Spybot Disabled, Unwanted browser redirects, malware for sure
I've been a user of Spybot for years and this is the first time its failed to protect me. I'm amazed that I was able to get into the forum without being redirected as when I search on any other topic I am immediately redirected to garbage sites. I believe I've followed all the pre-post instructions. Here is my DDS. Unfortunately as I am running XP sp3 on this box and I don't have a file zipper utility installed I cannot zip the other report. I have backed up my registry. Thanks in advance.
Owner
DDS (Ver_10-03-17.01) - NTFSx86
Run by Owner at 12:28:09.31 on Tue 08/10/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2218 [GMT -4:00]
============== Running Processes ===============
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\sttray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Sigaba\SigabaSecure\OutlookExpress\sigoetray.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\Program Files\Password Safe\pwsafe.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\STacSV.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\NUET49U2\dds[1].scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 10\SnagitBHO.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: LastPass Browser Helper Object: {95d9ecf5-2a4d-4550-be49-70d42f71296e} - c:\program files\lastpass\LPBar.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 10\SnagitIEAddin.dll
TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPBar.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [AdobeBridge] "c:\program files\adobe\adobe bridge cs4\Bridge.exe" -stealth
mRun: [SigmatelSysTrayApp] sttray.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [Adobe_ID0ENQBO] c:\progra~1\common~1\adobe\adobev~2\server\bin\VERSIO~2.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [nwiz] nwiz.exe /installquiet
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Verizon_McciTrayApp] "c:\program files\verizon\McciTrayApp.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\Owner~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\Owner~1\startm~1\programs\startup\passwo~1.lnk - c:\program files\password safe\pwsafe.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\secure~1.lnk - c:\program files\sigaba\sigabasecure\outlookexpress\sigoetray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - c:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wdsmar~1.lnk - c:\program files\western digital\wd smartware\front parlor\WDSmartWare.exe
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: LastPass - file://c:\program files\lastpass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://c:\program files\lastpass\context.html?cmd=fillforms
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPBar.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238251092606
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\Owner~1\applic~1\mozilla\firefox\profiles\rjgrleqn.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - component: c:\documents and settings\Owner converse\application data\mozilla\firefox\profiles\rjgrleqn.default\extensions\{0b457caa-602d-484a-8fe7-c1d894a011ba}\platform\winnt_x86-msvc\components\SSSLauncher.dll
FF - component: c:\documents and settings\Owner converse\application data\mozilla\firefox\profiles\rjgrleqn.default\extensions\support@lastpass.com\platform\winnt_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\documents and settings\Owner converse\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\common files\motive\npMotive.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-8 64288]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1352832]
R2 QuickBooksDB17;QuickBooksDB17;c:\progra~1\intuit\quickb~1\qbdbmgrn.exe -hvquickbooksdb17 --> c:\progra~1\intuit\quickb~1\QBDBMgrN.exe -hvQuickBooksDB17 [?]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-2-26 110592]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\western digital\wd smartware\front parlor\WDSmartWareBackgroundService.exe [2009-6-16 20480]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-3-18 11520]
S1 cfslmqfu;cfslmqfu;\??\c:\windows\system32\drivers\cfslmqfu.sys --> c:\windows\system32\drivers\cfslmqfu.sys [?]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 288112]
=============== Created Last 30 ================
2010-08-10 15:20:43 0 d-----w- c:\windows\system32\wbem\Repository
2010-08-10 15:04:28 0 d-----w- c:\program files\VSO
2010-08-10 14:54:17 0 d-----w- c:\docume~1\Owner~1\applic~1\Philipp Winterberg
2010-08-10 14:54:13 0 d-----w- c:\program files\Free RAR Extract Frog
2010-08-07 12:29:19 8056520 ----a-w- c:\program files\common files\lpuninstall.exe
2010-08-07 12:29:18 0 d-----w- c:\program files\LastPass
2010-08-07 12:08:16 0 d-----w- c:\docume~1\Owner~1\applic~1\FireShot
2010-08-07 11:15:58 0 d-----w- c:\program files\VideoLAN
2010-08-07 11:08:32 0 d-----w- C:\DECCHECK
2010-08-05 12:19:25 0 d-----w- c:\program files\Super_DVD_Creator_9.8
2010-08-05 10:30:15 0 d-----w- c:\docume~1\Owner~1\applic~1\Sony Creative Software Inc
2010-08-05 10:26:23 0 d-----w- c:\program files\Sony
2010-07-29 14:34:35 0 d-----w- c:\program files\common files\Wise Installation Wizard
2010-07-20 14:00:36 0 d-----w- c:\program files\ClipArt
2010-07-20 13:59:04 0 d-----w- c:\program files\docs
2010-07-20 13:59:01 0 d-----w- c:\program files\Symbols
2010-07-20 13:58:58 0 d-----w- c:\program files\common files\SureThing Shared
2010-07-20 13:58:57 0 d-----w- c:\windows\MVUNINST
2010-07-20 13:58:57 0 d-----w- c:\program files\STCD
2010-07-17 11:50:47 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
==================== Find3M ====================
2010-08-08 15:04:25 231021 ----a-w- c:\windows\fonts\AdobeFnt11.lst
2010-06-24 13:48:37 88656 ----a-w- c:\windows\fonts\DidotLTStd-Italic.ttf
2010-06-24 13:48:19 135904 ----a-w- c:\windows\fonts\DidotLTStd-Roman.ttf
2010-06-24 13:48:04 108232 ----a-w- c:\windows\fonts\DidotLTStd-Headline.ttf
2010-06-24 13:47:05 51004 ----a-w- c:\windows\fonts\AkzidenzGroteskBE-Bold.ttf
2010-06-24 13:46:47 50192 ----a-w- c:\windows\fonts\AkzidenzGroteskBE-Light.ttf
2010-06-24 13:45:23 50940 ----a-w- c:\windows\fonts\Univers(10)
2010-06-24 13:44:54 53164 ----a-w- c:\windows\fonts\Univers(9)
2010-06-24 13:44:36 66396 ----a-w- c:\windows\fonts\Univers(8)
2010-06-24 13:43:56 50548 ----a-w- c:\windows\fonts\Univers(7)
2010-06-24 13:43:26 66704 ----a-w- c:\windows\fonts\Univers(6)
2010-06-24 13:43:08 70972 ----a-w- c:\windows\fonts\Univers(5)
2010-06-24 13:42:46 84556 ----a-w- c:\windows\fonts\Univers(4)
2010-06-24 13:42:29 85620 ----a-w- c:\windows\fonts\Univers(3)
2010-06-24 13:42:14 45516 ----a-w- c:\windows\fonts\Univers(2)
2010-06-24 13:40:33 71264 ----a-w- c:\windows\fonts\Trajan(2)
2010-06-24 13:40:18 71396 ----a-w- c:\windows\fonts\Trajan
2010-06-24 13:36:55 38860 ----a-w- c:\windows\fonts\Futura(15)
2010-06-24 13:36:38 38596 ----a-w- c:\windows\fonts\Futura(14)
2010-06-24 13:36:21 45784 ----a-w- c:\windows\fonts\Futura(13)
2010-06-24 13:36:02 38788 ----a-w- c:\windows\fonts\Futura(12)
2010-06-24 13:35:44 44592 ----a-w- c:\windows\fonts\Futura(11)
2010-06-24 13:35:29 38764 ----a-w- c:\windows\fonts\Futura(10)
2010-06-24 13:35:12 62188 ----a-w- c:\windows\fonts\Futura(9)
2010-06-24 13:35:01 75732 ----a-w- c:\windows\fonts\Futura(8)
2010-06-24 13:34:42 65612 ----a-w- c:\windows\fonts\Futura(7)
2010-06-24 13:34:09 38040 ----a-w- c:\windows\fonts\Futura(5)
2010-06-24 13:33:55 37272 ----a-w- c:\windows\fonts\Futura(4)
2010-06-24 13:33:40 37008 ----a-w- c:\windows\fonts\Futura(3)
2010-06-24 13:33:25 34924 ----a-w- c:\windows\fonts\Futura(2)
2010-06-24 13:33:08 35356 ----a-w- c:\windows\fonts\Futura
2010-06-24 13:28:42 56876 ----a-w- c:\windows\fonts\Frutiger(10)
2010-06-24 13:28:13 47836 ----a-w- c:\windows\fonts\Frutiger(9)
2010-06-24 13:27:47 42856 ----a-w- c:\windows\fonts\Frutiger(8)
2010-06-24 13:27:18 57056 ----a-w- c:\windows\fonts\Frutiger(7)
2010-06-24 13:27:04 40884 ----a-w- c:\windows\fonts\Frutiger(6)
2010-06-24 13:26:45 56284 ----a-w- c:\windows\fonts\Frutiger(5)
2010-06-24 13:26:28 57364 ----a-w- c:\windows\fonts\Frutiger(4)
2010-06-24 13:26:01 89772 ----a-w- c:\windows\fonts\Frutiger(3)
2010-06-24 13:22:08 40784 ----a-w- c:\windows\fonts\Frutiger
2010-06-24 13:21:27 79212 ----a-w- c:\windows\fonts\Trade(8)
2010-06-24 13:21:06 69592 ----a-w- c:\windows\fonts\Trade(7)
2010-06-24 13:20:47 82036 ----a-w- c:\windows\fonts\Trade(6)
2010-06-24 13:20:30 70748 ----a-w- c:\windows\fonts\Trade(5)
2010-06-24 13:20:14 75292 ----a-w- c:\windows\fonts\Trade(4)
2010-06-24 13:19:26 77384 ----a-w- c:\windows\fonts\Trade(2)
2010-06-24 13:14:51 39084 ----a-w- c:\windows\fonts\Humanist(14)
2010-06-24 13:14:31 37764 ----a-w- c:\windows\fonts\Humanist(13)
2010-06-24 13:14:10 40352 ----a-w- c:\windows\fonts\Humanist(12)
2010-06-24 13:13:32 41040 ----a-w- c:\windows\fonts\Humanist(11)
2010-06-24 13:13:12 35340 ----a-w- c:\windows\fonts\Humanist(10)
2010-06-24 13:12:54 35052 ----a-w- c:\windows\fonts\Humanist(9)
2010-06-24 13:12:38 38316 ----a-w- c:\windows\fonts\Humanist(8)
2010-06-24 13:12:22 36516 ----a-w- c:\windows\fonts\Humanist(7)
2010-06-24 13:11:44 35468 ----a-w- c:\windows\fonts\Humanist(6)
2010-06-24 13:11:22 34428 ----a-w- c:\windows\fonts\Humanist(5)
2010-06-24 13:10:43 35872 ----a-w- c:\windows\fonts\Humanist(3)
2010-06-24 13:10:26 38124 ----a-w- c:\windows\fonts\Humanist(2)
2010-06-24 13:07:38 39568 ----a-w- c:\windows\fonts\HelveticaNeue(4)
2010-06-24 13:07:14 39656 ----a-w- c:\windows\fonts\HelveticaNeue(3)
2010-06-24 13:06:30 40104 ----a-w- c:\windows\fonts\HelveticaNeue
2010-06-24 13:06:12 73176 ----a-w- c:\windows\fonts\Helvetica(2)
2010-06-24 13:05:54 51624 ----a-w- c:\windows\fonts\Helvetica
2010-06-24 13:05:05 72496 ----a-w- c:\windows\fonts\Minion(4)
2010-06-24 13:04:07 104588 ----a-w- c:\windows\fonts\Minion(3)
2010-06-24 13:03:29 98996 ----a-w- c:\windows\fonts\Minion(2)
2010-06-24 13:03:11 112712 ----a-w- c:\windows\fonts\Minion
2010-06-24 13:01:06 83084 ----a-w- c:\windows\fonts\Bell(4)
2010-06-24 13:00:45 37160 ----a-w- c:\windows\fonts\Bell(3)
2010-06-24 13:00:24 36372 ----a-w- c:\windows\fonts\Bell(2)
2010-06-24 12:52:22 70240 ----a-w- c:\windows\fonts\Trade
2010-06-24 11:46:49 150804 ----a-w- c:\windows\fonts\DroidSans-Bold.ttf
2010-06-24 11:46:49 149076 ----a-w- c:\windows\fonts\DroidSans.ttf
2010-06-24 11:45:38 95616 ----a-w- c:\windows\fonts\AllerDisplay.ttf
2010-06-24 11:45:38 134436 ----a-w- c:\windows\fonts\Aller_Rg.ttf
2010-06-24 11:45:38 132780 ----a-w- c:\windows\fonts\Aller_Lt.ttf
2010-06-24 11:45:38 123556 ----a-w- c:\windows\fonts\Aller_BdIt.ttf
2010-06-24 11:45:38 122296 ----a-w- c:\windows\fonts\Aller_LtIt.ttf
2010-06-24 11:45:38 120876 ----a-w- c:\windows\fonts\Aller_It.ttf
2010-06-24 11:45:37 128368 ----a-w- c:\windows\fonts\Aller_Bd.ttf
2010-06-24 11:43:15 62196 ----a-w- c:\windows\fonts\GeosansLight-Oblique.ttf
2010-06-24 11:43:15 60072 ----a-w- c:\windows\fonts\GeosansLight.ttf
2010-06-24 11:42:52 80460 ----a-w- c:\windows\fonts\mentone-semibol.otf
2010-06-24 11:42:30 52752 ----a-w- c:\windows\fonts\centabel.ttf
2010-06-24 11:42:07 83160 ----a-w- c:\windows\fonts\DAYROM__.ttf
2010-06-24 11:42:07 63035 ----a-w- c:\windows\fonts\TLDPR2.jpg
2010-06-24 11:42:07 61529 ----a-w- c:\windows\fonts\TLDPR5.jpg
2010-06-24 11:42:07 57839 ----a-w- c:\windows\fonts\TLDPR1.jpg
2010-06-24 11:42:07 5707 ----a-w- c:\windows\fonts\DAY-O.txt
2010-06-24 11:42:07 30088 ----a-w- c:\windows\fonts\DAYROM_X.ttf
2010-06-24 11:42:07 19005 ----a-w- c:\windows\fonts\TLDPR4.jpg
2010-06-24 11:42:07 14708 ----a-w- c:\windows\fonts\TLDPR3.jpg
2010-06-24 11:41:40 128936 ----a-w- c:\windows\fonts\KIN668.TTF
2010-06-24 11:19:18 21764 ----a-w- c:\windows\fonts\SLANT.TTF
2010-06-24 11:18:54 9850 ----a-w- c:\windows\fonts\read_me.html
2010-06-24 11:18:54 55820 ----a-w- c:\windows\fonts\bluehigh.ttf
2010-06-24 11:18:54 52456 ----a-w- c:\windows\fonts\bluecond.ttf
2010-06-24 11:18:54 51728 ----a-w- c:\windows\fonts\bluebold.ttf
2010-06-24 11:18:54 41460 ----a-w- c:\windows\fonts\BLUEHIGD.TTF
2010-06-24 11:18:54 34884 ----a-w- c:\windows\fonts\bluehigl.ttf
2009-06-28 23:01:57 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat
2009-06-28 23:01:48 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009062820090629\index.dat
2009-06-28 23:01:57 32768 --sha-w- c:\windows\system32\config\systemprofile\privacie\index.dat
============= FINISH: 12:29:18.29 ===============
