Help,

I have some sort of redirect malware/virus! If i click on an image from google images then my browser shows the target page briefly before redirecting me to a page that starts www.searchmagnified.com but the title on the page is Gilane.net.

I have tried a few things but it still remains. I can't find anything to give the solution. Only partly finished investigations.
I have no problems to visit antispyware sites. Symantec doesn't spot it and malwarebytes hasn't managed to remove it yet either.

Not sure what to try next?!?

Help please

Just ran a new malwarebytes. 2 infections removed
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4051

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

29/04/2010 17:25:42
mbam-log-2010-04-29 (17-25-42).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 238337
Time elapsed: 2 hour(s), 22 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\disableconfig (Windows.Tool.Disabled) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Please visit this webpage for a tutorial on downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

See the area: Using ComboFix, and when done, post the log back here.

Just rebooted after malwarebytes and still got the issue. Will look at combofix and post log

ok

Hi,
log posted in PM. feel free to share once you have had a look at it. No idea if it is interesting?!?
In fact it is very interesting as Combofix seems to have fixed the issue. will reboot and confirm.

Thank you

OK rebooted and all is looking really good!

No redirect on google images. Combofix did the trick where as malwarebytes and others either didn't pick it up or didn't get rid of the source. Anyway a HUGE thank you.

You are a star

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic
  

looking clean. Running eset now. Only issue is that the laptop tries to automatically install Safeguard Easy on every boot but fails eventually saying some files are missing. Safeguard easy is however available on the program list and seems to work OK! Will post the logs when finished

Finished. No threats found says eset:
No log found either!
I did say to uninstall once finished though.
Do you want me to rescan?

I have also fixed the Safeguard issue by a reinstall.

No need for that.

Hi

Download OTL to your Desktop. (If you already have it downloaded, then just follow the instructions below).

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan box paste this in
  
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\*.sys
  %systemroot%\system32\drivers\*.dll
  %systemroot%\system32\drivers\*.ini
  %systemroot%\system32\drivers\*.exe
  %SYSTEMDRIVE%\*.*
  %PROGRAMFILES%\*.
  %appdata%\*.*
  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  disk.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  usbstor.sys
  /md5stop
  CREATERESTOREPOINT
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) and paste (Edit->Paste) the contents of these files, one at a time
    

OTL.txt log
OTL logfile created on: 30/04/2010 23:01:33 - Run 1
OTL by OldTimer - Version 3.2.3.1 Folder = D:\Users\MCornall\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 56.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 30.00 Gb Total Space | 10.68 Gb Free Space | 35.61% Space Free | Partition Type: NTFS
Drive D: | 44.04 Gb Total Space | 9.88 Gb Free Space | 22.43% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive P: | 44.04 Gb Total Space | 9.88 Gb Free Space | 22.43% Space Free | Partition Type: *NT5CSC
Drive Z: | 458.11 Gb Total Space | 18.87 Gb Free Space | 4.12% Space Free | Partition Type: NTFS

Computer Name: E0062643
Current User Name: MCornall
NOT logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/04/30 23:00:01 | 000,562,176 | ---- | M] (OldTimer Tools) -- D:\Users\MCornall\Desktop\OTL.exe
PRC - [2010/04/02 23:39:46 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/12/17 20:43:14 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2009/10/12 11:24:42 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
PRC - [2009/09/06 05:19:34 | 029,180,768 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
PRC - [2009/08/31 19:53:14 | 000,098,304 | ---- | M] (Jedox AG) -- C:\Program Files\Jedox\Palo\Manager.exe
PRC - [2009/08/31 12:35:36 | 001,822,720 | ---- | M] (Jedox AG) -- C:\Program Files\Jedox\Palo\MDXInterpreter.exe
PRC - [2009/07/24 15:05:26 | 000,762,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\vVX3000.exe
PRC - [2009/07/24 15:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2009/06/25 14:04:32 | 005,723,656 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office Communicator\communicator.exe
PRC - [2009/02/25 01:00:00 | 000,024,576 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\OA001Mon.exe
PRC - [2008/12/01 19:39:00 | 000,315,570 | ---- | M] (Hewlett-Packard) -- C:\Program Files\HPOVCM\radstgms.exe
PRC - [2008/11/18 21:19:28 | 000,483,420 | ---- | M] (IDT, Inc.) -- C:\Program Files\IDT\WDM\sttray.exe
PRC - [2008/11/18 21:19:28 | 000,241,746 | ---- | M] (IDT, Inc.) -- c:\_\@D\Dell\Exx00\AUDIO\stacsv.exe
PRC - [2008/11/11 16:35:22 | 000,020,840 | ---- | M] (Broadcom Corporation) -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
PRC - [2008/11/11 16:35:20 | 000,808,296 | ---- | M] (Broadcom Corporation) -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
PRC - [2008/10/16 17:26:20 | 000,860,160 | ---- | M] (Intel(R) Corporation) -- c:\Program Files\Intel\WiFi\bin\EvtEng.exe
PRC - [2008/10/16 17:15:58 | 000,348,160 | ---- | M] (Intel(R) Corporation) -- c:\Program Files\Intel\WiFi\bin\WLKEEPER.exe
PRC - [2008/10/16 17:14:56 | 001,368,064 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
PRC - [2008/10/16 17:05:38 | 000,905,216 | ---- | M] (Intel(R) Corporation) -- c:\Program Files\Intel\WiFi\bin\S24EvMon.exe
PRC - [2008/10/16 16:55:42 | 001,191,936 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
PRC - [2008/10/16 16:54:34 | 000,466,944 | ---- | M] (Intel(R) Corporation) -- c:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
PRC - [2008/10/02 14:04:14 | 000,200,704 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\Apoint.exe
PRC - [2008/09/16 21:03:50 | 000,050,472 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2008/09/12 01:50:46 | 002,436,536 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
PRC - [2008/09/04 23:44:20 | 001,439,040 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
PRC - [2008/09/04 23:44:18 | 001,787,200 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
PRC - [2008/08/28 16:20:22 | 000,049,250 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\hidfind.exe
PRC - [2008/08/27 12:37:10 | 000,471,040 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\AESTFltr.exe
PRC - [2008/08/20 08:45:26 | 000,466,432 | ---- | M] () -- C:\Program Files\qpac\qpac.exe
PRC - [2008/08/14 22:45:52 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2008/08/14 22:45:28 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2008/05/02 09:40:06 | 000,153,096 | ---- | M] (EMC) -- C:\Program Files\eRoom 7\ERClient7.exe
PRC - [2008/04/30 11:30:26 | 000,172,210 | ---- | M] (Hewlett-Packard) -- C:\Program Files\HPOVCM\radsched.exe
PRC - [2008/04/14 05:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/14 05:00:00 | 000,114,688 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\calc.exe
PRC - [2008/02/06 11:33:38 | 000,024,653 | ---- | M] (Utimaco Safeware AG) -- C:\Program Files\Utimaco\SafeGuard Easy\ecview.exe
PRC - [2008/02/06 11:27:00 | 000,163,931 | ---- | M] (Utimaco Safeware AG) -- c:\Program Files\Utimaco\SafeGuard Easy\WksCfgSrv.exe
PRC - [2008/02/06 11:26:22 | 000,114,773 | ---- | M] (Utimaco Safeware AG) -- c:\Program Files\Utimaco\SafeGuard Easy\SgeCtl.exe
PRC - [2008/01/18 16:57:54 | 005,750,784 | ---- | M] () -- C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
PRC - [2007/10/25 18:23:36 | 000,049,152 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApntEx.exe
PRC - [2007/05/10 22:46:20 | 000,624,248 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
PRC - [2007/02/20 13:59:58 | 000,270,510 | ---- | M] (Hewlett-Packard) -- C:\Program Files\HPOVCM\radexecd.exe
PRC - [2007/02/10 06:29:56 | 000,089,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2006/11/13 13:39:52 | 001,289,000 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\wcescomm.exe
PRC - [2006/11/13 13:39:34 | 000,199,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\rapimgr.exe
PRC - [2006/04/20 08:34:26 | 001,520,688 | ---- | M] (Cisco Systems, Inc.) -- c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2005/03/31 11:27:00 | 000,061,440 | ---- | M] (Utimaco Safeware AG) -- C:\WINDOWS\system32\SgLogPlayer.exe


========== Modules (SafeList) ==========

MOD - [2010/04/30 23:00:01 | 000,562,176 | ---- | M] (OldTimer Tools) -- D:\Users\MCornall\Desktop\OTL.exe
MOD - [2008/08/25 16:39:08 | 000,106,496 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\hccutils.dll
MOD - [2008/02/06 11:26:18 | 000,028,752 | ---- | M] (Utimaco Safeware AG) -- c:\Program Files\Utimaco\SafeGuard Easy\SgMsgBhk.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/12/17 20:43:14 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2009/10/20 19:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2009/10/12 11:24:42 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/09/06 05:19:34 | 029,180,768 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$ACTIXSQLEXPRESS) SQL Server (ACTIXSQLEXPRESS)
SRV - [2009/08/31 19:53:06 | 000,167,936 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Jedox\Palo\palo.exe -- (PaloServerService)
SRV - [2009/08/31 12:35:36 | 001,822,720 | ---- | M] (Jedox AG) [Auto | Running] -- C:\Program Files\Jedox\Palo\MDXInterpreter.exe -- (PaloMDXInterpreter)
SRV - [2009/07/24 15:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2008/12/01 19:39:00 | 000,315,570 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\HPOVCM\Radstgms.exe -- (Radstgms)
SRV - [2008/11/18 21:19:28 | 000,241,746 | ---- | M] (IDT, Inc.) [Auto | Running] -- c:\_\@D\Dell\Exx00\AUDIO\stacsv.exe -- (STacSV)
SRV - [2008/11/11 16:35:22 | 000,020,840 | ---- | M] (Broadcom Corporation) [Auto | Running] -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe -- (Credential Vault Host Storage)
SRV - [2008/11/11 16:35:20 | 000,808,296 | ---- | M] (Broadcom Corporation) [Auto | Running] -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe -- (Credential Vault Host Control Service)
SRV - [2008/10/16 17:26:20 | 000,860,160 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- c:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008/10/16 17:15:58 | 000,348,160 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- c:\Program Files\Intel\WiFi\bin\WLKEEPER.exe -- (WLANKEEPER) Intel(R)
SRV - [2008/10/16 17:05:38 | 000,905,216 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- c:\Program Files\Intel\WiFi\bin\S24EvMon.exe -- (S24EventMonitor)
SRV - [2008/10/16 16:54:34 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- c:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008/09/12 01:50:46 | 002,436,536 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2008/09/04 23:44:18 | 001,787,200 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2008/09/04 23:19:46 | 000,312,720 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)
SRV - [2008/08/20 08:45:26 | 000,466,432 | ---- | M] () [Auto | Running] -- C:\Program Files\qpac\qpac.exe -- (AutoProxyDetection)
SRV - [2008/08/14 22:45:28 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2008/08/14 22:45:28 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2008/04/30 11:30:26 | 000,172,210 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\HPOVCM\radsched.exe -- (radsched)
SRV - [2008/02/06 11:27:00 | 000,163,931 | ---- | M] (Utimaco Safeware AG) [Auto | Running] -- c:\Program Files\Utimaco\SafeGuard Easy\WksCfgSrv.exe -- (WksCfgSrv)
SRV - [2008/02/06 11:26:22 | 000,114,773 | ---- | M] (Utimaco Safeware AG) [Auto | Running] -- c:\Program Files\Utimaco\SafeGuard Easy\SgeCtl.exe -- (SgeCtl)
SRV - [2008/01/18 16:57:54 | 005,750,784 | ---- | M] () [Auto | Running] -- C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe -- (MySQL)
SRV - [2007/08/11 20:05:27 | 003,093,872 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2007/02/20 13:59:58 | 000,270,510 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\HPOVCM\radexecd.exe -- (radexecd)
SRV - [2007/02/10 06:29:56 | 000,089,968 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2007/02/10 06:29:48 | 000,242,544 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2006/10/01 13:37:42 | 000,016,384 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)
SRV - [2006/04/20 08:34:26 | 001,520,688 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2005/11/14 01:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/10/14 03:50:20 | 000,045,272 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2005/03/31 11:27:00 | 000,061,440 | ---- | M] (Utimaco Safeware AG) [Auto | Running] -- C:\WINDOWS\system32\SgLogPlayer.exe -- (SgLogPlayer)


========== Driver Services (SafeList) ==========

DRV - [2010/04/30 13:29:48 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/03/29 09:00:00 | 001,324,720 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100428.038\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/03/29 09:00:00 | 000,084,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100428.038\NAVENG.SYS -- (NAVENG)
DRV - [2009/11/16 13:49:32 | 000,080,000 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vodafone_K3805-z_dc_enum.sys -- (vodafone_K3805-z_dc_enum)
DRV - [2009/10/20 19:19:44 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)
DRV - [2009/08/27 09:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2009/08/27 09:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2009/07/24 15:05:26 | 001,961,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VX3000.sys -- (VX3000)
DRV - [2009/04/09 13:38:32 | 000,102,400 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009/03/09 01:06:00 | 000,280,096 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OA001Vid.sys -- (OA001Vid)
DRV - [2009/03/06 15:30:08 | 000,133,632 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OA001Ufd.sys -- (OA001Ufd)
DRV - [2008/11/18 21:19:28 | 001,392,819 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2008/11/17 07:23:16 | 003,636,864 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32) Intel(R)
DRV - [2008/11/11 16:32:10 | 000,032,808 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cvusbdrv.sys -- (cvusbdrv)
DRV - [2008/11/11 16:32:08 | 000,035,880 | R--- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID)
DRV - [2008/11/11 16:32:08 | 000,012,840 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ccidflt.sys -- (CCIDFILTER)
DRV - [2008/09/11 22:40:36 | 000,023,904 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\COH_Mon.sys -- (COH_Mon)
DRV - [2008/09/04 23:47:26 | 000,091,968 | ---- | M] (Symantec Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\SysPlant.sys -- (SysPlant)
DRV - [2008/09/04 23:45:36 | 000,041,792 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\WPSDRVnt.sys -- (WPS)
DRV - [2008/08/27 12:37:18 | 000,112,128 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2008/08/25 17:03:04 | 006,045,504 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2008/08/15 18:41:08 | 000,317,872 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2008/08/15 18:41:08 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2008/08/15 18:41:06 | 000,279,600 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)
DRV - [2008/08/13 16:23:56 | 000,011,904 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2008/08/07 19:42:48 | 000,991,016 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2008/08/04 00:35:28 | 000,047,272 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2008/07/30 17:44:18 | 000,110,080 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2008/07/24 19:42:48 | 000,170,032 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2008/07/21 01:44:44 | 000,324,120 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\iaStor.sys -- (iaStor)
DRV - [2008/07/10 11:57:56 | 000,049,536 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Teefer2.sys -- (Teefer2)
DRV - [2008/06/20 08:12:04 | 000,050,368 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WpsHelper.sys -- (WpsHelper)
DRV - [2008/06/19 13:35:58 | 000,040,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI) Intel(R)
DRV - [2008/06/17 00:53:14 | 000,420,400 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2008/06/13 17:42:56 | 000,243,856 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1y5132.sys -- (e1yexpress) Intel(R)
DRV - [2008/06/04 13:14:00 | 000,026,608 | ---- | M] (Dell Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\PBADRV.sys -- (PBADRV)
DRV - [2008/05/21 16:02:48 | 000,534,440 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2008/04/14 05:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/04/14 05:00:00 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008/04/14 00:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/02/06 11:34:28 | 000,023,168 | ---- | M] (Utimaco Safeware AG) [Kernel | Boot | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\RIJN256.SYS -- (RIJNDAEL-256)
DRV - [2008/02/06 11:34:16 | 000,063,488 | ---- | M] (Utimaco Safeware AG) [Kernel | Boot | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\SGEFLT.SYS -- (SgeFlt)
DRV - [2008/02/04 19:57:44 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2008/02/04 19:57:30 | 000,037,032 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2007/09/20 13:59:14 | 000,156,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2007/08/03 11:31:00 | 000,023,424 | ---- | M] (Hewlett Packard) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\radiamsi.sys -- (RadiaMsi)
DRV - [2007/06/08 01:00:02 | 000,148,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OA001Afx.sys -- (OA001Afx)
DRV - [2007/06/06 13:51:04 | 000,161,792 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2007/04/27 08:40:00 | 000,035,328 | ---- | M] (SafeNet, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS -- (SNTNLUSB)
DRV - [2007/02/24 14:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/10/01 13:37:02 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tap0801.sys -- (tap0801)
DRV - [2006/06/20 21:04:56 | 000,016,512 | ---- | M] (Chingachguk & Denger2k) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vusbbus.sys -- (vusbbus)
DRV - [2006/04/20 08:33:40 | 000,303,740 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2005/11/17 13:58:16 | 000,092,672 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symmpi.sys -- (Symmpi)
DRV - [2005/08/18 19:22:30 | 000,110,080 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2005/05/17 04:51:34 | 000,005,315 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005/01/26 06:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2001/08/17 14:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.vodafone.com/vgsl/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://intranet.vodafone.com/vgsl/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = http://tvm/*;mediacentre.vodafone.com;
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy10.gps.internal.vodafone.com:8080

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.bbc.co.uk/"
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.8
FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:0.9.10.2
FF - prefs.js..extensions.enabledItems: {da8bd68d-8e90-41cd-8345-a71b294e72e6}:2.0.7.0
FF - prefs.js..network.proxy.autoconfig_url: "http://proxy10.gps.internal.vodafone.com:8080/proxy.pac"
FF - prefs.js..network.proxy.ftp: "proxy10.gps.internal.vodafone.com"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.gopher: "proxy10.gps.internal.vodafone.com"
FF - prefs.js..network.proxy.gopher_port: 8080
FF - prefs.js..network.proxy.http: "proxy10.gps.internal.vodafone.com"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.no_proxies_on: "http://tvm/*,mediacentre.vodafone.com,localhost,127.0.0.1"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxy10.gps.internal.vodafone.com"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "proxy10.gps.internal.vodafone.com"
FF - prefs.js..network.proxy.ssl_port: 8080
FF - prefs.js..network.proxy.type: 2

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/02 23:39:49 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/02 23:39:49 | 000,000,000 | ---D | M]

[2010/01/02 02:14:34 | 000,000,000 | ---D | M] -- D:\Users\MCornall\Application Data\Mozilla\Extensions
[2010/01/02 02:14:34 | 000,000,000 | ---D | M] -- D:\Users\MCornall\Application Data\Mozilla\Extensions\home2@tomtom.com
[2010/04/30 12:56:06 | 000,000,000 | ---D | M] -- D:\Users\MCornall\Application Data\Mozilla\Firefox\Profiles\ruvpkm7u.default\extensions
[2010/02/05 12:32:54 | 000,000,000 | ---D | M] (Forecastfox) -- D:\Users\MCornall\Application Data\Mozilla\Firefox\Profiles\ruvpkm7u.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2010/04/12 09:16:49 | 000,000,000 | ---D | M] (Download Statusbar) -- D:\Users\MCornall\Application Data\Mozilla\Firefox\Profiles\ruvpkm7u.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/04/19 09:03:12 | 000,000,000 | ---D | M] (Property Bee) -- D:\Users\MCornall\Application Data\Mozilla\Firefox\Profiles\ruvpkm7u.default\extensions\{da8bd68d-8e90-41cd-8345-a71b294e72e6}
[2010/04/30 12:56:06 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2008/05/02 09:40:08 | 000,407,104 | ---- | M] (Documentum, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npeRoom7.dll
[2010/03/15 11:56:32 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/15 11:56:32 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/15 11:56:32 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/15 11:56:32 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2008/04/14 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Communicator] C:\Program Files\Microsoft Office Communicator\communicator.exe (Microsoft Corporation)
O4 - HKLM..\Run: [EdWizard] c:\Program Files\Utimaco\SafeGuard Easy\EdWizard.exe (Utimaco Safeware AG)
O4 - HKLM..\Run: [HPOVCM User connect] C:\Program Files\HPOVCM\connect.cmd ()
O4 - HKLM..\Run: [IntelWireless] c:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] c:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKLM..\Run: [OA001Mon] C:\WINDOWS\OA001Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [SgeEcView] c:\Program Files\Utimaco\SafeGuard Easy\Ecview.exe (Utimaco Safeware AG)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [VX3000] C:\WINDOWS\vVX3000.exe (Microsoft Corporation)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
O4 - Startup: D:\Users\All Users\Start Menu\Programs\Startup\Palo Manager.lnk = C:\Program Files\Jedox\Palo\Manager.exe (Jedox AG)
O4 - Startup: D:\Users\MCornall\Start Menu\Programs\Startup\Monitor My eRooms (V7).lnk = C:\Program Files\eRoom 7\ERClient7.exe (EMC)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Download present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWebServices = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoOnlinePrintsWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPublishingWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoMSAppLogo5ChannelNotify = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupscriptSync = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Send to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: gpsav10 ([]https in Trusted sites)
O15 - HKLM\..Trusted Domains: UKi ([]* in Local intranet)
O15 - HKLM\..Trusted Domains: vfl.vodafone ([ebusiness] * in Local intranet)
O15 - HKLM\..Trusted Domains: voc ([]* in Local intranet)
O15 - HKLM\..Trusted Domains: vodafone.com ([]* in Local intranet)
O15 - HKLM\..Trusted Domains: vodafone.com ([]http in Trusted sites)
O15 - HKLM\..Trusted Domains: vodafone.com ([]https in Trusted sites)
O15 - HKLM\..Trusted Domains: vodafone.de ([]http in Trusted sites)
O15 - HKLM\..Trusted Domains: vodafone.de ([]https in Trusted sites)
O15 - HKLM\..Trusted Domains: watsonwyatt.com ([epa] https in Trusted sites)
O15 - HKCU\..Trusted Domains: gpsav10 ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: UKi ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: vfl.vodafone ([ebusiness] * in Local intranet)
O15 - HKCU\..Trusted Domains: voc ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: vodafone.com ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: vodafone.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: vodafone.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: vodafone.com ([avoarc01.internal] * in Local intranet)
O15 - HKCU\..Trusted Domains: vodafone.com ([avoarc02.internal] * in Local intranet)
O15 - HKCU\..Trusted Domains: vodafone.com ([avoarc03.internal] * in Local intranet)
O15 - HKCU\..Trusted Domains: vodafone.com ([eito-kvs.internal] * in Local intranet)
O15 - HKCU\..Trusted Domains: vodafone.com ([eito-kvs01.internal] * in Local intranet)
O15 - HKCU\..Trusted Domains: vodafone.com ([eito-kvs02.internal] * in Local intranet)
O15 - HKCU\..Trusted Domains: vodafone.com ([eito-kvs03.internal] * in Local intranet)
O15 - HKCU\..Trusted Domains: vodafone.de ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: vodafone.de ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: watsonwyatt.com ([epa] https in Trusted sites)
O16 - DPF: {6E2510E6-BF2D-4C78-9F28-2F5C8760F124} Reg Error: Key error. (ERPageAddin Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {80017034-D4F8-410D-9B03-0E713C34CEAD} https://qmis.vodafone.com/ChartfxInt62/download/ChartFX.ComIEClient.Core.cab (Chart Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://vnc.webex.com/client/wbs27-vzbprodcn/webex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.5.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = internal.vodafone.com
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (SGGINA.DLL) - C:\WINDOWS\System32\Sggina.dll (Utimaco Safeware AG)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\NotLog: DllName - SGLogEx.dll - C:\WINDOWS\System32\SGLogEx.dll (Utimaco Safeware AG)
O20 - Winlogon\Notify\SGLogNotification: DllName - SGLogNotification.dll - C:\WINDOWS\System32\SGLogNotification.dll (Utimaco Safeware AG)
O24 - Desktop WallPaper: D:\Users\MCornall\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: D:\Users\MCornall\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/01/12 08:57:23 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2010/01/25 16:40:13 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found


SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: ccEvtMgr - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SafeBootMin: ccSetMgr - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: Symantec Antivirus - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
SafeBootMin: Symantec Antvirus - Service
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: ccEvtMgr - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SafeBootNet: ccSetMgr - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: SmcService - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: Symantec Antivirus - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
SafeBootNet: Symantec Antvirus - Service
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {0EEB34F6-991D-4a1b-8EEB-772DA0EADB22} - Microsoft Office Communicator 2007
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {129DDEC1-A6A3-3D60-AABE-76E6E5334922} - .NET Framework
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {220C5102-2566-337F-9E9B-C81C5C761BA2} - .NET Framework
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4b218e3e-bc98-4770-93d3-2731b9329278} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {71CB2612-627C-3D58-8D82-B77444B27B6A} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {BB0DCC5E-7477-3350-B5F5-7CE64E1E83B6} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C3F73257-31B8-34CF-901D-5422FB94940C} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D13EB4BD-8A13-35D1-9850-C29AF6D91CD1} - .NET Framework
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

part 2

========== Files/Folders - Created Within 30 Days ==========

[2010/04/30 22:59:59 | 000,562,176 | ---- | C] (OldTimer Tools) -- D:\Users\MCornall\Desktop\OTL.exe
[2010/04/30 13:31:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010/04/30 13:25:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/04/30 12:32:39 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/04/30 09:25:12 | 000,000,000 | ---D | C] -- C:\Data
[2010/04/30 00:11:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/04/30 00:02:02 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/04/29 23:58:41 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/04/29 23:58:40 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/04/29 23:58:40 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/04/29 23:58:40 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/04/29 23:58:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/04/29 23:58:34 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/04/29 23:50:01 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/04/29 14:51:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 14:51:49 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/29 14:51:49 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/27 15:25:36 | 000,000,000 | ---D | C] -- D:\Users\MCornall\Application Data\webex
[2010/04/21 12:12:58 | 000,075,776 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCShell64.dll
[2010/04/21 12:12:58 | 000,069,632 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCShell.dll
[2010/04/21 12:12:57 | 000,225,280 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCSET.DLL
[2010/04/21 12:12:57 | 000,071,680 | ---- | C] (DameWare Development) -- C:\WINDOWS\System32\DWRCST.EXE
[2010/04/21 12:12:57 | 000,053,248 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCK.DLL
[2010/04/21 12:12:56 | 000,208,384 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCS.EXE
[2010/04/20 10:40:43 | 000,000,000 | ---D | C] -- D:\Users\All Users\Application Data\SUPERAntiSpyware.com
[2010/04/20 10:40:37 | 000,000,000 | ---D | C] -- D:\Users\MCornall\Application Data\SUPERAntiSpyware.com
[2010/04/20 10:40:37 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/04/19 20:47:23 | 000,000,000 | ---D | C] -- D:\Users\MCornall\DoctorWeb
[2010/04/15 16:49:19 | 000,000,000 | ---D | C] -- D:\Users\MCornall\Desktop\Ukraine KPI Definitions
[2010/04/15 11:11:58 | 000,000,000 | ---D | C] -- C:\PerfLogs
[2010/04/05 10:47:19 | 000,000,000 | ---D | C] -- D:\Users\MCornall\Application Data\vlc

========== Files - Modified Within 30 Days ==========

[2010/04/30 23:00:01 | 000,562,176 | ---- | M] (OldTimer Tools) -- D:\Users\MCornall\Desktop\OTL.exe
[2010/04/30 18:45:25 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/30 18:45:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/30 18:44:45 | 2080,268,288 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/30 16:09:58 | 006,029,312 | -H-- | M] () -- D:\Users\MCornall\NTUSER.DAT
[2010/04/30 16:09:36 | 000,000,278 | -HS- | M] () -- D:\Users\MCornall\ntuser.ini
[2010/04/30 14:28:43 | 000,013,368 | RHS- | M] () -- D:\Users\MCornall\ntuser.pol
[2010/04/30 14:27:24 | 000,040,921 | RHS- | M] () -- D:\Users\All Users\ntuser.pol
[2010/04/30 13:29:48 | 000,123,952 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/04/30 13:29:48 | 000,060,800 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/04/30 13:29:48 | 000,010,563 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/04/30 13:29:48 | 000,000,805 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/04/30 09:26:35 | 000,000,067 | ---- | M] () -- C:\WINDOWS\VBADDIN.INI
[2010/04/30 09:22:28 | 000,008,137 | RHS- | M] () -- C:\ROMBL.CFG
[2010/04/30 09:18:14 | 000,015,723 | ---- | M] () -- C:\WINDOWS\System32\SMS_409.HLP
[2010/04/30 09:18:14 | 000,015,663 | ---- | M] () -- C:\WINDOWS\System32\FAX_409.HLP
[2010/04/30 09:18:14 | 000,015,638 | ---- | M] () -- C:\WINDOWS\System32\TLX_409.HLP
[2010/04/30 09:18:14 | 000,000,517 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2010/04/30 00:43:35 | 000,948,224 | ---- | M] () -- P:\Single Indicator for performance reporting v1_1.ppt
[2010/04/30 00:28:14 | 000,592,248 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/04/30 00:28:14 | 000,491,946 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/04/30 00:28:14 | 000,090,698 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/04/30 00:26:57 | 000,002,305 | ---- | M] () -- D:\Users\MCornall\Desktop\VPN Client.lnk
[2010/04/30 00:07:22 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/04/30 00:02:06 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/04/29 23:45:21 | 003,924,183 | R--- | M] () -- D:\Users\MCornall\Desktop\ComboFix.exe
[2010/04/29 17:18:51 | 004,501,504 | ---- | M] () -- P:\exco report anonymous.xls
[2010/04/29 09:26:37 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/04/28 16:24:28 | 000,719,872 | ---- | M] () -- P:\Single Indicator for performance reporting v1_0.ppt
[2010/04/27 11:57:25 | 000,073,728 | ---- | M] () -- D:\Users\MCornall\Desktop\DataEntryTemplate(1).xls
[2010/04/27 09:12:27 | 015,676,714 | ---- | M] () -- D:\Users\MCornall\Desktop\don_26_04_10.rar
[2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010/04/26 12:02:35 | 000,854,224 | ---- | M] () -- D:\Users\MCornall\Desktop\Exco KPI Reports incl definitions.zip
[2010/04/19 16:32:00 | 000,074,752 | ---- | M] () -- P:\N&SQ Summit 2010 - Registration Form.doc
[2010/04/19 16:16:51 | 000,255,488 | ---- | M] () -- P:\Performance Presentation for Entel.ppt
[2010/04/19 15:45:18 | 000,173,056 | ---- | M] () -- P:\Presentation for Entel.ppt
[2010/04/19 15:17:57 | 000,172,544 | ---- | M] () -- P:\Vodafone EXCO KPI 2010 targets v1 3.ppt
[2010/04/19 08:59:19 | 000,538,951 | ---- | M] () -- P:\George Homework.docx
[2010/04/15 16:07:23 | 000,008,019 | ---- | M] () -- P:\shopping cart headset.pdf
[2010/04/13 16:44:05 | 000,000,000 | ---- | M] () -- P:\~$Vodafone Mobile Broadband Dashboard Update v4.pptx
[2010/04/13 12:25:53 | 013,828,206 | ---- | M] () -- P:\Vodafone Mobile Broadband Dashboard Update v4.pptx
[2010/04/13 11:59:35 | 000,230,424 | ---- | M] () -- C:\img2-001.raw
[2010/04/05 10:47:46 | 000,030,720 | ---- | M] () -- D:\Users\MCornall\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/05 10:45:19 | 000,000,640 | ---- | M] () -- D:\Users\All Users\Desktop\VLC media player.lnk

========== Files Created - No Company Name ==========

[2010/04/30 00:02:06 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/04/30 00:02:04 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/04/29 23:58:41 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/04/29 23:58:40 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/04/29 23:58:40 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/04/29 23:58:40 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/04/29 23:58:40 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/04/29 23:45:13 | 003,924,183 | R--- | C] () -- D:\Users\MCornall\Desktop\ComboFix.exe
[2010/04/27 09:12:26 | 015,676,714 | ---- | C] () -- D:\Users\MCornall\Desktop\don_26_04_10.rar
[2010/04/21 12:12:59 | 000,000,714 | ---- | C] () -- C:\WINDOWS\System32\DWRCST.exe.manifest
[2010/04/21 12:12:58 | 000,008,768 | ---- | C] () -- C:\WINDOWS\System32\DWRCS.INI
[2010/04/19 20:42:47 | 2080,268,288 | -HS- | C] () -- C:\hiberfil.sys
[2010/04/15 10:34:18 | 000,073,728 | ---- | C] () -- D:\Users\MCornall\Desktop\DataEntryTemplate(1).xls
[2010/04/13 11:59:35 | 000,230,424 | ---- | C] () -- C:\img2-001.raw
[2010/04/05 10:45:19 | 000,000,640 | ---- | C] () -- D:\Users\All Users\Desktop\VLC media player.lnk
[2010/02/19 15:14:19 | 000,000,080 | ---- | C] () -- C:\WINDOWS\AxaQDCFSD.INI
[2010/02/17 21:11:15 | 000,000,108 | ---- | C] () -- C:\WINDOWS\rar_crck.ini
[2009/10/20 19:19:30 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2009/10/07 22:33:09 | 000,000,307 | ---- | C] () -- C:\WINDOWS\cedt.INI
[2009/09/02 08:56:35 | 000,015,498 | ---- | C] () -- C:\WINDOWS\VX3000.ini
[2009/06/25 13:53:45 | 000,000,497 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/06/25 13:30:22 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/06/25 13:26:21 | 000,279,888 | ---- | C] () -- C:\WINDOWS\System32\brcmbsp.dll
[2009/06/25 13:26:16 | 000,080,368 | ---- | C] () -- C:\WINDOWS\System32\pbadrvdll.dll
[2009/06/25 13:24:29 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4980.dll
[2009/01/12 15:42:01 | 000,000,317 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\ktg21yj.dll
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2009/01/12 15:41:47 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\nvcrfvl.dll
[2008/11/21 17:14:04 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\Machnm32.sys
[2008/11/21 17:13:52 | 000,010,496 | ---- | C] () -- C:\WINDOWS\System32\Machnm64.sys
[2008/08/15 08:46:30 | 002,854,912 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2008/02/06 11:33:48 | 000,020,575 | ---- | C] () -- C:\WINDOWS\System32\Sgegina040C.Dll
[2008/02/06 11:33:44 | 000,020,575 | ---- | C] () -- C:\WINDOWS\System32\SgeGina0407.Dll
[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/08/16 12:33:38 | 000,024,576 | R--- | C] () -- C:\WINDOWS\System32\loaddlln.dll
[2006/06/30 12:58:44 | 000,176,128 | R--- | C] () -- C:\WINDOWS\System32\bioapi_mds300.dll
[2006/06/30 12:58:44 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\bioapi100.dll
[2006/04/20 08:34:38 | 000,197,680 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2006/04/20 08:34:24 | 000,193,584 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2006/03/07 09:16:04 | 003,203,072 | ---- | C] () -- C:\WINDOWS\System32\lcppn201.dll
[2006/03/07 09:16:04 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nlsxdsgn.dll
[2005/03/31 11:27:18 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\SGCleanLocalGPO.dll
[2005/02/17 12:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 12:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2004/05/17 19:57:14 | 001,064,960 | ---- | C] () -- C:\WINDOWS\System32\h5krnl32.dll
[2004/05/17 19:57:14 | 000,188,928 | ---- | C] () -- C:\WINDOWS\System32\h5icon32.dll
[2004/05/17 19:57:14 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\h5menu32.dll
[2004/05/17 19:57:14 | 000,095,744 | ---- | C] () -- C:\WINDOWS\System32\h5rtf32.dll
[2004/05/17 19:57:14 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\h5tool32.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[1999/01/21 20:56:20 | 000,015,872 | ---- | C] () -- C:\WINDOWS\System32\vtssm32.dll

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/09/04 23:44:36 | 000,049,472 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\FwsVpn.dll
[2008/09/04 23:45:18 | 000,107,840 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\SymVPN.dll
[2008/09/04 23:45:20 | 000,357,696 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\sysfer.dll

< %systemroot%\system32\*.exe /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2008/09/04 23:47:26 | 000,091,968 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\SysPlant.sys
[2008/07/10 11:57:56 | 000,049,536 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\Teefer2.sys
[2008/09/04 23:45:36 | 000,041,792 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\WPSDRVnt.sys
[2008/06/20 08:12:04 | 000,050,368 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\WpsHelper.sys

< %systemroot%\System32\config\*.sav >
[2009/01/12 08:47:11 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/01/12 08:47:11 | 001,089,536 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/01/12 08:47:11 | 000,921,600 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2008/04/14 05:00:00 | 000,009,029 | ---- | M] () -- C:\WINDOWS\system32\ansi.sys
[2008/04/14 05:00:00 | 000,027,097 | ---- | M] () -- C:\WINDOWS\system32\country.sys
[2008/04/14 05:00:00 | 000,004,768 | ---- | M] () -- C:\WINDOWS\system32\himem.sys
[2008/04/14 05:00:00 | 000,042,809 | ---- | M] () -- C:\WINDOWS\system32\key01.sys
[2008/04/14 05:00:00 | 000,042,537 | ---- | M] () -- C:\WINDOWS\system32\keyboard.sys
[2008/11/21 17:14:04 | 000,007,168 | ---- | M] () -- C:\WINDOWS\system32\Machnm32.sys
[2008/11/21 17:13:52 | 000,010,496 | ---- | M] () -- C:\WINDOWS\system32\Machnm64.sys
[2008/04/14 05:00:00 | 000,027,866 | ---- | M] () -- C:\WINDOWS\system32\ntdos.sys
[2008/04/14 05:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos404.sys
[2008/04/14 05:00:00 | 000,029,370 | ---- | M] () -- C:\WINDOWS\system32\ntdos411.sys
[2008/04/14 05:00:00 | 000,029,274 | ---- | M] () -- C:\WINDOWS\system32\ntdos412.sys
[2008/04/14 05:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos804.sys
[2008/04/14 05:00:00 | 000,033,840 | ---- | M] () -- C:\WINDOWS\system32\ntio.sys
[2008/04/14 05:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio404.sys
[2008/04/14 05:00:00 | 000,035,648 | ---- | M] () -- C:\WINDOWS\system32\ntio411.sys
[2008/04/14 05:00:00 | 000,035,424 | ---- | M] () -- C:\WINDOWS\system32\ntio412.sys
[2008/04/14 05:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio804.sys
[2005/01/26 06:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) -- C:\WINDOWS\system32\vsdatant.sys
[2008/04/14 05:00:00 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\watchdog.sys
[2009/08/14 14:21:25 | 001,850,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\win32k.sys

< %systemroot%\system32\drivers\*.dll >

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2006/12/31 18:46:00 | 000,103,936 | ---- | M] () -- C:\aaaiight-fat.ttf
[2006/12/31 18:50:44 | 000,095,380 | ---- | M] () -- C:\aaaiight.ttf
[2010/02/16 15:30:03 | 000,004,335 | ---- | M] () -- C:\atlog.txt
[2009/01/12 08:57:23 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/06/25 13:31:27 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/04/30 00:02:06 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2010/04/30 00:09:55 | 000,027,606 | ---- | M] () -- C:\ComboFix.txt
[2009/01/12 08:57:23 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/01/20 11:39:38 | 000,046,452 | ---- | M] () -- C:\debug1214.txt
[2002/01/01 02:15:18 | 000,124,776 | ---- | M] () -- C:\graffonti.3d.drop.[fontvir.us].ttf
[2002/01/01 04:51:46 | 000,085,456 | ---- | M] () -- C:\graffonti.atomic.bomb.[fontvir.us].ttf
[2002/01/01 05:11:04 | 000,108,024 | ---- | M] () -- C:\graffonti.gradient.fill.[fontvir.us].ttf
[2010/04/30 18:44:45 | 2080,268,288 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/13 11:59:35 | 000,230,424 | ---- | M] () -- C:\img2-001.raw
[2009/01/12 08:57:23 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/09/25 15:06:39 | 000,029,862 | ---- | M] () -- C:\keys.zip
[2009/12/01 14:49:29 | 000,022,016 | ---- | M] () -- C:\List of QMIS Opcos for anonomsing.xls
[2009/11/03 18:37:46 | 000,028,716 | ---- | M] () -- C:\Mostwasted.ttf
[2009/01/12 08:57:23 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 05:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/04/30 18:44:42 | 2080,194,560 | -HS- | M] () -- C:\pagefile.sys
[2010/04/30 09:22:28 | 000,008,137 | RHS- | M] () -- C:\ROMBL.CFG
[2007/07/22 13:35:28 | 000,042,972 | ---- | M] () -- C:\Street Writers.ttf
[2010/01/29 14:54:22 | 034,645,740 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-101.zip
[2010/01/29 16:59:02 | 010,862,636 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-173.zip
[2010/01/29 16:48:18 | 022,257,219 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-225.zip
[2010/01/29 15:16:40 | 007,411,347 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-344.zip
[2010/01/29 16:39:18 | 007,759,485 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-564.zip
[2010/01/29 10:14:28 | 004,082,587 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-779.zip
[2010/01/29 14:58:52 | 007,198,537 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-862.zip
[2010/02/01 14:12:12 | 063,433,562 | ---- | M] () -- C:\VMC-Logs23415-2010-02-01-275.zip
[2010/02/01 14:25:40 | 049,930,563 | ---- | M] () -- C:\VMC-Logs23415-2010-02-01-681.zip
[2010/02/03 17:53:52 | 004,772,087 | ---- | M] () -- C:\VMC-Logs23415-2010-02-03-769.zip
[2010/02/04 16:50:44 | 002,366,661 | ---- | M] () -- C:\VMC-Logs23415-2010-02-04-195.zip
[2010/02/11 17:56:35 | 034,578,327 | ---- | M] () -- C:\VMC-Logs23415-2010-02-11-365.zip
[2010/02/11 17:40:17 | 003,329,378 | ---- | M] () -- C:\VMC-Logs23415-2010-02-11-938.zip
[2009/06/25 13:23:50 | 000,000,297 | ---- | M] () -- C:\WINBOM.000

< %PROGRAMFILES%\*. >
[2009/09/11 15:22:52 | 000,000,000 | ---D | M] -- C:\Program Files\7-Zip
[2010/02/16 14:46:13 | 000,000,000 | ---D | M] -- C:\Program Files\Actix
[2010/03/25 10:29:38 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010/01/07 15:15:25 | 000,000,000 | ---D | M] -- C:\Program Files\Audacity
[2010/02/01 14:43:00 | 000,000,000 | ---D | M] -- C:\Program Files\AutoIt3
[2010/03/23 11:38:18 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2009/06/25 13:26:19 | 000,000,000 | ---D | M] -- C:\Program Files\Broadcom Corporation
[2009/06/25 13:59:30 | 000,000,000 | ---D | M] -- C:\Program Files\Cisco Systems
[2009/06/25 14:00:57 | 000,000,000 | ---D | M] -- C:\Program Files\Citrix
[2010/04/30 13:31:46 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2009/01/12 08:54:50 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2009/06/25 14:00:40 | 000,000,000 | ---D | M] -- C:\Program Files\CyberLink
[2009/06/25 13:25:14 | 000,000,000 | ---D | M] -- C:\Program Files\Dell
[2009/06/25 13:28:09 | 000,000,000 | ---D | M] -- C:\Program Files\DellTPad
[2009/06/25 13:26:16 | 000,000,000 | ---D | M] -- C:\Program Files\DIFX
[2009/10/07 21:51:11 | 000,000,000 | ---D | M] -- C:\Program Files\Emerald Editor Community
[2009/06/25 13:58:05 | 000,000,000 | ---D | M] -- C:\Program Files\Enterprise Vault
[2009/10/28 02:32:02 | 000,000,000 | ---D | M] -- C:\Program Files\EpsonNet
[2010/02/01 11:25:50 | 000,000,000 | ---D | M] -- C:\Program Files\eRoom 7
[2009/12/24 22:42:08 | 000,000,000 | ---D | M] -- C:\Program Files\FileZilla FTP Client
[2010/04/30 09:21:36 | 000,000,000 | ---D | M] -- C:\Program Files\HPOVCM
[2009/06/25 13:28:12 | 000,000,000 | ---D | M] -- C:\Program Files\IDT
[2010/02/17 21:10:13 | 000,000,000 | ---D | M] -- C:\Program Files\Information Packaging
[2010/02/16 15:30:02 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2009/06/25 13:37:01 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2009/06/25 13:57:52 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2009/09/01 09:40:29 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2009/11/24 11:13:42 | 000,000,000 | ---D | M] -- C:\Program Files\Jedox
[2009/12/10 12:01:18 | 000,000,000 | ---D | M] -- C:\Program Files\Kettle
[2010/01/07 15:19:44 | 000,000,000 | ---D | M] -- C:\Program Files\Lame for Audacity
[2010/04/29 14:53:15 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/01/12 08:59:24 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2010/03/24 10:38:57 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
[2009/01/12 09:22:34 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2009/01/12 09:00:04 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/09/02 08:56:18 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft LifeCam
[2009/07/22 15:32:52 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/06/25 14:04:32 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office Communicator
[2009/10/07 14:48:21 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2010/02/23 10:28:22 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server
[2009/06/25 13:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2009/06/25 13:52:20 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2010/02/16 14:42:07 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2009/01/12 08:55:40 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/04/02 23:39:53 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/01/07 15:26:22 | 000,000,000 | ---D | M] -- C:\Program Files\MP3Gain
[2009/01/12 09:34:44 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2009/01/12 09:00:04 | 000,000,000 | ---D | M] -- C:\Program Files\msn gaming zone
[2009/01/12 09:16:48 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2009/01/12 09:18:37 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0
[2009/11/30 16:36:03 | 000,000,000 | ---D | M] -- C:\Program Files\MySQL
[2009/01/12 08:55:44 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2009/08/05 21:21:34 | 000,000,000 | ---D | M] -- C:\Program Files\NOS
[2009/01/12 08:55:56 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2009/09/24 21:56:36 | 000,000,000 | ---D | M] -- C:\Program Files\OpenVPN
[2009/09/27 01:44:21 | 000,000,000 | ---D | M] -- C:\Program Files\OpenVPN-Control
[2009/09/08 09:43:30 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2010/02/04 10:08:34 | 000,000,000 | ---D | M] -- C:\Program Files\qpac
[2010/04/30 13:33:30 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2009/01/12 09:34:36 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2010/03/19 18:58:41 | 000,000,000 | ---D | M] -- C:\Program Files\Safari
[2009/06/25 14:07:36 | 000,000,000 | ---D | M] -- C:\Program Files\SAP
[2009/09/01 09:42:28 | 000,000,000 | ---D | M] -- C:\Program Files\SAS
[2009/08/03 12:09:46 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2010/04/21 15:36:27 | 000,000,000 | ---D | M] -- C:\Program Files\SUPERAntiSpyware
[2010/04/30 13:29:50 | 000,000,000 | ---D | M] -- C:\Program Files\Symantec
[2010/01/22 10:27:25 | 000,000,000 | ---D | M] -- C:\Program Files\SymbioWare
[2009/01/12 09:03:20 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2009/06/25 14:47:48 | 000,000,000 | ---D | M] -- C:\Program Files\Utimaco
[2009/09/04 22:30:14 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2010/01/20 11:36:28 | 000,000,000 | ---D | M] -- C:\Program Files\Vodafone
[2009/06/25 13:35:24 | 000,000,000 | ---D | M] -- C:\Program Files\WIDCOMM
[2009/01/12 09:15:39 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2009/01/12 09:16:05 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2009/01/12 09:00:04 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2009/01/12 08:56:01 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2010/01/20 11:58:19 | 000,000,000 | ---D | M] -- C:\Program Files\WinPcap
[2009/09/24 21:25:38 | 000,000,000 | ---D | M] -- C:\Program Files\WinSCP
[2009/10/12 11:25:05 | 000,000,000 | ---D | M] -- C:\Program Files\WinZip
[2010/01/20 11:58:23 | 000,000,000 | ---D | M] -- C:\Program Files\Wireshark
[2009/08/03 11:54:45 | 000,000,000 | ---D | M] -- C:\Program Files\Wisdom-soft ScreenHunter 5 Free
[2010/01/09 13:14:05 | 000,000,000 | ---D | M] -- C:\Program Files\XBMC
[2009/01/12 09:00:04 | 000,000,000 | ---D | M] -- C:\Program Files\xerox

< %appdata%\*.* >
[2009/09/27 22:07:06 | 000,002,528 | ---- | M] () -- D:\Users\MCornall\Application Data\$_hpcst$.hpc
[2009/01/12 08:48:53 | 000,000,062 | -HS- | M] () -- D:\Users\MCornall\Application Data\desktop.ini
[2009/09/27 01:22:44 | 000,000,600 | ---- | M] () -- D:\Users\MCornall\Application Data\winscp.rnd


< MD5 for: AGP440.SYS >
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Source\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Source\i386\sp3.cab:atapi.sys
[2008/04/14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: DISK.SYS >
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Source\i386\sp3.cab:disk.sys
[2008/04/14 05:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/14 05:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 05:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2008/07/21 01:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\OemDir\iaStor.sys
[2008/07/21 01:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\system32\drivers\BuildMSC\IaStor.sys
[2008/07/21 01:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\system32\drivers\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/14 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 05:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 05:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 05:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SYMMPI.SYS >
[2005/11/17 13:58:16 | 000,092,672 | ---- | M] (LSI Logic) MD5=1FD5249D5103125D2DA63F68D7BE1D35 -- C:\WINDOWS\system32\drivers\BuildMSC\symmpi.sys
[2005/11/17 13:58:16 | 000,092,672 | ---- | M] (LSI Logic) MD5=1FD5249D5103125D2DA63F68D7BE1D35 -- C:\WINDOWS\system32\drivers\symmpi.sys

< MD5 for: USBSTOR.SYS >
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbstor.sys
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Source\i386\sp3.cab:usbstor.sys
[2008/04/14 01:15:40 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\system32\dllcache\usbstor.sys
[2008/04/14 01:15:40 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\system32\drivers\USBSTOR.SYS

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

and extras txt

========== Files/Folders - Created Within 30 Days ==========

[2010/04/30 22:59:59 | 000,562,176 | ---- | C] (OldTimer Tools) -- D:\Users\MCornall\Desktop\OTL.exe
[2010/04/30 13:31:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010/04/30 13:25:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/04/30 12:32:39 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/04/30 09:25:12 | 000,000,000 | ---D | C] -- C:\Data
[2010/04/30 00:11:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/04/30 00:02:02 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/04/29 23:58:41 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/04/29 23:58:40 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/04/29 23:58:40 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/04/29 23:58:40 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/04/29 23:58:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/04/29 23:58:34 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/04/29 23:50:01 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/04/29 14:51:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 14:51:49 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/29 14:51:49 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/27 15:25:36 | 000,000,000 | ---D | C] -- D:\Users\MCornall\Application Data\webex
[2010/04/21 12:12:58 | 000,075,776 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCShell64.dll
[2010/04/21 12:12:58 | 000,069,632 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCShell.dll
[2010/04/21 12:12:57 | 000,225,280 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCSET.DLL
[2010/04/21 12:12:57 | 000,071,680 | ---- | C] (DameWare Development) -- C:\WINDOWS\System32\DWRCST.EXE
[2010/04/21 12:12:57 | 000,053,248 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCK.DLL
[2010/04/21 12:12:56 | 000,208,384 | ---- | C] (DameWare Development LLC) -- C:\WINDOWS\System32\DWRCS.EXE
[2010/04/20 10:40:43 | 000,000,000 | ---D | C] -- D:\Users\All Users\Application Data\SUPERAntiSpyware.com
[2010/04/20 10:40:37 | 000,000,000 | ---D | C] -- D:\Users\MCornall\Application Data\SUPERAntiSpyware.com
[2010/04/20 10:40:37 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/04/19 20:47:23 | 000,000,000 | ---D | C] -- D:\Users\MCornall\DoctorWeb
[2010/04/15 16:49:19 | 000,000,000 | ---D | C] -- D:\Users\MCornall\Desktop\Ukraine KPI Definitions
[2010/04/15 11:11:58 | 000,000,000 | ---D | C] -- C:\PerfLogs
[2010/04/05 10:47:19 | 000,000,000 | ---D | C] -- D:\Users\MCornall\Application Data\vlc

========== Files - Modified Within 30 Days ==========

[2010/04/30 23:00:01 | 000,562,176 | ---- | M] (OldTimer Tools) -- D:\Users\MCornall\Desktop\OTL.exe
[2010/04/30 18:45:25 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/30 18:45:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/30 18:44:45 | 2080,268,288 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/30 16:09:58 | 006,029,312 | -H-- | M] () -- D:\Users\MCornall\NTUSER.DAT
[2010/04/30 16:09:36 | 000,000,278 | -HS- | M] () -- D:\Users\MCornall\ntuser.ini
[2010/04/30 14:28:43 | 000,013,368 | RHS- | M] () -- D:\Users\MCornall\ntuser.pol
[2010/04/30 14:27:24 | 000,040,921 | RHS- | M] () -- D:\Users\All Users\ntuser.pol
[2010/04/30 13:29:48 | 000,123,952 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/04/30 13:29:48 | 000,060,800 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/04/30 13:29:48 | 000,010,563 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/04/30 13:29:48 | 000,000,805 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/04/30 09:26:35 | 000,000,067 | ---- | M] () -- C:\WINDOWS\VBADDIN.INI
[2010/04/30 09:22:28 | 000,008,137 | RHS- | M] () -- C:\ROMBL.CFG
[2010/04/30 09:18:14 | 000,015,723 | ---- | M] () -- C:\WINDOWS\System32\SMS_409.HLP
[2010/04/30 09:18:14 | 000,015,663 | ---- | M] () -- C:\WINDOWS\System32\FAX_409.HLP
[2010/04/30 09:18:14 | 000,015,638 | ---- | M] () -- C:\WINDOWS\System32\TLX_409.HLP
[2010/04/30 09:18:14 | 000,000,517 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2010/04/30 00:43:35 | 000,948,224 | ---- | M] () -- P:\Single Indicator for performance reporting v1_1.ppt
[2010/04/30 00:28:14 | 000,592,248 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/04/30 00:28:14 | 000,491,946 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/04/30 00:28:14 | 000,090,698 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/04/30 00:26:57 | 000,002,305 | ---- | M] () -- D:\Users\MCornall\Desktop\VPN Client.lnk
[2010/04/30 00:07:22 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/04/30 00:02:06 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/04/29 23:45:21 | 003,924,183 | R--- | M] () -- D:\Users\MCornall\Desktop\ComboFix.exe
[2010/04/29 17:18:51 | 004,501,504 | ---- | M] () -- P:\exco report anonymous.xls
[2010/04/29 09:26:37 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/04/28 16:24:28 | 000,719,872 | ---- | M] () -- P:\Single Indicator for performance reporting v1_0.ppt
[2010/04/27 11:57:25 | 000,073,728 | ---- | M] () -- D:\Users\MCornall\Desktop\DataEntryTemplate(1).xls
[2010/04/27 09:12:27 | 015,676,714 | ---- | M] () -- D:\Users\MCornall\Desktop\don_26_04_10.rar
[2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010/04/26 12:02:35 | 000,854,224 | ---- | M] () -- D:\Users\MCornall\Desktop\Exco KPI Reports incl definitions.zip
[2010/04/19 16:32:00 | 000,074,752 | ---- | M] () -- P:\N&SQ Summit 2010 - Registration Form.doc
[2010/04/19 16:16:51 | 000,255,488 | ---- | M] () -- P:\Performance Presentation for Entel.ppt
[2010/04/19 15:45:18 | 000,173,056 | ---- | M] () -- P:\Presentation for Entel.ppt
[2010/04/19 15:17:57 | 000,172,544 | ---- | M] () -- P:\Vodafone EXCO KPI 2010 targets v1 3.ppt
[2010/04/19 08:59:19 | 000,538,951 | ---- | M] () -- P:\George Homework.docx
[2010/04/15 16:07:23 | 000,008,019 | ---- | M] () -- P:\shopping cart headset.pdf
[2010/04/13 16:44:05 | 000,000,000 | ---- | M] () -- P:\~$Vodafone Mobile Broadband Dashboard Update v4.pptx
[2010/04/13 12:25:53 | 013,828,206 | ---- | M] () -- P:\Vodafone Mobile Broadband Dashboard Update v4.pptx
[2010/04/13 11:59:35 | 000,230,424 | ---- | M] () -- C:\img2-001.raw
[2010/04/05 10:47:46 | 000,030,720 | ---- | M] () -- D:\Users\MCornall\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/05 10:45:19 | 000,000,640 | ---- | M] () -- D:\Users\All Users\Desktop\VLC media player.lnk

========== Files Created - No Company Name ==========

[2010/04/30 00:02:06 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/04/30 00:02:04 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/04/29 23:58:41 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/04/29 23:58:40 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/04/29 23:58:40 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/04/29 23:58:40 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/04/29 23:58:40 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/04/29 23:45:13 | 003,924,183 | R--- | C] () -- D:\Users\MCornall\Desktop\ComboFix.exe
[2010/04/27 09:12:26 | 015,676,714 | ---- | C] () -- D:\Users\MCornall\Desktop\don_26_04_10.rar
[2010/04/21 12:12:59 | 000,000,714 | ---- | C] () -- C:\WINDOWS\System32\DWRCST.exe.manifest
[2010/04/21 12:12:58 | 000,008,768 | ---- | C] () -- C:\WINDOWS\System32\DWRCS.INI
[2010/04/19 20:42:47 | 2080,268,288 | -HS- | C] () -- C:\hiberfil.sys
[2010/04/15 10:34:18 | 000,073,728 | ---- | C] () -- D:\Users\MCornall\Desktop\DataEntryTemplate(1).xls
[2010/04/13 11:59:35 | 000,230,424 | ---- | C] () -- C:\img2-001.raw
[2010/04/05 10:45:19 | 000,000,640 | ---- | C] () -- D:\Users\All Users\Desktop\VLC media player.lnk
[2010/02/19 15:14:19 | 000,000,080 | ---- | C] () -- C:\WINDOWS\AxaQDCFSD.INI
[2010/02/17 21:11:15 | 000,000,108 | ---- | C] () -- C:\WINDOWS\rar_crck.ini
[2009/10/20 19:19:30 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2009/10/07 22:33:09 | 000,000,307 | ---- | C] () -- C:\WINDOWS\cedt.INI
[2009/09/02 08:56:35 | 000,015,498 | ---- | C] () -- C:\WINDOWS\VX3000.ini
[2009/06/25 13:53:45 | 000,000,497 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/06/25 13:30:22 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/06/25 13:26:21 | 000,279,888 | ---- | C] () -- C:\WINDOWS\System32\brcmbsp.dll
[2009/06/25 13:26:16 | 000,080,368 | ---- | C] () -- C:\WINDOWS\System32\pbadrvdll.dll
[2009/06/25 13:24:29 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4980.dll
[2009/01/12 15:42:01 | 000,000,317 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\ktg21yj.dll
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2009/01/12 15:41:47 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2009/01/12 15:41:47 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\System32\nvcrfvl.dll
[2008/11/21 17:14:04 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\Machnm32.sys
[2008/11/21 17:13:52 | 000,010,496 | ---- | C] () -- C:\WINDOWS\System32\Machnm64.sys
[2008/08/15 08:46:30 | 002,854,912 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2008/02/06 11:33:48 | 000,020,575 | ---- | C] () -- C:\WINDOWS\System32\Sgegina040C.Dll
[2008/02/06 11:33:44 | 000,020,575 | ---- | C] () -- C:\WINDOWS\System32\SgeGina0407.Dll
[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/08/16 12:33:38 | 000,024,576 | R--- | C] () -- C:\WINDOWS\System32\loaddlln.dll
[2006/06/30 12:58:44 | 000,176,128 | R--- | C] () -- C:\WINDOWS\System32\bioapi_mds300.dll
[2006/06/30 12:58:44 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\bioapi100.dll
[2006/04/20 08:34:38 | 000,197,680 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2006/04/20 08:34:24 | 000,193,584 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2006/03/07 09:16:04 | 003,203,072 | ---- | C] () -- C:\WINDOWS\System32\lcppn201.dll
[2006/03/07 09:16:04 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nlsxdsgn.dll
[2005/03/31 11:27:18 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\SGCleanLocalGPO.dll
[2005/02/17 12:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 12:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2004/05/17 19:57:14 | 001,064,960 | ---- | C] () -- C:\WINDOWS\System32\h5krnl32.dll
[2004/05/17 19:57:14 | 000,188,928 | ---- | C] () -- C:\WINDOWS\System32\h5icon32.dll
[2004/05/17 19:57:14 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\h5menu32.dll
[2004/05/17 19:57:14 | 000,095,744 | ---- | C] () -- C:\WINDOWS\System32\h5rtf32.dll
[2004/05/17 19:57:14 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\h5tool32.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[1999/01/21 20:56:20 | 000,015,872 | ---- | C] () -- C:\WINDOWS\System32\vtssm32.dll

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/09/04 23:44:36 | 000,049,472 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\FwsVpn.dll
[2008/09/04 23:45:18 | 000,107,840 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\SymVPN.dll
[2008/09/04 23:45:20 | 000,357,696 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\sysfer.dll

< %systemroot%\system32\*.exe /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2008/09/04 23:47:26 | 000,091,968 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\SysPlant.sys
[2008/07/10 11:57:56 | 000,049,536 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\Teefer2.sys
[2008/09/04 23:45:36 | 000,041,792 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\WPSDRVnt.sys
[2008/06/20 08:12:04 | 000,050,368 | ---- | M] (Symantec Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\WpsHelper.sys

< %systemroot%\System32\config\*.sav >
[2009/01/12 08:47:11 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/01/12 08:47:11 | 001,089,536 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/01/12 08:47:11 | 000,921,600 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2008/04/14 05:00:00 | 000,009,029 | ---- | M] () -- C:\WINDOWS\system32\ansi.sys
[2008/04/14 05:00:00 | 000,027,097 | ---- | M] () -- C:\WINDOWS\system32\country.sys
[2008/04/14 05:00:00 | 000,004,768 | ---- | M] () -- C:\WINDOWS\system32\himem.sys
[2008/04/14 05:00:00 | 000,042,809 | ---- | M] () -- C:\WINDOWS\system32\key01.sys
[2008/04/14 05:00:00 | 000,042,537 | ---- | M] () -- C:\WINDOWS\system32\keyboard.sys
[2008/11/21 17:14:04 | 000,007,168 | ---- | M] () -- C:\WINDOWS\system32\Machnm32.sys
[2008/11/21 17:13:52 | 000,010,496 | ---- | M] () -- C:\WINDOWS\system32\Machnm64.sys
[2008/04/14 05:00:00 | 000,027,866 | ---- | M] () -- C:\WINDOWS\system32\ntdos.sys
[2008/04/14 05:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos404.sys
[2008/04/14 05:00:00 | 000,029,370 | ---- | M] () -- C:\WINDOWS\system32\ntdos411.sys
[2008/04/14 05:00:00 | 000,029,274 | ---- | M] () -- C:\WINDOWS\system32\ntdos412.sys
[2008/04/14 05:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos804.sys
[2008/04/14 05:00:00 | 000,033,840 | ---- | M] () -- C:\WINDOWS\system32\ntio.sys
[2008/04/14 05:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio404.sys
[2008/04/14 05:00:00 | 000,035,648 | ---- | M] () -- C:\WINDOWS\system32\ntio411.sys
[2008/04/14 05:00:00 | 000,035,424 | ---- | M] () -- C:\WINDOWS\system32\ntio412.sys
[2008/04/14 05:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio804.sys
[2005/01/26 06:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) -- C:\WINDOWS\system32\vsdatant.sys
[2008/04/14 05:00:00 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\watchdog.sys
[2009/08/14 14:21:25 | 001,850,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\win32k.sys

< %systemroot%\system32\drivers\*.dll >

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2006/12/31 18:46:00 | 000,103,936 | ---- | M] () -- C:\aaaiight-fat.ttf
[2006/12/31 18:50:44 | 000,095,380 | ---- | M] () -- C:\aaaiight.ttf
[2010/02/16 15:30:03 | 000,004,335 | ---- | M] () -- C:\atlog.txt
[2009/01/12 08:57:23 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/06/25 13:31:27 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/04/30 00:02:06 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2010/04/30 00:09:55 | 000,027,606 | ---- | M] () -- C:\ComboFix.txt
[2009/01/12 08:57:23 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/01/20 11:39:38 | 000,046,452 | ---- | M] () -- C:\debug1214.txt
[2002/01/01 02:15:18 | 000,124,776 | ---- | M] () -- C:\graffonti.3d.drop.[fontvir.us].ttf
[2002/01/01 04:51:46 | 000,085,456 | ---- | M] () -- C:\graffonti.atomic.bomb.[fontvir.us].ttf
[2002/01/01 05:11:04 | 000,108,024 | ---- | M] () -- C:\graffonti.gradient.fill.[fontvir.us].ttf
[2010/04/30 18:44:45 | 2080,268,288 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/13 11:59:35 | 000,230,424 | ---- | M] () -- C:\img2-001.raw
[2009/01/12 08:57:23 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/09/25 15:06:39 | 000,029,862 | ---- | M] () -- C:\keys.zip
[2009/12/01 14:49:29 | 000,022,016 | ---- | M] () -- C:\List of QMIS Opcos for anonomsing.xls
[2009/11/03 18:37:46 | 000,028,716 | ---- | M] () -- C:\Mostwasted.ttf
[2009/01/12 08:57:23 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 05:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/04/30 18:44:42 | 2080,194,560 | -HS- | M] () -- C:\pagefile.sys
[2010/04/30 09:22:28 | 000,008,137 | RHS- | M] () -- C:\ROMBL.CFG
[2007/07/22 13:35:28 | 000,042,972 | ---- | M] () -- C:\Street Writers.ttf
[2010/01/29 14:54:22 | 034,645,740 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-101.zip
[2010/01/29 16:59:02 | 010,862,636 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-173.zip
[2010/01/29 16:48:18 | 022,257,219 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-225.zip
[2010/01/29 15:16:40 | 007,411,347 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-344.zip
[2010/01/29 16:39:18 | 007,759,485 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-564.zip
[2010/01/29 10:14:28 | 004,082,587 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-779.zip
[2010/01/29 14:58:52 | 007,198,537 | ---- | M] () -- C:\VMC-Logs23415-2010-01-29-862.zip
[2010/02/01 14:12:12 | 063,433,562 | ---- | M] () -- C:\VMC-Logs23415-2010-02-01-275.zip
[2010/02/01 14:25:40 | 049,930,563 | ---- | M] () -- C:\VMC-Logs23415-2010-02-01-681.zip
[2010/02/03 17:53:52 | 004,772,087 | ---- | M] () -- C:\VMC-Logs23415-2010-02-03-769.zip
[2010/02/04 16:50:44 | 002,366,661 | ---- | M] () -- C:\VMC-Logs23415-2010-02-04-195.zip
[2010/02/11 17:56:35 | 034,578,327 | ---- | M] () -- C:\VMC-Logs23415-2010-02-11-365.zip
[2010/02/11 17:40:17 | 003,329,378 | ---- | M] () -- C:\VMC-Logs23415-2010-02-11-938.zip
[2009/06/25 13:23:50 | 000,000,297 | ---- | M] () -- C:\WINBOM.000

< %PROGRAMFILES%\*. >
[2009/09/11 15:22:52 | 000,000,000 | ---D | M] -- C:\Program Files\7-Zip
[2010/02/16 14:46:13 | 000,000,000 | ---D | M] -- C:\Program Files\Actix
[2010/03/25 10:29:38 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010/01/07 15:15:25 | 000,000,000 | ---D | M] -- C:\Program Files\Audacity
[2010/02/01 14:43:00 | 000,000,000 | ---D | M] -- C:\Program Files\AutoIt3
[2010/03/23 11:38:18 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2009/06/25 13:26:19 | 000,000,000 | ---D | M] -- C:\Program Files\Broadcom Corporation
[2009/06/25 13:59:30 | 000,000,000 | ---D | M] -- C:\Program Files\Cisco Systems
[2009/06/25 14:00:57 | 000,000,000 | ---D | M] -- C:\Program Files\Citrix
[2010/04/30 13:31:46 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2009/01/12 08:54:50 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2009/06/25 14:00:40 | 000,000,000 | ---D | M] -- C:\Program Files\CyberLink
[2009/06/25 13:25:14 | 000,000,000 | ---D | M] -- C:\Program Files\Dell
[2009/06/25 13:28:09 | 000,000,000 | ---D | M] -- C:\Program Files\DellTPad
[2009/06/25 13:26:16 | 000,000,000 | ---D | M] -- C:\Program Files\DIFX
[2009/10/07 21:51:11 | 000,000,000 | ---D | M] -- C:\Program Files\Emerald Editor Community
[2009/06/25 13:58:05 | 000,000,000 | ---D | M] -- C:\Program Files\Enterprise Vault
[2009/10/28 02:32:02 | 000,000,000 | ---D | M] -- C:\Program Files\EpsonNet
[2010/02/01 11:25:50 | 000,000,000 | ---D | M] -- C:\Program Files\eRoom 7
[2009/12/24 22:42:08 | 000,000,000 | ---D | M] -- C:\Program Files\FileZilla FTP Client
[2010/04/30 09:21:36 | 000,000,000 | ---D | M] -- C:\Program Files\HPOVCM
[2009/06/25 13:28:12 | 000,000,000 | ---D | M] -- C:\Program Files\IDT
[2010/02/17 21:10:13 | 000,000,000 | ---D | M] -- C:\Program Files\Information Packaging
[2010/02/16 15:30:02 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2009/06/25 13:37:01 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2009/06/25 13:57:52 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2009/09/01 09:40:29 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2009/11/24 11:13:42 | 000,000,000 | ---D | M] -- C:\Program Files\Jedox
[2009/12/10 12:01:18 | 000,000,000 | ---D | M] -- C:\Program Files\Kettle
[2010/01/07 15:19:44 | 000,000,000 | ---D | M] -- C:\Program Files\Lame for Audacity
[2010/04/29 14:53:15 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/01/12 08:59:24 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2010/03/24 10:38:57 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
[2009/01/12 09:22:34 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2009/01/12 09:00:04 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/09/02 08:56:18 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft LifeCam
[2009/07/22 15:32:52 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/06/25 14:04:32 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office Communicator
[2009/10/07 14:48:21 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2010/02/23 10:28:22 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server
[2009/06/25 13:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2009/06/25 13:52:20 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2010/02/16 14:42:07 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2009/01/12 08:55:40 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/04/02 23:39:53 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/01/07 15:26:22 | 000,000,000 | ---D | M] -- C:\Program Files\MP3Gain
[2009/01/12 09:34:44 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2009/01/12 09:00:04 | 000,000,000 | ---D | M] -- C:\Program Files\msn gaming zone
[2009/01/12 09:16:48 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2009/01/12 09:18:37 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0
[2009/11/30 16:36:03 | 000,000,000 | ---D | M] -- C:\Program Files\MySQL
[2009/01/12 08:55:44 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2009/08/05 21:21:34 | 000,000,000 | ---D | M] -- C:\Program Files\NOS
[2009/01/12 08:55:56 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2009/09/24 21:56:36 | 000,000,000 | ---D | M] -- C:\Program Files\OpenVPN
[2009/09/27 01:44:21 | 000,000,000 | ---D | M] -- C:\Program Files\OpenVPN-Control
[2009/09/08 09:43:30 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2010/02/04 10:08:34 | 000,000,000 | ---D | M] -- C:\Program Files\qpac
[2010/04/30 13:33:30 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2009/01/12 09:34:36 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2010/03/19 18:58:41 | 000,000,000 | ---D | M] -- C:\Program Files\Safari
[2009/06/25 14:07:36 | 000,000,000 | ---D | M] -- C:\Program Files\SAP
[2009/09/01 09:42:28 | 000,000,000 | ---D | M] -- C:\Program Files\SAS
[2009/08/03 12:09:46 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2010/04/21 15:36:27 | 000,000,000 | ---D | M] -- C:\Program Files\SUPERAntiSpyware
[2010/04/30 13:29:50 | 000,000,000 | ---D | M] -- C:\Program Files\Symantec
[2010/01/22 10:27:25 | 000,000,000 | ---D | M] -- C:\Program Files\SymbioWare
[2009/01/12 09:03:20 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2009/06/25 14:47:48 | 000,000,000 | ---D | M] -- C:\Program Files\Utimaco
[2009/09/04 22:30:14 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2010/01/20 11:36:28 | 000,000,000 | ---D | M] -- C:\Program Files\Vodafone
[2009/06/25 13:35:24 | 000,000,000 | ---D | M] -- C:\Program Files\WIDCOMM
[2009/01/12 09:15:39 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2009/01/12 09:16:05 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2009/01/12 09:00:04 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2009/01/12 08:56:01 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2010/01/20 11:58:19 | 000,000,000 | ---D | M] -- C:\Program Files\WinPcap
[2009/09/24 21:25:38 | 000,000,000 | ---D | M] -- C:\Program Files\WinSCP
[2009/10/12 11:25:05 | 000,000,000 | ---D | M] -- C:\Program Files\WinZip
[2010/01/20 11:58:23 | 000,000,000 | ---D | M] -- C:\Program Files\Wireshark
[2009/08/03 11:54:45 | 000,000,000 | ---D | M] -- C:\Program Files\Wisdom-soft ScreenHunter 5 Free
[2010/01/09 13:14:05 | 000,000,000 | ---D | M] -- C:\Program Files\XBMC
[2009/01/12 09:00:04 | 000,000,000 | ---D | M] -- C:\Program Files\xerox

< %appdata%\*.* >
[2009/09/27 22:07:06 | 000,002,528 | ---- | M] () -- D:\Users\MCornall\Application Data\$_hpcst$.hpc
[2009/01/12 08:48:53 | 000,000,062 | -HS- | M] () -- D:\Users\MCornall\Application Data\desktop.ini
[2009/09/27 01:22:44 | 000,000,600 | ---- | M] () -- D:\Users\MCornall\Application Data\winscp.rnd


< MD5 for: AGP440.SYS >
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Source\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Source\i386\sp3.cab:atapi.sys
[2008/04/14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: DISK.SYS >
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Source\i386\sp3.cab:disk.sys
[2008/04/14 05:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/14 05:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 05:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2008/07/21 01:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\OemDir\iaStor.sys
[2008/07/21 01:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\system32\drivers\BuildMSC\IaStor.sys
[2008/07/21 01:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\system32\drivers\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/14 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 05:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 05:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 05:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SYMMPI.SYS >
[2005/11/17 13:58:16 | 000,092,672 | ---- | M] (LSI Logic) MD5=1FD5249D5103125D2DA63F68D7BE1D35 -- C:\WINDOWS\system32\drivers\BuildMSC\symmpi.sys
[2005/11/17 13:58:16 | 000,092,672 | ---- | M] (LSI Logic) MD5=1FD5249D5103125D2DA63F68D7BE1D35 -- C:\WINDOWS\system32\drivers\symmpi.sys

< MD5 for: USBSTOR.SYS >
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbstor.sys
[2008/04/14 05:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Source\i386\sp3.cab:usbstor.sys
[2008/04/14 01:15:40 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\system32\dllcache\usbstor.sys
[2008/04/14 01:15:40 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\system32\drivers\USBSTOR.SYS

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

Please do a scan with Kaspersky Online Scanner

Click on the Accept button and install any components it needs.

• The program will install and then begin downloading the latest definition files.
  
• After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  
• This will start the program and scan your system.
  
• The scan will take a while, so be patient and let it run.
  
• Once the scan is complete, click on View scan report
  
• Now, click on the Save Report as button.
  
• Save the file to your desktop.
  
• Copy and paste that information in your next post.