[Resolved] Internet Explorer is not working

Computer forums for help with removing malicious software (malware) and improving computer security

grin Welcome to What the Tech! ( Log In | Register ) What tech support ought to be... Fast, friendly and free! Once registered - you'll have the ability to post your question in the appropriate forum below. Additionally, if you can assist another member by sharing your tech knowledge, please post a reply! Best of all - Registration and all assistance is FREE! Once you've completed registration, simply choose the appropriate forum below, click on the "new topic" button, and post your question! What are you waiting for? Register today! *Registered users see NO ADVERTISING.

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

2 Pages

1 2 >

[Resolved] Internet Explorer is not working

Options

Warnite View Member Profile	Jun 17 2009, 10:53 AM Post #1
New Member Group: Authentic Member Posts: 17 Joined: 15-January 08 Member No.: 75,988 Operating System: Windows XP	Well let me start by saying this. Last night, i was playing a game... im sure you all know it, its called World of Warcraft, well i recieved a mail ingame from a person i know, and basicly it said that he made a video of our guild in game and to download it and check it out. Well as stupid as i am, i went ahead and downloaded it, now before i launched it, i looked at the file because it did not look like a video file. The file was called "org.exe". I was really hesitant about it, but i was stupid enough to open it. When i double click on it, the file had disappeared. Shortly after, my internet explorer has completely stopped working. When i try to open it, and error pops up saying "Internet Explorer has stopped working.... A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available." Now i do have an Antivirus, Anti-malware, and registry cleaner.... My Antivirus i use is called "Vipre", my antimalware is called "Malwarebyte's Anti-Malware", and my registry cleaner is called "Ccleaner". Well i ran a full system scan on both Vipre and Malwarebyte's Anti-Malware. Vipre didnt find anything, but Malwarebyte's did find 9 infections including trojans and other stuff. When i ran Ccleaner, it found numerous problems in my registry. I went ahead and fixed all the problems ive found. When i restarted my computer, IE was still not working, i have Vista 64bit, AOL and IE 64bit works, but the normal IE still gives me the error. I have IE version 8, so what i did was uninstalled the update rolled back to version 7, tried it and it still didnt work, so then i went back and redownloaded IE version 8 installed it, and it still gives me the error. Some people that i talked to online in the game i played said it either could've been either a virus or even keyloggers that people are trying to hack my account. So i downloaded Hijackthis and did a log of my computer. Can you guys look at this and see if there is anything wrong or if im still infected with virus/spyware/keyloggers?? Before i i post my HJT Log, here is the log from Malwarebyte's Anti-Malware: Malwarebytes' Anti-Malware 1.37 Database version: 2293 Windows 6.0.6001 Service Pack 1 6/17/2009 12:44:51 AM mbam-log-2009-06-17 (00-44-51).txt Scan type: Quick Scan Objects scanned: 74002 Time elapsed: 2 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 9 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 2 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\ieshowinfo.receiverbho (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{89ec0b92-2c0c-42e0-98b9-c049ef027140} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{46f03432-be65-4333-b524-04713c4c81fe} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{dbaf53d4-11fe-482d-b516-b3103bc71f87} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{dbaf53d4-11fe-482d-b516-b3103bc71f87} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dbaf53d4-11fe-482d-b516-b3103bc71f87} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\ieshowinfo.receiverbho.1 (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: c:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\freshplay (Trojan.DNSChanger) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\freshplay (Trojan.DNSChanger) -> Quarantined and deleted successfully. Files Infected: C:\Program Files (x86)\linksador\ShowInfo\IeShowInfo.dll (Trojan.BHO) -> Quarantined and deleted successfully. c:\programdata\microsoft\Windows\start menu\Programs\freshplay\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully. Here is my HJT Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:51:41 AM, on 6/17/2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe C:\Program Files (x86)\Java\jre6\bin\jusched.exe C:\Program Files (x86)\Common Files\aol\1230257227\ee\aolsoftware.exe C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe C:\Program Files (x86)\AOL 9.5\waol.exe C:\Program Files (x86)\AOL 9.5\shellmon.exe C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: IAOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: AOL Toolbar Loader - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [nmctxth] "C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [HostManager] "C:\Program Files (x86)\Common Files\AOL\1230257227\ee\AOLSoftware.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SBAMTray] C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [AnyDVD] C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\rundll32.exe C:\Users\ADMINI~1\AppData\Local\Temp\294479031754mxx.dll,DllMain O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files (x86)\AOL 9.5\AOL.EXE" -b O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O13 - Gopher Prefix: O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing) O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: VIPRE Antivirus + Antispyware (SBAMSvc) - Sunbelt Software - C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMSvc.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 9190 bytes I tried to do use the "Analyze This" button but i dont think it work since it had to open up IE, and when it did, IE gave me the error once again.. This post has been edited by Warnite: Jun 17 2009, 11:08 AM

SpySentinel View Member Profile	Jun 17 2009, 07:30 PM Post #2
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	Hi Warnite, My name is SpySentinel and I will be helping you with your malware problem. DNS Changer Infection Please read this post completely, it may make it easier if you copy and paste this post to a new text document or print it for reference later. This will especially help you when your computer is off line. Also copy this link for router passwords - see below http://www.phenoelit-us.org/dpl/dpl.html Copy this link for video tutorial - see below http://onguardonline.gov/tutorials/index.h...orials-wireless Some things here to know. DNS changer infects your router. We need to clean your machine again, off line, so that the router can't re-infect your computer. Before you use the router again we want to re-set it to it's default settings to remove the infection and stop it coming back. Some routers you can re-set quite easily just by rebooting them others need a different approach. Some types of internet (i.e. DSL connections that use PPPoE in the router), you will need to know the data to re-setup the router itself. What I am going to do now is give you some instructions that work in most cases. If however it doesn't work for you, you will lose internet connection and will need to talk to your router provider to ascertain how to re-setup your router. You have used Malwarebytes before. If you no-longer have Malwarebytes please download from Here or Here Next disconnect your system from the internet, and your router, then… Double Click mbam-setup.exe to install the application. Launch Malwarebytes' Anti-Malware, then click Finish. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. =============================================== Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds). If you don’t know the router's default password, you can look it up HERE However, if there are other Zlob-infected machines using the same router, they will need to be cleared with the above steps before resetting the router. Otherwise, the malware will simply go back and change the router's DNS settings. You also need to reconfigure any security settings you had in place prior to the reset. Check out this site here for video tutorials on how to properly configure your router's encryption and security settings. You may also need to consult with your Internet service provider to find out which DNS servers your network should be using. Once you have ran Malwarebytes' Anti-Malware on the infected system, and reset the router to its default configuration you can reconnect to the internet, and router. Then return to this site to post your logs.

Warnite View Member Profile	Jun 17 2009, 10:55 PM Post #3
New Member Group: Authentic Member Posts: 17 Joined: 15-January 08 Member No.: 75,988 Operating System: Windows XP	Hi, SpySentinel I unplugged my router from my computer, and unpluged the router from the modem, but leaving the power on in the router. I ran Malwarebyte's, and once it finished, i then resetted my router using a paperclip and putting it in the small hole like you said, i saw the lights blink for several seconds then it went to a steady light. I then reconnected my computer to the router and hooked it up to the modem. Here is my log for Malwarebyte's. Malwarebytes' Anti-Malware 1.37 Database version: 2293 Windows 6.0.6002 Service Pack 2 6/17/2009 11:49:57 PM mbam-log-2009-06-17 (23-49-57).txt Scan type: Quick Scan Objects scanned: 73786 Time elapsed: 1 minute(s), 27 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) SpySentinel, i forgot to tell you though, before i came and checked up on the forums to see if i had a reply, i went into safemode, and used SUPERAntiSpyware. It found another infection at the name of "Adware.Vundo/Varient-MMX". I found where the file was located on my computer and just deleted it. I then ran another scan in safemode on my computer and it found nothing. When i restarted my computer back to it normal and when the computer logged into windows, there was an error something about "RunDLL Error Loading: C:\Users\ADMINI~1\AppData\Local\Temp\294479031754mxx.dll. This specific module cannot be found" i did noticed that Internet Explorer finally started working and did not give me the previous error "Internet Explorer has stopped working.... A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available." like it did before. Just thought i let you know. This post has been edited by Warnite: Jun 17 2009, 11:14 PM

SpySentinel View Member Profile	Jun 18 2009, 02:50 PM Post #4
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	Hi Warnite, Thanks for letting me know. Along with a DNS Changer infection, you are also infected with Vundo which caused your internet explorer problems and since SUPERAntiSpyware removed it thats why you got that message regarding C:\Users\ADMINI~1\AppData\Local\Temp\294479031754mxx.dll. Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding. Step #1 Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\rundll32.exe C:\Users\ADMINI~1\AppData\Local\Temp\294479031754mxx.dll,DllMain Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. After that, Reboot Step #2 Please download VundoFix.exe to your desktop Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting. Step #3 Disable resident protections (Antivirus...); you'll re-enable them after the scan Download Lop S&D < here Double-click Lop S&D.exe Choose the language, then choose Option 1 (Search) Wait till the end of the scan Post the log which is created: (%SystemDrive%\lopR.txt)

Warnite View Member Profile	Jun 18 2009, 07:10 PM Post #5
New Member Group: Authentic Member Posts: 17 Joined: 15-January 08 Member No.: 75,988 Operating System: Windows XP	Hi SpySentinel I did Steps 1 and 2 in safe mode, although i was NOT able to do Step 3. I downloaded Lop S&D, and i ran the program, i typed "E" for english as shown, and when i hit enter, the program just turned off. I redownloaded it again and tried it in safe mode and normal and it did the same thing. Anyways, here are my logs for both HJT and Vundofix. VundoFix V7.0.6 Scan started at 7:25:30 PM 6/18/2009 Listing files found while scanning.... No infected files were found. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:03:06 PM, on 6/18/2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Safe mode Running processes: C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: IAOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: AOL Toolbar Loader - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [nmctxth] "C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [HostManager] "C:\Program Files (x86)\Common Files\AOL\1230257227\ee\AOLSoftware.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SBAMTray] C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [AnyDVD] C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O13 - Gopher Prefix: O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing) O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: VIPRE Antivirus + Antispyware (SBAMSvc) - Sunbelt Software - C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMSvc.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: TomTomHOMEService - TomTom - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 8939 bytes

SpySentinel View Member Profile	Jun 18 2009, 07:46 PM Post #6
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	Hi Warnite, Thanks for letting me know. Download OTL to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Check the boxes beside LOP Check and Purity Check. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Warnite View Member Profile	Jun 18 2009, 09:14 PM Post #7
New Member Group: Authentic Member Posts: 17 Joined: 15-January 08 Member No.: 75,988 Operating System: Windows XP	Hi SpySentinel I have a question. Do i have to run OTL in safe mode aswell? Or did you want me to run it in normal windows? Just want to make sure. Edit Ok, im editing so i wont double post, but i went ahead and did the scan in normal windows. Here are the logs for OLT.txt, and Extras.txt OTL logfile created on: 6/18/2009 11:43:03 PM - Run 1 OTL by OldTimer - Version 2.1.1.0 Folder = C:\Users\Administrator\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18783) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 4.00 Gb Total Physical Memory \| 4.00 Gb Available Physical Memory \| 100.00% Memory free 4.00 Gb Paging File \| 4.00 Gb Available in Paging File \| 100.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files (x86) Drive C: \| 465.76 Gb Total Space \| 401.93 Gb Free Space \| 86.30% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: JOHNNIE-PC Current User Name: Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.) PRC - C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC) PRC - C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe () PRC - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TomTom) PRC - C:\Windows\SysWOW64\java.exe (Sun Microsystems, Inc.) PRC - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Pure Networks, Inc.) PRC - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (AOL ACS [Auto \| Running]) -- C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC) SRV - (clr_optimization_v2.0.50727_32 [On_Demand \| Stopped]) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_64 [On_Demand \| Stopped]) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ehRecvr [On_Demand \| Stopped]) -- C:\Windows\ehome\ehRecvr.exe (Microsoft Corporation) SRV - (ehSched [On_Demand \| Stopped]) -- C:\Windows\ehome\ehsched.exe (Microsoft Corporation) SRV - (ehstart [Auto \| Stopped]) -- C:\Windows\ehome\ehstart.dll (Microsoft Corporation) SRV - (FontCache3.0.0.0 [On_Demand \| Stopped]) -- C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) SRV - (ForceWare Intelligent Application Manager (IAM) [Auto \| Running]) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe () SRV - (idsvc [Unknown \| Stopped]) -- C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation) SRV - (LinksysUpdater [Auto \| Running]) -- C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe () SRV - (Microsoft Office Groove Audit Service [On_Demand \| Stopped]) -- C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation) SRV - (NetTcpPortSharing [Disabled \| Stopped]) -- C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation) SRV - (nmservice [Auto \| Running]) -- C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Pure Networks, Inc.) SRV - (npggsvc [On_Demand \| Stopped]) -- C:\Windows\system32\GameMon.des (INCA Internet Co., Ltd.) SRV - (nSvcIp [Auto \| Running]) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe () SRV - (odserv [On_Demand \| Stopped]) -- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (ose [On_Demand \| Stopped]) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (PerfHost [On_Demand \| Stopped]) -- C:\Windows\SysWow64\perfhost.exe (Microsoft Corporation) SRV - (SBAMSvc [Auto \| Stopped]) -- C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMSvc.exe (Sunbelt Software) SRV - (Steam Client Service [On_Demand \| Stopped]) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (TomTomHOMEService [Auto \| Running]) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TomTom) SRV - (usnjsvc [On_Demand \| Stopped]) -- C:\Program Files (x86)\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation) SRV - (WLSetupSvc [On_Demand \| Stopped]) -- C:\Program Files (x86)\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation) SRV - (WMPNetworkSvc [On_Demand \| Stopped]) -- C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (AnyDVD [On_Demand \| Running]) -- C:\Windows\System32\Drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (ElbyCDIO [System \| Running]) -- C:\Windows\sysnative\Drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV - (HdAudAddService [On_Demand \| Running]) -- C:\Windows\sysnative\drivers\HdAudio.sys (Microsoft Corporation) DRV - (MTsensor [On_Demand \| Running]) -- C:\Windows\sysnative\DRIVERS\ASACPI.sys () DRV - (netr28ux [On_Demand \| Stopped]) -- C:\Windows\sysnative\DRIVERS\netr28ux.sys (Ralink Technology Corp.) DRV - (NPPTNT2 [On_Demand \| Stopped]) -- C:\Windows\system32\npptNT2.sys (INCA Internet Co., Ltd.) DRV - (pcouffin [On_Demand \| Stopped]) -- C:\Windows\sysnative\Drivers\pcouffin.sys (VSO Software) DRV - (pnarp [Auto \| Running]) -- C:\Windows\sysnative\DRIVERS\pnarp.sys (Pure Networks, Inc.) DRV - (purendis [Auto \| Running]) -- C:\Windows\sysnative\DRIVERS\purendis.sys (Pure Networks, Inc.) DRV - (SASDIFSV [System \| Stopped]) -- C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASENUM [On_Demand \| Stopped]) -- C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASKUTIL [System \| Stopped]) -- C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (sbapifs [Auto \| Running]) -- C:\Windows\sysnative\DRIVERS\sbapifs.sys (Sunbelt Software) DRV - (sbtis [System \| Running]) -- C:\Windows\sysnative\drivers\sbtis.sys (Sunbelt Software) DRV - (USB28xxBGA [On_Demand \| Stopped]) -- C:\Windows\sysnative\DRIVERS\emBDA64.sys (eMPIA Technology, Inc.) DRV - (USB28xxOEM [On_Demand \| Stopped]) -- C:\Windows\sysnative\DRIVERS\emOEM64.sys (eMPIA Technology, Inc.) DRV - (usbaudio [On_Demand \| Running]) -- C:\Windows\sysnative\drivers\usbaudio.sys (Microsoft Corporation) DRV - (wanatw [On_Demand \| Running]) -- C:\Windows\sysnative\DRIVERS\wanatw64.sys (America Online, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2009/04/16 20:02:12 \| 00,000,000 \| ---D \| M] O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (AOL Toolbar Loader) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll (AOL LLC) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - Reg Error: Key error. File not found O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll (AOL LLC) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll (AOL LLC) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation) O4 - HKLM..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" (Microsoft Corporation) O4 - HKLM..\Run: [HostManager] "C:\Program Files (x86)\Common Files\AOL\1230257227\ee\AOLSoftware.exe" (AOL LLC) O4 - HKLM..\Run: [nmctxth] "C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe" (Pure Networks, Inc.) O4 - HKLM..\Run: [SBAMTray] C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe (Sunbelt Software) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKCU..\Run: [AnyDVD] C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.) O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (Microsoft Corporation) O4 - HKCU..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background (Microsoft Corporation) O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (Microsoft Corporation) O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKCU..\Run: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" (TomTom) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-US\local\search.html () O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 (Microsoft Corporation) O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [@%SystemRoot%\system32\nlasvc.dll,-1000] - C:\Windows\system32\NLAapi.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [@%SystemRoot%\system32\napinsp.dll,-1000] - C:\Windows\system32\napinsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [@%SystemRoot%\system32\pnrpnsp.dll,-1000] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [@%SystemRoot%\system32\pnrpnsp.dll,-1001] - C:\Windows\system32\pnrpnsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\system32\nvLsp.dll (NVIDIA) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5) O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.) O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp3.dll (Pure Networks, Inc.) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Filter: - deflate - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter: - gzip - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\system32\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{75123ca9-e3e5-11dd-923c-00038a000015}\Shell - "" = AutoRun O33 - MountPoints2\{75123ca9-e3e5-11dd-923c-00038a000015}\Shell\AutoRun\command - "" = L:\StarterOfficeGuardian.exe -- File not found O33 - MountPoints2\{b8c972f0-5b6a-11de-b1a8-00038a000015}\Shell\AutoRun\command - "" = K:\InstallTomTomHOME.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - [2009/06/18 23:39:23 \| 00,000,000 \| R--D \| M] ========== Files/Folders - Created Within 30 Days ========== [2 C:\Windows\.tmp files] [2009/06/18 23:39:18 \| 00,501,760 \| ---- \| C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe [2009/06/18 20:05:56 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata10.sqm [2009/06/18 20:05:56 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt10.sqm [2009/06/18 19:46:43 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata09.sqm [2009/06/18 19:46:43 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt09.sqm [2009/06/18 19:11:23 \| 00,000,000 \| ---D \| C] -- C:\Lop SD [2009/06/18 19:11:09 \| 00,530,106 \| ---- \| C] () -- C:\Users\Administrator\Desktop\LopSD.exe [2009/06/18 12:14:45 \| 00,000,000 \| ---D \| C] -- C:\Downloads [2009/06/18 09:12:53 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata08.sqm [2009/06/18 09:12:53 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt08.sqm [2009/06/18 00:35:15 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata07.sqm [2009/06/18 00:35:15 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt07.sqm [2009/06/17 23:07:51 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata06.sqm [2009/06/17 23:07:51 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt06.sqm [2009/06/17 22:25:45 \| 00,000,000 \| ---- \| C] () -- C:\Windows\System32\SBRC.dat [2009/06/17 19:22:43 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata05.sqm [2009/06/17 19:22:42 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt05.sqm [2009/06/17 16:25:58 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata04.sqm [2009/06/17 16:25:58 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt04.sqm [2009/06/17 15:22:02 \| 00,000,000 \| ---D \| C] -- C:\VundoFix Backups [2009/06/17 14:55:13 \| 00,000,000 \| ---D \| C] -- C:\Users\Administrator\Documents\TomTom [2009/06/17 14:55:10 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\TomTom [2009/06/17 14:54:56 \| 00,000,000 \| ---D \| C] -- C:\Users\Administrator\AppData\Roaming\TomTom [2009/06/17 14:54:56 \| 00,000,000 \| ---D \| C] -- C:\Users\Administrator\AppData\Roaming\Mozilla [2009/06/17 14:54:52 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\TomTom International B.V [2009/06/17 14:54:34 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\TomTom HOME 2 [2009/06/17 14:53:54 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\TomTom DesktopSuite [2009/06/17 14:51:51 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\SUPERAntiSpyware.com [2009/06/17 14:51:38 \| 00,000,944 \| ---- \| C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2009/06/17 14:51:36 \| 00,000,000 \| ---D \| C] -- C:\Users\Administrator\AppData\Roaming\SUPERAntiSpyware.com [2009/06/17 14:51:36 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\SUPERAntiSpyware [2009/06/17 14:46:33 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata03.sqm [2009/06/17 14:46:33 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt03.sqm [2009/06/17 13:21:27 \| 00,000,000 \| -HSD \| C] -- C:\Config.Msi [2009/06/17 13:12:19 \| 00,000,000 \| ---D \| C] -- C:\Windows\System32\vi-VN [2009/06/17 13:12:19 \| 00,000,000 \| ---D \| C] -- C:\Windows\System32\eu-ES [2009/06/17 13:12:19 \| 00,000,000 \| ---D \| C] -- C:\Windows\System32\ca-ES [2009/06/17 12:52:26 \| 12,240,896 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\NlsLexicons0007.dll [2009/06/17 12:52:22 \| 02,134,528 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\FunctionDiscoveryFolder.dll [2009/06/17 12:52:21 \| 02,644,480 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\NlsLexicons0009.dll [2009/06/17 12:52:19 \| 01,081,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SLCExt.dll [2009/06/17 12:52:17 \| 01,480,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll [2009/06/17 12:52:15 \| 00,968,192 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wcnwiz2.dll [2009/06/17 12:52:15 \| 00,291,328 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WscEapPr.dll [2009/06/17 12:52:12 \| 01,576,960 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll [2009/06/17 12:52:11 \| 00,779,136 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PresentationNative_v0300.dll [2009/06/17 12:52:10 \| 00,526,336 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe [2009/06/17 12:52:09 \| 00,518,144 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe [2009/06/17 12:52:08 \| 02,241,536 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msi.dll [2009/06/17 12:52:06 \| 00,677,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\imapi2fs.dll [2009/06/17 12:52:05 \| 00,476,672 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll [2009/06/17 12:52:02 \| 02,868,224 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll [2009/06/17 12:52:02 \| 00,619,864 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\icardagt.exe [2009/06/17 12:52:02 \| 00,035,168 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\infocardcpl.cpl [2009/06/17 12:52:00 \| 01,216,000 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\AuxiliaryDisplayCpl.dll [2009/06/17 12:52:00 \| 00,164,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\spwizui.dll [2009/06/17 12:51:59 \| 00,289,792 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\spinstall.exe [2009/06/17 12:51:59 \| 00,112,640 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\spreview.exe [2009/06/17 12:51:58 \| 00,978,432 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\drmv2clt.dll [2009/06/17 12:51:57 \| 11,584,000 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\shell32.dll [2009/06/17 12:51:57 \| 00,472,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll [2009/06/17 12:51:56 \| 00,644,608 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\p2psvc.dll [2009/06/17 12:51:56 \| 00,441,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SearchIndexer.exe [2009/06/17 12:51:56 \| 00,117,248 \| ---- \| C] () -- C:\Windows\System32\EhStorAuthn.dll [2009/06/17 12:51:56 \| 00,037,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\EhStorPwdMgr.dll [2009/06/17 12:51:55 \| 00,858,112 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\kernel32.dll [2009/06/17 12:51:55 \| 00,670,720 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll [2009/06/17 12:51:55 \| 00,278,848 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mscoree.dll [2009/06/17 12:51:54 \| 01,165,088 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ntdll.dll [2009/06/17 12:51:54 \| 00,613,888 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\MSMPEG2VDEC.DLL [2009/06/17 12:51:54 \| 00,378,368 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\imapi2.dll [2009/06/17 12:51:54 \| 00,351,744 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll [2009/06/17 12:51:54 \| 00,203,264 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll [2009/06/17 12:51:53 \| 00,324,608 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\sdohlp.dll [2009/06/17 12:51:52 \| 01,459,200 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\esent.dll [2009/06/17 12:51:52 \| 00,729,600 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\IMJP10K.DLL [2009/06/17 12:51:52 \| 00,478,208 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\DevicePairing.dll [2009/06/17 12:51:51 \| 00,347,136 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe [2009/06/17 12:51:51 \| 00,190,464 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\sperror.dll [2009/06/17 12:51:51 \| 00,143,872 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\korwbrkr.dll [2009/06/17 12:51:50 \| 10,625,536 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wmp.dll [2009/06/17 12:51:50 \| 02,386,944 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL [2009/06/17 12:51:50 \| 00,346,624 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe [2009/06/17 12:51:50 \| 00,231,424 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll [2009/06/17 12:51:50 \| 00,228,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SLC.dll [2009/06/17 12:51:50 \| 00,120,320 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\EhStorAPI.dll [2009/06/17 12:51:50 \| 00,041,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll [2009/06/17 12:51:49 \| 01,589,248 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msjet40.dll [2009/06/17 12:51:49 \| 01,336,320 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msxml6.dll [2009/06/17 12:51:48 \| 01,381,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\Query.dll [2009/06/17 12:51:48 \| 00,883,712 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\IMJP10.IME [2009/06/17 12:51:48 \| 00,114,176 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\EhStorShell.dll [2009/06/17 12:51:47 \| 00,648,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\user32.dll [2009/06/17 12:51:47 \| 00,409,600 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msexch40.dll [2009/06/17 12:51:47 \| 00,327,168 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\P2PGraph.dll [2009/06/17 12:51:46 \| 03,079,168 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\explorer.exe [2009/06/17 12:51:46 \| 01,316,864 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ole32.dll [2009/06/17 12:51:46 \| 01,183,232 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msxml3.dll [2009/06/17 12:51:46 \| 00,463,872 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\IasMigReader.exe [2009/06/17 12:51:46 \| 00,301,568 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\srchadmin.dll [2009/06/17 12:51:45 \| 00,428,544 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll [2009/06/17 12:51:45 \| 00,303,616 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\gdi32.dll [2009/06/17 12:51:45 \| 00,217,088 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax [2009/06/17 12:51:44 \| 01,792,512 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mmc.exe [2009/06/17 12:51:44 \| 00,454,144 \| ---- \| C] (Microsoft) -- C:\Windows\System32\IasMigPlugin.dll [2009/06/17 12:51:44 \| 00,065,536 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\DevicePairingWizard.exe [2009/06/17 12:51:43 \| 00,880,640 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\RacEngn.dll [2009/06/17 12:51:43 \| 00,710,144 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\Magnify.exe [2009/06/17 12:51:43 \| 00,466,944 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\riched20.dll [2009/06/17 12:51:43 \| 00,088,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fdBth.dll [2009/06/17 12:51:42 \| 02,012,160 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\milcore.dll [2009/06/17 12:51:42 \| 01,112,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\CertEnroll.dll [2009/06/17 12:51:42 \| 00,275,968 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\bcrypt.dll [2009/06/17 12:51:42 \| 00,185,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SearchProtocolHost.exe [2009/06/17 12:51:42 \| 00,087,552 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SearchFilterHost.exe [2009/06/17 12:51:41 \| 00,805,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\NaturalLanguage6.dll [2009/06/17 12:51:41 \| 00,160,768 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\spoolss.dll [2009/06/17 12:51:37 \| 00,290,816 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msjtes40.dll [2009/06/17 12:51:36 \| 00,950,784 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\gpedit.dll [2009/06/17 12:51:36 \| 00,406,528 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msvcp60.dll [2009/06/17 12:51:36 \| 00,099,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\infocardapi.dll [2009/06/17 12:51:36 \| 00,055,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\Storprop.dll [2009/06/17 12:51:35 \| 00,800,768 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\advapi32.dll [2009/06/17 12:51:35 \| 00,282,624 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mstext40.dll [2009/06/17 12:51:35 \| 00,268,800 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\es.dll [2009/06/17 12:51:34 \| 00,339,968 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msexcl40.dll [2009/06/17 12:51:34 \| 00,321,536 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll [2009/06/17 12:51:34 \| 00,199,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WebClnt.dll [2009/06/17 12:51:34 \| 00,067,584 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\slwmi.dll [2009/06/17 12:51:33 \| 01,209,856 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\comsvcs.dll [2009/06/17 12:51:33 \| 01,077,248 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\vssapi.dll [2009/06/17 12:51:33 \| 00,454,656 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msxbde40.dll [2009/06/17 12:51:33 \| 00,054,784 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\DevicePairingProxy.dll [2009/06/17 12:51:32 \| 02,066,432 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mstscax.dll [2009/06/17 12:51:32 \| 01,985,024 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\authui.dll [2009/06/17 12:51:31 \| 00,754,688 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\propsys.dll [2009/06/17 12:51:31 \| 00,643,072 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msrepl40.dll [2009/06/17 12:51:31 \| 00,640,512 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\bthprops.cpl [2009/06/17 12:51:31 \| 00,469,504 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\newdev.dll [2009/06/17 12:51:31 \| 00,323,952 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe [2009/06/17 12:51:30 \| 02,926,592 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\explorer.exe [2009/06/17 12:51:30 \| 01,591,296 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\setupapi.dll [2009/06/17 12:51:30 \| 00,978,944 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\crypt32.dll [2009/06/17 12:51:30 \| 00,205,824 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\eudcedit.exe [2009/06/17 12:51:30 \| 00,119,296 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iasrecst.dll [2009/06/17 12:51:30 \| 00,102,816 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll [2009/06/17 12:51:29 \| 01,788,416 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\d3d9.dll [2009/06/17 12:51:29 \| 00,368,640 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mspbde40.dll [2009/06/17 12:51:28 \| 00,241,664 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msltus40.dll [2009/06/17 12:51:28 \| 00,061,440 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\davclnt.dll [2009/06/17 12:51:27 \| 01,324,032 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\browseui.dll [2009/06/17 12:51:27 \| 01,135,104 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll [2009/06/17 12:51:27 \| 00,353,280 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\shlwapi.dll [2009/06/17 12:51:27 \| 00,344,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msrd3x40.dll [2009/06/17 12:51:27 \| 00,107,612 \| ---- \| C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009/06/17 12:51:26 \| 00,293,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\photowiz.dll [2009/06/17 12:51:26 \| 00,250,368 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wevtapi.dll [2009/06/17 12:51:26 \| 00,136,192 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\nlhtml.dll [2009/06/17 12:51:24 \| 03,662,128 \| ---- \| C] () -- C:\Windows\System32\locale.nls [2009/06/17 12:51:23 \| 01,314,816 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll [2009/06/17 12:51:23 \| 00,582,144 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SLCommDlg.dll [2009/06/17 12:51:23 \| 00,563,712 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\oleaut32.dll [2009/06/17 12:51:23 \| 00,497,664 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\kerberos.dll [2009/06/17 12:51:23 \| 00,443,392 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\win32spl.dll [2009/06/17 12:51:23 \| 00,165,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WcnNetsh.dll [2009/06/17 12:51:22 \| 03,174,400 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\netshell.dll [2009/06/17 12:51:22 \| 01,730,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\apds.dll [2009/06/17 12:51:22 \| 00,618,496 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mswstr10.dll [2009/06/17 12:51:22 \| 00,375,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\winhttp.dll [2009/06/17 12:51:22 \| 00,215,040 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msv1_0.dll [2009/06/17 12:51:21 \| 01,160,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll [2009/06/17 12:51:21 \| 00,807,424 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msctf.dll [2009/06/17 12:51:21 \| 00,679,936 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msvcrt.dll [2009/06/17 12:51:21 \| 00,056,320 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\xmlfilter.dll [2009/06/17 12:51:20 \| 00,524,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\sqlsrv32.dll [2009/06/17 12:51:20 \| 00,319,488 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msrd2x40.dll [2009/06/17 12:51:20 \| 00,183,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\eapphost.dll [2009/06/17 12:51:20 \| 00,077,312 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\secur32.dll [2009/06/17 12:51:19 \| 01,068,032 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\shdocvw.dll [2009/06/17 12:51:19 \| 00,409,600 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll [2009/06/17 12:51:19 \| 00,071,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\propdefs.dll [2009/06/17 12:51:18 \| 02,167,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mmcndmgr.dll [2009/06/17 12:51:18 \| 01,856,512 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dbgeng.dll [2009/06/17 12:51:18 \| 00,747,008 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WsmSvc.dll [2009/06/17 12:51:18 \| 00,163,840 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wevtutil.exe [2009/06/17 12:51:18 \| 00,087,040 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mssitlb.dll [2009/06/17 12:51:17 \| 00,502,272 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\usp10.dll [2009/06/17 12:51:15 \| 00,194,048 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\drvinst.exe [2009/06/17 12:51:14 \| 00,592,896 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\netlogon.dll [2009/06/17 12:51:14 \| 00,378,368 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\devmgr.dll [2009/06/17 12:51:14 \| 00,268,800 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\schannel.dll [2009/06/17 12:51:14 \| 00,199,168 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\adsldpc.dll [2009/06/17 12:51:14 \| 00,084,992 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msctfp.dll [2009/06/17 12:51:14 \| 00,035,328 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msscb.dll [2009/06/17 12:51:14 \| 00,009,728 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fdBthProxy.dll [2009/06/17 12:51:13 \| 01,533,440 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wcnwiz.dll [2009/06/17 12:51:13 \| 00,485,888 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\evr.dll [2009/06/17 12:51:13 \| 00,425,472 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll [2009/06/17 12:51:13 \| 00,355,328 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WSDApi.dll [2009/06/17 12:51:13 \| 00,287,744 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\Wldap32.dll [2009/06/17 12:51:12 \| 01,382,912 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WMVSDECD.DLL [2009/06/17 12:51:11 \| 00,712,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll [2009/06/17 12:51:11 \| 00,617,984 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\adtschema.dll [2009/06/17 12:51:11 \| 00,450,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\comdlg32.dll [2009/06/17 12:51:11 \| 00,279,552 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\services.exe [2009/06/17 12:51:11 \| 00,124,928 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\quick.ime [2009/06/17 12:51:11 \| 00,124,928 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\qintlgnt.ime [2009/06/17 12:51:11 \| 00,124,928 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\phon.ime [2009/06/17 12:51:11 \| 00,124,928 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\cintlgnt.ime [2009/06/17 12:51:11 \| 00,124,928 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\chajei.ime [2009/06/17 12:51:11 \| 00,041,984 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mimefilt.dll [2009/06/17 12:51:10 \| 00,560,640 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msdtcprx.dll [2009/06/17 12:51:10 \| 00,413,696 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wcncsvc.dll [2009/06/17 12:51:10 \| 00,332,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll [2009/06/17 12:51:10 \| 00,323,584 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\certcli.dll [2009/06/17 12:51:10 \| 00,241,152 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll [2009/06/17 12:51:10 \| 00,061,440 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msjter40.dll [2009/06/17 12:51:09 \| 00,996,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WMNetMgr.dll [2009/06/17 12:51:09 \| 00,856,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mswdat10.dll [2009/06/17 12:51:09 \| 00,799,744 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe [2009/06/17 12:51:09 \| 00,396,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ipsmsnap.dll [2009/06/17 12:51:09 \| 00,169,984 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\taskeng.exe [2009/06/17 12:51:09 \| 00,168,448 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dnsapi.dll [2009/06/17 12:51:09 \| 00,061,952 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\reg.exe [2009/06/17 12:51:09 \| 00,038,400 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rtffilt.dll [2009/06/17 12:51:08 \| 00,704,512 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PhotoScreensaver.scr [2009/06/17 12:51:08 \| 00,060,416 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll [2009/06/17 12:51:08 \| 00,011,776 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msshooks.dll [2009/06/17 12:51:07 \| 00,332,800 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msihnd.dll [2009/06/17 12:51:07 \| 00,241,128 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rsaenh.dll [2009/06/17 12:51:07 \| 00,150,528 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\MMDevAPI.dll [2009/06/17 12:51:06 \| 00,738,816 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\inetcomm.dll [2009/06/17 12:51:06 \| 00,093,512 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dfshim.dll [2009/06/17 12:51:06 \| 00,043,008 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msstrc.dll [2009/06/17 12:51:05 \| 00,467,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\netapi32.dll [2009/06/17 12:51:05 \| 00,310,272 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mtxclu.dll [2009/06/17 12:51:05 \| 00,153,088 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fundisc.dll [2009/06/17 12:51:05 \| 00,130,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcsvc6.dll [2009/06/17 12:51:05 \| 00,129,024 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\cryptsvc.dll [2009/06/17 12:51:05 \| 00,080,720 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mscories.dll [2009/06/17 12:51:05 \| 00,026,112 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\hidserv.dll [2009/06/17 12:51:04 \| 01,696,768 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll [2009/06/17 12:51:04 \| 00,035,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\TsWpfWrp.exe [2009/06/17 12:51:03 \| 01,671,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\chsbrkr.dll [2009/06/17 12:51:03 \| 01,020,928 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wdc.dll [2009/06/17 12:51:03 \| 00,247,296 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\shsvcs.dll [2009/06/17 12:51:03 \| 00,107,520 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\imapi.dll [2009/06/17 12:51:03 \| 00,073,216 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msiexec.exe [2009/06/17 12:51:02 \| 01,823,744 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\pnidui.dll [2009/06/17 12:51:02 \| 00,252,928 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iassdo.dll [2009/06/17 12:51:02 \| 00,116,224 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\imm32.dll [2009/06/17 12:51:02 \| 00,093,696 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\Kswdmcap.ax [2009/06/17 12:51:01 \| 00,636,416 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\autofmt.exe [2009/06/17 12:51:01 \| 00,172,032 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\scrrun.dll [2009/06/17 12:51:01 \| 00,092,918 \| ---- \| C] () -- C:\Windows\System32\slmgr.vbs [2009/06/17 12:51:01 \| 00,013,312 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\spcmsg.dll [2009/06/17 12:51:00 \| 00,757,248 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\azroles.dll [2009/06/17 12:51:00 \| 00,633,856 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\CertEnrollUI.dll [2009/06/17 12:51:00 \| 00,242,176 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\pdh.dll [2009/06/17 12:51:00 \| 00,204,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcsvc.dll [2009/06/17 12:50:59 \| 01,122,304 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\appwiz.cpl [2009/06/17 12:50:59 \| 01,107,968 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\pidgenx.dll [2009/06/17 12:50:59 \| 00,867,328 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll [2009/06/17 12:50:59 \| 00,389,632 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\sysmon.ocx [2009/06/17 12:50:59 \| 00,258,048 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\winspool.drv [2009/06/17 12:50:58 \| 02,205,184 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SyncCenter.dll [2009/06/17 12:50:58 \| 00,593,408 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\comuid.dll [2009/06/17 12:50:58 \| 00,314,368 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\winlogon.exe [2009/06/17 12:50:57 \| 01,502,720 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\certmgr.dll [2009/06/17 12:50:57 \| 00,627,200 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\sethc.exe [2009/06/17 12:50:57 \| 00,347,648 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll [2009/06/17 12:50:57 \| 00,204,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll [2009/06/17 12:50:57 \| 00,182,272 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iassam.dll [2009/06/17 12:50:57 \| 00,142,336 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\spp.dll [2009/06/17 12:50:56 \| 00,413,696 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\imkr80.ime [2009/06/17 12:50:56 \| 00,324,096 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\untfs.dll [2009/06/17 12:50:56 \| 00,270,336 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll [2009/06/17 12:50:56 \| 00,180,224 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\scrobj.dll [2009/06/17 12:50:56 \| 00,036,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll [2009/06/17 12:50:55 \| 00,643,072 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\autochk.exe [2009/06/17 12:50:54 \| 00,150,528 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iasnap.dll [2009/06/17 12:50:53 \| 00,869,888 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\printui.dll [2009/06/17 12:50:53 \| 00,656,896 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\autoconv.exe [2009/06/17 12:50:52 \| 01,548,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WMVDECOD.DLL [2009/06/17 12:50:52 \| 01,541,120 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\onex.dll [2009/06/17 12:50:52 \| 00,135,168 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\cscript.exe [2009/06/17 12:50:52 \| 00,130,024 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\basecsp.dll [2009/06/17 12:50:52 \| 00,088,576 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe [2009/06/17 12:50:51 \| 00,223,232 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mswsock.dll [2009/06/17 12:50:51 \| 00,182,272 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\osk.exe [2009/06/17 12:50:51 \| 00,108,544 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\userenv.dll [2009/06/17 12:50:49 \| 00,340,992 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\RelMon.dll [2009/06/17 12:50:49 \| 00,189,952 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\winmm.dll [2009/06/17 12:50:48 \| 00,860,160 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WerFaultSecure.exe [2009/06/17 12:50:48 \| 00,638,976 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\Utilman.exe [2009/06/17 12:50:48 \| 00,612,864 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rdpencom.dll [2009/06/17 12:50:48 \| 00,586,752 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\stobject.dll [2009/06/17 12:50:48 \| 00,564,224 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msftedit.dll [2009/06/17 12:50:48 \| 00,230,912 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\diskraid.exe [2009/06/17 12:50:48 \| 00,217,088 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WerFault.exe [2009/06/17 12:50:48 \| 00,208,896 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll [2009/06/17 12:50:48 \| 00,194,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\offfilt.dll [2009/06/17 12:50:48 \| 00,171,008 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\apphelp.dll [2009/06/17 12:50:48 \| 00,152,576 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll [2009/06/17 12:50:48 \| 00,152,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll [2009/06/17 12:50:48 \| 00,115,712 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WinSCard.dll [2009/06/17 12:50:47 \| 00,971,264 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\cryptui.dll [2009/06/17 12:50:47 \| 00,551,936 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\prnntfy.dll [2009/06/17 12:50:47 \| 00,444,416 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dsound.dll [2009/06/17 12:50:47 \| 00,396,800 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\AudioEng.dll [2009/06/17 12:50:47 \| 00,391,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mscms.dll [2009/06/17 12:50:47 \| 00,197,632 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SndVol.exe [2009/06/17 12:50:47 \| 00,179,712 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msnetobj.dll [2009/06/17 12:50:47 \| 00,155,648 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wscript.exe [2009/06/17 12:50:47 \| 00,114,688 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\odbccp32.dll [2009/06/17 12:50:47 \| 00,099,840 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ulib.dll [2009/06/17 12:50:47 \| 00,091,648 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\IPHLPAPI.DLL [2009/06/17 12:50:47 \| 00,075,264 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\adsmsext.dll [2009/06/17 12:50:47 \| 00,047,104 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iasdatastore.dll [2009/06/17 12:50:46 \| 00,759,296 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ipsecsnp.dll [2009/06/17 12:50:46 \| 00,399,360 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wlangpui.dll [2009/06/17 12:50:46 \| 00,223,744 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wscntfy.dll [2009/06/17 12:50:46 \| 00,181,760 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\pnpsetup.dll [2009/06/17 12:50:46 \| 00,119,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\diskpart.exe [2009/06/17 12:50:46 \| 00,069,632 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rastapi.dll [2009/06/17 12:50:46 \| 00,024,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fdProxy.dll [2009/06/17 12:50:45 \| 00,244,224 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rastls.dll [2009/06/17 12:50:45 \| 00,075,264 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\gpapi.dll [2009/06/17 12:50:45 \| 00,070,656 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iashlpr.dll [2009/06/17 12:50:44 \| 01,575,936 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WMVENCOD.DLL [2009/06/17 12:50:44 \| 00,507,904 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\vdsdyn.dll [2009/06/17 12:50:44 \| 00,104,448 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\netiohlp.dll [2009/06/17 12:50:44 \| 00,057,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\logman.exe [2009/06/17 12:50:43 \| 00,286,720 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rasapi32.dll [2009/06/17 12:50:43 \| 00,216,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ntprint.dll [2009/06/17 12:50:43 \| 00,158,208 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iasrad.dll [2009/06/17 12:50:43 \| 00,155,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mscorier.dll [2009/06/17 12:50:43 \| 00,140,800 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wusa.exe [2009/06/17 12:50:42 \| 02,225,664 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\netcenter.dll [2009/06/17 12:50:42 \| 00,342,528 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\zipfldr.dll [2009/06/17 12:50:42 \| 00,090,112 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wshext.dll [2009/06/17 12:50:42 \| 00,060,928 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\findstr.exe [2009/06/17 12:50:40 \| 01,152,000 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\themecpl.dll [2009/06/17 12:50:40 \| 00,876,032 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wer.dll [2009/06/17 12:50:40 \| 00,825,856 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rasdlg.dll [2009/06/17 12:50:40 \| 00,714,240 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl [2009/06/17 12:50:40 \| 00,135,168 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wshom.ocx [2009/06/17 12:50:40 \| 00,076,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iassvcs.dll [2009/06/17 12:50:40 \| 00,050,688 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wsnmp32.dll [2009/06/17 12:50:40 \| 00,033,280 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mssprxy.dll [2009/06/17 12:50:40 \| 00,012,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\tsbyuv.dll [2009/06/17 12:50:39 \| 00,777,216 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\slcc.dll [2009/06/17 12:50:39 \| 00,678,400 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mstsc.exe [2009/06/17 12:50:39 \| 00,245,760 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\scansetting.dll [2009/06/17 12:50:39 \| 00,163,328 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msutb.dll [2009/06/17 12:50:39 \| 00,121,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ntmarta.dll [2009/06/17 12:50:39 \| 00,098,816 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\powrprof.dll [2009/06/17 12:50:39 \| 00,084,992 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mstlsapi.dll [2009/06/17 12:50:39 \| 00,057,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iasads.dll [2009/06/17 12:50:38 \| 03,072,000 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\networkmap.dll [2009/06/17 12:50:38 \| 01,645,568 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\connect.dll [2009/06/17 12:50:38 \| 01,248,768 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PerfCenterCPL.dll [2009/06/17 12:50:38 \| 00,723,968 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\powercpl.dll [2009/06/17 12:50:38 \| 00,079,872 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\authz.dll [2009/06/17 12:50:38 \| 00,074,752 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\newdev.exe [2009/06/17 12:50:38 \| 00,068,096 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wlanhlp.dll [2009/06/17 12:50:38 \| 00,058,880 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iasacct.dll [2009/06/17 12:50:38 \| 00,023,552 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\lpk.dll [2009/06/17 12:50:38 \| 00,009,048 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\icardres.dll [2009/06/17 12:50:37 \| 02,515,968 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\accessibilitycpl.dll [2009/06/17 12:50:37 \| 01,224,192 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\sud.dll [2009/06/17 12:50:37 \| 01,123,840 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\usercpl.dll [2009/06/17 12:50:37 \| 00,842,240 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\systemcpl.dll [2009/06/17 12:50:37 \| 00,615,424 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\themeui.dll [2009/06/17 12:50:37 \| 00,464,384 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\pcaui.dll [2009/06/17 12:50:37 \| 00,057,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\samlib.dll [2009/06/17 12:50:37 \| 00,052,224 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mmci.dll [2009/06/17 12:50:36 \| 01,671,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wlanpref.dll [2009/06/17 12:50:36 \| 00,516,608 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\autoplay.dll [2009/06/17 12:50:36 \| 00,497,152 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll [2009/06/17 12:50:36 \| 00,127,488 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rpchttp.dll [2009/06/17 12:50:36 \| 00,089,088 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\pintlgnt.ime [2009/06/17 12:50:35 \| 00,532,992 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wpcao.dll [2009/06/17 12:50:35 \| 00,408,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msinfo32.exe [2009/06/17 12:50:35 \| 00,242,688 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\tapisrv.dll [2009/06/17 12:50:35 \| 00,140,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\scksp.dll [2009/06/17 12:50:35 \| 00,128,000 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\vdsutil.dll [2009/06/17 12:50:35 \| 00,067,584 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\regapi.dll [2009/06/17 12:50:35 \| 00,054,272 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\feclient.dll [2009/06/17 12:50:34 \| 01,642,496 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WMPEncEn.dll [2009/06/17 12:50:34 \| 00,306,176 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\scesrv.dll [2009/06/17 12:50:34 \| 00,293,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll [2009/06/17 12:50:34 \| 00,147,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\Faultrep.dll [2009/06/17 12:50:34 \| 00,115,712 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\AudioSes.dll [2009/06/17 12:50:34 \| 00,097,792 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\oleprn.dll [2009/06/17 12:50:34 \| 00,075,264 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dot3msm.dll [2009/06/17 12:50:34 \| 00,068,608 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mpr.dll [2009/06/17 12:50:34 \| 00,043,520 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rekeywiz.exe [2009/06/17 12:50:34 \| 00,009,239 \| ---- \| C] () -- C:\Windows\System32\spcinstrumentation.man [2009/06/17 12:50:33 \| 01,689,600 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wscui.cpl [2009/06/17 12:50:33 \| 01,102,848 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mmsys.cpl [2009/06/17 12:50:33 \| 00,505,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\qedit.dll [2009/06/17 12:50:33 \| 00,445,952 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ncryptui.dll [2009/06/17 12:50:33 \| 00,407,040 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dpapimig.exe [2009/06/17 12:50:33 \| 00,215,552 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\certreq.exe [2009/06/17 12:50:33 \| 00,033,792 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iaspolcy.dll [2009/06/17 12:50:33 \| 00,031,744 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\perfdisk.dll [2009/06/17 12:50:33 \| 00,017,920 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wscisvif.dll [2009/06/17 12:50:32 \| 00,642,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rasgcw.dll [2009/06/17 12:50:32 \| 00,595,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\FWPUCLNT.DLL [2009/06/17 12:50:32 \| 00,177,152 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\scecli.dll [2009/06/17 12:50:32 \| 00,080,384 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\hdwwiz.exe [2009/06/17 12:50:31 \| 00,376,832 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rasplap.dll [2009/06/17 12:50:31 \| 00,170,496 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\tcpipcfg.dll [2009/06/17 12:50:31 \| 00,135,168 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\tcpmon.dll [2009/06/17 12:50:31 \| 00,134,656 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SmartcardCredentialProvider.dll [2009/06/17 12:50:31 \| 00,067,072 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fdWSD.dll [2009/06/17 12:50:31 \| 00,049,152 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\cmmon32.exe [2009/06/17 12:50:31 \| 00,038,400 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\TSTheme.exe [2009/06/17 12:50:31 \| 00,011,776 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\spwinsat.dll [2009/06/17 12:50:30 \| 00,031,232 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\whealogr.dll [2009/06/17 12:50:29 \| 00,481,792 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\cmdial32.dll [2009/06/17 12:50:29 \| 00,281,088 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\raschap.dll [2009/06/17 12:50:29 \| 00,167,424 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wdmaud.drv [2009/06/17 12:50:29 \| 00,142,336 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fontext.dll [2009/06/17 12:50:29 \| 00,095,232 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SCardSvr.dll [2009/06/17 12:50:29 \| 00,069,120 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\conime.exe [2009/06/17 12:50:28 \| 02,153,472 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\oobefldr.dll [2009/06/17 12:50:28 \| 01,544,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\MSVidCtl.dll [2009/06/17 12:50:28 \| 00,657,408 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WMVXENCD.DLL [2009/06/17 12:50:28 \| 00,547,840 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wiaaut.dll [2009/06/17 12:50:28 \| 00,425,472 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\shwebsvc.dll [2009/06/17 12:50:28 \| 00,293,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wlanmsm.dll [2009/06/17 12:50:28 \| 00,280,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\unimdm.tsp [2009/06/17 12:50:28 \| 00,259,584 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rasppp.dll [2009/06/17 12:50:28 \| 00,202,752 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wlanui.dll [2009/06/17 12:50:28 \| 00,137,728 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dsprop.dll [2009/06/17 12:50:28 \| 00,054,784 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dimsroam.dll [2009/06/17 12:50:27 \| 06,103,040 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\chtbrkr.dll [2009/06/17 12:50:27 \| 00,533,504 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wmdrmsdk.dll [2009/06/17 12:50:27 \| 00,288,256 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\modemui.dll [2009/06/17 12:50:27 \| 00,218,624 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mscandui.dll [2009/06/17 12:50:27 \| 00,155,136 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rasmontr.dll [2009/06/17 12:50:27 \| 00,101,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\shsetup.dll [2009/06/17 12:50:27 \| 00,045,056 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dataclen.dll [2009/06/17 12:50:26 \| 02,226,688 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\networkexplorer.dll [2009/06/17 12:50:26 \| 00,542,720 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\blackbox.dll [2009/06/17 12:50:26 \| 00,303,616 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wmpeffects.dll [2009/06/17 12:50:26 \| 00,274,944 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\AUDIOKSE.dll [2009/06/17 12:50:26 \| 00,180,736 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\netplwiz.dll [2009/06/17 12:50:26 \| 00,178,176 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\credui.dll [2009/06/17 12:50:26 \| 00,177,664 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WSDMon.dll [2009/06/17 12:50:26 \| 00,140,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wpcsvc.dll [2009/06/17 12:50:26 \| 00,083,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wlgpclnt.dll [2009/06/17 12:50:26 \| 00,029,696 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ifmon.dll [2009/06/17 12:50:25 \| 00,414,208 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msscp.dll [2009/06/17 12:50:25 \| 00,313,344 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\thawbrkr.dll [2009/06/17 12:50:25 \| 00,217,600 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\InkEd.dll [2009/06/17 12:50:25 \| 00,203,776 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wpdwcn.dll [2009/06/17 12:50:25 \| 00,128,000 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\gpresult.exe [2009/06/17 12:50:25 \| 00,125,952 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\softkbd.dll [2009/06/17 12:50:25 \| 00,094,720 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\logagent.exe [2009/06/17 12:50:25 \| 00,069,632 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\sendmail.dll [2009/06/17 12:50:25 \| 00,058,368 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\cipher.exe [2009/06/17 12:50:25 \| 00,033,280 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wscapi.dll [2009/06/17 12:50:25 \| 00,031,232 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msimtf.dll [2009/06/17 12:50:24 \| 00,356,864 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\MediaMetadataHandler.dll [2009/06/17 12:50:24 \| 00,085,504 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msctfui.dll [2009/06/17 12:50:24 \| 00,028,672 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll [2009/06/17 12:50:23 \| 00,284,672 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\drmmgrtn.dll [2009/06/17 12:50:23 \| 00,177,664 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax [2009/06/17 12:50:23 \| 00,105,472 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dmsynth.dll [2009/06/17 12:50:23 \| 00,088,576 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\olepro32.dll [2009/06/17 12:50:22 \| 00,418,304 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wmdrmdev.dll [2009/06/17 12:50:22 \| 00,200,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\input.dll [2009/06/17 12:50:22 \| 00,166,400 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\puiapi.dll [2009/06/17 12:50:22 \| 00,097,792 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mprapi.dll [2009/06/17 12:50:22 \| 00,034,304 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wshbth.dll [2009/06/17 12:50:22 \| 00,020,992 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll [2009/06/17 12:50:22 \| 00,020,480 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\version.dll [2009/06/17 12:50:21 \| 00,758,784 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WMADMOD.DLL [2009/06/17 12:50:21 \| 00,125,952 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\tintlgnt.ime [2009/06/17 12:50:21 \| 00,101,888 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dmusic.dll [2009/06/17 12:50:21 \| 00,080,896 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax [2009/06/17 12:50:21 \| 00,068,096 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fdSSDP.dll [2009/06/17 12:50:21 \| 00,031,744 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\cscapi.dll [2009/06/17 12:50:21 \| 00,019,968 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fc.exe [2009/06/17 12:50:21 \| 00,019,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\MsCtfMonitor.dll [2009/06/17 12:50:21 \| 00,016,384 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msisip.dll [2009/06/17 12:50:20 \| 00,187,904 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\eapp3hst.dll [2009/06/17 12:50:20 \| 00,094,720 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll [2009/06/17 12:50:20 \| 00,048,128 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\l2nacp.dll [2009/06/17 12:50:20 \| 00,041,984 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ftp.exe [2009/06/17 12:50:20 \| 00,024,576 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msjint40.dll [2009/06/17 12:50:20 \| 00,022,016 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\cscdll.dll [2009/06/17 12:50:19 \| 00,347,648 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wmdrmnet.dll [2009/06/17 12:50:19 \| 00,160,768 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll [2009/06/17 12:50:19 \| 00,136,192 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll [2009/06/17 12:50:19 \| 00,135,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\eappcfg.dll [2009/06/17 12:50:19 \| 00,083,456 \| ---- \| C] (Microsoft) -- C:\Windows\System32\SMBHelperClass.dll [2009/06/17 12:50:19 \| 00,069,120 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fdWCN.dll [2009/06/17 12:50:19 \| 00,053,248 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rrinstaller.exe [2009/06/17 12:50:19 \| 00,052,736 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rasdiag.dll [2009/06/17 12:50:19 \| 00,049,664 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dot3cfg.dll [2009/06/17 12:50:19 \| 00,034,304 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\bthudtask.exe [2009/06/17 12:50:19 \| 00,026,624 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ipconfig.exe [2009/06/17 12:50:19 \| 00,020,992 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wsdchngr.dll [2009/06/17 12:50:19 \| 00,016,896 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rasdial.exe [2009/06/17 12:50:19 \| 00,010,752 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\CHxReadingStringIME.dll [2009/06/17 12:50:18 \| 00,506,880 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\MSMPEG2ENC.DLL [2009/06/17 12:50:18 \| 00,160,256 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\MSAC3ENC.DLL [2009/06/17 12:50:18 \| 00,098,816 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll [2009/06/17 12:50:18 \| 00,093,696 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\eappgnui.dll [2009/06/17 12:50:18 \| 00,082,944 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\nslookup.exe [2009/06/17 12:50:18 \| 00,063,488 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\tscupgrd.exe [2009/06/17 12:50:18 \| 00,053,760 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fdeploy.dll [2009/06/17 12:50:18 \| 00,042,496 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\slcinst.dll [2009/06/17 12:50:18 \| 00,041,472 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\hbaapi.dll [2009/06/17 12:50:18 \| 00,039,936 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\networkitemfactory.dll [2009/06/17 12:50:18 \| 00,035,840 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ocsetup.exe [2009/06/17 12:50:18 \| 00,028,672 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\FwRemoteSvr.dll [2009/06/17 12:50:18 \| 00,024,576 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mfpmp.exe [2009/06/17 12:50:18 \| 00,021,504 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msacm32.drv [2009/06/17 12:50:18 \| 00,012,800 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mmcico.dll [2009/06/17 12:50:17 \| 00,053,248 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll [2009/06/17 12:50:17 \| 00,034,304 \| ---- \| C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2009/06/17 12:50:17 \| 00,019,968 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\NcdProp.dll [2009/06/17 12:50:17 \| 00,016,896 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\gpupdate.exe [2009/06/17 12:50:15 \| 00,131,072 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wmpps.dll [2009/06/17 12:50:15 \| 00,040,960 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\odbcconf.dll [2009/06/17 12:50:15 \| 00,017,408 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\vdmdbg.dll [2009/06/17 12:50:15 \| 00,012,288 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\slwga.dll [2009/06/17 12:50:14 \| 00,019,968 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\winrnr.dll [2009/06/17 12:50:14 \| 00,017,408 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\midimap.dll [2009/06/17 12:50:14 \| 00,009,212 \| ---- \| C] () -- C:\Windows\System32\RacUR.xml [2009/06/17 12:50:11 \| 00,007,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll [2009/06/17 12:50:10 \| 08,147,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL [2009/06/17 12:50:10 \| 00,004,096 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx [2009/06/17 12:50:10 \| 00,004,096 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dxmasf.dll [2009/06/17 12:50:09 \| 00,007,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\f3ahvoas.dll [2009/06/17 12:50:09 \| 00,002,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msimsg.dll [2009/06/17 12:50:09 \| 00,002,048 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mferror.dll [2009/06/17 12:50:06 \| 00,000,153 \| ---- \| C] () -- C:\Windows\System32\RacUREx.xml [2009/06/17 12:49:59 \| 00,218,624 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wdscore.dll [2009/06/17 12:49:54 \| 00,247,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\drvstore.dll [2009/06/17 11:36:26 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata02.sqm [2009/06/17 11:36:26 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt02.sqm [2009/06/17 11:19:59 \| 00,001,928 \| ---- \| C] () -- C:\Users\Administrator\Desktop\HijackThis.lnk [2009/06/17 11:19:59 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Trend Micro [2009/06/17 11:13:00 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata01.sqm [2009/06/17 11:12:55 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt01.sqm [2009/06/17 08:15:03 \| 00,000,520 \| ---- \| C] () -- C:\Users\Administrator\Documents\cc_20090617_081459.reg [2009/06/17 08:04:06 \| 00,000,268 \| -H-- \| C] () -- C:\sqmdata00.sqm [2009/06/17 08:04:06 \| 00,000,244 \| -H-- \| C] () -- C:\sqmnoopt00.sqm [2009/06/17 01:19:53 \| 00,000,520 \| ---- \| C] () -- C:\Users\Administrator\Documents\cc_20090617_011951.reg [2009/06/17 00:49:45 \| 00,000,358 \| ---- \| C] () -- C:\Users\Administrator\Documents\cc_20090617_004944.reg [2009/06/17 00:49:33 \| 00,005,890 \| ---- \| C] () -- C:\Users\Administrator\Documents\cc_20090617_004929.reg [2009/06/17 00:44:12 \| 00,039,300 \| ---- \| C] () -- C:\Users\Administrator\Documents\cc_20090617_004409.reg [2009/06/17 00:40:44 \| 00,000,000 \| ---D \| C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes [2009/06/17 00:40:43 \| 00,000,848 \| ---- \| C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2009/06/17 00:40:40 \| 00,040,160 \| ---- \| C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/06/17 00:40:39 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\Malwarebytes [2009/06/17 00:40:39 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2009/06/17 00:38:16 \| 00,000,000 \| ---D \| C] -- C:\Users\Administrator\AppData\Roaming\Yahoo! [2009/06/17 00:38:16 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\Yahoo! Companion [2009/06/17 00:38:15 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Yahoo! [2009/06/17 00:38:14 \| 00,001,724 \| ---- \| C] () -- C:\Users\Administrator\Desktop\CCleaner.lnk [2009/06/17 00:38:13 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\CCleaner [2009/06/16 16:19:14 \| 00,032,631 \| ---- \| C] () -- C:\ProgramData\nvModes.001 [2009/06/16 16:18:42 \| 00,032,631 \| ---- \| C] () -- C:\ProgramData\nvModes.dat [2009/06/16 16:11:19 \| 00,000,000 \| ---D \| C] -- C:\Windows\1C4551A64743409391E41477CD655043.TMP [2009/06/12 20:13:26 \| 00,001,910 \| ---- \| C] () -- C:\Users\Public\Desktop\VIPRE.lnk [2009/06/12 17:09:09 \| 00,623,616 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll [2009/06/12 17:09:03 \| 00,677,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\rpcrt4.dll [2009/06/12 17:08:57 \| 05,936,128 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.dll [2009/06/12 17:08:55 \| 11,064,832 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieframe.dll [2009/06/12 17:08:55 \| 01,985,024 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iertutil.dll [2009/06/12 17:08:54 \| 01,207,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\urlmon.dll [2009/06/12 17:08:54 \| 00,915,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wininet.dll [2009/06/12 17:08:54 \| 00,385,536 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2009/06/12 17:08:53 \| 01,469,440 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2009/06/12 17:08:53 \| 00,173,056 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2009/06/12 17:08:53 \| 00,164,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2009/06/12 17:08:53 \| 00,071,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2009/06/12 17:08:53 \| 00,025,600 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2009/06/12 17:08:52 \| 01,638,912 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2009/06/12 17:08:52 \| 00,055,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2009/06/10 06:00:54 \| 00,068,392 \| ---- \| C] (Sunbelt Software) -- C:\Windows\System32\sbbd.exe [2009/06/07 13:18:14 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Microsoft Silverlight [2009/05/21 17:51:48 \| 00,041,808 \| ---- \| C] () -- C:\Windows\System32\xfcodec.dll [2009/03/14 12:47:15 \| 00,000,002 \| ---- \| C] () -- C:\Windows\msoffice.ini [2009/02/12 20:08:50 \| 00,000,026 \| ---- \| C] () -- C:\Windows\dvdSanta.INI [2009/02/12 19:40:21 \| 01,216,512 \| ---- \| C] () -- C:\Windows\System32\xvidcore.dll [2009/02/12 19:40:21 \| 00,921,600 \| ---- \| C] () -- C:\Windows\System32\vorbisenc.dll [2009/02/12 19:40:21 \| 00,237,568 \| ---- \| C] () -- C:\Windows\System32\xvidvfw.dll [2009/02/12 19:40:21 \| 00,237,568 \| ---- \| C] () -- C:\Windows\System32\OggDS.dll [2009/02/12 19:40:21 \| 00,188,416 \| ---- \| C] () -- C:\Windows\System32\vorbis.dll [2009/02/12 19:40:21 \| 00,045,056 \| ---- \| C] () -- C:\Windows\System32\ogg.dll [2008/12/25 22:59:55 \| 00,000,014 \| ---- \| C] () -- C:\Windows\System32\systeminfo3.dll [2008/11/06 11:37:32 \| 03,596,288 \| ---- \| C] () -- C:\Windows\System32\qt-dx331.dll [2008/11/06 11:34:00 \| 00,000,416 \| ---- \| C] () -- C:\Windows\System32\dtu100.dll.manifest [2008/11/06 11:34:00 \| 00,000,416 \| ---- \| C] () -- C:\Windows\System32\dpl100.dll.manifest [2008/11/06 11:33:02 \| 00,012,288 \| ---- \| C] () -- C:\Windows\System32\DivXWMPExtType.dll [2008/10/07 10:13:30 \| 00,197,912 \| ---- \| C] () -- C:\Windows\System32\physxcudart_20.dll [2008/10/07 10:13:22 \| 00,058,648 \| ---- \| C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2008/10/07 10:13:20 \| 00,058,648 \| ---- \| C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2008/10/07 10:13:20 \| 00,058,648 \| ---- \| C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2008/10/07 10:13:20 \| 00,058,648 \| ---- \| C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2008/10/07 10:13:20 \| 00,058,648 \| ---- \| C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2008/10/07 10:13:20 \| 00,058,648 \| ---- \| C] () -- C:\Windows\System32\AgCPanelKorean.dll [2008/10/07 10:13:20 \| 00,058,648 \| ---- \| C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2008/10/07 10:13:20 \| 00,058,648 \| ---- \| C] () -- C:\Windows\System32\AgCPanelGerman.dll [2008/10/07 10:13:20 \| 00,058,648 \| ---- \| C] () -- C:\Windows\System32\AgCPanelFrench.dll [2006/11/02 07:34:27 \| 00,000,336 \| ---- \| C] () -- C:\Windows\win.ini [2006/11/02 07:34:27 \| 00,000,219 \| ---- \| C] () -- C:\Windows\system.ini ========== Files - Modified Within 30 Days ========== [2 C:\Windows\.tmp files] [2009/06/18 23:39:28 \| 00,501,760 \| ---- \| M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe [2009/06/18 20:05:56 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata10.sqm [2009/06/18 20:05:56 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt10.sqm [2009/06/18 20:05:44 \| 00,032,631 \| ---- \| M] () -- C:\ProgramData\nvModes.dat [2009/06/18 20:05:41 \| 00,032,631 \| ---- \| M] () -- C:\ProgramData\nvModes.001 [2009/06/18 20:05:29 \| 00,000,006 \| -H-- \| M] () -- C:\Windows\tasks\SA.DAT [2009/06/18 20:05:27 \| 00,067,584 \| --S- \| M] () -- C:\Windows\bootstat.dat [2009/06/18 19:48:51 \| 00,530,106 \| ---- \| M] () -- C:\Users\Administrator\Desktop\LopSD.exe [2009/06/18 19:46:43 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata09.sqm [2009/06/18 19:46:43 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt09.sqm [2009/06/18 09:12:53 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata08.sqm [2009/06/18 09:12:53 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt08.sqm [2009/06/18 00:35:15 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata07.sqm [2009/06/18 00:35:15 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt07.sqm [2009/06/17 23:07:51 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata06.sqm [2009/06/17 23:07:51 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt06.sqm [2009/06/17 22:25:58 \| 00,000,000 \| ---- \| M] () -- C:\Windows\System32\SBRC.dat [2009/06/17 19:23:41 \| 00,000,336 \| ---- \| M] () -- C:\Windows\win.ini [2009/06/17 19:22:43 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata05.sqm [2009/06/17 19:22:42 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt05.sqm [2009/06/17 16:25:58 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata04.sqm [2009/06/17 16:25:58 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt04.sqm [2009/06/17 14:51:38 \| 00,000,944 \| ---- \| M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2009/06/17 14:46:33 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata03.sqm [2009/06/17 14:46:33 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt03.sqm [2009/06/17 11:36:26 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata02.sqm [2009/06/17 11:36:26 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt02.sqm [2009/06/17 11:19:59 \| 00,001,928 \| ---- \| M] () -- C:\Users\Administrator\Desktop\HijackThis.lnk [2009/06/17 11:13:00 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata01.sqm [2009/06/17 11:12:55 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt01.sqm [2009/06/17 08:15:04 \| 00,000,520 \| ---- \| M] () -- C:\Users\Administrator\Documents\cc_20090617_081459.reg [2009/06/17 08:04:06 \| 00,000,268 \| -H-- \| M] () -- C:\sqmdata00.sqm [2009/06/17 08:04:06 \| 00,000,244 \| -H-- \| M] () -- C:\sqmnoopt00.sqm [2009/06/17 01:19:54 \| 00,000,520 \| ---- \| M] () -- C:\Users\Administrator\Documents\cc_20090617_011951.reg [2009/06/17 00:49:47 \| 00,000,358 \| ---- \| M] () -- C:\Users\Administrator\Documents\cc_20090617_004944.reg [2009/06/17 00:49:36 \| 00,005,890 \| ---- \| M] () -- C:\Users\Administrator\Documents\cc_20090617_004929.reg [2009/06/17 00:44:26 \| 00,039,300 \| ---- \| M] () -- C:\Users\Administrator\Documents\cc_20090617_004409.reg [2009/06/17 00:40:43 \| 00,000,848 \| ---- \| M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2009/06/17 00:38:14 \| 00,001,724 \| ---- \| M] () -- C:\Users\Administrator\Desktop\CCleaner.lnk [2009/06/16 16:20:17 \| 00,000,125 \| -HS- \| M] () -- C:\ProgramData\.zreglib [2009/06/12 20:13:26 \| 00,001,910 \| ---- \| M] () -- C:\Users\Public\Desktop\VIPRE.lnk [2009/06/10 06:00:54 \| 00,068,392 \| ---- \| M] (Sunbelt Software) -- C:\Windows\System32\sbbd.exe [2009/05/26 13:20:08 \| 00,040,160 \| ---- \| M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/05/21 17:51:48 \| 00,041,808 \| ---- \| M] () -- C:\Windows\System32\xfcodec.dll ========== LOP Check ========== [2009/06/17 14:54:56 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming [2008/12/29 21:10:13 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Adobe [2009/03/14 13:18:58 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\AOL [2009/02/12 19:22:58 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\DivX [2009/02/12 20:58:08 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\DJ ToneXpress [2008/12/25 19:37:07 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Identities [2008/12/25 21:34:12 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\InstallShield [2008/12/25 19:48:12 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Macromedia [2009/06/17 00:40:44 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes [2006/11/02 10:07:25 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Media Center Programs [2009/04/09 00:05:34 \| 00,000,000 \| --SD \| M] -- C:\Users\Administrator\AppData\Roaming\Microsoft [2009/03/25 09:54:28 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Move Networks [2009/06/17 14:54:56 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Mozilla [2009/01/16 10:56:27 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\OfficeGuardian [2008/12/25 20:30:22 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Sunbelt [2009/06/17 14:51:36 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\SUPERAntiSpyware.com [2009/06/17 14:54:56 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\TomTom [2009/06/14 01:42:29 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Ventrilo [2009/01/20 18:21:43 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Vso [2008/12/25 20:57:48 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\WinRAR [2009/06/02 20:06:11 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Xfire [2009/06/17 00:38:16 \| 00,000,000 \| ---D \| M] -- C:\Users\Administrator\AppData\Roaming\Yahoo! [2009/06/18 20:05:29 \| 00,000,006 \| -H-- \| M] () -- C:\Windows\Tasks\SA.DAT [2009/06/18 20:00:51 \| 00,032,648 \| ---- \| M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 72 bytes -> C:\Windows:02408B7D422B4B15 < End of report > This post has been edited by Warnite: Jun 18 2009, 10:47 PM

SpySentinel View Member Profile	Jun 19 2009, 04:01 PM Post #9
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	Hi Warnite, Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This changed from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 I suggest you remove the program now. Click on start > run > and then paste the following into the "open" field: appwiz.cpl and press OK. From within Add or Remove Programs uninstall the following if they exist: Viewpoint, Viewpoint Manager, Viewpoint Media Player. Run OTL.exe Under the Custom Scans/Fixes box at the bottom, paste in the following CODE :OTL O33 - MountPoints2\{75123ca9-e3e5-11dd-923c-00038a000015}\Shell - "" = AutoRun O33 - MountPoints2\{75123ca9-e3e5-11dd-923c-00038a000015}\Shell\AutoRun\command - "" = L:\StarterOfficeGuardian.exe -- File not found O33 - MountPoints2\{b8c972f0-5b6a-11de-b1a8-00038a000015}\Shell\AutoRun\command - "" = K:\InstallTomTomHOME.exe -- File not found :Commands [purity] [emptytemp] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done

Warnite View Member Profile	Jun 19 2009, 04:23 PM Post #10
New Member Group: Authentic Member Posts: 17 Joined: 15-January 08 Member No.: 75,988 Operating System: Windows XP	Ok ive pasted the code that you told me at the bottom, although the "Run Fix" button is at the top. It asked for a reboot so i rebooted the computer. When i rebooted the computer is came up with this log. ========== OTL ========== Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{75123ca9-e3e5-11dd-923c-00038a000015}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75123ca9-e3e5-11dd-923c-00038a000015}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{75123ca9-e3e5-11dd-923c-00038a000015}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75123ca9-e3e5-11dd-923c-00038a000015}\ not found. File L:\StarterOfficeGuardian.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b8c972f0-5b6a-11de-b1a8-00038a000015}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8c972f0-5b6a-11de-b1a8-00038a000015}\ not found. File K:\InstallTomTomHOME.exe not found. ========== COMMANDS ========== File delete failed. C:\Users\Administrator\AppData\Local\Temp\CMLS--2009-06-19--11-37-11.log scheduled to be deleted on reboot. File delete failed. C:\Users\Administrator\AppData\Local\Temp\~DF3C08.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\Administrator\AppData\Local\Temp\~DF3C15.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\Administrator\AppData\Local\Temp\~DF3C81.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\Administrator\AppData\Local\Temp\~DF3C8E.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\Administrator\AppData\Local\Temp\~DF3CD0.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\Administrator\AppData\Local\Temp\~DF3CDD.tmp scheduled to be deleted on reboot. File delete failed. C:\Users\Administrator\AppData\Local\Temp\~DFBE2D.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. User's Temporary Internet Files folder emptied. Windows Temp folder emptied. Temp folders emptied. Explorer started successfully OTL by OldTimer - Version 2.1.1.0 log created on 06192009_171811 Files moved on Reboot... C:\Users\Administrator\AppData\Local\Temp\CMLS--2009-06-19--11-37-11.log moved successfully. File C:\Users\Administrator\AppData\Local\Temp\~DF3C08.tmp not found! File C:\Users\Administrator\AppData\Local\Temp\~DF3C15.tmp not found! File C:\Users\Administrator\AppData\Local\Temp\~DF3C81.tmp not found! File C:\Users\Administrator\AppData\Local\Temp\~DF3C8E.tmp not found! File C:\Users\Administrator\AppData\Local\Temp\~DF3CD0.tmp not found! File C:\Users\Administrator\AppData\Local\Temp\~DF3CDD.tmp not found! C:\Users\Administrator\AppData\Local\Temp\~DFBE2D.tmp moved successfully. Registry entries deleted on Reboot... I also noticed once the computer rebooted, there were 2 files on my desktop at the name of "desktop.ini". Just wondering if this is common after the reboot This post has been edited by Warnite: Jun 19 2009, 04:25 PM

SpySentinel View Member Profile	Jun 19 2009, 07:10 PM Post #11
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	I have not heard of "desktop.ini" being added to the desktop. See if it is still there after a reboot. Download Dr.Web CureIt to the desktop: ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe Doubleclick the drweb-cureit.exe file and Allow to run the express scan This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan. Once the short scan has finished, mark the drives that you want to scan. Select all drives. A red dot shows which drives have been chosen. Click the green arrow at the right, and the scan will start. Click 'Yes to all' if it asks if you want to cure/move the file. When the scan has finished, in the menu, click file and choose save report list Save the report to your desktop. The report will be called DrWeb.csv Close Dr.Web Cureit. Go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

Warnite View Member Profile	Jun 22 2009, 09:39 PM Post #12
New Member Group: Authentic Member Posts: 17 Joined: 15-January 08 Member No.: 75,988 Operating System: Windows XP	Hi SpySentinel Sorry for the long reply, was busy during the weekend for Farther's Day ect... Anyways i did as you asked. Here is my report i saved for Kapersky. As for the report for DrWeb.csv, not sure how to report that one, it opens with microsoft excel... Anyways here's the kapersky report. -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, June 22, 2009 Operating System: Microsoft Windows Vista Home Premium Edition, 64-bit Service Pack 2 (build 6002) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Monday, June 22, 2009 22:57:55 Records in database: 2378674 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan statistics: Files scanned: 128330 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 01:19:36 No malware has been detected. The scan area is clean. The selected area was scanned. I manged to open DrWeb.csv with notepad and the report was this... htdvdauthor.dll;C:\Program Files (x86)\honestech VHS to DVD 3.0 Deluxe;Adware.Cinmus.origin;Incurable.Deleted.; This post has been edited by Warnite: Jun 22 2009, 09:41 PM

SpySentinel View Member Profile	Jun 24 2009, 05:31 PM Post #13
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	No worries, hope you had a great fathers day. How is your computer running? Your Adobe Acrobat Reader is out of date. Older versions are vulnerable to attack. Please go to the link below to update. http://www.adobe.com/products/acrobat/readstep2.html Download random's system information tool (RSIT) by random/random from here and save it to your desktop. Double click on RSIT.exe to run RSIT. Click Continue at the disclaimer screen. Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

Warnite View Member Profile	Jun 27 2009, 02:30 PM Post #14
New Member Group: Authentic Member Posts: 17 Joined: 15-January 08 Member No.: 75,988 Operating System: Windows XP	My computer is doing so much better thanks to your help... seems like everything is back to normal. By the way.. here are the 2 logs from RSIT. info.txt logfile of random's system information tool 1.06 2009-06-27 15:28:44 ======Uninstall list====== -->C:\PROGRA~2\Yahoo!\Common\UNYT_W~1.EXE -->C:\Program Files (x86)\DivX\DivXConverterUninstall.exe /CONVERTER -->MsiExec /X{DD1865F0-AD73-40FB-B23E-1822E02396FF} Acrobat.com-->MsiExec.exe /X{6D8D64BE-F500-55B6-705D-DFD08AFE0624} Adobe AIR-->c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723} Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe Adobe Reader 9.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001} AnyDVD-->"C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="C:\Program Files (x86)\SlySoft\AnyDVD" AOL Toolbar -->"C:\Program Files (x86)\AOL Toolbar\uninstall.exe" AOL Uninstaller (Choose which Products to Remove)-->C:\Program Files (x86)\Common Files\AOL\uninstaller.exe Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033} CCleaner (remove only)-->"C:\Program Files (x86)\CCleaner\uninst.exe" CloneDVD2-->"C:\Program Files (x86)\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe" /D="C:\Program Files (x86)\Elaborate Bytes\CloneDVD2" Comcast High-Speed Internet Install Wizard-->C:\Program Files (x86)\support.com\uninstall\chsi_uninstaller.exe Command & Conquer The First Decade-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{66D6F3BD-CA23-41A4-9FA3-96B26B32528C}\setup.exe" -l0x9 -removeonly DivX Codec-->C:\Program Files (x86)\DivX\DivXCodecUninstall.exe /CODEC DivX Converter-->C:\Program Files (x86)\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player-->C:\Program Files (x86)\DivX\DivXPlayerUninstall.exe /PLAYER DivX Plus DirectShow Filters-->C:\Program Files (x86)\DivX\DivXDSFiltersUninstall.exe /DSFILTERS DivX Web Player-->C:\Program Files (x86)\DivX\DivXWebPlayerUninstall.exe /PLUGIN DJ ToneXpress 4.5.3-->C:\Program Files (x86)\DJ ToneXpress 4\uninst.exe Download Updater (AOL LLC)-->C:\Program Files (x86)\Common Files\Software Update Utility\uninstall.exe dvdSanta 4.50-->"C:\Program Files (x86)\dvdSanta\unins000.exe" HijackThis 2.0.2-->"C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe" /uninstall honestech VHS to DVD 3.0 Deluxe-->C:\Program Files (x86)\InstallShield Installation Information\{2856F5EA-E98A-40E4-BAD6-8C644A4A3F3C}\setup.exe -runfromtemp -l0x0009 -removeonly Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT="" Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {08155812-0202-4D5F-A7FF-12A2782DC548} /qb+ REBOOTPROMPT="" ImageMixer 3-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{AB19A235-66D4-47F7-9904-BAF84ED25BB6}\SETUP.EXE" -l0x9 UNINSTALL -removeonly Java™ 6 Update 14-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF} Java™ 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Linksys Dual-Band Wireless-N USB Network Adapter-->C:\Program Files (x86)\InstallShield Installation Information\{90EC11E4-854E-4C0F-9B4C-76D6C7CF7C68}\setup.exe -runfromtemp -l0x0409 Linksys EasyLink Advisor-->"C:\Program Files (x86)\InstallShield Installation Information\{30DC3C30-719B-46A9-A4FA-BBEEEE528B65}\setup.exe" -runfromtemp -l0x0409 -removeonly Magelo Sync (uninstall only)-->"C:\Program Files (x86)\Magelo\Magelo Sync\UnInstall.exe" Malwarebytes' Anti-Malware-->"C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe" Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0000-1000-0000000FF1CE} /uninstall {E64BA721-2310-4B55-BE5A-2925F9706192} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0409-1000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0116-0409-1000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE} Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE} Microsoft Office Enterprise 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE} Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE} Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE} Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE} Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE} Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE} Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE} Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE} Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9} Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE} Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE} Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE} Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE} Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft VC9 runtime libraries-->MsiExec.exe /I{797EE0CA-8165-405C-B5CE-F11EC20F1BB0} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Move Networks Media Player for Internet Explorer-->C:\Users\Administrator\AppData\Roaming\Move Networks\ie_bin\Uninst.exe Mozilla Firefox (3.0.11)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} NVIDIA ForceWare Network Access Manager-->"C:\Program Files (x86)\InstallShield Installation Information\{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}\setup.exe" -runfromtemp -l0x0409 -removeonly NVIDIA PhysX-->MsiExec.exe /X{DD1865F0-AD73-40FB-B23E-1822E02396FF} QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68} RTC Client API v1.2-->MsiExec.exe /X{44CDBD1B-89FB-4E02-8319-2A4C550F664A} Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08} Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73} Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780} Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D} Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C} Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050} ShowInfo-->MsiExec.exe /X{635E5FD4-5AF3-4EFD-8060-FE5113A1ECC1} SpeechRedist-->MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE} SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA} System Requirements Lab-->C:\Program Files (x86)\SystemRequirementsLab\Uninstall.exe TomTom HOME 2.6.2.1586-->C:\Program Files (x86)\TomTom HOME 2\Uninstall TomTom HOME.exe TomTom HOME Visual Studio Merge Modules-->MsiExec.exe /I{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533} Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D} Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42} Update for Microsoft Office Access 2007 Help (KB963663)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987} Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9} Update for Microsoft Office Infopath 2007 Help (KB963662)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {716B81B8-B13C-41DF-8EAC-7A2F656CAB63} Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245} Update for Microsoft Office Outlook 2007 (KB969907)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {74F98B24-AFBD-4800-9BD6-87D349B5C462} Update for Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784} Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876} Update for Microsoft Office Publisher 2007 Help (KB963667)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F} Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C} Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726} Update for Outlook 2007 Junk Email Filter (kb970012)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {DC4A962B-9EC2-469C-BC9C-87312ADAEE81} USB2.0 VIDBOX NW03 -->C:\Program Files (x86)\InstallShield Installation Information\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}\setup.exe -runfromtemp -l0x0009 -removeonly WebEx Support Manager for Internet Explorer-->MsiExec.exe /I{C34FAEF3-4241-4C4E-9CFF-7BBD8BCEABE7} Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320} Windows Live Messenger-->MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0} Windows Live Sign-in Assistant-->MsiExec.exe /I{9422C8EA-B0C6-4197-B8FC-DC797658CA00} WinRAR archiver-->C:\Program Files (x86)\WinRAR\uninstall.exe Xfire (remove only)-->"C:\Program Files (x86)\Xfire\uninst.exe" Yahoo! Toolbar-->C:\PROGRA~2\Yahoo!\Common\UNYT_W~1.EXE =====HijackThis Backups===== O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\rundll32.exe C:\Users\ADMINI~1\AppData\Local\Temp\294479031754mxx.dll,DllMain [2009-06-18] ======Security center information====== AV: Sunbelt VIPRE AS: Windows Defender AS: SUPERAntiSpyware (disabled) AS: Sunbelt VIPRE ======System event log====== Computer Name: Johnnie-PC Event Code: 15016 Message: Unable to initialize the security package Kerberos for server side authentication. The data field contains the error number. Record Number: 12931 Source Name: Microsoft-Windows-HttpEvent Time Written: 20090110030442.263733-000 Event Type: Error User: Computer Name: Johnnie-PC Event Code: 4001 Message: WLAN AutoConfig service has successfully stopped. Record Number: 12917 Source Name: Microsoft-Windows-WLAN-AutoConfig Time Written: 20090110023941.104400-000 Event Type: Warning User: NT AUTHORITY\SYSTEM Computer Name: Johnnie-PC Event Code: 1003 Message: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 001EE5DCE677. The following error occurred: The semaphore timeout period has expired.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. Record Number: 12907 Source Name: Microsoft-Windows-Dhcp-Client Time Written: 20090110014223.000000-000 Event Type: Warning User: Computer Name: Johnnie-PC Event Code: 1003 Message: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 001EE5DCE677. The following error occurred: The operation was canceled by the user.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. Record Number: 12904 Source Name: Microsoft-Windows-Dhcp-Client Time Written: 20090110014150.000000-000 Event Type: Warning User: Computer Name: Johnnie-PC Event Code: 1003 Message: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 001EE5DCE677. The following error occurred: The operation was canceled by the user.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. Record Number: 12903 Source Name: Microsoft-Windows-Dhcp-Client Time Written: 20090110014150.000000-000 Event Type: Warning User: =====Application event log===== Computer Name: Johnnie-PC Event Code: 1530 Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 2 user registry handles leaked from \Registry\User\S-1-5-21-2181739780-1661913245-1849498853-500: Process 504 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-2181739780-1661913245-1849498853-500 Process 380 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2181739780-1661913245-1849498853-500 Record Number: 126 Source Name: Microsoft-Windows-User Profiles Service Time Written: 20081226012616.000000-000 Event Type: Warning User: NT AUTHORITY\SYSTEM Computer Name: Johnnie-PC Event Code: 1000 Message: Faulting application setup.exe_Linksys WUSB600N Dual-Band Wireless-N USB Network Adapter, version 12.0.0.49974, time stamp 0x4475d140, faulting module ISSetup.dll, version 12.0.0.49974, time stamp 0x4471f0ea, exception code 0xc0000005, fault offset 0x00093267, process id 0x494, application start time 0x01c966f2a5bc8946. Record Number: 55 Source Name: Application Error Time Written: 20081226004157.000000-000 Event Type: Error User: Computer Name: Johnnie-PC Event Code: 10 Message: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Record Number: 29 Source Name: Microsoft-Windows-WMI Time Written: 20081226003505.000000-000 Event Type: Error User: Computer Name: Johnnie-PC Event Code: 1008 Message: The Windows Search Service is attempting to remove the old catalog. Record Number: 23 Source Name: Microsoft-Windows-Search Time Written: 20081226023453.000000-000 Event Type: Warning User: Computer Name: 26L2233B3-02 Event Code: 1036 Message: InitializePrintProvider failed for provider inetpp.dll. This can occur because of system instability or a lack of system resources. Record Number: 13 Source Name: Microsoft-Windows-SpoolerSpoolss Time Written: 20081226023139.000000-000 Event Type: Warning User: NT AUTHORITY\SYSTEM =====Security event log===== Computer Name: 26L2233B3-02 Event Code: 4648 Message: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: 26L2233B3-02$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: SYSTEM Account Domain: NT AUTHORITY Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x220 Process Name: C:\Windows\System32\services.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. Record Number: 5 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081226022903.403040-000 Event Type: Audit Success User: Computer Name: 26L2233B3-02 Event Code: 4902 Message: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0x8cd1f Record Number: 4 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081226022858.067806-000 Event Type: Audit Success User: Computer Name: 26L2233B3-02 Event Code: 4624 Message: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Record Number: 3 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081226022855.119387-000 Event Type: Audit Success User: Computer Name: 26L2233B3-02 Event Code: 4608 Message: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Record Number: 2 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081226022855.119387-000 Event Type: Audit Success User: Computer Name: 26L2233B3-02 Event Code: 4634 Message: An account was logged off. Subject: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logon ID: 0x21410 Logon Type: 3 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. Record Number: 1 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20080121034608.538800-000 Event Type: Audit Success User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\QuickTime\QTSystem\ "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC "PROCESSOR_ARCHITECTURE"=AMD64 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "USERNAME"=SYSTEM "windir"=%SystemRoot% "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 23 Stepping 10, GenuineIntel "PROCESSOR_REVISION"=170a "NUMBER_OF_PROCESSORS"=4 "TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\34FB5F65-FFEB-4B61-BF0E-A6A76C450FAA\TraceFormat "DFSTRACINGON"=FALSE "CLASSPATH"=.;C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip -----------------EOF----------------- and Logfile of random's system information tool 1.06 (written by random/random) Run by Administrator at 2009-06-27 15:28:41 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 377 GB (79%) free of 477 GB Total RAM: 8190 MB (81% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:28:42 PM, on 6/27/2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\distnoted.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\SyncServer.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe c:\program files (x86)\aol toolbar\AolTbServer.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\DllHost.exe C:\Users\Administrator\Desktop\RSIT.exe C:\Program Files (x86)\Trend Micro\HijackThis\Administrator.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: IAOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: AOL Toolbar Loader - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [nmctxth] "C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SBAMTray] C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O13 - Gopher Prefix: O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing) O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: VIPRE Antivirus + Antispyware (SBAMSvc) - Sunbelt Software - C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMSvc.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: TomTomHOMEService - TomTom - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 9822 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] &Yahoo! Toolbar Helper - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}] AOL Toolbar Loader - C:\Program Files (x86)\AOL Toolbar\aoltb.dll [2008-11-05 1275176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java™ Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-05-21 41368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}] SingleInstance Class - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28 160496] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar - C:\Program Files (x86)\AOL Toolbar\aoltb.dll [2008-11-05 1275176] {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "nmctxth"=C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe [2008-05-16 648504] "GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072] "SBAMTray"=C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe [2009-06-10 959784] "AppleSyncNotifier"=C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-05-13 177472] "SunJavaUpdateSched"=C:\Program Files (x86)\Java\jre6\bin\jusched.exe [2009-05-21 148888] "Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1555968] "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-20 138240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SBAMSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoActiveDesktop"= "ForceActiveDesktopOn"= "NoActiveDesktopChanges"= "BindDirectlyToPropertySetStorage"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] ======File associations====== .js - edit - C:\Windows\SysWOW64\Notepad.exe %1 .js - open - C:\Windows\SysWOW64\WScript.exe "%1" %* ======List of files/folders created in the last 1 months====== 2009-06-27 15:28:41 ----D---- C:\rsit 2009-06-24 20:25:19 ----SHD---- C:\Config.Msi 2009-06-24 20:21:42 ----D---- C:\Program Files (x86)\Common Files\Adobe AIR 2009-06-24 20:19:28 ----D---- C:\ProgramData\NOS 2009-06-24 20:19:28 ----D---- C:\Program Files (x86)\NOS 2009-06-21 00:17:32 ----A---- C:\Windows\system32\javaws.exe 2009-06-21 00:17:32 ----A---- C:\Windows\system32\javaw.exe 2009-06-21 00:17:32 ----A---- C:\Windows\system32\java.exe 2009-06-20 18:56:24 ----D---- C:\Users\Administrator\AppData\Roaming\Apple Computer 2009-06-20 18:56:10 ----A---- C:\Windows\system32\GEARAspi.dll 2009-06-20 18:55:54 ----D---- C:\Program Files (x86)\iPod 2009-06-20 18:55:52 ----D---- C:\ProgramData\{35733029-9859-49C7-8475-1E78E2AAE413} 2009-06-20 18:55:52 ----D---- C:\Program Files (x86)\iTunes 2009-06-20 18:55:33 ----D---- C:\Program Files (x86)\Bonjour 2009-06-20 18:55:10 ----D---- C:\ProgramData\Apple Computer 2009-06-20 18:55:10 ----D---- C:\Program Files (x86)\QuickTime 2009-06-20 18:54:51 ----D---- C:\Program Files (x86)\Apple Software Update 2009-06-20 18:53:28 ----D---- C:\ProgramData\Apple 2009-06-20 18:53:28 ----D---- C:\Program Files (x86)\Common Files\Apple 2009-06-20 18:43:27 ----D---- C:\Program Files (x86)\Mozilla Firefox 2009-06-19 17:18:11 ----D---- C:\_OTL 2009-06-18 12:14:45 ----D---- C:\Downloads 2009-06-17 22:28:08 ----A---- C:\Windows\ntbtlog.txt 2009-06-17 15:22:02 ----D---- C:\VundoFix Backups 2009-06-17 15:22:02 ----A---- C:\VundoFix.txt 2009-06-17 14:55:10 ----D---- C:\ProgramData\TomTom 2009-06-17 14:54:56 ----D---- C:\Users\Administrator\AppData\Roaming\TomTom 2009-06-17 14:54:56 ----D---- C:\Users\Administrator\AppData\Roaming\Mozilla 2009-06-17 14:54:52 ----D---- C:\Program Files (x86)\TomTom International B.V 2009-06-17 14:54:34 ----D---- C:\Program Files (x86)\TomTom HOME 2 2009-06-17 14:53:54 ----D---- C:\Program Files (x86)\TomTom DesktopSuite 2009-06-17 14:51:51 ----D---- C:\ProgramData\SUPERAntiSpyware.com 2009-06-17 14:51:36 ----D---- C:\Users\Administrator\AppData\Roaming\SUPERAntiSpyware.com 2009-06-17 14:51:36 ----D---- C:\Program Files (x86)\SUPERAntiSpyware 2009-06-17 13:12:19 ----D---- C:\Windows\system32\vi-VN 2009-06-17 13:12:19 ----D---- C:\Windows\system32\eu-ES 2009-06-17 13:12:19 ----D---- C:\Windows\system32\ca-ES 2009-06-17 12:52:26 ----A---- C:\Windows\system32\NlsLexicons0007.dll 2009-06-17 12:52:22 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll 2009-06-17 12:52:21 ----A---- C:\Windows\system32\NlsLexicons0009.dll 2009-06-17 12:52:19 ----A---- C:\Windows\system32\SLCExt.dll 2009-06-17 12:52:17 ----A---- C:\Windows\system32\mssrch.dll 2009-06-17 12:52:15 ----A---- C:\Windows\system32\WscEapPr.dll 2009-06-17 12:52:15 ----A---- C:\Windows\system32\wcnwiz2.dll 2009-06-17 12:52:12 ----A---- C:\Windows\system32\tquery.dll 2009-06-17 12:52:11 ----A---- C:\Windows\system32\PresentationNative_v0300.dll 2009-06-17 12:52:10 ----A---- C:\Windows\system32\RMActivate_isv.exe 2009-06-17 12:52:09 ----A---- C:\Windows\system32\RMActivate.exe 2009-06-17 12:52:08 ----A---- C:\Windows\system32\msi.dll 2009-06-17 12:52:06 ----A---- C:\Windows\system32\imapi2fs.dll 2009-06-17 12:52:05 ----A---- C:\Windows\system32\secproc_isv.dll 2009-06-17 12:52:02 ----A---- C:\Windows\system32\mf.dll 2009-06-17 12:52:02 ----A---- C:\Windows\system32\icardagt.exe 2009-06-17 12:52:00 ----A---- C:\Windows\system32\spwizui.dll 2009-06-17 12:52:00 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll 2009-06-17 12:51:59 ----A---- C:\Windows\system32\spreview.exe 2009-06-17 12:51:59 ----A---- C:\Windows\system32\spinstall.exe 2009-06-17 12:51:58 ----A---- C:\Windows\system32\drmv2clt.dll 2009-06-17 12:51:57 ----A---- C:\Windows\system32\shell32.dll 2009-06-17 12:51:57 ----A---- C:\Windows\system32\secproc.dll 2009-06-17 12:51:56 ----A---- C:\Windows\system32\SearchIndexer.exe 2009-06-17 12:51:56 ----A---- C:\Windows\system32\p2psvc.dll 2009-06-17 12:51:56 ----A---- C:\Windows\system32\EhStorPwdMgr.dll 2009-06-17 12:51:56 ----A---- C:\Windows\system32\EhStorAuthn.dll 2009-06-17 12:51:55 ----A---- C:\Windows\system32\mssvp.dll 2009-06-17 12:51:55 ----A---- C:\Windows\system32\mscoree.dll 2009-06-17 12:51:55 ----A---- C:\Windows\system32\kernel32.dll 2009-06-17 12:51:54 ----A---- C:\Windows\system32\ntdll.dll 2009-06-17 12:51:54 ----A---- C:\Windows\system32\mssphtb.dll 2009-06-17 12:51:54 ----A---- C:\Windows\system32\mssph.dll 2009-06-17 12:51:54 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL 2009-06-17 12:51:54 ----A---- C:\Windows\system32\imapi2.dll 2009-06-17 12:51:53 ----A---- C:\Windows\system32\sdohlp.dll 2009-06-17 12:51:52 ----A---- C:\Windows\system32\IMJP10K.DLL 2009-06-17 12:51:52 ----A---- C:\Windows\system32\esent.dll 2009-06-17 12:51:52 ----A---- C:\Windows\system32\DevicePairing.dll 2009-06-17 12:51:51 ----A---- C:\Windows\system32\sperror.dll 2009-06-17 12:51:51 ----A---- C:\Windows\system32\RMActivate_ssp.exe 2009-06-17 12:51:51 ----A---- C:\Windows\system32\korwbrkr.dll 2009-06-17 12:51:50 ----A---- C:\Windows\system32\WMVCORE.DLL 2009-06-17 12:51:50 ----A---- C:\Windows\system32\wmp.dll 2009-06-17 12:51:50 ----A---- C:\Windows\system32\SLC.dll 2009-06-17 12:51:50 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe 2009-06-17 12:51:50 ----A---- C:\Windows\system32\PresentationHostProxy.dll 2009-06-17 12:51:50 ----A---- C:\Windows\system32\msshsq.dll 2009-06-17 12:51:50 ----A---- C:\Windows\system32\EhStorAPI.dll 2009-06-17 12:51:49 ----A---- C:\Windows\system32\msxml6.dll 2009-06-17 12:51:49 ----A---- C:\Windows\system32\msjet40.dll 2009-06-17 12:51:48 ----A---- C:\Windows\system32\Query.dll 2009-06-17 12:51:48 ----A---- C:\Windows\system32\EhStorShell.dll 2009-06-17 12:51:47 ----A---- C:\Windows\system32\user32.dll 2009-06-17 12:51:47 ----A---- C:\Windows\system32\P2PGraph.dll 2009-06-17 12:51:47 ----A---- C:\Windows\system32\msexch40.dll 2009-06-17 12:51:46 ----A---- C:\Windows\system32\srchadmin.dll 2009-06-17 12:51:46 ----A---- C:\Windows\system32\ole32.dll 2009-06-17 12:51:46 ----A---- C:\Windows\system32\msxml3.dll 2009-06-17 12:51:46 ----A---- C:\Windows\system32\IasMigReader.exe 2009-06-17 12:51:46 ----A---- C:\Windows\explorer.exe 2009-06-17 12:51:45 ----A---- C:\Windows\system32\gdi32.dll 2009-06-17 12:51:45 ----A---- C:\Windows\system32\EncDec.dll 2009-06-17 12:51:44 ----A---- C:\Windows\system32\mmc.exe 2009-06-17 12:51:44 ----A---- C:\Windows\system32\IasMigPlugin.dll 2009-06-17 12:51:44 ----A---- C:\Windows\system32\DevicePairingWizard.exe 2009-06-17 12:51:43 ----A---- C:\Windows\system32\riched20.dll 2009-06-17 12:51:43 ----A---- C:\Windows\system32\RacEngn.dll 2009-06-17 12:51:43 ----A---- C:\Windows\system32\Magnify.exe 2009-06-17 12:51:43 ----A---- C:\Windows\system32\fdBth.dll 2009-06-17 12:51:42 ----A---- C:\Windows\system32\SearchProtocolHost.exe 2009-06-17 12:51:42 ----A---- C:\Windows\system32\SearchFilterHost.exe 2009-06-17 12:51:42 ----A---- C:\Windows\system32\milcore.dll 2009-06-17 12:51:42 ----A---- C:\Windows\system32\CertEnroll.dll 2009-06-17 12:51:42 ----A---- C:\Windows\system32\bcrypt.dll 2009-06-17 12:51:41 ----A---- C:\Windows\system32\spoolss.dll 2009-06-17 12:51:41 ----A---- C:\Windows\system32\NaturalLanguage6.dll 2009-06-17 12:51:37 ----A---- C:\Windows\system32\msjtes40.dll 2009-06-17 12:51:36 ----A---- C:\Windows\system32\Storprop.dll 2009-06-17 12:51:36 ----A---- C:\Windows\system32\msvcp60.dll 2009-06-17 12:51:36 ----A---- C:\Windows\system32\infocardapi.dll 2009-06-17 12:51:36 ----A---- C:\Windows\system32\gpedit.dll 2009-06-17 12:51:35 ----A---- C:\Windows\system32\mstext40.dll 2009-06-17 12:51:35 ----A---- C:\Windows\system32\es.dll 2009-06-17 12:51:35 ----A---- C:\Windows\system32\advapi32.dll 2009-06-17 12:51:34 ----A---- C:\Windows\system32\WMPhoto.dll 2009-06-17 12:51:34 ----A---- C:\Windows\system32\WebClnt.dll 2009-06-17 12:51:34 ----A---- C:\Windows\system32\slwmi.dll 2009-06-17 12:51:34 ----A---- C:\Windows\system32\msexcl40.dll 2009-06-17 12:51:33 ----A---- C:\Windows\system32\vssapi.dll 2009-06-17 12:51:33 ----A---- C:\Windows\system32\msxbde40.dll 2009-06-17 12:51:33 ----A---- C:\Windows\system32\DevicePairingProxy.dll 2009-06-17 12:51:33 ----A---- C:\Windows\system32\comsvcs.dll 2009-06-17 12:51:32 ----A---- C:\Windows\system32\mstscax.dll 2009-06-17 12:51:32 ----A---- C:\Windows\system32\authui.dll 2009-06-17 12:51:31 ----A---- C:\Windows\system32\propsys.dll 2009-06-17 12:51:31 ----A---- C:\Windows\system32\PresentationHost.exe 2009-06-17 12:51:31 ----A---- C:\Windows\system32\newdev.dll 2009-06-17 12:51:31 ----A---- C:\Windows\system32\msrepl40.dll 2009-06-17 12:51:30 ----A---- C:\Windows\system32\setupapi.dll 2009-06-17 12:51:30 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2009-06-17 12:51:30 ----A---- C:\Windows\system32\iasrecst.dll 2009-06-17 12:51:30 ----A---- C:\Windows\system32\explorer.exe 2009-06-17 12:51:30 ----A---- C:\Windows\system32\eudcedit.exe 2009-06-17 12:51:30 ----A---- C:\Windows\system32\crypt32.dll 2009-06-17 12:51:29 ----A---- C:\Windows\system32\mspbde40.dll 2009-06-17 12:51:29 ----A---- C:\Windows\system32\d3d9.dll 2009-06-17 12:51:28 ----A---- C:\Windows\system32\msltus40.dll 2009-06-17 12:51:28 ----A---- C:\Windows\system32\davclnt.dll 2009-06-17 12:51:27 ----A---- C:\Windows\system32\shlwapi.dll 2009-06-17 12:51:27 ----A---- C:\Windows\system32\msrd3x40.dll 2009-06-17 12:51:27 ----A---- C:\Windows\system32\mfc42.dll 2009-06-17 12:51:27 ----A---- C:\Windows\system32\browseui.dll 2009-06-17 12:51:26 ----A---- C:\Windows\system32\wevtapi.dll 2009-06-17 12:51:26 ----A---- C:\Windows\system32\photowiz.dll 2009-06-17 12:51:26 ----A---- C:\Windows\system32\nlhtml.dll 2009-06-17 12:51:23 ----A---- C:\Windows\system32\win32spl.dll 2009-06-17 12:51:23 ----A---- C:\Windows\system32\WcnNetsh.dll 2009-06-17 12:51:23 ----A---- C:\Windows\system32\SLCommDlg.dll 2009-06-17 12:51:23 ----A---- C:\Windows\system32\quartz.dll 2009-06-17 12:51:23 ----A---- C:\Windows\system32\oleaut32.dll 2009-06-17 12:51:23 ----A---- C:\Windows\system32\kerberos.dll 2009-06-17 12:51:22 ----A---- C:\Windows\system32\winhttp.dll 2009-06-17 12:51:22 ----A---- C:\Windows\system32\netshell.dll 2009-06-17 12:51:22 ----A---- C:\Windows\system32\mswstr10.dll 2009-06-17 12:51:22 ----A---- C:\Windows\system32\msv1_0.dll 2009-06-17 12:51:22 ----A---- C:\Windows\system32\apds.dll 2009-06-17 12:51:21 ----A---- C:\Windows\system32\xmlfilter.dll 2009-06-17 12:51:21 ----A---- C:\Windows\system32\msvcrt.dll 2009-06-17 12:51:21 ----A---- C:\Windows\system32\msctf.dll 2009-06-17 12:51:21 ----A---- C:\Windows\system32\mfc42u.dll 2009-06-17 12:51:20 ----A---- C:\Windows\system32\sqlsrv32.dll 2009-06-17 12:51:20 ----A---- C:\Windows\system32\secur32.dll 2009-06-17 12:51:20 ----A---- C:\Windows\system32\msrd2x40.dll 2009-06-17 12:51:20 ----A---- C:\Windows\system32\eapphost.dll 2009-06-17 12:51:19 ----A---- C:\Windows\system32\shdocvw.dll 2009-06-17 12:51:19 ----A---- C:\Windows\system32\propdefs.dll 2009-06-17 12:51:19 ----A---- C:\Windows\system32\odbc32.dll 2009-06-17 12:51:18 ----A---- C:\Windows\system32\WsmSvc.dll 2009-06-17 12:51:18 ----A---- C:\Windows\system32\wevtutil.exe 2009-06-17 12:51:18 ----A---- C:\Windows\system32\mssitlb.dll 2009-06-17 12:51:18 ----A---- C:\Windows\system32\mmcndmgr.dll 2009-06-17 12:51:18 ----A---- C:\Windows\system32\dbgeng.dll 2009-06-17 12:51:17 ----A---- C:\Windows\system32\usp10.dll 2009-06-17 12:51:15 ----A---- C:\Windows\system32\drvinst.exe 2009-06-17 12:51:14 ----A---- C:\Windows\system32\schannel.dll 2009-06-17 12:51:14 ----A---- C:\Windows\system32\netlogon.dll 2009-06-17 12:51:14 ----A---- C:\Windows\system32\msscb.dll 2009-06-17 12:51:14 ----A---- C:\Windows\system32\msctfp.dll 2009-06-17 12:51:14 ----A---- C:\Windows\system32\fdBthProxy.dll 2009-06-17 12:51:14 ----A---- C:\Windows\system32\devmgr.dll 2009-06-17 12:51:14 ----A---- C:\Windows\system32\adsldpc.dll 2009-06-17 12:51:13 ----A---- C:\Windows\system32\WSDApi.dll 2009-06-17 12:51:13 ----A---- C:\Windows\system32\Wldap32.dll 2009-06-17 12:51:13 ----A---- C:\Windows\system32\wcnwiz.dll 2009-06-17 12:51:13 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll 2009-06-17 12:51:13 ----A---- C:\Windows\system32\evr.dll 2009-06-17 12:51:12 ----A---- C:\Windows\system32\WMVSDECD.DLL 2009-06-17 12:51:11 ----A---- C:\Windows\system32\WindowsCodecs.dll 2009-06-17 12:51:11 ----A---- C:\Windows\system32\services.exe 2009-06-17 12:51:11 ----A---- C:\Windows\system32\mimefilt.dll 2009-06-17 12:51:11 ----A---- C:\Windows\system32\comdlg32.dll 2009-06-17 12:51:11 ----A---- C:\Windows\system32\adtschema.dll 2009-06-17 12:51:10 ----A---- C:\Windows\system32\wcncsvc.dll 2009-06-17 12:51:10 ----A---- C:\Windows\system32\PortableDeviceApi.dll 2009-06-17 12:51:10 ----A---- C:\Windows\system32\msjter40.dll 2009-06-17 12:51:10 ----A---- C:\Windows\system32\msdtcprx.dll 2009-06-17 12:51:10 ----A---- C:\Windows\system32\msdrm.dll 2009-06-17 12:51:10 ----A---- C:\Windows\system32\certcli.dll 2009-06-17 12:51:09 ----A---- C:\Windows\system32\WMNetMgr.dll 2009-06-17 12:51:09 ----A---- C:\Windows\system32\taskeng.exe 2009-06-17 12:51:09 ----A---- C:\Windows\system32\rtffilt.dll 2009-06-17 12:51:09 ----A---- C:\Windows\system32\reg.exe 2009-06-17 12:51:09 ----A---- C:\Windows\system32\mswdat10.dll 2009-06-17 12:51:09 ----A---- C:\Windows\system32\ipsmsnap.dll 2009-06-17 12:51:09 ----A---- C:\Windows\system32\dnsapi.dll 2009-06-17 12:51:09 ----A---- C:\Windows\system32\certutil.exe 2009-06-17 12:51:08 ----A---- C:\Windows\system32\msshooks.dll 2009-06-17 12:51:08 ----A---- C:\Windows\system32\msscntrs.dll 2009-06-17 12:51:07 ----A---- C:\Windows\system32\rsaenh.dll 2009-06-17 12:51:07 ----A---- C:\Windows\system32\msihnd.dll 2009-06-17 12:51:07 ----A---- C:\Windows\system32\MMDevAPI.dll 2009-06-17 12:51:06 ----A---- C:\Windows\system32\msstrc.dll 2009-06-17 12:51:06 ----A---- C:\Windows\system32\inetcomm.dll 2009-06-17 12:51:06 ----A---- C:\Windows\system32\dfshim.dll 2009-06-17 12:51:05 ----A---- C:\Windows\system32\netapi32.dll 2009-06-17 12:51:05 ----A---- C:\Windows\system32\mtxclu.dll 2009-06-17 12:51:05 ----A---- C:\Windows\system32\mscories.dll 2009-06-17 12:51:05 ----A---- C:\Windows\system32\hidserv.dll 2009-06-17 12:51:05 ----A---- C:\Windows\system32\fundisc.dll 2009-06-17 12:51:05 ----A---- C:\Windows\system32\dhcpcsvc6.dll 2009-06-17 12:51:05 ----A---- C:\Windows\system32\cryptsvc.dll 2009-06-17 12:51:04 ----A---- C:\Windows\system32\TsWpfWrp.exe 2009-06-17 12:51:04 ----A---- C:\Windows\system32\gameux.dll 2009-06-17 12:51:03 ----A---- C:\Windows\system32\wdc.dll 2009-06-17 12:51:03 ----A---- C:\Windows\system32\shsvcs.dll 2009-06-17 12:51:03 ----A---- C:\Windows\system32\msiexec.exe 2009-06-17 12:51:03 ----A---- C:\Windows\system32\imapi.dll 2009-06-17 12:51:03 ----A---- C:\Windows\system32\chsbrkr.dll 2009-06-17 12:51:02 ----A---- C:\Windows\system32\pnidui.dll 2009-06-17 12:51:02 ----A---- C:\Windows\system32\imm32.dll 2009-06-17 12:51:02 ----A---- C:\Windows\system32\iassdo.dll 2009-06-17 12:51:01 ----A---- C:\Windows\system32\spcmsg.dll 2009-06-17 12:51:01 ----A---- C:\Windows\system32\slmgr.vbs 2009-06-17 12:51:01 ----A---- C:\Windows\system32\scrrun.dll 2009-06-17 12:51:01 ----A---- C:\Windows\system32\autofmt.exe 2009-06-17 12:51:00 ----A---- C:\Windows\system32\pdh.dll 2009-06-17 12:51:00 ----A---- C:\Windows\system32\dhcpcsvc.dll 2009-06-17 12:51:00 ----A---- C:\Windows\system32\CertEnrollUI.dll 2009-06-17 12:51:00 ----A---- C:\Windows\system32\azroles.dll 2009-06-17 12:50:59 ----A---- C:\Windows\system32\wmpmde.dll 2009-06-17 12:50:59 ----A---- C:\Windows\system32\pidgenx.dll 2009-06-17 12:50:58 ----A---- C:\Windows\system32\winlogon.exe 2009-06-17 12:50:58 ----A---- C:\Windows\system32\SyncCenter.dll 2009-06-17 12:50:58 ----A---- C:\Windows\system32\msjetoledb40.dll 2009-06-17 12:50:58 ----A---- C:\Windows\system32\comuid.dll 2009-06-17 12:50:57 ----A---- C:\Windows\system32\WindowsCodecsExt.dll 2009-06-17 12:50:57 ----A---- C:\Windows\system32\spp.dll 2009-06-17 12:50:57 ----A---- C:\Windows\system32\sethc.exe 2009-06-17 12:50:57 ----A---- C:\Windows\system32\ncrypt.dll 2009-06-17 12:50:57 ----A---- C:\Windows\system32\iassam.dll 2009-06-17 12:50:57 ----A---- C:\Windows\system32\certmgr.dll 2009-06-17 12:50:56 ----A---- C:\Windows\system32\untfs.dll 2009-06-17 12:50:56 ----A---- C:\Windows\system32\taskcomp.dll 2009-06-17 12:50:56 ----A---- C:\Windows\system32\scrobj.dll 2009-06-17 12:50:56 ----A---- C:\Windows\system32\rtutils.dll 2009-06-17 12:50:55 ----A---- C:\Windows\system32\autochk.exe 2009-06-17 12:50:54 ----A---- C:\Windows\system32\iasnap.dll 2009-06-17 12:50:53 ----A---- C:\Windows\system32\printui.dll 2009-06-17 12:50:53 ----A---- C:\Windows\system32\autoconv.exe 2009-06-17 12:50:52 ----A---- C:\Windows\system32\WMVDECOD.DLL 2009-06-17 12:50:52 ----A---- C:\Windows\system32\onex.dll 2009-06-17 12:50:52 ----A---- C:\Windows\system32\cscript.exe 2009-06-17 12:50:52 ----A---- C:\Windows\system32\basecsp.dll 2009-06-17 12:50:52 ----A---- C:\Windows\system32\audiodg.exe 2009-06-17 12:50:51 ----A---- C:\Windows\system32\userenv.dll 2009-06-17 12:50:51 ----A---- C:\Windows\system32\osk.exe 2009-06-17 12:50:51 ----A---- C:\Windows\system32\mswsock.dll 2009-06-17 12:50:49 ----A---- C:\Windows\system32\winmm.dll 2009-06-17 12:50:49 ----A---- C:\Windows\system32\RelMon.dll 2009-06-17 12:50:48 ----A---- C:\Windows\system32\WinSCard.dll 2009-06-17 12:50:48 ----A---- C:\Windows\system32\WerFaultSecure.exe 2009-06-17 12:50:48 ----A---- C:\Windows\system32\WerFault.exe 2009-06-17 12:50:48 ----A---- C:\Windows\system32\Utilman.exe 2009-06-17 12:50:48 ----A---- C:\Windows\system32\stobject.dll 2009-06-17 12:50:48 ----A---- C:\Windows\system32\secproc_ssp_isv.dll 2009-06-17 12:50:48 ----A---- C:\Windows\system32\secproc_ssp.dll 2009-06-17 12:50:48 ----A---- C:\Windows\system32\rdpencom.dll 2009-06-17 12:50:48 ----A---- C:\Windows\system32\offfilt.dll 2009-06-17 12:50:48 ----A---- C:\Windows\system32\msftedit.dll 2009-06-17 12:50:48 ----A---- C:\Windows\system32\mfplat.dll 2009-06-17 12:50:48 ----A---- C:\Windows\system32\diskraid.exe 2009-06-17 12:50:48 ----A---- C:\Windows\system32\apphelp.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\wscript.exe 2009-06-17 12:50:47 ----A---- C:\Windows\system32\ulib.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\SndVol.exe 2009-06-17 12:50:47 ----A---- C:\Windows\system32\prnntfy.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\odbccp32.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\msnetobj.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\mscms.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\IPHLPAPI.DLL 2009-06-17 12:50:47 ----A---- C:\Windows\system32\iasdatastore.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\dsound.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\cryptui.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\AudioEng.dll 2009-06-17 12:50:47 ----A---- C:\Windows\system32\adsmsext.dll 2009-06-17 12:50:46 ----A---- C:\Windows\system32\wscntfy.dll 2009-06-17 12:50:46 ----A---- C:\Windows\system32\wlangpui.dll 2009-06-17 12:50:46 ----A---- C:\Windows\system32\rastapi.dll 2009-06-17 12:50:46 ----A---- C:\Windows\system32\pnpsetup.dll 2009-06-17 12:50:46 ----A---- C:\Windows\system32\ipsecsnp.dll 2009-06-17 12:50:46 ----A---- C:\Windows\system32\fdProxy.dll 2009-06-17 12:50:46 ----A---- C:\Windows\system32\diskpart.exe 2009-06-17 12:50:45 ----A---- C:\Windows\system32\rastls.dll 2009-06-17 12:50:45 ----A---- C:\Windows\system32\iashlpr.dll 2009-06-17 12:50:45 ----A---- C:\Windows\system32\gpapi.dll 2009-06-17 12:50:44 ----A---- C:\Windows\system32\WMVENCOD.DLL 2009-06-17 12:50:44 ----A---- C:\Windows\system32\vdsdyn.dll 2009-06-17 12:50:44 ----A---- C:\Windows\system32\netiohlp.dll 2009-06-17 12:50:44 ----A---- C:\Windows\system32\logman.exe 2009-06-17 12:50:43 ----A---- C:\Windows\system32\wusa.exe 2009-06-17 12:50:43 ----A---- C:\Windows\system32\rasapi32.dll 2009-06-17 12:50:43 ----A---- C:\Windows\system32\ntprint.dll 2009-06-17 12:50:43 ----A---- C:\Windows\system32\mscorier.dll 2009-06-17 12:50:43 ----A---- C:\Windows\system32\iasrad.dll 2009-06-17 12:50:42 ----A---- C:\Windows\system32\zipfldr.dll 2009-06-17 12:50:42 ----A---- C:\Windows\system32\wshext.dll 2009-06-17 12:50:42 ----A---- C:\Windows\system32\netcenter.dll 2009-06-17 12:50:42 ----A---- C:\Windows\system32\findstr.exe 2009-06-17 12:50:40 ----A---- C:\Windows\system32\wsnmp32.dll 2009-06-17 12:50:40 ----A---- C:\Windows\system32\wer.dll 2009-06-17 12:50:40 ----A---- C:\Windows\system32\tsbyuv.dll 2009-06-17 12:50:40 ----A---- C:\Windows\system32\themecpl.dll 2009-06-17 12:50:40 ----A---- C:\Windows\system32\rasdlg.dll 2009-06-17 12:50:40 ----A---- C:\Windows\system32\mssprxy.dll 2009-06-17 12:50:40 ----A---- C:\Windows\system32\iassvcs.dll 2009-06-17 12:50:39 ----A---- C:\Windows\system32\slcc.dll 2009-06-17 12:50:39 ----A---- C:\Windows\system32\scansetting.dll 2009-06-17 12:50:39 ----A---- C:\Windows\system32\powrprof.dll 2009-06-17 12:50:39 ----A---- C:\Windows\system32\ntmarta.dll 2009-06-17 12:50:39 ----A---- C:\Windows\system32\msutb.dll 2009-06-17 12:50:39 ----A---- C:\Windows\system32\mstsc.exe 2009-06-17 12:50:39 ----A---- C:\Windows\system32\mstlsapi.dll 2009-06-17 12:50:39 ----A---- C:\Windows\system32\iasads.dll 2009-06-17 12:50:38 ----A---- C:\Windows\system32\wlanhlp.dll 2009-06-17 12:50:38 ----A---- C:\Windows\system32\powercpl.dll 2009-06-17 12:50:38 ----A---- C:\Windows\system32\PerfCenterCPL.dll 2009-06-17 12:50:38 ----A---- C:\Windows\system32\newdev.exe 2009-06-17 12:50:38 ----A---- C:\Windows\system32\networkmap.dll 2009-06-17 12:50:38 ----A---- C:\Windows\system32\lpk.dll 2009-06-17 12:50:38 ----A---- C:\Windows\system32\icardres.dll 2009-06-17 12:50:38 ----A---- C:\Windows\system32\iasacct.dll 2009-06-17 12:50:38 ----A---- C:\Windows\system32\connect.dll 2009-06-17 12:50:38 ----A---- C:\Windows\system32\authz.dll 2009-06-17 12:50:37 ----A---- C:\Windows\system32\usercpl.dll 2009-06-17 12:50:37 ----A---- C:\Windows\system32\themeui.dll 2009-06-17 12:50:37 ----A---- C:\Windows\system32\systemcpl.dll 2009-06-17 12:50:37 ----A---- C:\Windows\system32\sud.dll 2009-06-17 12:50:37 ----A---- C:\Windows\system32\samlib.dll 2009-06-17 12:50:37 ----A---- C:\Windows\system32\pcaui.dll 2009-06-17 12:50:37 ----A---- C:\Windows\system32\mmci.dll 2009-06-17 12:50:37 ----A---- C:\Windows\system32\accessibilitycpl.dll 2009-06-17 12:50:36 ----A---- C:\Windows\system32\wlanpref.dll 2009-06-17 12:50:36 ----A---- C:\Windows\system32\rpchttp.dll 2009-06-17 12:50:36 ----A---- C:\Windows\system32\qdvd.dll 2009-06-17 12:50:36 ----A---- C:\Windows\system32\autoplay.dll 2009-06-17 12:50:35 ----A---- C:\Windows\system32\wpcao.dll 2009-06-17 12:50:35 ----A---- C:\Windows\system32\vdsutil.dll 2009-06-17 12:50:35 ----A---- C:\Windows\system32\tapisrv.dll 2009-06-17 12:50:35 ----A---- C:\Windows\system32\scksp.dll 2009-06-17 12:50:35 ----A---- C:\Windows\system32\regapi.dll 2009-06-17 12:50:35 ----A---- C:\Windows\system32\msinfo32.exe 2009-06-17 12:50:35 ----A---- C:\Windows\system32\feclient.dll 2009-06-17 12:50:34 ----A---- C:\Windows\system32\WMPEncEn.dll 2009-06-17 12:50:34 ----A---- C:\Windows\system32\scesrv.dll 2009-06-17 12:50:34 ----A---- C:\Windows\system32\rekeywiz.exe 2009-06-17 12:50:34 ----A---- C:\Windows\system32\psisdecd.dll 2009-06-17 12:50:34 ----A---- C:\Windows\system32\oleprn.dll 2009-06-17 12:50:34 ----A---- C:\Windows\system32\mpr.dll 2009-06-17 12:50:34 ----A---- C:\Windows\system32\Faultrep.dll 2009-06-17 12:50:34 ----A---- C:\Windows\system32\dot3msm.dll 2009-06-17 12:50:34 ----A---- C:\Windows\system32\AudioSes.dll 2009-06-17 12:50:33 ----A---- C:\Windows\system32\wscisvif.dll 2009-06-17 12:50:33 ----A---- C:\Windows\system32\qedit.dll 2009-06-17 12:50:33 ----A---- C:\Windows\system32\perfdisk.dll 2009-06-17 12:50:33 ----A---- C:\Windows\system32\ncryptui.dll 2009-06-17 12:50:33 ----A---- C:\Windows\system32\iaspolcy.dll 2009-06-17 12:50:33 ----A---- C:\Windows\system32\dpapimig.exe 2009-06-17 12:50:33 ----A---- C:\Windows\system32\certreq.exe 2009-06-17 12:50:32 ----A---- C:\Windows\system32\scecli.dll 2009-06-17 12:50:32 ----A---- C:\Windows\system32\rasgcw.dll 2009-06-17 12:50:32 ----A---- C:\Windows\system32\hdwwiz.exe 2009-06-17 12:50:32 ----A---- C:\Windows\system32\FWPUCLNT.DLL 2009-06-17 12:50:31 ----A---- C:\Windows\system32\TSTheme.exe 2009-06-17 12:50:31 ----A---- C:\Windows\system32\tcpmon.dll 2009-06-17 12:50:31 ----A---- C:\Windows\system32\tcpipcfg.dll 2009-06-17 12:50:31 ----A---- C:\Windows\system32\spwinsat.dll 2009-06-17 12:50:31 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll 2009-06-17 12:50:31 ----A---- C:\Windows\system32\rasplap.dll 2009-06-17 12:50:31 ----A---- C:\Windows\system32\fdWSD.dll 2009-06-17 12:50:31 ----A---- C:\Windows\system32\cmmon32.exe 2009-06-17 12:50:30 ----A---- C:\Windows\system32\whealogr.dll 2009-06-17 12:50:29 ----A---- C:\Windows\system32\SCardSvr.dll 2009-06-17 12:50:29 ----A---- C:\Windows\system32\raschap.dll 2009-06-17 12:50:29 ----A---- C:\Windows\system32\fontext.dll 2009-06-17 12:50:29 ----A---- C:\Windows\system32\conime.exe 2009-06-17 12:50:29 ----A---- C:\Windows\system32\cmdial32.dll 2009-06-17 12:50:28 ----A---- C:\Windows\system32\WMVXENCD.DLL 2009-06-17 12:50:28 ----A---- C:\Windows\system32\wlanui.dll 2009-06-17 12:50:28 ----A---- C:\Windows\system32\wlanmsm.dll 2009-06-17 12:50:28 ----A---- C:\Windows\system32\wiaaut.dll 2009-06-17 12:50:28 ----A---- C:\Windows\system32\shwebsvc.dll 2009-06-17 12:50:28 ----A---- C:\Windows\system32\rasppp.dll 2009-06-17 12:50:28 ----A---- C:\Windows\system32\oobefldr.dll 2009-06-17 12:50:28 ----A---- C:\Windows\system32\MSVidCtl.dll 2009-06-17 12:50:28 ----A---- C:\Windows\system32\dsprop.dll 2009-06-17 12:50:28 ----A---- C:\Windows\system32\dimsroam.dll 2009-06-17 12:50:27 ----A---- C:\Windows\system32\wmdrmsdk.dll 2009-06-17 12:50:27 ----A---- C:\Windows\system32\shsetup.dll 2009-06-17 12:50:27 ----A---- C:\Windows\system32\rasmontr.dll 2009-06-17 12:50:27 ----A---- C:\Windows\system32\mscandui.dll 2009-06-17 12:50:27 ----A---- C:\Windows\system32\modemui.dll 2009-06-17 12:50:27 ----A---- C:\Windows\system32\dataclen.dll 2009-06-17 12:50:27 ----A---- C:\Windows\system32\chtbrkr.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\WSDMon.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\wpcsvc.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\wmpeffects.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\wlgpclnt.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\networkexplorer.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\netplwiz.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\ifmon.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\credui.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\blackbox.dll 2009-06-17 12:50:26 ----A---- C:\Windows\system32\AUDIOKSE.dll 2009-06-17 12:50:25 ----A---- C:\Windows\system32\wscapi.dll 2009-06-17 12:50:25 ----A---- C:\Windows\system32\wpdwcn.dll 2009-06-17 12:50:25 ----A---- C:\Windows\system32\thawbrkr.dll 2009-06-17 12:50:25 ----A---- C:\Windows\system32\softkbd.dll 2009-06-17 12:50:25 ----A---- C:\Windows\system32\sendmail.dll 2009-06-17 12:50:25 ----A---- C:\Windows\system32\msscp.dll 2009-06-17 12:50:25 ----A---- C:\Windows\system32\msimtf.dll 2009-06-17 12:50:25 ----A---- C:\Windows\system32\logagent.exe 2009-06-17 12:50:25 ----A---- C:\Windows\system32\InkEd.dll 2009-06-17 12:50:25 ----A---- C:\Windows\system32\gpresult.exe 2009-06-17 12:50:25 ----A---- C:\Windows\system32\cipher.exe 2009-06-17 12:50:24 ----A---- C:\Windows\system32\msctfui.dll 2009-06-17 12:50:24 ----A---- C:\Windows\system32\MediaMetadataHandler.dll 2009-06-17 12:50:24 ----A---- C:\Windows\system32\Apphlpdm.dll 2009-06-17 12:50:23 ----A---- C:\Windows\system32\olepro32.dll 2009-06-17 12:50:23 ----A---- C:\Windows\system32\drmmgrtn.dll 2009-06-17 12:50:23 ----A---- C:\Windows\system32\dmsynth.dll 2009-06-17 12:50:22 ----A---- C:\Windows\system32\wshbth.dll 2009-06-17 12:50:22 ----A---- C:\Windows\system32\wmdrmdev.dll 2009-06-17 12:50:22 ----A---- C:\Windows\system32\version.dll 2009-06-17 12:50:22 ----A---- C:\Windows\system32\puiapi.dll 2009-06-17 12:50:22 ----A---- C:\Windows\system32\mprapi.dll 2009-06-17 12:50:22 ----A---- C:\Windows\system32\input.dll 2009-06-17 12:50:22 ----A---- C:\Windows\system32\ExplorerFrame.dll 2009-06-17 12:50:21 ----A---- C:\Windows\system32\WMADMOD.DLL 2009-06-17 12:50:21 ----A---- C:\Windows\system32\msisip.dll 2009-06-17 12:50:21 ----A---- C:\Windows\system32\MsCtfMonitor.dll 2009-06-17 12:50:21 ----A---- C:\Windows\system32\fdSSDP.dll 2009-06-17 12:50:21 ----A---- C:\Windows\system32\fc.exe 2009-06-17 12:50:21 ----A---- C:\Windows\system32\dmusic.dll 2009-06-17 12:50:21 ----A---- C:\Windows\system32\cscapi.dll 2009-06-17 12:50:20 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll 2009-06-17 12:50:20 ----A---- C:\Windows\system32\msjint40.dll 2009-06-17 12:50:20 ----A---- C:\Windows\system32\l2nacp.dll 2009-06-17 12:50:20 ----A---- C:\Windows\system32\ftp.exe 2009-06-17 12:50:20 ----A---- C:\Windows\system32\eapp3hst.dll 2009-06-17 12:50:20 ----A---- C:\Windows\system32\cscdll.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\wsdchngr.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\wmdrmnet.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\SMBHelperClass.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\rrinstaller.exe 2009-06-17 12:50:19 ----A---- C:\Windows\system32\rasdial.exe 2009-06-17 12:50:19 ----A---- C:\Windows\system32\rasdiag.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\PortableDeviceTypes.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\ipconfig.exe 2009-06-17 12:50:19 ----A---- C:\Windows\system32\fdWCN.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\eappcfg.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\dot3cfg.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\CHxReadingStringIME.dll 2009-06-17 12:50:19 ----A---- C:\Windows\system32\bthudtask.exe 2009-06-17 12:50:19 ----A---- C:\Windows\system32\aaclient.dll 2009-06-17 12:50:18 ----A---- C:\Windows\system32\tscupgrd.exe 2009-06-17 12:50:18 ----A---- C:\Windows\system32\slcinst.dll 2009-06-17 12:50:18 ----A---- C:\Windows\system32\ocsetup.exe 2009-06-17 12:50:18 ----A---- C:\Windows\system32\nslookup.exe 2009-06-17 12:50:18 ----A---- C:\Windows\system32\networkitemfactory.dll 2009-06-17 12:50:18 ----A---- C:\Windows\system32\MSMPEG2ENC.DLL 2009-06-17 12:50:18 ----A---- C:\Windows\system32\MSAC3ENC.DLL 2009-06-17 12:50:18 ----A---- C:\Windows\system32\mmcico.dll 2009-06-17 12:50:18 ----A---- C:\Windows\system32\mfps.dll 2009-06-17 12:50:18 ----A---- C:\Windows\system32\mfpmp.exe 2009-06-17 12:50:18 ----A---- C:\Windows\system32\hbaapi.dll 2009-06-17 12:50:18 ----A---- C:\Windows\system32\FwRemoteSvr.dll 2009-06-17 12:50:18 ----A---- C:\Windows\system32\fdeploy.dll 2009-06-17 12:50:18 ----A---- C:\Windows\system32\eappgnui.dll 2009-06-17 12:50:17 ----A---- C:\Windows\system32\tsgqec.dll 2009-06-17 12:50:17 ----A---- C:\Windows\system32\NcdProp.dll 2009-06-17 12:50:17 ----A---- C:\Windows\system32\gpupdate.exe 2009-06-17 12:50:17 ----A---- C:\Windows\system32\atmlib.dll 2009-06-17 12:50:15 ----A---- C:\Windows\system32\wmpps.dll 2009-06-17 12:50:15 ----A---- C:\Windows\system32\vdmdbg.dll 2009-06-17 12:50:15 ----A---- C:\Windows\system32\slwga.dll 2009-06-17 12:50:15 ----A---- C:\Windows\system32\odbcconf.dll 2009-06-17 12:50:14 ----A---- C:\Windows\system32\winrnr.dll 2009-06-17 12:50:14 ----A---- C:\Windows\system32\midimap.dll 2009-06-17 12:50:14 ----A---- C:\Windows\system32\atmfd.dll 2009-06-17 12:50:11 ----A---- C:\Windows\system32\spwmp.dll 2009-06-17 12:50:10 ----A---- C:\Windows\system32\wmploc.DLL 2009-06-17 12:50:10 ----A---- C:\Windows\system32\dxmasf.dll 2009-06-17 12:50:09 ----A---- C:\Windows\system32\msimsg.dll 2009-06-17 12:50:09 ----A---- C:\Windows\system32\mferror.dll 2009-06-17 12:50:09 ----A---- C:\Windows\system32\f3ahvoas.dll 2009-06-17 12:49:59 ----A---- C:\Windows\system32\wdscore.dll 2009-06-17 12:49:54 ----A---- C:\Windows\system32\drvstore.dll 2009-06-17 11:19:59 ----D---- C:\Program Files (x86)\Trend Micro 2009-06-17 00:40:44 ----D---- C:\Users\Administrator\AppData\Roaming\Malwarebytes 2009-06-17 00:40:39 ----D---- C:\ProgramData\Malwarebytes 2009-06-17 00:40:39 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2009-06-17 00:38:16 ----D---- C:\Users\Administrator\AppData\Roaming\Yahoo! 2009-06-17 00:38:16 ----D---- C:\ProgramData\Yahoo! Companion 2009-06-17 00:38:15 ----D---- C:\Program Files (x86)\Yahoo! 2009-06-17 00:38:13 ----D---- C:\Program Files (x86)\CCleaner 2009-06-16 16:11:19 ----D---- C:\Windows\1C4551A64743409391E41477CD655043.TMP 2009-06-12 17:09:09 ----A---- C:\Windows\system32\localspl.dll 2009-06-12 17:09:03 ----A---- C:\Windows\system32\rpcrt4.dll 2009-06-12 17:08:57 ----A---- C:\Windows\system32\mshtml.dll 2009-06-12 17:08:55 ----A---- C:\Windows\system32\iertutil.dll 2009-06-12 17:08:55 ----A---- C:\Windows\system32\ieframe.dll 2009-06-12 17:08:54 ----A---- C:\Windows\system32\wininet.dll 2009-06-12 17:08:54 ----A---- C:\Windows\system32\urlmon.dll 2009-06-12 17:08:54 ----A---- C:\Windows\system32\iedkcs32.dll 2009-06-12 17:08:53 ----A---- C:\Windows\system32\jsproxy.dll 2009-06-12 17:08:53 ----A---- C:\Windows\system32\ieui.dll 2009-06-12 17:08:53 ----A---- C:\Windows\system32\iesetup.dll 2009-06-12 17:08:53 ----A---- C:\Windows\system32\ie4uinit.exe 2009-06-12 17:08:52 ----A---- C:\Windows\system32\iernonce.dll 2009-06-10 06:00:54 ----A---- C:\Windows\system32\sbbd.exe 2009-06-07 13:18:14 ----D---- C:\Program Files (x86)\Microsoft Silverlight ======List of files/folders modified in the last 1 months====== 2009-06-27 15:28:42 ----D---- C:\Windows\Prefetch 2009-06-27 15:28:39 ----D---- C:\Windows\Temp 2009-06-27 14:43:41 ----D---- C:\Windows\System32 2009-06-27 14:43:40 ----D---- C:\Windows\inf 2009-06-27 00:00:05 ----SHD---- C:\System Volume Information 2009-06-25 01:07:50 ----A---- C:\Windows\dvdSanta.INI 2009-06-25 01:00:37 ----D---- C:\Program Files (x86)\dvdSanta 2009-06-25 01:00:37 ----D---- C:\dvdsanta 2009-06-24 20:58:33 ----SD---- C:\Windows\Downloaded Program Files 2009-06-24 20:26:06 ----SHD---- C:\Windows\Installer 2009-06-24 20:26:05 ----D---- C:\ProgramData\Adobe 2009-06-24 20:25:42 ----D---- C:\Program Files (x86)\Common Files\Adobe 2009-06-24 20:25:38 ----D---- C:\Program Files (x86)\Adobe 2009-06-24 20:24:32 ----D---- C:\Windows\SysWOW64 2009-06-24 20:21:43 ----D---- C:\Users\Administrator\AppData\Roaming\Adobe 2009-06-24 20:21:42 ----D---- C:\Program Files (x86)\Common Files 2009-06-24 20:19:28 ----RD---- C:\Program Files (x86) 2009-06-24 20:19:28 ----HD---- C:\ProgramData 2009-06-24 19:34:33 ----D---- C:\Windows\winsxs 2009-06-24 19:34:32 ----D---- C:\Program Files (x86)\Internet Explorer 2009-06-23 20:19:43 ----D---- C:\TempDVD 2009-06-21 00:17:31 ----D---- C:\Program Files (x86)\Java 2009-06-20 21:23:06 ----AD---- C:\Windows 2009-06-20 18:55:52 ----RD---- C:\Program Files 2009-06-20 18:38:18 ----SD---- C:\Users\Administrator\AppData\Roaming\Microsoft 2009-06-20 18:37:55 ----D---- C:\Program Files (x86)\honestech VHS to DVD 3.0 Deluxe 2009-06-17 19:23:41 ----A---- C:\Windows\win.ini 2009-06-17 14:51:15 ----D---- C:\Program Files (x86)\Common Files\Wise Installation Wizard 2009-06-17 13:33:16 ----D---- C:\Windows\rescache 2009-06-17 13:31:07 ----D---- C:\Windows\Microsoft.NET 2009-06-17 13:31:01 ----RSD---- C:\Windows\assembly 2009-06-17 13:20:34 ----D---- C:\ProgramData\NVIDIA 2009-06-17 13:18:47 ----SHD---- C:\Boot 2009-06-17 13:13:02 ----D---- C:\Program Files (x86)\Windows Sidebar 2009-06-17 13:13:02 ----D---- C:\Program Files (x86)\Windows Photo Gallery 2009-06-17 13:13:02 ----D---- C:\Program Files (x86)\Windows Media Player 2009-06-17 13:13:02 ----D---- C:\Program Files (x86)\Windows Mail 2009-06-17 13:13:02 ----D---- C:\Program Files (x86)\Windows Calendar 2009-06-17 13:13:02 ----D---- C:\Program Files (x86)\Common Files\System 2009-06-17 13:13:01 ----D---- C:\Windows\servicing 2009-06-17 13:13:01 ----D---- C:\Windows\ehome 2009-06-17 13:12:51 ----D---- C:\Windows\system32\XPSViewer 2009-06-17 13:12:51 ----D---- C:\Windows\system32\sk-SK 2009-06-17 13:12:51 ----D---- C:\Windows\system32\lv-LV 2009-06-17 13:12:51 ----D---- C:\Windows\system32\ko-KR 2009-06-17 13:12:51 ----D---- C:\Windows\system32\hr-HR 2009-06-17 13:12:51 ----D---- C:\Windows\system32\et-EE 2009-06-17 13:12:51 ----D---- C:\Windows\system32\en-US 2009-06-17 13:12:51 ----D---- C:\Windows\system32\da-DK 2009-06-17 13:12:50 ----D---- C:\Windows\system32\zh-TW 2009-06-17 13:12:50 ----D---- C:\Windows\system32\zh-CN 2009-06-17 13:12:50 ----D---- C:\Windows\system32\wbem 2009-06-17 13:12:50 ----D---- C:\Windows\system32\uk-UA 2009-06-17 13:12:50 ----D---- C:\Windows\system32\tr-TR 2009-06-17 13:12:50 ----D---- C:\Windows\system32\th-TH 2009-06-17 13:12:50 ----D---- C:\Windows\system32\sv-SE 2009-06-17 13:12:50 ----D---- C:\Windows\system32\sr-Latn-CS 2009-06-17 13:12:50 ----D---- C:\Windows\system32\SLUI 2009-06-17 13:12:50 ----D---- C:\Windows\system32\sl-SI 2009-06-17 13:12:50 ----D---- C:\Windows\system32\setup 2009-06-17 13:12:50 ----D---- C:\Windows\system32\ru-RU 2009-06-17 13:12:50 ----D---- C:\Windows\system32\ro-RO 2009-06-17 13:12:50 ----D---- C:\Windows\system32\pt-PT 2009-06-17 13:12:50 ----D---- C:\Windows\system32\pl-PL 2009-06-17 13:12:50 ----D---- C:\Windows\system32\oobe 2009-06-17 13:12:50 ----D---- C:\Windows\system32\migration 2009-06-17 13:12:50 ----D---- C:\Windows\system32\manifeststore 2009-06-17 13:12:50 ----D---- C:\Windows\system32\ja-JP 2009-06-17 13:12:50 ----D---- C:\Windows\system32\it-IT 2009-06-17 13:12:50 ----D---- C:\Windows\system32\hu-HU 2009-06-17 13:12:50 ----D---- C:\Windows\system32\he-IL 2009-06-17 13:12:50 ----D---- C:\Windows\system32\fr-FR 2009-06-17 13:12:50 ----D---- C:\Windows\system32\fi-FI 2009-06-17 13:12:50 ----D---- C:\Windows\system32\es-ES 2009-06-17 13:12:50 ----D---- C:\Windows\system32\en 2009-06-17 13:12:50 ----D---- C:\Windows\system32\el-GR 2009-06-17 13:12:50 ----D---- C:\Windows\system32\de-DE 2009-06-17 13:12:50 ----D---- C:\Windows\system32\cs-CZ 2009-06-17 13:12:50 ----D---- C:\Windows\system32\bg-BG 2009-06-17 13:12:50 ----D---- C:\Windows\system32\AdvancedInstallers 2009-06-17 13:12:49 ----D---- C:\Windows\system32\pt-BR 2009-06-17 13:12:49 ----D---- C:\Windows\system32\nl-NL 2009-06-17 13:12:49 ----D---- C:\Windows\system32\nb-NO 2009-06-17 13:12:49 ----D---- C:\Windows\system32\migwiz 2009-06-17 13:12:49 ----D---- C:\Windows\system32\lt-LT 2009-06-17 13:12:49 ----D---- C:\Windows\system32\ar-SA 2009-06-17 13:12:42 ----D---- C:\Windows\IME 2009-06-17 13:12:27 ----RSD---- C:\Windows\Fonts 2009-06-17 13:12:27 ----D---- C:\Windows\AppPatch 2009-06-17 11:24:21 ----D---- C:\Windows\PolicyDefinitions 2009-06-17 00:43:38 ----D---- C:\Windows\Debug 2009-06-17 00:40:40 ----D---- C:\Windows\system32\drivers 2009-06-16 18:33:34 ----D---- C:\Windows\Minidump 2009-06-14 01:42:29 ----D---- C:\Users\Administrator\AppData\Roaming\Ventrilo 2009-06-13 12:21:01 ----D---- C:\ProgramData\Xfire 2009-06-12 20:17:04 ----D---- C:\ProgramData\Microsoft Help 2009-06-03 21:30:00 ----D---- C:\Program Files (x86)\World of Warcraft 2009-06-02 20:06:11 ----D---- C:\Users\Administrator\AppData\Roaming\Xfire ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [] R1 sbtis;sbtis; C:\Windows\system32\drivers\sbtis.sys [] R2 pnarp;Pure Networks Device Discovery Driver; C:\Windows\system32\DRIVERS\pnarp.sys [] R2 purendis;Pure Networks Wireless Driver; C:\Windows\system32\DRIVERS\purendis.sys [] R2 sbapifs;sbapifs; C:\Windows\system32\DRIVERS\sbapifs.sys [] R3 AnyDVD;AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [2009-03-18 120768] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [] R3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [] R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys [] R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [] R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmfdx64.sys [] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [] R3 usbaudio;USB Audio Driver (WDM); C:\Windows\system32\drivers\usbaudio.sys [] R3 wanatw;WAN Miniport (ATW); C:\Windows\system32\DRIVERS\wanatw64.sys [] R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [] S1 SASDIFSV;SASDIFSV; \??\C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS [2009-05-26 9968] S1 SASKUTIL;SASKUTIL; \??\C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys [2009-05-26 72944] S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [] S3 dump_wmimmc;dump_wmimmc; \??\C:\Program Files (x86)\GamezEventos\GameGuard\dump_wmimmc.sys [] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [] S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [] S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [] S3 netr28ux;Linksys USB Wireless LAN Card Driver for Vista; C:\Windows\system32\DRIVERS\netr28ux.sys [] S3 NPPTNT2;NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [2005-01-04 4682] S3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [] S3 SASENUM;SASENUM; \??\C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS [2009-05-26 7408] S3 USB28xxBGA;USB2.0 VIDBOX NW03; C:\Windows\system32\DRIVERS\emBDA64.sys [] S3 USB28xxOEM;USB 28xx OEM Filter; C:\Windows\system32\DRIVERS\emOEM64.sys [] S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [] S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [] S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [] S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [] S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AOL ACS;AOL Connectivity Service; C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe [2006-10-23 46640] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-06-05 144712] R2 Bonjour Service;Bonjour Service; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2008-12-12 238888] R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [2008-09-08 726016] R2 LinksysUpdater;Linksys Updater; C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-05-08 204800] R2 nmservice;Pure Networks Platform Service; C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [2008-05-16 648504] R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [2008-09-08 221696] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [] R2 SBAMSvc;VIPRE Antivirus + Antispyware; C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMSvc.exe [2009-06-10 980264] R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2009-04-08 92008] S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-03-29 89920] S3 iPod Service;iPod Service; C:\Program Files (x86)\iPod\bin\iPodService.exe [2009-06-05 541992] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888] S3 npggsvc;nProtect GameGuard Service; C:\Windows\system32\GameMon.des [2009-02-23 2790138] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712] S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-20 19968] S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2009-01-17 316664] S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files (x86)\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328] S3 usprserv;User Privilege Service; C:\Windows\System32\svchost.exe [2008-01-20 21504] S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files (x86)\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240] -----------------EOF-----------------

SpySentinel View Member Profile	Jun 28 2009, 02:42 PM Post #15
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	Your log looks clean, Great Job Now for some cleanup.. Please download OTC and save it to Desktop. Please make sure you are connecting to the Internet Double-click OTC.exe Click the CleanUp! button. Select Yes when the "Begin cleanup Process?" prompt appears. If you are prompted to Reboot during the cleanup, select Yes *Set a New Restore Point to prevent possible reinfection* from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. Disabling System Restore WARNING: By disabling system restore you will delete all stored restore points and shadow copies of documents on your computer. To disable System Restore you would follow these steps: Click on the Start button to open Start Menu. Click on Control Panel Click on System and Maintenance Click on System Click on System Protection in the left-hand task list. Uncheck the checkboxes next to each hard drive listed under the Create restore points automatically on the selected disks: section. When you uncheck a disk you will be presented with the following screen. You should click on the Turn System Protection Off button. Press the Apply button and then the OK button. System Restore is now disabled. Enabling System Restore By default System Restore is enabled on Windows Vista. To enable System Restore: Click on the Start button Click on the Control Panel menu option. Click on System and Maintenance Click on System Click on System Protection in the left-hand task list. Put a checkmark in the checkboxes next to each hard drive listed under the Create restore points automatically on the selected disks: section. Press the Apply button and then the OK button. System Restore is now enabled again. Make your Internet Explorer more secure - This can be done by following these simple instructions: From within Internet Explorer click on the Tools menu and then click on Options. Click once on the Security tab Click once on the Internet icon so it becomes highlighted. Click once on the Custom Level button. Change the Download signed ActiveX controls to Prompt Change the Download unsigned ActiveX controls to Disable Change the Initialize and script ActiveX controls not marked as safe to Disable Change the Installation of desktop items to Prompt Change the Launching programs and files in an IFRAME to Prompt Change the Navigate sub-frames across different domains to Prompt When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Next press the Apply button and then the OK to exit the Internet Properties page. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly. No Firewall Onboard You don't seem to have a firewall program installed. Using a firewall will allow you to allow/deny access for applications that want to go online. Select one of these, or another of your choice: Online Armor Sunbelt Personal Firewall OutPost Firewall Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. Install SpywareGuard - SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. here are some additional utilities that will enhance your safety McAfee Site Advisor <= McAfee Site Advisor protects your browser against malicious sites and warns you when you go to one. MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here: Using Winpatrol to protect your computer from malicious software**

« Next Oldest · Infections Removal · Next Newest »

2 Pages

1 2 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies	Topic Starter	Views	Last Action
Infections Removal [Resolved] Need help removing re-generating virus/trojan 12	17	Granny Mouse	255	Today, 05:04 AM Last post by: CatByte
Infections Removal [Resolved] Computer Infected Please Help... 123» 8	118	Joecastle	1,281	Today, 05:03 AM Last post by: CatByte
Infections Removal [Resolved] mamapome.dll error message	10	Dancin' Homer	97	Today, 05:03 AM Last post by: CatByte
Infections Removal [Resolved] intermittent computer lockup 12	24	kayaref	307	Today, 05:01 AM Last post by: CatByte