Autoruns won't actually fit into a post, so I'll find somewhere to host it.
Rootkit Revealer:
Code:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesProcessed 18/12/2005 14:53 4 bytes Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\OFFICE\msodata035.dat 18/12/2005 14:58 1.36 KB Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\OFFICE\msodata036.dat 18/12/2005 14:58 3.57 KB Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\0EA9F058d01 18/12/2005 14:59 44.46 KB Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\98CB2FE9d01 18/12/2005 15:00 558.46 KB Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\CC40D7EEd01 18/12/2005 14:59 19.42 KB Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\E0EB16ECd01 18/12/2005 14:59 80.38 KB Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Temp\~DFE38F.tmp 18/12/2005 14:44 112.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Peter\Recent\ProcessExplorerNt.lnk 18/12/2005 15:00 460 bytes Hidden from Windows API.
C:\Documents and Settings\Peter\Recent\README.TXT.lnk 18/12/2005 15:00 603 bytes Hidden from Windows API.