD5 = A468117106C94701A3B55576192815D4 | TOSHIBA Corporation [Ver = 1, 0, 0, 7 | Size = 73728 bytes | Modified Date = 2/2/2006 2:11:38 PM | Attr = ] pinger.exe -> %SystemDrive%\TOSHIBA\IVP\ISM\pinger.exe -> MD5 = FA8D59CD0B55A489A3CF237ACF6F3D46 | TOSHIBA Corporation [Ver = 3.7.0.0 | Size = 151552 bytes | Modified Date = 3/17/2005 7:37:26 PM | Attr = ] zcfgsvc.exe -> %ProgramFiles%\Intel\Wireless\Bin\ZCfgSvc.exe -> MD5 = 2DFB46F886A092B1AF5F3A4A3402F6EA | Intel Corporation [Ver = 10.5.0.5 | Size = 802816 bytes | Modified Date = 7/3/2006 4:07:28 AM | Attr = ] ifrmewrk.exe -> %ProgramFiles%\Intel\Wireless\Bin\iFrmewrk.exe -> MD5 = 370DC0AF1AC4E8F06E75716E8E023E3F | Intel Corporation [Ver = 10.5.0.1 | Size = 700416 bytes | Modified Date = 7/3/2006 12:50:32 AM | Attr = ] jusched.exe -> %ProgramFiles%\Java\jre1.6.0_07\bin\jusched.exe -> MD5 = 6AB4C021FBD36DC6764924C312428D97 | Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 144784 bytes | Modified Date = 6/10/2008 4:27:04 AM | Attr = ] tpsbattm.exe -> %SystemRoot%\system32\TPSBattM.exe -> MD5 = 1822A66A82433F83195B170592F8A7D8 | TOSHIBA Corporation [Ver = 1, 0, 2, 0 | Size = 45056 bytes | Modified Date = 5/31/2005 10:59:58 PM | Attr = ] ituneshelper.exe -> %ProgramFiles%\iTunes\iTunesHelper.exe -> MD5 = 04A9F0C58B170F30445BCC0683EF9FFC | Apple Inc. [Ver = 7.6.2.9 | Size = 267048 bytes | Modified Date = 3/30/2008 10:36:40 AM | Attr = ] dot1xcfg.exe -> %ProgramFiles%\Intel\Wireless\Bin\Dot1XCfg.exe -> MD5 = 217CD9B3FED4F6F80E43C5988831C51D | Intel Corporation [Ver = 10.5.0.3 | Size = 479232 bytes | Modified Date = 7/3/2006 3:57:04 AM | Attr = ] avgtray.exe -> %ProgramFiles%\AVG\AVG8\avgtray.exe -> MD5 = 348A781AEF0870A56549F53BB37A233A | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 1232152 bytes | Modified Date = 8/21/2008 5:01:26 PM | Attr = ] toscdspd.exe -> %ProgramFiles%\TOSHIBA\TOSCDSPD\TOSCDSPD.exe -> MD5 = D8CF04E65081018CF3379B0FC02FFCBB | TOSHIBA [Ver = 1, 0, 6, 0 | Size = 65536 bytes | Modified Date = 12/30/2004 2:32:20 AM | Attr = ] googletoolbarnotifier.exe -> %ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -> MD5 = E616A6A6E91B0A86F2F6217CDE835FFE | Google Inc. [Ver = 2, 0, 301, 1654 | Size = 68856 bytes | Modified Date = 8/9/2008 12:19:42 PM | Attr = ] ipodservice.exe -> %ProgramFiles%\iPod\bin\iPodService.exe -> MD5 = 1CB96E83FD76EB5580451CEF29E24303 | Apple Inc. [Ver = 7.6.2.9 | Size = 504104 bytes | Modified Date = 3/30/2008 10:36:30 AM | Attr = ] otscanit.exe -> %SystemDrive%\temp\OTScanIt\OTScanIt.exe -> MD5 = A6CDC430F6D5C3AEB8856C0EB2996D2E | OldTimer Tools [Ver = 1.0.16.2 | Size = 397312 bytes | Modified Date = 7/12/2008 9:29:54 AM | Attr = ] [Win32 Services - Non-Microsoft Only] (Apple Mobile Device) Apple Mobile Device [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> MD5 = 1961CB10BB48EB4D97E37DB6373E9E63 | Apple, Inc. [Ver = 1, 14, 0, 0 | Size = 110592 bytes | Modified Date = 1/15/2008 3:40:04 AM | Attr = ] (avg8wd) AVG Free8 WatchDog [Win32_Own | Auto | Running] -> %ProgramFiles%\AVG\AVG8\avgwdsvc.exe -> MD5 = F43C8FCC7FDB984FD06FE29BAA741947 | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 231192 bytes | Modified Date = 8/21/2008 5:01:23 PM | Attr = ] (dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %SystemRoot%\system32\dmadmin.exe -> MD5 = E46050330BD42F33609117F861E32D3C | Microsoft Corp., Veritas Software [Ver = 2600.5512.503.0 | Size = 224768 bytes | Modified Date = 4/13/2008 7:12:17 PM | Attr = ] (DVD-RAM_Service) DVD-RAM_Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\DVDRAMSV.exe -> MD5 = C9FFBD6B8EDC46CD3D13E3C6DB914FB7 | Matsushita Electric Industrial Co., Ltd. [Ver = 3, 0, 0, 0 | Size = 110592 bytes | Modified Date = 8/28/2004 2:33:00 AM | Attr = ] (EvtEng) Intel(R) PROSet/Wireless Event Log [Win32_Own | Auto | Running] -> %ProgramFiles%\Intel\Wireless\Bin\EvtEng.exe -> MD5 = 2B1284C4EC97CC204F8430F5CCC2992F | Intel Corporation [Ver = 10.5.0.20 | Size = 434176 bytes | Modified Date = 7/3/2006 12:57:12 AM | Attr = ] (gusvc) Google Updater Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe -> MD5 = 751C1D2CA2ABF4A9F5A6B8D7D45B907C | Google [Ver = 2.0.734.29932.beta | Size = 138168 bytes | Modified Date = 7/21/2008 8:53:39 PM | Attr = ] (IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriverT.exe -> MD5 = 6F95324909B502E2651442C1548AB12F | Macrovision Corporation [Ver = 10.50.125 | Size = 73728 bytes | Modified Date = 10/22/2004 5:24:18 AM | Attr = ] (iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> %ProgramFiles%\iPod\bin\iPodService.exe -> MD5 = 1CB96E83FD76EB5580451CEF29E24303 | Apple Inc. [Ver = 7.6.2.9 | Size = 504104 bytes | Modified Date = 3/30/2008 10:36:30 AM | Attr = ] (RegSrvc) Intel(R) PROSet/Wireless Registry Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Intel\Wireless\Bin\RegSrvc.exe -> MD5 = C35EC743558ED20FBC99C47616F9415E | Intel Corporation [Ver = 10.5.0.4 | Size = 327680 bytes | Modified Date = 7/3/2006 12:42:14 AM | Attr = ] (S24EventMonitor) Intel(R) PROSet/Wireless Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Intel\Wireless\Bin\S24EvMon.exe -> MD5 = D72566C2E6A9EE9BA5B0D1F855AF74CF | Intel Corporation [Ver = 10.5.0.34 | Size = 937984 bytes | Modified Date = 7/3/2006 12:49:10 AM | Attr = ] (Swupdtmr) Swupdtmr [Win32_Own | Auto | Running] -> %SystemDrive%\TOSHIBA\IVP\swupdate\swupdtmr.exe -> MD5 = 486A64AABD88E4E174681E89E9736BC9 | [Ver = | Size = 40960 bytes | Modified Date = 7/12/2005 7:14:42 PM | Attr = ] (TAPPSRV) TOSHIBA Application Service [Win32_Own | Auto | Running] -> %ProgramFiles%\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe -> MD5 = 36772B5EAAAF42DB5C5EE6EEB0EC0AF7 | TOSHIBA Corp. [Ver = 1, 0, 0, 14M | Size = 35840 bytes | Modified Date = 2/7/2006 6:30:40 PM | Attr = ] (TODDSrv) TOSHIBA Optical Disc Drive Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\TODDSrv.exe -> MD5 = D540858E65BFA6FDED41AD2495ECE344 | TOSHIBA Corporation [Ver = 1, 0, 0, 3 | Size = 114688 bytes | Modified Date = 5/25/2006 8:30:16 PM | Attr = ] [Registry - Non-Microsoft Only] < Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> AGRSMMSG -> %SystemRoot%\agrsmmsg.exe [AGRSMMSG.exe] -> MD5 = D6E32F433FDC70670DD50CCBC1923789 | Agere Systems [Ver = 2.1.68 2.1.68 03/17/2006 15:22:25 | Size = 89541 bytes | Modified Date = 3/18/2006 10:22:26 AM | Attr = ] Alcmtr -> %SystemRoot%\Alcmtr.exe [ALCMTR.EXE] -> MD5 = 8B4CBBA1EA526830C7F97E7822E2493A | Realtek Semiconductor Corp. [Ver = 1.6.0.2 | Size = 69632 bytes | Modified Date = 5/3/2005 5:43:28 AM | Attr = ] AVG8_TRAY -> %ProgramFiles%\AVG\AVG8\avgtray.exe [C:\PROGRA~1\AVG\AVG8\avgtray.exe] -> MD5 = 348A781AEF0870A56549F53BB37A233A | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 1232152 bytes | Modified Date = 8/21/2008 5:01:26 PM | Attr = ] DDWMon -> %ProgramFiles%\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe [C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe] -> MD5 = 14273A29CC670F43E3CE931B38C3729D | TOSHIBA Corporation [Ver = 1.0.0.9 | Size = 299008 bytes | Modified Date = 4/25/2006 7:57:00 PM | Attr = ] igfxhkcmd -> %SystemRoot%\system32\hkcmd.exe [C:\WINDOWS\system32\hkcmd.exe] -> MD5 = D9F3DB62D1B361D82CD82A347EA6218D | Intel Corporation [Ver = 3.0.0.4543 | Size = 77824 bytes | Modified Date = 3/22/2006 11:13:40 PM | Attr = ] igfxpers -> %SystemRoot%\system32\igfxpers.exe [C:\WINDOWS\system32\igfxpers.exe] -> MD5 = 32FB9368F485A7FE944EB6678B61734B | Intel Corporation [Ver = 3.0.0.4543 | Size = 118784 bytes | Modified Date = 3/22/2006 11:17:50 PM | Attr = ] igfxtray -> %SystemRoot%\system32\igfxtray.exe [C:\WINDOWS\system32\igfxtray.exe] -> MD5 = 54F1F98C4AD8F99BBBE8FBB62B38733F | Intel Corporation [Ver = 3.0.0.4543 | Size = 94208 bytes | Modified Date = 3/22/2006 11:17:04 PM | Attr = ] IntelWireless -> %ProgramFiles%\Intel\Wireless\Bin\iFrmewrk.exe ["C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless] -> MD5 = 370DC0AF1AC4E8F06E75716E8E023E3F | Intel Corporation [Ver = 10.5.0.1 | Size = 700416 bytes | Modified Date = 7/3/2006 12:50:32 AM | Attr = ] IntelZeroConfig -> %ProgramFiles%\Intel\Wireless\Bin\ZCfgSvc.exe ["C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"] -> MD5 = 2DFB46F886A092B1AF5F3A4A3402F6EA | Intel Corporation [Ver = 10.5.0.5 | Size = 802816 bytes | Modified Date = 7/3/2006 4:07:28 AM | Attr = ] iTunesHelper -> %ProgramFiles%\iTunes\iTunesHelper.exe ["C:\Program Files\iTunes\iTunesHelper.exe"] -> MD5 = 04A9F0C58B170F30445BCC0683EF9FFC | Apple Inc. [Ver = 7.6.2.9 | Size = 267048 bytes | Modified Date = 3/30/2008 10:36:40 AM | Attr = ] Pinger -> %SystemDrive%\TOSHIBA\IVP\ISM\pinger.exe [c:\toshiba\ivp\ism\pinger.exe /run] -> MD5 = FA8D59CD0B55A489A3CF237ACF6F3D46 | TOSHIBA Corporation [Ver = 3.7.0.0 | Size = 151552 bytes | Modified Date = 3/17/2005 7:37:26 PM | Attr = ] PSQLLauncher -> %ProgramFiles%\Protector Suite QL\launcher.exe ["C:\Program Files\Protector Suite QL\launcher.exe" /startup] -> MD5 = 4D7F0C286F6C543F12DC45F18CB3A971 | UPEK Inc. [Ver = 5.4.0.2934 | Size = 30208 bytes | Modified Date = 5/5/2006 7:36:28 PM | Attr = ] QuickTime Task -> %ProgramFiles%\QuickTime\QTTask.exe ["C:\Program Files\QuickTime\qttask.exe" -atboottime] -> MD5 = 6DF76965A0FB8237E9C3B3CAB9815EC2 | Apple Inc. [Ver = 7.4.5 | Size = 413696 bytes | Modified Date = 3/28/2008 11:37:20 PM | Attr = ] RTHDCPL -> %SystemRoot%\RTHDCPL.exe [RTHDCPL.EXE] -> MD5 = 94897A21D751D72DA0F34421DE17FB9D | Realtek Semiconductor Corp. [Ver = 2.0.9.1 | Size = 16050688 bytes | Modified Date = 8/23/2006 7:08:04 AM | Attr = ] SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_07\bin\jusched.exe ["C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"] -> MD5 = 6AB4C021FBD36DC6764924C312428D97 | Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 144784 bytes | Modified Date = 6/10/2008 4:27:04 AM | Attr = ] SynTPEnh -> %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] -> MD5 = 6668B0E0B95E75CE3F3C8F737830F320 | Synaptics, Inc. [Ver = 8.2.13.2 02Mar06 | Size = 761948 bytes | Modified Date = 3/2/2006 6:02:08 PM | Attr = ] TPSMain -> %SystemRoot%\system32\TPSMain.exe [TPSMain.exe] -> MD5 = 1812D1BB1FAD95017C613F927EAC8147 | TOSHIBA Corporation [Ver = 1, 0, 15, 0 | Size = 282624 bytes | Modified Date = 5/31/2005 11:00:12 PM | Attr = ] Tvs -> %ProgramFiles%\TOSHIBA\Tvs\TvsTray.exe [C:\Program Files\Toshiba\Tvs\TvsTray.exe] -> MD5 = A468117106C94701A3B55576192815D4 | TOSHIBA Corporation [Ver = 1, 0, 0, 7 | Size = 73728 bytes | Modified Date = 2/2/2006 2:11:38 PM | Attr = ] < OptionalComponents [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\ -> IMAIL-> Installed = 1 -> MAPI-> Installed = 1 -> MSFS-> Installed = 1 -> < Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> swg -> %ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] -> MD5 = E616A6A6E91B0A86F2F6217CDE835FFE | Google Inc. [Ver = 2, 0, 301, 1654 | Size = 68856 bytes | Modified Date = 8/9/2008 12:19:42 PM | Attr = ] TOSCDSPD -> %ProgramFiles%\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe] -> MD5 = D8CF04E65081018CF3379B0FC02FFCBB | TOSHIBA [Ver = 1, 0, 6, 0 | Size = 65536 bytes | Modified Date = 12/30/2004 2:32:20 AM | Attr = ] < Run [HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\] > -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> swg -> %ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] -> MD5 = E616A6A6E91B0A86F2F6217CDE835FFE | Google Inc. [Ver = 2, 0, 301, 1654 | Size = 68856 bytes | Modified Date = 8/9/2008 12:19:42 PM | Attr = ] TOSCDSPD -> %ProgramFiles%\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe] -> MD5 = D8CF04E65081018CF3379B0FC02FFCBB | TOSHIBA [Ver = 1, 0, 6, 0 | Size = 65536 bytes | Modified Date = 12/30/2004 2:32:20 AM | Attr = ] < Administrator Startup Folder > -> C:\Documents and Settings\Administrator\Start Menu\Programs\Startup -> < All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> < Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup -> < AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs -> *AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls -> avgrsstx.dll -> %SystemRoot%\system32\avgrsstx.dll -> MD5 = 0535736A706D0B5DBCDB3B00307D707F | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 10520 bytes | Modified Date = 8/21/2008 5:01:40 PM | Attr = ] *MultiFile Done* -> -> < SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders -> *SecurityProviders* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders -> msapsspc.dll schannel.dll digest.dll msnsspc.dll -> -> File not found *MultiFile Done* -> -> < Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> *Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> Explorer.exe -> %SystemRoot%\explorer.exe -> MD5 = 12896823FB95BFB3DC9B46BCAEDC9923 | Microsoft Corporation [Ver = 6.00.2900.5512 (xpsp.080413-2105) | Size = 1033728 bytes | Modified Date = 4/13/2008 7:12:19 PM | Attr = ] *MultiFile Done* -> -> *UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit -> C:\WINDOWS\system32\userinit.exe -> %SystemRoot%\system32\userinit.exe -> MD5 = A93AEE1928A9D7CE3E16D24EC7380F89 | Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2113) | Size = 26112 bytes | Modified Date = 4/13/2008 7:12:38 PM | Attr = ] *MultiFile Done* -> -> *UIHost* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost -> logonui.exe -> %SystemRoot%\system32\logonui.exe -> MD5 = 2081A5B5E4ABA206A0A8A1A97DF0FB23 | Microsoft Corporation [Ver = 6.00.2900.5512 (xpsp.080413-2105) | Size = 514560 bytes | Modified Date = 4/13/2008 7:12:24 PM | Attr = ] *MultiFile Done* -> -> *VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> rundll32 shell32 -> %SystemRoot%\system32\shell32.dll -> MD5 = 0CF50B1F45DAB08430C1DBB79FE2CA5B | Microsoft Corporation [Ver = 6.00.2900.5512 (xpsp.080413-2105) | Size = 8461312 bytes | Modified Date = 4/13/2008 7:12:05 PM | Attr = ] Control_RunDLL "sysdm.cpl" -> %SystemRoot%\system32\sysdm.cpl -> MD5 = C504A9FE17F997F8B1F8561D0A68DE52 | Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2105) | Size = 300544 bytes | Modified Date = 4/13/2008 7:12:41 PM | Attr = ] *MultiFile Done* -> -> < Winlogon settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> < Winlogon settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> < Winlogon settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> < Winlogon settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> < Winlogon settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> < Winlogon settings [HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500] > -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> < Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> igfxcui -> %SystemRoot%\system32\igfxdev.dll -> MD5 = A58241451A149929A679C82FA934EF81 | Intel Corporation [Ver = 3.0.0.4543 | Size = 139264 bytes | Modified Date = 3/22/2006 11:12:42 PM | Attr = ] psfus -> %SystemRoot%\system32\psqlpwd.dll -> MD5 = B484246BAC533B1BB08E36000E6D267E | UPEK Inc. [Ver = 5.4.0.2934 | Size = 40448 bytes | Modified Date = 5/5/2006 7:48:24 PM | Attr = ] < CurrentVersion Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\ -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\undockwithoutlogon -> 1 -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\InstallVisualStyle -> %SystemRoot%\Resources\Themes\Royale\Royale.mss [C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles] -> File not found HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\InstallTheme -> %SystemRoot%\Resources\Themes\Royale.the [C:\WINDOWS\Resources\Themes\Royale.theme] -> File not found < CurrentVersion Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools -> 0 -> < CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 -> < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 -> < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 -> < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 -> < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500] > -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools -> 0 -> < CDROM Autorun Settings > [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\ -> -> *DependOnGroup* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DependOnGroup -> SCSI miniport -> -> File not found *MultiFile Done* -> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ErrorControl -> 1 -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Group -> SCSI CDROM Class -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Start -> 1 -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Tag -> 2 -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Type -> 1 -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DisplayName -> CD-ROM Driver -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ImagePath -> %SystemRoot%\system32\drivers\cdrom.sys [system32\DRIVERS\cdrom.sys] -> MD5 = 1F4260CC5B42272D71F79E570A27A4FE | Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2108) | Size = 62976 bytes | Modified Date = 4/13/2008 1:40:46 PM | Attr = ] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun -> 1 -> *AutoRunAlwaysDisable* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRunAlwaysDisable -> NEC MBR-7 -> -> File not found NEC MBR-7.4 -> -> File not found PIONEER CHANGR DRM-1804X -> -> File not found PIONEER CD-ROM DRM-6324X -> -> File not found PIONEER CD-ROM DRM-624X -> -> File not found TORiSAN CD-ROM CDR_C36 -> -> File not found *MultiFile Done* -> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\ -> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\0 -> IDE\CdRomMATSHITA_DVD-RAM_UJ-841S________________1.60____\5&226f6cf2&0&0.0.0 -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\Count -> 1 -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\NextInstance -> 1 -> < Drives - Autoruns > -> -> AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ] -> MD5 = D41D8CD98F00B204E9800998ECF8427E | [Ver = | Size = 0 bytes | Modified Date = 7/18/2006 9:37:30 PM | Attr = ] < HOSTS File > (734 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts -> < Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> HKEY_LOCAL_MACHINE\: Main\\Default_Page_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> HKEY_LOCAL_MACHINE\: Main\\Default_Search_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_LOCAL_MACHINE\: Main\\Local Page -> C:\windows\system32\blank.htm -> HKEY_LOCAL_MACHINE\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_LOCAL_MACHINE\: Main\\Start Page -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home -> HKEY_LOCAL_MACHINE\: Search\\CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> HKEY_LOCAL_MACHINE\: Search\\Default_Search_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_LOCAL_MACHINE\: Search\\SearchAssistant -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> < Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> HKEY_CURRENT_USER\: Main\\Default_Search_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_CURRENT_USER\: Main\\Local Page -> C:\WINDOWS\system32\blank.htm -> HKEY_CURRENT_USER\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_CURRENT_USER\: Main\\Start Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> HKEY_CURRENT_USER\: SearchURL\\ -> http://home.microsoft.com/access/autosearch.asp?p=%s[Reg Error: Value provider does not exist or could not be read.] -> HKEY_CURRENT_USER\: ProxyEnable -> 0 -> < Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> HKEY_USERS\.DEFAULT\: Main\\Search Bar -> http://www.toshiba.com/search -> HKEY_USERS\.DEFAULT\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_USERS\.DEFAULT\: Main\\Start Page -> http://www.toshibadirect.com/dpdstart -> HKEY_USERS\.DEFAULT\: ProxyEnable -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> HKEY_USERS\S-1-5-18\: Main\\Search Bar -> http://www.toshiba.com/search -> HKEY_USERS\S-1-5-18\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_USERS\S-1-5-18\: Main\\Start Page -> http://www.toshibadirect.com/dpdstart -> HKEY_USERS\S-1-5-18\: ProxyEnable -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> HKEY_USERS\S-1-5-19\: Main\\Search Bar -> http://www.toshiba.com/search -> HKEY_USERS\S-1-5-19\: Main\\Start Page -> http://www.toshibadirect.com/dpdstart -> < Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> HKEY_USERS\S-1-5-20\: Main\\Search Bar -> http://www.toshiba.com/search -> HKEY_USERS\S-1-5-20\: Main\\Start Page -> http://www.toshibadirect.com/dpdstart -> HKEY_USERS\S-1-5-20\: ProxyEnable -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\] > -> -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\: Main\\Default_Search_URL -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\: Main\\Local Page -> C:\WINDOWS\system32\blank.htm -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\: Main\\Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\: Main\\Start Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\: SearchURL\\ -> http://home.microsoft.com/access/autosearch.asp?p=%s[Reg Error: Value provider does not exist or could not be read.] -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\: ProxyEnable -> 0 -> < Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. -> 1 domain(s) and sub-domain(s) not assigned to a zone. < Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\] > -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\] > -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [AcroIEHlprObj Class] -> Unable to obtain MD5 | Adobe Systems Incorporated [Ver = 7.0.0.2004121400 | Size = 63136 bytes | Modified Date = 12/14/2004 3:56:50 AM | Attr = ] {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\AVG\AVG8\avgssie.dll [AVG Safe Search] -> MD5 = 7CF5C46FE2A65151950A3FB8084419EB | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.136 | Size = 455960 bytes | Modified Date = 8/21/2008 5:01:27 PM | Attr = ] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_07\bin\ssv.dll [SSVHelper Class] -> MD5 = F921D875A1CBD69A6A462BA2514BC831 | Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 509328 bytes | Modified Date = 6/10/2008 4:27:02 AM | Attr = ] {AA58ED58-01DD-4d91-8333-CF10577473F7} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbar2.dll [Google Toolbar Helper] -> MD5 = 6319F2D4708DBCAE37CFA03DA10782C0 | Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 7/21/2008 8:53:36 PM | Attr = R ] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll [Google Toolbar Notifier BHO] -> MD5 = F1D0608833F726C8FF84E11A46843CDE | Google Inc. [Ver = 3, 0, 1225, 9868 | Size = 734704 bytes | Modified Date = 8/9/2008 12:19:42 PM | Attr = ] < Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> {2318C2B1-4965-11d4-9B18-009027A5CD4F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbar2.dll [&Google] -> MD5 = 6319F2D4708DBCAE37CFA03DA10782C0 | Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 7/21/2008 8:53:36 PM | Attr = R ] < Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ -> WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbar2.dll [&Google] -> MD5 = 6319F2D4708DBCAE37CFA03DA10782C0 | Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 7/21/2008 8:53:36 PM | Attr = R ] < Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\] > -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\Software\Microsoft\Internet Explorer\Toolbar\ -> WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbar2.dll [&Google] -> MD5 = 6319F2D4708DBCAE37CFA03DA10782C0 | Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 7/21/2008 8:53:36 PM | Attr = R ] < Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> {08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_07\bin\npjpi160_07.dll [Sun Java Console] -> MD5 = 7C83A2809E13950359189767AC9D5DB8 | Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 132496 bytes | Modified Date = 6/10/2008 4:27:02 AM | Attr = ] {08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} [HKEY_CURRENT_USER] -> %ProgramFiles%\Java\jre1.6.0_07\bin\ssv.dll [Sun Java Console] -> MD5 = F921D875A1CBD69A6A462BA2514BC831 | Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 509328 bytes | Modified Date = 6/10/2008 4:27:02 AM | Attr = ] < Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_07\bin\npjpi160_07.dll [Sun Java Console] -> MD5 = 7C83A2809E13950359189767AC9D5DB8 | Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 132496 bytes | Modified Date = 6/10/2008 4:27:02 AM | Attr = ] CmdMapping\\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} [HKEY_LOCAL_MACHINE] -> [Reg Error: Key does not exist or could not be opened.] -> File not found < Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> &Google Search -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found &Translate English Word -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found Backward Links -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found Cached Snapshot of Page -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found Similar Pages -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found Translate Page into English -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found < Internet Explorer Extensions [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\ -> CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_07\bin\npjpi160_07.dll [Sun Java Console] -> MD5 = 7C83A2809E13950359189767AC9D5DB8 | Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 132496 bytes | Modified Date = 6/10/2008 4:27:02 AM | Attr = ] CmdMapping\\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} [HKEY_LOCAL_MACHINE] -> [Reg Error: Key does not exist or could not be opened.] -> File not found < Internet Explorer Extensions [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\ -> CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_07\bin\npjpi160_07.dll [Sun Java Console] -> MD5 = 7C83A2809E13950359189767AC9D5DB8 | Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 132496 bytes | Modified Date = 6/10/2008 4:27:02 AM | Attr = ] CmdMapping\\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} [HKEY_LOCAL_MACHINE] -> [Reg Error: Key does not exist or could not be opened.] -> File not found < Internet Explorer Extensions [HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\] > -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\Software\Microsoft\Internet Explorer\Extensions\ -> CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_07\bin\npjpi160_07.dll [Sun Java Console] -> MD5 = 7C83A2809E13950359189767AC9D5DB8 | Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 132496 bytes | Modified Date = 6/10/2008 4:27:02 AM | Attr = ] CmdMapping\\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} [HKEY_LOCAL_MACHINE] -> [Reg Error: Key does not exist or could not be opened.] -> File not found < Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\] > -> HKEY_USERS\S-1-5-21-3199582824-2625250360-4097293786-500\Software\Microsoft\Internet Explorer\MenuExt\ -> &Google Search -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found &Translate English Word -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found Backward Links -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found Cached Snapshot of Page -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found Similar Pages -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found Translate Page into English -> %ProgramFiles%\Google\GoogleToolbar1.dll -> File not found < Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> < User Agent Post Platform [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform -> AntivirXP08 -> AntivirXP08 -> < DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> {239E7586-1B37-4580-BB78-ED82B4C8D57E} -> (Windows Mobile-based Device) -> {4C5359C8-28D0-456B-A7C6-21B1CB51DBA0} -> (Realtek RTL8139/810x Family Fast Ethernet NIC) -> {777C746E-D21D-4EB5-9F4C-A0A3DD6A2A8A} -> (1394 Net Adapter) -> {B2C57DF0-CDE1-4859-9D51-E7D7B92B6726} -> (Windows Mobile-based Device) -> {B3D9B4ED-9B62-4FF5-B143-5C482184B5C5} -> (Intel(R) PRO/Wireless 3945ABG Network Connection) -> < Protocol Handlers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ -> ipp: [HKEY_LOCAL_MACHINE] -> No CLSID value linkscanner:{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\AVG\AVG8\avgpp.dll[XPLPPFilter Class] -> MD5 = 5E0B47F3AE5D516F3A185ED62FF437D9 | AVG Technologies CZ, s.r.o. [Ver = | Size = 79128 bytes | Modified Date = 8/21/2008 5:01:31 PM | Attr = ] msdaipp: [HKEY_LOCAL_MACHINE] -> No CLSID value < Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> {13EC55CF-D993-475B-9ACA-F4A384957956}[HKEY_LOCAL_MACHINE] -> https://www.windowsonecare.com/install/cli/1.1.1067.14/WinSSWebAgent.CAB[Reg Error: Key does not exist or could not be opened.] -> {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5}[HKEY_LOCAL_MACHINE] -> https://support.microsoft.com/OAS/ActiveX/odc.cab[Microsoft Data Collection Control] -> {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}[HKEY_LOCAL_MACHINE] -> http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168054657203[MUWebControl Class] -> {8AD9C840-044E-11D1-B3E9-00805F499D93}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab[Java Plug-in 1.6.0_07] -> {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab[Java Plug-in 1.5.0_06] -> {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab[Java Plug-in 1.6.0_03] -> {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab[Java Plug-in 1.6.0_05] -> {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab[Java Plug-in 1.6.0_07] -> {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab[Java Plug-in 1.6.0_07] -> {D27CDB6E-AE6D-11CF-96B8-444553540000}[HKEY_LOCAL_MACHINE] -> http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab[Shockwave Flash Object] -> < Module Usage Keys [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/muweb.dll\ -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/muweb.dll\\.Owner -> {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/muweb.dll\\{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/WINSSWEBAGENT.DLL\ -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/WINSSWEBAGENT.DLL\\.Owner -> Unknown Owner -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/WINSSWEBAGENT.DLL\\{13EC55CF-D993-475B-9ACA-F4A384957956} -> -> [Files/Folders - Created Within 30 days] $AVG8.VAULT$ -> %SystemDrive%\$AVG8.VAULT$ -> [Folder | Created Date = 8/21/2008 5:40:13 PM | Attr = H ] hiberfil.sys -> %SystemDrive%\hiberfil.sys -> Unable to obtain MD5 | [Ver = | Size = 2137051136 bytes | Created Date = 8/21/2008 2:13:01 PM | Attr = HS] apph_sp.sdb -> %SystemRoot%\System32\dllcache\apph_sp.sdb -> MD5 = 03429E251CCBE1B97E7B2FD21BD5C551 | [Ver = | Size = 790846 bytes | Created Date = 8/22/2008 10:56:42 AM | Attr = ] drvmain.sdb -> %SystemRoot%\System32\dllcache\drvmain.sdb -> MD5 = B037581A25AA16A5864218C0B296089C | [Ver = | Size = 9696 bytes | Created Date = 8/22/2008 10:56:42 AM | Attr = ] sysmain.sdb -> %SystemRoot%\System32\dllcache\sysmain.sdb -> MD5 = 9AD2A24B0888535357CEF0CFE2F1CCA7 | [Ver = | Size = 1214526 bytes | Created Date = 8/22/2008 10:56:42 AM | Attr = ] Avg -> %SystemRoot%\System32\drivers\Avg -> [Folder | Created Date = 8/21/2008 5:01:31 PM | Attr = ] avi7.avg -> %SystemRoot%\System32\drivers\Avg\avi7.avg -> MD5 = 6A74707B6F6D569044B0A32481E9B919 | [Ver = | Size = 6061540 bytes | Created Date = 8/21/2008 5:01:31 PM | Attr = ] incavi.avm -> %SystemRoot%\System32\drivers\Avg\incavi.avm -> MD5 = 5061FEFE0A4B369979CF703A60CF8A32 | [Ver = | Size = 26608478 bytes | Created Date = 8/21/2008 5:01:31 PM | Attr = ] microavi.avg -> %SystemRoot%\System32\drivers\Avg\microavi.avg -> MD5 = 0AFE432E9BF5C1221957FB6C71984A8B | [Ver = | Size = 70426 bytes | Created Date = 8/21/2008 5:01:31 PM | Attr = ] miniavi.avg -> %SystemRoot%\System32\drivers\Avg\miniavi.avg -> MD5 = 6339BA4DBE48512B025581AB2B5BB999 | [Ver = | Size = 211986 bytes | Created Date = 8/21/2008 5:01:31 PM | Attr = ] avgldx86.sys -> %SystemRoot%\System32\drivers\avgldx86.sys -> MD5 = 1D58D4B6514D740F41357F4FB4181256 | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.116 | Size = 96520 bytes | Created Date = 8/21/2008 5:01:36 PM | Attr = ] avgmfx86.sys -> %SystemRoot%\System32\drivers\avgmfx86.sys -> MD5 = 37A7618A843BB15B5430103C9945DC4C | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.132 | Size = 26824 bytes | Created Date = 8/21/2008 5:01:34 PM | Attr = ] mbam.sys -> %SystemRoot%\System32\drivers\mbam.sys -> MD5 = D0A24B1CE108774ED95EB4C56D39DB23 | Malwarebytes Corporation [Ver = 1, 0, 0, 1 | Size = 17144 bytes | Created Date = 8/25/2008 11:54:27 AM | Attr = ] mbamswissarmy.sys -> %SystemRoot%\System32\drivers\mbamswissarmy.sys -> MD5 = EDFEAA96258C813E37C4AFE3F6433A2E | Malwarebytes Corporation [Ver = 1.00 | Size = 38472 bytes | Created Date = 8/25/2008 11:54:26 AM | Attr = ] UMDF -> %SystemRoot%\System32\drivers\UMDF -> [Folder | Created Date = 8/22/2008 10:57:58 AM | Attr = ] MsftWdf_user_01_00_00.Wdf -> %SystemRoot%\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf -> MD5 = D41D8CD98F00B204E9800998ECF8427E | [Ver = | Size = 0 bytes | Created Date = 8/22/2008 10:57:58 AM | Attr = H ] 404Fix.exe -> %SystemRoot%\System32\404Fix.exe -> MD5 = 61FD593673225697D091DE2DDD2E9E47 | S!Ri.URZ [Ver = | Size = 82432 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] avgrsstx.dll -> %SystemRoot%\System32\avgrsstx.dll -> MD5 = 0535736A706D0B5DBCDB3B00307D707F | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 10520 bytes | Created Date = 8/21/2008 5:01:40 PM | Attr = ] Co2c40en.dll -> %SystemRoot%\System32\Co2c40en.dll -> MD5 = 78C745A6A97012147675CBE4EF4A45EC | [Ver = 4.6.1.106 | Size = 748167 bytes | Created Date = 8/12/2008 10:48:57 AM | Attr = ] Cryptocx.exp -> %SystemRoot%\System32\Cryptocx.exp -> MD5 = B6A28D06C4F501BD537AA0F5D6A08EFD | [Ver = | Size = 975 bytes | Created Date = 8/12/2008 10:48:56 AM | Attr = ] Cryptocx.lib -> %SystemRoot%\System32\Cryptocx.lib -> MD5 = E13428BF14DC69C0CFD228F5428301E2 | [Ver = | Size = 2616 bytes | Created Date = 8/12/2008 10:48:56 AM | Attr = ] Cryptocx.ocx -> %SystemRoot%\System32\Cryptocx.ocx -> MD5 = 7D984294BAD9CAD8AF77CE8500A89F6A | www.EasyByte.com [Ver = 4.01.0003 | Size = 266240 bytes | Created Date = 8/12/2008 10:48:55 AM | Attr = ] dumphive.exe -> %SystemRoot%\System32\dumphive.exe -> MD5 = 21868B2D22C726D94D98F15825D4134B | [Ver = | Size = 51200 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] Dunzip32.dll -> %SystemRoot%\System32\Dunzip32.dll -> MD5 = A8B03B341018D65C1092D4CFFA5AD775 | Inner Media, Inc. [Ver = 3.00.16 | Size = 99840 bytes | Created Date = 8/12/2008 10:48:56 AM | Attr = ] DWSBC32.OCX -> %SystemRoot%\System32\DWSBC32.OCX -> MD5 = FAD71BEE14DCCF8BAFFAECACD09972CD | Desaware Inc. [Ver = 4.2.010 | Size = 99840 bytes | Created Date = 8/12/2008 10:48:59 AM | Attr = ] Dwshk36.ocx -> %SystemRoot%\System32\Dwshk36.ocx -> MD5 = F1D2572F6B222CA756316F80E725FE58 | Desaware Inc. [Ver = 6.0.1.0 | Size = 141312 bytes | Created Date = 8/12/2008 10:48:56 AM | Attr = ] DWSPY32.DLL -> %SystemRoot%\System32\DWSPY32.DLL -> MD5 = D3B9E77B9903C119B0514A1CB83390D4 | Desaware [Ver = 4.2.009 | Size = 134656 bytes | Created Date = 8/12/2008 10:48:59 AM | Attr = ] DWSPY36.dll -> %SystemRoot%\System32\DWSPY36.dll -> MD5 = 01412C5DD0B6686038B21D47BB17D54E | Desaware Inc. [Ver = 6.2.0.0 | Size = 76800 bytes | Created Date = 8/12/2008 10:48:56 AM | Attr = ] dzip32.dll -> %SystemRoot%\System32\dzip32.dll -> MD5 = A485DABEE9D293AAC190C11676D8120A | Inner Media, Inc. [Ver = 3.00.16 | Size = 125440 bytes | Created Date = 8/12/2008 10:48:56 AM | Attr = ] fximg432.ocx -> %SystemRoot%\System32\fximg432.ocx -> MD5 = 2011ECEB317F1A980AD94E9ADE363419 | ImageFX [Ver = 4.1.000 | Size = 248744 bytes | Created Date = 8/12/2008 10:48:56 AM | Attr = ] fxtls432.dll -> %SystemRoot%\System32\fxtls432.dll -> MD5 = 18341BE747B14EB896E17C51F90005A9 | ImageFX [Ver = 4, 0, 0, 5 | Size = 107008 bytes | Created Date = 8/12/2008 10:48:57 AM | Attr = ] fxtmr432.OCX -> %SystemRoot%\System32\fxtmr432.OCX -> MD5 = 79DD0A5821F23594024EC7F15F8E92C2 | ImageFX [Ver = 4.1.0.0 | Size = 33712 bytes | Created Date = 8/12/2008 10:48:57 AM | Attr = ] fxvid432.ocx -> %SystemRoot%\System32\fxvid432.ocx -> MD5 = 5EEE3F2CDF99E9FAEB87A39713600436 | ImageFX [Ver = 4.1.000 | Size = 131496 bytes | Created Date = 8/12/2008 10:48:57 AM | Attr = ] GroupPolicy -> %SystemRoot%\System32\GroupPolicy -> [Folder | Created Date = 8/22/2008 11:01:03 AM | Attr = ] 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> IEDFix.C.exe -> %SystemRoot%\System32\IEDFix.C.exe -> MD5 = 61D808A9692623E1E1BC56E17F69F814 | S!Ri.URZ [Ver = | Size = 82432 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] Implode.dll -> %SystemRoot%\System32\Implode.dll -> MD5 = 0A0324A4282DF0F2C3129E5BD84077BC | [Ver = 1, 0, 0, 1 | Size = 18944 bytes | Created Date = 8/12/2008 10:48:59 AM | Attr = ] Process.exe -> %SystemRoot%\System32\Process.exe -> MD5 = 7397F6EE4A9601A123B645C0CD428017 | http://www.beyondlogic.org [Ver = 2, 0, 0, 0 | Size = 53248 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] rspchecksumr260.ocx -> %SystemRoot%\System32\rspchecksumr260.ocx -> MD5 = 6E02919B5FA35BDCC5E2A59A013897CD | RSP Software - http://rspsoftware.clic3.net [Ver = 2.06 | Size = 200704 bytes | Created Date = 8/12/2008 10:48:56 AM | Attr = ] SrchSTS.exe -> %SystemRoot%\System32\SrchSTS.exe -> MD5 = FC041F7D1341EEE456F1FA1A256CD24F | S!Ri [Ver = | Size = 288417 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] swreg.exe -> %SystemRoot%\System32\swreg.exe -> MD5 = E417D888FDDE9A2290C369C82A7AEC3E | SteelWerX [Ver = 2.0.1.0 | Size = 135168 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] swsc.exe -> %SystemRoot%\System32\swsc.exe -> MD5 = C16B1595E3C2FFC875EF28BF66EC557F | [Ver = | Size = 40960 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] swxcacls.exe -> %SystemRoot%\System32\swxcacls.exe -> MD5 = EF5DC4CF7C39CFB4653859878C14D86C | SteelWerX [Ver = 1.0.1.1 | Size = 79360 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] tmp.reg -> %SystemRoot%\System32\tmp.reg -> MD5 = BB6A843D8E668866D74BED1E65D009D2 | [Ver = | Size = 3722 bytes | Created Date = 8/21/2008 12:12:21 PM | Attr = ] VACFix.exe -> %SystemRoot%\System32\VACFix.exe -> MD5 = 4303FC5CDA3B4DAD7ED4A5573BFBC83D | S!Ri.URZ [Ver = | Size = 86528 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] VCCLSID.exe -> %SystemRoot%\System32\VCCLSID.exe -> MD5 = D726E152E257A1AB819F88312EC69620 | S!Ri [Ver = | Size = 289144 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] WS2Fix.exe -> %SystemRoot%\System32\WS2Fix.exe -> MD5 = 49B5595B1824BEA6D850E0ED08B53E43 | [Ver = | Size = 25600 bytes | Created Date = 8/21/2008 12:10:39 PM | Attr = ] CSC -> %SystemRoot%\CSC -> [Folder | Created Date = 8/21/2008 12:03:01 PM | Attr = HS] 1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> Sysvxd.exe -> %SystemRoot%\Sysvxd.exe -> MD5 = 1B31CF72937C802EF3206F2B15133B5B | [Ver = | Size = 179 bytes | Created Date = 8/14/2008 1:20:06 AM | Attr = ] teensmrt.ini -> %SystemRoot%\teensmrt.ini -> MD5 = BAEBA9851B8E36C183C4294B0E2D6C74 | [Ver = | Size = 227 bytes | Created Date = 8/12/2008 10:48:48 AM | Attr = ] [Files/Folders - Modified Within 30 days] $AVG8.VAULT$ -> %SystemDrive%\$AVG8.VAULT$ -> [Folder | Modified Date = 8/22/2008 4:06:24 PM | Attr = H ] Config.Msi -> %SystemDrive%\Config.Msi -> [Folder | Modified Date = 8/26/2008 8:39:50 AM | Attr = H ] hiberfil.sys -> %SystemDrive%\hiberfil.sys -> Unable to obtain MD5 | [Ver = | Size = 2137051136 bytes | Modified Date = 8/26/2008 8:30:02 AM | Attr = HS] Program Files -> %ProgramFiles% -> [Folder | Modified Date = 8/25/2008 11:54:25 AM | Attr = ] RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Modified Date = 8/21/2008 12:39:27 PM | Attr = HS] System Volume Information -> %SystemDrive%\System Volume Information -> [Folder | Modified Date = 8/14/2008 1:48:10 PM | Attr = HS] temp -> %SystemDrive%\temp -> [Folder | Modified Date = 8/26/2008 8:47:57 AM | Attr = ] WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 8/26/2008 8:58:44 AM | Attr = ] Avg -> %SystemRoot%\System32\drivers\Avg -> [Folder | Modified Date = 8/26/2008 8:33:16 AM | Attr = ] avi7.avg -> %SystemRoot%\System32\drivers\Avg\avi7.avg -> MD5 = 6A74707B6F6D569044B0A32481E9B919 | [Ver = | Size = 6061540 bytes | Modified Date = 8/21/2008 5:01:31 PM | Attr = ] incavi.avm -> %SystemRoot%\System32\drivers\Avg\incavi.avm -> MD5 = 5061FEFE0A4B369979CF703A60CF8A32 | [Ver = | Size = 26608478 bytes | Modified Date = 8/26/2008 8:33:15 AM | Attr = ] microavi.avg -> %SystemRoot%\System32\drivers\Avg\microavi.avg -> MD5 = 0AFE432E9BF5C1221957FB6C71984A8B | [Ver = | Size = 70426 bytes | Modified Date = 8/25/2008 10:08:18 PM | Attr = ] miniavi.avg -> %SystemRoot%\System32\drivers\Avg\miniavi.avg -> MD5 = 6339BA4DBE48512B025581AB2B5BB999 | [Ver = | Size = 211986 bytes | Modified Date = 8/21/2008 5:05:20 PM | Attr = ] avgldx86.sys -> %SystemRoot%\System32\drivers\avgldx86.sys -> MD5 = 1D58D4B6514D740F41357F4FB4181256 | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.116 | Size = 96520 bytes | Modified Date = 8/21/2008 5:01:36 PM | Attr = ] avgmfx86.sys -> %SystemRoot%\System32\drivers\avgmfx86.sys -> MD5 = 37A7618A843BB15B5430103C9945DC4C | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.132 | Size = 26824 bytes | Modified Date = 8/21/2008 5:01:34 PM | Attr = ] mbam.sys -> %SystemRoot%\System32\drivers\mbam.sys -> MD5 = D0A24B1CE108774ED95EB4C56D39DB23 | Malwarebytes Corporation [Ver = 1, 0, 0, 1 | Size = 17144 bytes | Modified Date = 8/17/2008 3:01:14 PM | Attr = ] mbamswissarmy.sys -> %SystemRoot%\System32\drivers\mbamswissarmy.sys -> MD5 = EDFEAA96258C813E37C4AFE3F6433A2E | Malwarebytes Corporation [Ver = 1.00 | Size = 38472 bytes | Modified Date = 8/17/2008 3:01:18 PM | Attr = ] UMDF -> %SystemRoot%\System32\drivers\UMDF -> [Folder | Modified Date = 8/22/2008 10:58:39 AM | Attr = ] MsftWdf_user_01_00_00.Wdf -> %SystemRoot%\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf -> MD5 = D41D8CD98F00B204E9800998ECF8427E | [Ver = | Size = 0 bytes | Modified Date = 8/22/2008 10:57:58 AM | Attr = H ] 404Fix.exe -> %SystemRoot%\System32\404Fix.exe -> MD5 = 61FD593673225697D091DE2DDD2E9E47 | S!Ri.URZ [Ver = | Size = 82432 bytes | Modified Date = 8/18/2008 12:19:03 PM | Attr = ] amcompat.tlb -> %SystemRoot%\System32\amcompat.tlb -> MD5 = 6D6F4B1886E91EB37ABCCAD19C561EE0 | [Ver = | Size = 16832 bytes | Modified Date = 8/22/2008 10:59:39 AM | Attr = ] avgrsstx.dll -> %SystemRoot%\System32\avgrsstx.dll -> MD5 = 0535736A706D0B5DBCDB3B00307D707F | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 10520 bytes | Modified Date = 8/21/2008 5:01:40 PM | Attr = ] CatRoot -> %SystemRoot%\System32\CatRoot -> [Folder | Modified Date = 8/24/2008 3:00:44 AM | Attr = ] 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> CatRoot2 -> %SystemRoot%\System32\CatRoot2 -> [Folder | Modified Date = 8/26/2008 3:00:16 AM | Attr = ] dllcache -> %SystemRoot%\System32\dllcache -> [Folder | Modified Date = 8/24/2008 3:01:04 AM | Attr = RHS] drivers -> %SystemRoot%\System32\drivers -> [Folder | Modified Date = 8/25/2008 11:54:27 AM | Attr = ] en-US -> %SystemRoot%\System32\en-US -> [Folder | Modified Date = 8/22/2008 11:01:05 AM | Attr = ] FxsTmp -> %SystemRoot%\System32\FxsTmp -> [Folder | Modified Date = 8/13/2008 12:18:00 PM | Attr = ] GroupPolicy -> %SystemRoot%\System32\GroupPolicy -> [Folder | Modified Date = 8/22/2008 11:01:03 AM | Attr = ] IEDFix.C.exe -> %SystemRoot%\System32\IEDFix.C.exe -> MD5 = 61D808A9692623E1E1BC56E17F69F814 | S!Ri.URZ [Ver = | Size = 82432 bytes | Modified Date = 8/14/2008 9:52:23 PM | Attr = ] LogFiles -> %SystemRoot%\System32\LogFiles -> [Folder | Modified Date = 8/22/2008 10:57:58 AM | Attr = ] nscompat.tlb -> %SystemRoot%\System32\nscompat.tlb -> MD5 = A32B14BE5EDAE794FCE1A9E970827509 | [Ver = | Size = 23392 bytes | Modified Date = 8/22/2008 10:59:39 AM | Attr = ] perfc009.dat -> %SystemRoot%\System32\perfc009.dat -> MD5 = 6C1D8455343CC7FA14F08F619CEEC567 | [Ver = | Size = 73018 bytes | Modified Date = 8/22/2008 11:01:10 AM | Attr = ] perfh009.dat -> %SystemRoot%\System32\perfh009.dat -> MD5 = 8777F783A5A924A7BDACD49AF184334D | [Ver = | Size = 433062 bytes | Modified Date = 8/22/2008 11:01:10 AM | Attr = ] PerfStringBackup.INI -> %SystemRoot%\System32\PerfStringBackup.INI -> MD5 = 79FB11395CCCF14900BF90213323C0ED | [Ver = | Size = 507728 bytes | Modified Date = 8/22/2008 11:01:10 AM | Attr = ] Restore -> %SystemRoot%\System32\Restore -> [Folder | Modified Date = 8/13/2008 11:41:20 PM | Attr = ] tmp.reg -> %SystemRoot%\System32\tmp.reg -> MD5 = BB6A843D8E668866D74BED1E65D009D2 | [Ver = | Size = 3722 bytes | Modified Date = 8/21/2008 12:12:21 PM | Attr = ] wbem -> %SystemRoot%\System32\wbem -> [Folder | Modified Date = 8/22/2008 11:01:03 AM | Attr = ] wpa.dbl -> %SystemRoot%\System32\wpa.dbl -> MD5 = C9B9357F16E058DB5028494E7B84BE4D | [Ver = | Size = 1158 bytes | Modified Date = 8/25/2008 11:49:28 AM | Attr = ] $hf_mig$ -> %SystemRoot%\$hf_mig$ -> [Folder | Modified Date = 8/22/2008 11:01:38 AM | Attr = H ] 1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> AppPatch -> %SystemRoot%\AppPatch -> [Folder | Modified Date = 8/22/2008 11:30:08 AM | Attr = ] bootstat.dat -> %SystemRoot%\bootstat.dat -> MD5 = 6A2CB42966136854F4464516FBB4AE72 | [Ver = | Size = 2048 bytes | Modified Date = 8/26/2008 8:30:03 AM | Attr = S] CSC -> %SystemRoot%\CSC -> [Folder | Modified Date = 8/21/2008 12:03:01 PM | Attr = HS] Debug -> %SystemRoot%\Debug -> [Folder | Modified Date = 8/21/2008 12:39:29 PM | Attr = ] ehome -> %SystemRoot%\ehome -> [Folder | Modified Date = 8/22/2008 11:30:08 AM | Attr = ] Help -> %SystemRoot%\Help -> [Folder | Modified Date = 8/22/2008 11:01:44 AM | Attr = ] inf -> %SystemRoot%\inf -> [Folder | Modified Date = 8/26/2008 3:00:44 AM | Attr = H ] Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 8/26/2008 8:39:50 AM | Attr = HS] machine.ver -> %SystemRoot%\machine.ver -> MD5 = F652EF916652E7B65DE4C5A09B884B81 | [Ver = | Size = 2838 bytes | Modified Date = 8/12/2008 12:20:49 PM | Attr = ] Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 8/26/2008 1:41:52 PM | Attr = ] QTFont.qfn -> %SystemRoot%\QTFont.qfn -> MD5 = DBA91CD5A3A68302967C03213E52BDE8 | [Ver = | Size = 54156 bytes | Modified Date = 8/26/2008 8:39:24 AM | Attr = H ] Registration -> %SystemRoot%\Registration -> [Folder | Modified Date = 8/26/2008 8:30:27 AM | Attr = ] SoftwareDistribution -> %SystemRoot%\SoftwareDistribution -> [Folder | Modified Date = 8/22/2008 10:49:48 AM | Attr = ] system32 -> %SystemRoot%\system32 -> [Folder | Modified Date = 8/24/2008 3:01:04 AM | Attr = ] Sysvxd.exe -> %SystemRoot%\Sysvxd.exe -> MD5 = 1B31CF72937C802EF3206F2B15133B5B | [Ver = | Size = 179 bytes | Modified Date = 8/14/2008 1:20:06 AM | Attr = ] teensmrt.ini -> %SystemRoot%\teensmrt.ini -> MD5 = BAEBA9851B8E36C183C4294B0E2D6C74 | [Ver = | Size = 227 bytes | Modified Date = 8/12/2008 10:49:16 AM | Attr = ] Temp -> %SystemRoot%\Temp -> [Folder | Modified Date = 8/26/2008 3:08:11 PM | Attr = ] win.ini -> %SystemRoot%\win.ini -> MD5 = F4C7FD77FE13077D7C0E9BEC4CA72EF5 | [Ver = | Size = 603 bytes | Modified Date = 8/22/2008 10:59:34 AM | Attr = ] WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified Date = 8/21/2008 5:01:13 PM | Attr = ] AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job -> MD5 = FD8C3A19EC8A9568711B8B4CCE46B5B8 | [Ver = | Size = 284 bytes | Modified Date = 8/22/2008 11:04:02 AM | Attr = ] SA.DAT -> %SystemRoot%\tasks\SA.DAT -> MD5 = F1A6CD5ADAAB953A6764EA364E17BFB8 | [Ver = | Size = 6 bytes | Modified Date = 8/26/2008 8:30:08 AM | Attr = H ] C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader -> [Folder | Modified Date = 7/19/2006 9:14:08 PM | Attr = ] qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> MD5 = FA223CB9252435F2EF6845F1A22352FF | [Ver = | Size = 4232 bytes | Modified Date = 8/25/2008 3:11:58 PM | Attr = ] qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> MD5 = 5149D39A272828A8E09752A7F9D4F9AA | [Ver = | Size = 4646 bytes | Modified Date = 8/25/2008 3:11:58 PM | Attr = ] C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA -> [Folder | Modified Date = 7/18/2006 9:43:44 PM | Attr = ] opa11.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa11.dat -> MD5 = 4A6023879295C3445DD52646A33E6ADE | [Ver = | Size = 11112 bytes | Modified Date = 1/5/2007 5:36:12 PM | Attr = ] C:\Documents and Settings\All Users\Application Data\Microsoft\PI\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\PI -> [Folder | Modified Date = 7/19/2006 9:13:07 PM | Attr = ] mspi11.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\PI\mspi11.dat -> MD5 = A8622CCE13A2F68A67071C658EC5D39A | [Ver = | Size = 4 bytes | Modified Date = 7/19/2006 9:13:07 PM | Attr = ] C:\Documents and Settings\All Users\Application Data\Microsoft\POD\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\POD -> [Folder | Modified Date = 7/19/2006 9:13:07 PM | Attr = ] mspod11.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\POD\mspod11.dat -> MD5 = A8622CCE13A2F68A67071C658EC5D39A | [Ver = | Size = 4 bytes | Modified Date = 7/19/2006 9:13:07 PM | Attr = ] C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc -> [Folder | Modified Date = 8/26/2008 8:30:24 AM | Attr = ] Perflib_Perfdata_300.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_300.dat -> Unable to obtain MD5 | [Ver = | Size = 16384 bytes | Modified Date = 8/26/2008 8:30:24 AM | Attr = ] C:\Documents and Settings\All Users\Application Data\Microsoft\Works\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works -> [Folder | Modified Date = 1/14/2007 8:50:36 PM | Attr = ] wkcalcat.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works\wkcalcat.dat -> MD5 = AA563914D536084370039886074AE4C7 | [Ver = | Size = 16384 bytes | Modified Date = 12/14/2006 9:36:31 PM | Attr = ] wklntsk1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works\wklntsk1.dat -> MD5 = 9AA509075A1A646B25CCDB7CADFCF410 | [Ver = | Size = 162475 bytes | Modified Date = 12/14/2006 9:36:56 PM | Attr = ] C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\ -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\ -> [Folder | Modified Date = 8/21/2008 5:04:16 PM | Attr = ] avgsetup.exe -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\avgsetup.exe -> MD5 = 58344AE4BC6759E8E2AAE3888FEAD8E6 | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 2539800 bytes | Modified Date = 7/4/2008 7:06:51 AM | Attr = ] C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\ -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\ -> [Folder | Modified Date = 8/21/2008 4:33:57 PM | Attr = ] avgsetup.exe -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\avgsetup.exe -> MD5 = 58344AE4BC6759E8E2AAE3888FEAD8E6 | AVG Technologies CZ, s.r.o. [Ver = 8.0.0.134 | Size = 2539800 bytes | Modified Date = 7/4/2008 7:06:51 AM | Attr = ] C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\ -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\ -> [Folder | Modified Date = 8/21/2008 5:04:16 PM | Attr = ] sporder.dll -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\sporder.dll -> MD5 = 97F50C3E6EEB45CBE2413431F1BB52FB | Microsoft Corporation [Ver = 5.00.2134.1 | Size = 8464 bytes | Modified Date = 8/7/2007 2:01:31 PM | Attr = ] C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\ -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\ -> [Folder | Modified Date = 8/21/2008 4:33:57 PM | Attr = ] sporder.dll -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\sporder.dll -> MD5 = 97F50C3E6EEB45CBE2413431F1BB52FB | Microsoft Corporation [Ver = 5.00.2134.1 | Size = 8464 bytes | Modified Date = 8/7/2007 2:01:31 PM | Attr = ] C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\ -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\ -> [Folder | Modified Date = 8/21/2008 5:04:16 PM | Attr = ] files.dat -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\files.dat -> MD5 = 3E2939865BC5F7D471207F5B3635F650 | [Ver = | Size = 76424696 bytes | Modified Date = 7/4/2008 7:07:08 AM | Attr = ] setup.dat -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\setup.dat -> MD5 = 23991D9C13D80514BA968DAA4E295611 | [Ver = | Size = 862808 bytes | Modified Date = 7/4/2008 7:06:50 AM | Attr = ] trialkey.dat -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zS1.tmp\trialkey.dat -> MD5 = 884C21B5FD45335AA34B6936F323CB43 | [Ver = | Size = 70 bytes | Modified Date = 7/4/2008 7:06:50 AM | Attr = ] C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\ -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\ -> [Folder | Modified Date = 8/21/2008 4:33:57 PM | Attr = ] files.dat -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\files.dat -> MD5 = 3E2939865BC5F7D471207F5B3635F650 | [Ver = | Size = 76424696 bytes | Modified Date = 7/4/2008 7:07:08 AM | Attr = ] setup.dat -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\setup.dat -> MD5 = 23991D9C13D80514BA968DAA4E295611 | [Ver = | Size = 862808 bytes | Modified Date = 7/4/2008 7:06:50 AM | Attr = ] trialkey.dat -> C:\Documents and Settings\Administrator\Local Settings\Temp\7zSB.tmp\trialkey.dat -> MD5 = 884C21B5FD45335AA34B6936F323CB43 | [Ver = | Size = 70 bytes | Modified Date = 7/4/2008 7:06:50 AM | Attr = ] C:\WINDOWS\Temp\Cookies\ -> C:\WINDOWS\Temp\Cookies -> [Folder | Modified Date = 8/22/2008 11:04:03 AM | Attr = HS] index.dat -> C:\WINDOWS\Temp\Cookies\index.dat -> MD5 = D7A950FEFD60DBAA01DF2D85FEFB3862 | [Ver = | Size = 16384 bytes | Modified Date = 8/22/2008 11:04:02 AM | Attr = HS] C:\WINDOWS\Temp\History\History.IE5\ -> C:\WINDOWS\Temp\History\History.IE5\ -> [Folder | Modified Date = 8/22/2008 11:04:03 AM | Attr = HS] index.dat -> C:\WINDOWS\Temp\History\History.IE5\index.dat -> MD5 = D7A950FEFD60DBAA01DF2D85FEFB3862 | [Ver = | Size = 16384 bytes | Modified Date = 8/22/2008 11:04:02 AM | Attr = HS] C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> [Folder | Modified Date = 8/22/2008 11:04:03 AM | Attr = HS] index.dat -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat -> MD5 = B4F5A4759BD52AF15829E0FD25E1BF1F | [Ver = | Size = 32768 bytes | Modified Date = 8/22/2008 11:04:02 AM | Attr = HS] C:\WINDOWS\Temp\History\History.IE5\ -> C:\WINDOWS\Temp\History\History.IE5\ -> [Folder | Modified Date = 8/22/2008 11:04:03 AM | Attr = HS] desktop.ini -> C:\WINDOWS\Temp\History\History.IE5\desktop.ini -> MD5 = BA96961F5E22882527919E19DAEA510F | [Ver = | Size = 145 bytes | Modified Date = 8/22/2008 11:04:03 AM | Attr = ] C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> [Folder | Modified Date = 8/22/2008 11:04:03 AM | Attr = HS] desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini -> MD5 = 4A3DEB274BB5F0212C2419D3D8D08612 | [Ver = | Size = 67 bytes | Modified Date = 8/22/2008 11:04:02 AM | Attr = HS] C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\0C5A72LG\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\0C5A72LG -> [Folder | Modified Date = 8/22/2008 11:04:06 AM | Attr = HS] desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\0C5A72LG\desktop.ini -> MD5 = 4A3DEB274BB5F0212C2419D3D8D08612 | [Ver = | Size = 67 bytes | Modified Date = 8/22/2008 11:04:03 AM | Attr = HS] C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\A4BF9OL6\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\A4BF9OL6 -> [Folder | Modified Date = 8/22/2008 11:04:07 AM | Attr = HS] desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\A4BF9OL6\desktop.ini -> MD5 = 4A3DEB274BB5F0212C2419D3D8D08612 | [Ver = | Size = 67 bytes | Modified Date = 8/22/2008 11:04:02 AM | Attr = HS] C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\H6KL36M0\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\H6KL36M0 -> [Folder | Modified Date = 8/22/2008 11:04:07 AM | Attr = HS] desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\H6KL36M0\desktop.ini -> MD5 = 4A3DEB274BB5F0212C2419D3D8D08612 | [Ver = | Size = 67 bytes | Modified Date = 8/22/2008 11:04:03 AM | Attr = HS] C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\P4FD8D84\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\P4FD8D84 -> [Folder | Modified Date = 8/22/2008 11:04:06 AM | Attr = HS] desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\P4FD8D84\desktop.ini -> MD5 = 4A3DEB274BB5F0212C2419D3D8D08612 | [Ver = | Size = 67 bytes | Modified Date = 8/22/2008 11:04:03 AM | Attr = HS] < End of report > [/code]