[Resolved] Laptop sometimes hang on start up (page 2)

Tomk

Post #16February 20, 2009, 2:42 PM UTC

BennyLCB, Only part of the script ran. After we get you Kaspersky report, we will need to re-run part of the script.

BennyLCB

Post #17February 20, 2009, 2:45 PM UTC

ok no problem.. but very weird, but hving trouble running the combofix smoothly, is it normal? and im posting the kaperski report soon, updating its scanner database..

Tomk

Post #18February 20, 2009, 2:53 PM UTC

BennyLCB, I'm not really sure what you mean by smoothly. It does tend to zip along and then sort of hang and the zip along again. Is that what you mean?

BennyLCB

Post #19February 20, 2009, 2:56 PM UTC

no, sometimes it juz fails to initialize.. and need to reboot my laptop for it to run.. or smtimes its says my antivirus still on, but i've actually off it..

Tomk

Post #20February 20, 2009, 2:59 PM UTC

BennyLCB, When we run it again, I'll slip another directive into the script that might help. Hopefully we will only have to run it once more.

BennyLCB

Post #21February 21, 2009, 6:37 PM UTC

very sry, the kaspersky always need update? ytday i dc-ed half way updating.. and now again it needs to update.. and takes long time.. sry for slow kaspersky report ya..

Tomk

Post #22February 21, 2009, 8:37 PM UTC

BennyLCB,

Maybe the problem is with Kaspersky. Try this online scanner instead.

I need you to run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

BennyLCB

Post #23February 25, 2009, 7:56 PM UTC

i tried this scanner as well, but it doesnt seem to run, always stuck at update.. any other solution?

Tomk

Post #24February 25, 2009, 9:43 PM UTC

BennyLCB,

Let's try one more online scanner.

Run this online scan Click HERE to run Panda's ActiveScan

You need to use IE to run this scan
Once you are on the Panda site click the Scan your PC button
A new window will open…click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Click the big Scan Now button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on My Computer to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

In your next reply please post:
Panda ActiveScan report
new HijackThis log

BennyLCB

Post #25February 26, 2009, 8:14 PM UTC

finally an online scanner that works =) ;******************************************************************************* ********************************************************************************* ******************* ANALYSIS: 2009-02-23 04:12:14 PROTECTIONS: 1 MALWARE: 37 SUSPECTS: 0 ;******************************************************************************* ********************************************************************************* ******************* PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================= =================== AVG 7.5.552 7.5.552 Yes Yes ;=============================================================================== ================================================================================= =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================= =================== 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\user@doubleclick[1].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\user@atdmt[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\user@mediaplex[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\user@serving-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\User\Cookies\[removed]-sys[2].txt 00390584 W32/Gamania.gen Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000025.dll 00390584 W32/Gamania.gen Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000024.dll 00390584 W32/Gamania.gen Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000023.exe 00390584 W32/Gamania.gen Virus No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000035.cmd 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\1rfw8hjr.com.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\E\svdioajm.cmd.vir 00390584 W32/Gamania.gen Virus No 0 Yes No J:\SVDIOAJM.CMD 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\E\1rfw8hjr.com.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\ckvo1.dll.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\svdioajm.cmd.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\ckvo.exe.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\ckvo0.dll.vir 00390584 W32/Gamania.gen Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000030.cmd 00429440 W32/Lineage.KAJ.worm Virus/Trojan No 1 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\ckvo2.dll.vir 00429441 W32/Lineage.KAJ.worm Virus/Trojan No 1 Yes No E:\xlk9.com 00429441 W32/Lineage.KAJ.worm Virus/Trojan No 1 Yes No J:\XLK9.COM 00429441 W32/Lineage.KAJ.worm Virus/Trojan No 1 Yes No C:\Qoobox\Quarantine\C\xlk9.com.vir 00432608 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\autorun.inf.vir 00432608 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\autorun.inf.vir 00439042 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\xih9.cmd.vir 00439042 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000036.cmd 00439042 W32/Lineage.KAY.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\xih9.cmd.vir 00443985 W32/Lineage.KDD Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000033.cmd 00443985 W32/Lineage.KDD Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\nq0cq.cmd.vir 00444033 W32/Autorun.ALJ.worm Virus/Worm No 1 Yes No E:\whi.com 00444033 W32/Autorun.ALJ.worm Virus/Worm No 1 Yes No C:\whi.com 00445556 W32/Lineage.KDJ Virus No 0 Yes No C:\Qoobox\Quarantine\E\sq.com.vir 00445556 W32/Lineage.KDJ Virus No 0 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000034.com 00445556 W32/Lineage.KDJ Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000022.com 00445556 W32/Lineage.KDJ Virus No 0 Yes No C:\Qoobox\Quarantine\C\sq.com.vir 00531079 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\msqpdxrwallywq.dll.vir 00531079 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000002.dll 00531414 W32/Conficker.C.worm Virus/Worm No 1 Yes No J:\AUTORUN.INF 00532525 W32/Lineage.KJJ.worm Virus/Trojan No 1 Yes No J:\YB12J.CMD 00533404 W32/Lineage.KJT Virus No 1 Yes No J:\1SERTC.EXE 00534172 Rootkit/Conficker.C Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][03.tmp] 00534172 Rootkit/Conficker.C Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][04.tmp] 00534172 Rootkit/Conficker.C Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][01.tmp] 00534172 Rootkit/Conficker.C Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][02.tmp] 00534283 W32/Lineage.KJL Virus No 1 Yes No J:\NM3OSQ.BAT 00534496 W32/Conficker.C.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\[4]-[removed][cgnmgrks.dll] 00534496 W32/Conficker.C.worm Virus/Worm No 1 Yes No J:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\JWGKVSQ.VMX 00534932 W32/Lineage.KKA Virus/Worm No 1 Yes No J:\XCISVXL.COM 00551906 W32/Lineage.KLL Virus No 1 Yes No J:\IL0BYU3H.COM 00576598 W32/Lineage.KLS Virus No 0 Yes No J:\A2H2.COM 00585524 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000020.bat 00585524 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000031.bat 00585524 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No J:\1UTBFD.BAT 00585524 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\1utbfd.bat.vir 00585524 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\1utbfd.bat.vir 00586395 W32/Lineage.KNK.worm Virus/Worm No 1 Yes No J:\2AAXAIY.EXE 00586395 W32/Lineage.KNK.worm Virus/Worm No 1 Yes No E:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000032.exe 00586395 W32/Lineage.KNK.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000021.exe 00586395 W32/Lineage.KNK.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\E\2aaxaiy.exe.vir 00586395 W32/Lineage.KNK.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\C\2aaxaiy.exe.vir 00587511 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\[4]-[removed][opgde.exe] 00587511 W32/Lineage.KMF.worm Virus/Worm No 1 Yes No E:\opgde.exe 00589955 W32/Lineage.KMF Virus No 0 Yes No J:\OPGDE.EXE 00593436 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP3\A0001257.bat 00593436 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP4\A0001363.bat 00593436 W32/Autorun.AQG.worm Virus/Worm No 1 No No C:\Documents and Settings\User\Desktop\worknow.com[32788R22FWJFW\List.bat] 00593436 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP3\A0001191.bat 00593436 W32/Autorun.AQG.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP3\A0001056.bat 00594518 W32/Lineage.KFS Virus/Worm No 1 Yes No E:\ur0.com 00594518 W32/Lineage.KFS Virus/Worm No 1 Yes No C:\Qoobox\Quarantine\[4]-[removed][ur0.com] 00595867 W32/Lineage.KNS Virus No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][qphdin.com] 00595867 W32/Lineage.KNS Virus No 0 Yes No J:\QPHDIN.COM 00595867 W32/Lineage.KNS Virus No 0 Yes No E:\qphdin.com 00598764 W32/Lineage.KNV Virus No 0 Yes No E:\hyetn1i.exe 00598764 W32/Lineage.KNV Virus No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][hyetn1i.exe] 00602363 W32/Lineage.KNV.worm Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\nmdfgds0.dll.vir 00602363 W32/Lineage.KNV.worm Virus/Worm No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\nmdfgds1.dll.vir 00602363 W32/Lineage.KNV.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000026.dll 00602363 W32/Lineage.KNV.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000027.dll 00602372 W32/Lineage.KNV Virus No 0 Yes No C:\Qoobox\Quarantine\[4]-[removed][cv22.cmd] 00602372 W32/Lineage.KNV Virus No 0 Yes No E:\cv22.cmd 00602372 W32/Lineage.KNV Virus No 0 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\olhrwef.exe.vir 00602372 W32/Lineage.KNV Virus No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000028.exe 01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP4\A0001338.EXE 02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP4\A0001310.sys 02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP3\A0001282.sys 02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{CDC7DCBA-C0C5-4C4B-B2C4-A8C704604870}\RP0\A0000003.sys 02906154 Adware/AdsRevenue Adware No 0 Yes No C:\Documents and Settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00373[opr00373] 02906154 Adware/AdsRevenue Adware No 0 Yes No C:\Documents and Settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0037A[opr0037A] 02906154 Adware/AdsRevenue Adware No 0 Yes No C:\Documents and Settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0038F[opr0038F] 03931361 Generic Trojan Virus/Trojan No 0 No No E:\App\Witcobber_RM_to_AVI_MPEG_WMV_VCD_SVCD_DVD_Converter.rar[Witcobber RM to AVI MPEG WMV VCD SVCD DVD Converter\SuperRmtoAlKeygen.exe] ;=============================================================================== ================================================================================= =================== SUSPECTS Sent Location O ;=============================================================================== ================================================================================= =================== ;=============================================================================== ================================================================================= =================== VULNERABILITIES Id Severity Description O ;=============================================================================== ================================================================================= =================== 184380 MEDIUM MS08-002 O 184379 MEDIUM MS08-001 O 182048 HIGH MS07-069 O 182046 HIGH MS07-067 O 182043 HIGH MS07-064 O 179553 HIGH MS07-061 O 176382 HIGH MS07-057 O 176383 HIGH MS07-058 O 170911 HIGH MS07-050 O 170907 HIGH MS07-046 O 170906 HIGH MS07-045 O 170904 HIGH MS07-043 O 150243 HIGH MS07-008 O 126087 HIGH MS06-046 O 120825 MEDIUM MS06-032 O 120823 MEDIUM MS06-030 O 108743 MEDIUM MS06-007 O 93394 HIGH MS05-050 O 93454 MEDIUM MS05-049 O ;=============================================================================== ================================================================================= ===================

BennyLCB

Post #26February 26, 2009, 8:16 PM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:16:46 AM, on 2/23/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
E:\Program Files\QvodPlayer\QvodTerminal.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\User\LOCALS~1\Temp\RtkBtMnt.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
E:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENMY/SAOS01?FORM=TOOLBR
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - E:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ATI Tray Tools.lnk = E:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download with Star Downloader - C:\PROGRA~1\STARDO~1\sdie.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Qvod Terminal - Shenzhen QVOD Technology Co.,Ltd - E:\Program Files\QvodPlayer\QvodTerminal.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

–
End of file - 12837 bytes

Tomk

Post #27February 26, 2009, 9:13 PM UTC

BennyLCB,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

killall::

File::
J:\SVDIOAJM.CMD
E:\xlk9.com
J:\XLK9.COM
E:\whi.com
C:\whi.com
J:\YB12J.CMD
J:\1SERTC.EXE
J:\NM3OSQ.BAT
J:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\JWGKVSQ.VMX
J:\XCISVXL.COM
J:\IL0BYU3H.COM
J:\A2H2.COM
J:\1UTBFD.BAT
J:\2AAXAIY.EXE
E:\opgde.exe
J:\OPGDE.EXE
E:\ur0.com
J:\QPHDIN.COM
E:\qphdin.com
E:\hyetn1i.exe
E:\cv22.cmd
E:\App\Witcobber_RM_to_AVI_MPEG_WMV_VCD_SVCD_DVD_Converter.rar
c:\windows\system32\cgnmgrks.dll
C:\DOCUME~1\User\Desktop\5800\keygen for best reminder.rar
C:\DOCUME~1\User\Desktop\5800\Smartphoneware Best Reminder v1.0.S60v5.SymbianOS9.4.Incl Keygen-HSpda.rar
C:\DOCUME~1\User\Recent\keygen for best reminder.lnk
C:\DOCUME~1\User\Recent\Smartphoneware Best Reminder v1.0.S60v5.SymbianOS9.4.Incl Keygen-HSpda.lnk

Folder::
C:\Documents and Settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Also please give me a new HijackThis log.

BennyLCB

Post #28February 27, 2009, 3:38 AM UTC

ComboFix 09-02-17.02 - User 2009-02-23 4:31:19.12 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.88 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\worknow.com
Command switches used :: c:\docume~1\User\Desktop\CFScript.txt
AV: AVG 7.5.552 *On-access scanning enabled* (Updated)
* Created a new restore point

FILE ::
c:\docume~1\User\Desktop\5800\keygen for best reminder.rar
c:\docume~1\User\Desktop\5800\Smartphoneware Best Reminder v1.0.S60v5.SymbianOS9.4.Incl Keygen-HSpda.rar
c:\docume~1\User\Recent\keygen for best reminder.lnk
c:\docume~1\User\Recent\Smartphoneware Best Reminder v1.0.S60v5.SymbianOS9.4.Incl Keygen-HSpda.lnk
C:\whi.com
c:\windows\system32\cgnmgrks.dll
e:\app\Witcobber_RM_to_AVI_MPEG_WMV_VCD_SVCD_DVD_Converter.rar
E:\cv22.cmd
E:\hyetn1i.exe
E:\opgde.exe
E:\qphdin.com
E:\ur0.com
E:\whi.com
E:\xlk9.com
J:\1SERTC.EXE
J:\1UTBFD.BAT
J:\2AAXAIY.EXE
J:\A2H2.COM
J:\IL0BYU3H.COM
J:\NM3OSQ.BAT
J:\OPGDE.EXE
J:\QPHDIN.COM
j:\recycler\S-5-3-42-2819952290-8240758988-879315005-3665\JWGKVSQ.VMX
J:\SVDIOAJM.CMD
J:\XCISVXL.COM
J:\XLK9.COM
J:\YB12J.CMD
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\User\Desktop\5800\keygen for best reminder.rar
c:\docume~1\User\Desktop\5800\Smartphoneware Best Reminder v1.0.S60v5.SymbianOS9.4.Incl Keygen-HSpda.rar
c:\docume~1\User\Recent\keygen for best reminder.lnk
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\dcache4.url
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00022
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00026
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0002B
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0002C
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0002G
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0003F
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00043
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0004U
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0004X
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0009J
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr000BQ
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr000BR
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr000C0
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr000C4
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr000EV
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr000EX
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr000FO
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr000QT
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0012B
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0012M
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0017A
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr001DI
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0024I
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003N8
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003N9
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003OM
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003Q6
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003V2
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003V4
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003V7
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003V8
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003VA
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003VC
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003VD
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr003YC
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0043S
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0047H
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr004KM
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr004MI
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr004MJ
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr004TC
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0052B
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0054Q
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0055Z
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00560
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00561
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00562
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00563
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr005DS
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr005DU
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr005EX
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061C
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061D
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061E
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061G
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061I
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061K
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061L
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061M
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061N
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061O
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061P
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061Q
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061R
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061S
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061T
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061U
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061V
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061W
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061X
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0061Y
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00621
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00622
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0062A
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0062C
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0062D
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0062E
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0062K
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0062L
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0062W
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00638
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0063K
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0063N
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0063P
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0063R
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0063U
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0063Z
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00640
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00641
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00642
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00646
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00648
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064A
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064B
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064C
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064D
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064F
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064H
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064I
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064K
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064M
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064N
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064O
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064P
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064Q
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064R
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064S
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064T
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064V
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064W
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064X
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064Y
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0064Z
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00650
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00653
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00654
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00655
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00656
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00657
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00658
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00659
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065A
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065C
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065D
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065E
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065F
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065G
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065H
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065J
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065K
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065L
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0065Y
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00662
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00665
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00666
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066F
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066G
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066I
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066K
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066L
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066M
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066N
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066O
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066Q
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066R
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066T
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066V
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066W
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066X
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066Y
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0066Z
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00670
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00671
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00672
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00673
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00674
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00675
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00676
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00677
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00678
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067A
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067B
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067C
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067D
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067E
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067G
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067H
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067J
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067K
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067L
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067M
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067N
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067O
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067P
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067Q
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067R
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067S
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067T
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067U
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067W
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0067Z
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00681
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00682
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00683
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00689
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068B
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068C
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068E
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068H
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068K
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068M
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068O
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068P
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068S
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068T
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068W
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0068Z
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00690
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00695
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00697
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr00699
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0069C
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0069D
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0069G
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0069H
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0069J
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\opr0069K
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\revocation\dcache4.url
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\revocation\opr00002
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\revocation\opr00003
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\revocation\opr0001X
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\revocation\opr004E8
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\revocation\opr31F.tmp
c:\documents and settings\User\Local Settings\Application Data\Opera\Opera\profile\cache4\revocation\vlink4.dat
C:\whi.com
e:\app\Witcobber_RM_to_AVI_MPEG_WMV_VCD_SVCD_DVD_Converter.rar
E:\cv22.cmd
E:\hyetn1i.exe
E:\opgde.exe
E:\qphdin.com
E:\ur0.com
E:\whi.com
E:\xlk9.com

.
((((((((((((((((((((((((( Files Created from 2009-01-22 to 2009-02-22 )))))))))))))))))))))))))))))))
.

2009-02-23 04:53 . 2009-02-23 04:25 d——– c:\program files\EsetOnlineScanner
2009-02-23 04:50 . 2005-07-14 12:31 27,648 –a—— c:\windows\system32\AVSredirect.dll
2009-02-23 04:46 . 2008-06-19 16:24 28,544 –a—— c:\windows\system32\drivers\pavboot.sys
2009-02-23 04:45 . 2009-02-23 04:45 d——– c:\program files\Panda Security
2009-02-23 04:36 . 2006-10-26 19:56 32,592 –a—— c:\windows\system32\msonpmon.dll
2009-02-23 04:33 . 2009-02-23 04:33 d——– c:\program files\Microsoft Works
2009-02-23 04:29 . 2009-02-23 04:29 d——– c:\program files\Microsoft.NET
2009-02-23 04:23 . 2009-02-23 04:41 d——– c:\program files\Microsoft Visual Studio 8
2009-02-23 04:21 . 2009-02-23 04:44 d——– c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-20 20:47 . 2009-02-20 20:47 d——– c:\windows\Sun
2009-02-20 07:01 . 2009-02-20 07:00 410,984 –a—— c:\windows\system32\deploytk.dll
2009-02-20 07:01 . 2009-02-20 07:00 73,728 –a—— c:\windows\system32\javacpl.cpl
2009-02-20 07:00 . 2009-02-20 07:00 d——– c:\program files\Java
2009-02-19 23:48 . 2009-02-19 23:49 d——– C:\Rooter$
2009-02-15 11:08 . 2009-02-15 11:42 d——– C:\Download
2009-02-12 03:40 . 2009-02-13 12:31 d——– c:\program files\Star Downloader
2009-01-31 16:59 . 2009-01-31 17:09 d——– c:\program files\MAIET
2009-01-28 08:58 . 2009-02-20 11:41 d——– c:\program files\Garena
2009-01-28 08:58 . 2009-01-28 08:58 d——– c:\documents and settings\User\Application Data\InstallShield
2009-01-26 04:16 . 2009-01-26 04:16 d——– c:\program files\AviSynth 2.5
2009-01-22 18:23 . 2009-01-22 18:23 d——– c:\documents and settings\User\Application Data\Yahoo!
2009-01-22 18:23 . 2009-01-27 21:49 d——– c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-22 18:21 . 2009-01-22 18:23 d——– c:\program files\Yahoo!
2009-01-22 18:21 . 2009-01-22 18:25 d——– c:\documents and settings\All Users\Application Data\Yahoo!

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-22 21:04 ——— d—–w c:\documents and settings\User\Application Data\MegauploadToolbar
2009-02-22 20:32 ——— d—–w c:\program files\MSBuild
2009-02-22 20:18 ——— d—–w c:\documents and settings\User\Application Data\AVG7
2009-02-16 17:04 ——— d—–w c:\documents and settings\User\Application Data\Hoyle Casino
2009-02-11 02:19 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 02:19 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-01-28 16:59 ——— d—–w c:\program files\Valve
2009-01-28 11:54 ——— d—–w c:\documents and settings\User\Application Data\U3
2009-01-28 00:58 ——— d–h–w c:\program files\InstallShield Installation Information
2009-01-17 22:10 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2008-07-16 09:44 25,880 —-a-w c:\documents and settings\User\Application Data\GDIPFONTCACHEV1.DAT
2006-05-03 10:06 163,328 –sh–r c:\windows\system32\flvDX.dll
2007-02-21 11:47 31,232 –sh–r c:\windows\system32\msfDX.dll
2008-03-16 13:30 216,064 –sh–r c:\windows\system32\nbDX.dll
2008-03-06 11:41 16,384 –sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
2008-03-06 11:41 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2008-01-17 12:44 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008011720080118\index.dat
.

((((((((((((((((((((((((((((( SnapShot_2009-02-19_15.27.04.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-22 20:32:12 110,592 —-a-w c:\windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll
+ 2009-02-22 20:32:08 65,536 —-a-w c:\windows\assembly\GAC\dao\10.0.4504.0__31bf3856ad364e35\DAO.DLL
+ 2009-02-22 20:32:27 245,760 —-a-w c:\windows\assembly\GAC\EnvDTE\8.0.0.0__b03f5f7f11d50a3a\envdte.dll
+ 2009-02-22 20:32:22 135,168 —-a-w c:\windows\assembly\GAC\EnvDTE80\8.0.0.0__b03f5f7f11d50a3a\envdte80.dll
+ 2009-02-22 20:32:22 4,608 —-a-w c:\windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\extensibility.dll
+ 2009-02-22 20:32:07 1,215,328 —-a-w c:\windows\assembly\GAC\IACore\1.7.6223.0__31bf3856ad364e35\IACore.dll
+ 2009-02-22 20:32:07 82,784 —-a-w c:\windows\assembly\GAC\IALoader\1.7.6223.0__31bf3856ad364e35\IALoader.dll
+ 2009-02-22 20:31:57 31,560 —-a-w c:\windows\assembly\GAC\ipdmctrl\11.0.0.0__71e9bce111e9429c\IPDMCTRL.DLL
+ 2009-02-22 20:32:10 8,007,680 —-a-w c:\windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll
+ 2009-02-22 20:31:58 16,712 —-a-w c:\windows\assembly\GAC\Microsoft.Office.InfoPath.Permission\12.0.0.0__71e9bce111e9429c\Microsoft.Office.InfoPath.Permission.dll
+ 2009-02-22 20:29:28 80,696 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.Access.Dao\12.0.0.0__71e9bce111e9429c\Microsoft.Office.interop.access.dao.dll
+ 2009-02-22 20:30:30 1,612,592 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.Access\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Access.dll
+ 2009-02-22 20:30:30 1,276,720 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Excel.dll
+ 2009-02-22 20:30:31 150,320 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Graph.dll
+ 2009-02-22 20:32:00 404,296 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.SemiTrust.dll
+ 2009-02-22 20:30:34 88,896 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.InfoPath.Xml\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.Xml.dll
+ 2009-02-22 20:30:34 146,232 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.InfoPath\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.dll
+ 2009-02-22 20:31:35 17,208 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.OneNote.dll
+ 2009-02-22 20:30:32 920,376 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.Outlook\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Outlook.dll
+ 2009-02-22 20:30:32 35,648 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.OutlookViewCtl\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.OutlookViewCtl.dll
+ 2009-02-22 20:30:32 248,632 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.PowerPoint\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.PowerPoint.dll
+ 2009-02-22 20:30:33 232,248 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.Publisher\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Publisher.dll
+ 2009-02-22 20:30:31 20,280 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.SmartTag.dll
+ 2009-02-22 20:30:33 781,104 —-a-w c:\windows\assembly\GAC\Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Word.dll
+ 2009-02-22 20:32:09 13,312 —-a-w c:\windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll
+ 2009-02-22 20:30:31 371,496 —-a-w c:\windows\assembly\GAC\Microsoft.Vbe.Interop.Forms\11.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.Forms.dll
+ 2009-02-22 20:30:33 64,288 —-a-w c:\windows\assembly\GAC\Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll
+ 2009-02-22 20:32:39 69,632 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.CommandBars\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.CommandBars.dll
+ 2009-02-22 20:32:59 176,128 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.Debugger.Interop\8.0.1.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Debugger.Interop.dll
+ 2009-02-22 20:32:19 8,704 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.Designer.Interfaces\1.0.5000.0__b03f5f7f11d50a3a\microsoft.visualstudio.designer.interfaces.dll
+ 2009-02-22 20:33:01 118,784 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll
+ 2009-02-22 20:33:00 167,936 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.Shell.Interop.8.0\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.shell.interop.8.0.dll
+ 2009-02-22 20:33:01 249,856 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.Shell.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Interop.dll
+ 2009-02-22 20:33:01 57,344 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop.8.0\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.textmanager.interop.8.0.dll
+ 2009-02-22 20:33:02 114,688 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TextManager.Interop.dll
+ 2009-02-22 20:32:58 11,264 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.VSHelp\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.VSHelp.dll
+ 2009-02-22 20:32:58 8,704 —-a-w c:\windows\assembly\GAC\Microsoft.VisualStudio.VSHelp80\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.VSHelp80.dll
+ 2009-02-22 20:32:08 229,376 —-a-w c:\windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\MSCOMCTL.DLL
+ 2009-02-22 20:32:12 4,096 —-a-w c:\windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll
+ 2009-02-22 20:30:32 416,544 —-a-w c:\windows\assembly\GAC\office\12.0.0.0__71e9bce111e9429c\OFFICE.DLL
+ 2009-02-22 20:29:24 12,104 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Access\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Access.dll
+ 2009-02-22 20:29:31 12,096 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Excel.dll
+ 2009-02-22 20:30:45 12,096 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Graph.dll
+ 2009-02-22 20:32:01 12,616 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll
+ 2009-02-22 20:32:01 12,616 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.InfoPath\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.InfoPath.dll
+ 2009-02-22 20:31:41 12,104 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Outlook\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Outlook.dll
+ 2009-02-22 20:31:36 12,632 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll
+ 2009-02-22 20:31:41 12,112 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.PowerPoint\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll
+ 2009-02-22 20:31:52 12,104 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Publisher\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Publisher.dll
+ 2009-02-22 20:31:05 12,104 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll
+ 2009-02-22 20:31:55 12,096 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Word.dll
+ 2009-02-22 20:31:10 12,080 —-a-w c:\windows\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.dll
+ 2009-02-22 20:31:08 11,544 —-a-w c:\windows\assembly\GAC\Policy.11.0.office\12.0.0.0__71e9bce111e9429c\Policy.11.0.Office.dll
+ 2009-02-22 20:32:09 16,384 —-a-w c:\windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll
+ 2009-02-22 20:33:03 53,248 —-a-w c:\windows\assembly\GAC\VSLangProj\7.0.3300.0__b03f5f7f11d50a3a\VSLangProj.dll
+ 2009-02-22 20:33:02 19,968 —-a-w c:\windows\assembly\GAC\VSLangProj2\7.0.5000.0__b03f5f7f11d50a3a\VSLangProj2.dll
+ 2009-02-22 20:33:03 73,728 —-a-w c:\windows\assembly\GAC\VSLangProj80\8.0.0.0__b03f5f7f11d50a3a\VSLangProj80.dll
+ 2009-02-22 20:32:45 49,152 —-a-w c:\windows\assembly\GAC\VsWebSite.Interop\8.0.0.0__b03f5f7f11d50a3a\VsWebSite.Interop.dll
+ 2009-02-22 20:31:59 118,112 —-a-w c:\windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.Interop.dll
+ 2009-02-22 20:33:19 367,400 —-a-w c:\windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.InteropAdapter.dll
+ 2009-02-22 20:32:36 1,662,976 —-a-w c:\windows\assembly\GAC_32\mscorcfg\2.0.0.0__b03f5f7f11d50a3a\mscorcfg.dll
+ 2009-02-22 20:32:35 106,496 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Conversion\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.dll
+ 2009-02-22 20:32:52 69,632 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.MSXML\8.0.0.0__b03f5f7f11d50a3a\microsoft.msxml.dll
+ 2009-02-22 20:31:59 609,104 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.dll
+ 2009-02-22 20:31:58 43,840 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\12.0.0.0__71e9bce111e9429c\microsoft.office.infopath.formcontrol.dll
+ 2009-02-22 20:32:01 39,728 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\12.0.0.0__71e9bce111e9429c\Microsoft.Office.InfoPath.Vsta.dll
+ 2009-02-22 20:32:00 60,200 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.dll
+ 2009-02-22 20:32:15 733,184 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.CommonIDE\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.commonide.dll
+ 2009-02-22 20:32:18 106,496 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Configuration\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Configuration.dll
+ 2009-02-22 20:24:10 49,152 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.DebuggerVisualizers\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.DebuggerVisualizers.dll
+ 2009-02-22 20:32:20 434,176 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Design\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Design.dll
+ 2009-02-22 20:32:56 1,859,584 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Editors\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Editors.dll
+ 2009-02-22 20:32:58 24,576 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.HostingProcess.Utilities.Sync\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll
+ 2009-02-22 20:32:59 49,152 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.HostingProcess.Utilities\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.HostingProcess.Utilities.dll
+ 2009-02-22 20:32:34 32,768 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.ManagedInterfaces\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ManagedInterfaces.dll
+ 2009-02-22 20:32:20 344,064 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Package.LanguageService\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Package.LanguageService.dll
+ 2009-02-22 20:32:32 4,096 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.ProjectAggregator\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ProjectAggregator.dll
+ 2009-02-22 20:33:18 806,912 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Publish\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Publish.dll
+ 2009-02-22 20:32:22 249,856 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.Design\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Design.dll
+ 2009-02-22 20:32:31 376,832 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.dll
+ 2009-02-22 20:32:17 15,872 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.TemplateWizardInterface\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TemplateWizardInterface.dll
+ 2009-02-22 20:32:06 211,736 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Adapter.dll
+ 2009-02-22 20:32:06 105,248 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.AddInManager.dll
+ 2009-02-22 20:32:06 330,520 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Blueprints.dll
+ 2009-02-22 20:32:07 39,712 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll
+ 2009-02-22 20:32:07 39,704 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Contract.dll
+ 2009-02-22 20:32:06 72,472 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.DesignTime.dll
+ 2009-02-22 20:32:13 16,384 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.VSContentInstaller\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.VSContentInstaller.dll
+ 2009-02-22 20:32:20 360,448 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Windows.Forms\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Windows.Forms.dll
+ 2009-02-22 20:32:18 73,728 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.WizardFramework\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.WizardFramework.Dll
+ 2009-02-22 20:24:05 53,248 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Zip\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Zip.dll
+ 2009-02-22 20:32:21 294,912 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio\2.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.dll
+ 2009-02-22 20:32:54 4,202,496 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VSDesigner\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VSDesigner.dll
+ 2009-02-22 20:32:07 39,624 —-a-w c:\windows\assembly\GAC_MSIL\System.AddIn\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.dll
+ 2009-02-22 20:32:06 13,024 —-a-w c:\windows\assembly\GAC_MSIL\VSTADTEProvider.Interop\8.0.0.0__b03f5f7f11d50a3a\VSTADTEProvider.Interop.dll
- 2000-08-31 00:00:00 163,328 —-a-w c:\windows\erdnt\subs\ERDNT.EXE
+ 2005-10-20 12:02:28 163,328 —-a-w c:\windows\erdnt\subs\ERDNT.EXE
+ 2009-02-22 20:36:47 1,165,584 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-02-22 20:36:48 20,240 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-02-22 20:36:48 159,504 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-02-22 20:36:48 184,080 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2009-02-22 20:36:48 217,864 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2009-02-22 20:36:48 18,704 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-02-22 20:36:49 35,088 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-02-22 20:36:48 845,584 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-02-22 20:36:48 922,384 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-02-22 20:36:48 272,648 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-02-22 20:36:49 888,080 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-02-22 20:36:48 1,172,240 —-a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-02-22 20:44:15 217,864 —-a-r c:\windows\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
+ 2006-10-26 05:44:56 68,280 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\al.exe
+ 2006-10-26 05:45:00 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Conversion.dll
- 1999-10-17 11:01:42 1,129,232 —-a-w c:\windows\system32\FM20.DLL
+ 2006-10-26 06:10:08 1,190,688 —-a-w c:\windows\system32\FM20.DLL
- 1999-10-17 11:01:16 26,384 —-a-w c:\windows\system32\FM20ENU.DLL
+ 2006-10-26 06:10:06 33,088 —-a-w c:\windows\system32\FM20ENU.DLL
- 2008-10-20 05:49:08 123,728 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-22 20:11:20 276,560 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2006-10-26 05:45:04 207,360 —-a-w c:\windows\system32\INKED.DLL
+ 2009-02-19 23:00:56 144,792 —-a-w c:\windows\system32\java.exe
+ 2009-02-19 23:00:56 144,792 —-a-w c:\windows\system32\javaw.exe
+ 2009-02-19 23:00:56 148,888 —-a-w c:\windows\system32\javaws.exe
+ 2007-07-27 06:49:02 196,683 —-a-w c:\windows\system32\lnod32apiA.dll
+ 2007-07-27 06:49:02 225,355 —-a-w c:\windows\system32\lnod32apiW.dll
+ 2005-12-05 11:25:22 139,264 —-a-w c:\windows\system32\lnod32umc.dll
+ 2005-12-05 04:37:10 106,496 —-a-w c:\windows\system32\lnod32upd.dll
+ 2008-02-11 01:39:26 253,952 —-a-w c:\windows\system32\OnlineScannerDLLA.dll
+ 2008-02-11 01:39:18 237,568 —-a-w c:\windows\system32\OnlineScannerDLLW.dll
+ 2008-02-08 05:53:46 110,592 —-a-w c:\windows\system32\OnlineScannerLang.dll
+ 2008-02-05 00:48:04 77,824 —-a-w c:\windows\system32\OnlineScannerUninstaller.exe
- 2008-12-11 19:00:42 71,462 —-a-w c:\windows\system32\perfc009.dat
+ 2009-02-22 20:13:28 72,306 —-a-w c:\windows\system32\perfc009.dat
- 2008-12-11 19:00:42 441,692 —-a-w c:\windows\system32\perfh009.dat
+ 2009-02-22 20:13:28 444,596 —-a-w c:\windows\system32\perfh009.dat
+ 2006-10-26 11:56:16 864,080 —-a-w c:\windows\system32\spool\drivers\w32x86\3\msonpdrv.dll
+ 2006-10-26 11:56:14 67,408 —-a-w c:\windows\system32\spool\drivers\w32x86\3\msonpui.dll
+ 2006-10-26 11:56:16 864,080 —-a-w c:\windows\system32\spool\drivers\w32x86\msonpdrv.dll
+ 2006-10-26 11:56:14 67,408 —-a-w c:\windows\system32\spool\drivers\w32x86\msonpui.dll
+ 2006-10-26 11:56:12 33,104 —-a-w c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll
+ 2006-10-26 05:45:04 293,376 —-a-w c:\windows\system32\WISPTIS.EXE
+ 2009-02-22 20:11:33 16,384 —-atw c:\windows\temp\Perflib_Perfdata_370.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-01-18 486856]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2007-07-22 1694208]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-01-08 4363504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2007-07-22 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-11-30 225280]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]
"LogitechCameraAssistant"="c:\program files\Acer\OrbiCam\CameraAssistant.exe" [2005-11-29 438272]
"LogitechVideo[inspector]"="c:\program files\Acer\OrbiCam\InstallHelper.exe" [2005-11-29 14:51 73728]
"LogitechCameraService(E)"="c:\windows\system32\ElkCtrl.exe" [2004-11-01 262144]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2005-11-28 569413]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-10-18 590848]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-27 185896]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-20 148888]
"GrooveMonitor"="e:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"RTHDCPL"="RTHDCPL.EXE" [2005-12-19 c:\windows\RTHDCPL.exe]
"AtiPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-01-18 219136]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

c:\documents and settings\User\Start Menu\Programs\Startup\
ATI Tray Tools.lnk - e:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.exe [2008-01-01 570528]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-12-02 618557]
Microsoft Office.lnk - e:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.l3fhg"= mp3fhg.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"msacm.divxa32"= divxa32.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\DAP\\DAP.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"e:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
"c:\\ijji\\ENGLISH\\u_gunz.exe"=
"c:\\Program Files\\Ocean Technology\\GG E-Sports Platform\\Garena.exe"=
"c:\\ijji\\ENGLISH\\Gunz\\Gunz.exe"=
"e:\\Program Files\\QvodPlayer\\QvodTerminal.exe"=
"c:\\Program Files\\Counter-Strike\\cstrike.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23951:TCP"= 23951:TCP:BitComet 23951 TCP
"23951:UDP"= 23951:UDP:BitComet 23951 UDP
"12432:TCP"= 12432:TCP:BitComet 12432 TCP
"12432:UDP"= 12432:UDP:BitComet 12432 UDP
"23385:TCP"= 23385:TCP:BitComet 23385 TCP
"23385:UDP"= 23385:UDP:BitComet 23385 UDP
"9429:TCP"= 9429:TCP:BitComet 9429 TCP
"9429:UDP"= 9429:UDP:BitComet 9429 UDP
"38215:TCP"= 38215:TCP:*:Disabled:SolidNetworkManager
"38215:UDP"= 38215:UDP:*:Disabled:SolidNetworkManager
"41330:TCP"= 41330:TCP:*:Disabled:SolidNetworkManager
"41330:UDP"= 41330:UDP:*:Disabled:SolidNetworkManager
"31799:TCP"= 31799:TCP:*:Disabled:SolidNetworkManager
"31799:UDP"= 31799:UDP:*:Disabled:SolidNetworkManager
"16853:TCP"= 16853:TCP:NortonAV
"13227:TCP"= 13227:TCP:NortonAV
"13279:TCP"= 13279:TCP:NortonAV
"17629:TCP"= 17629:TCP:NortonAV
"18181:TCP"= 18181:TCP:NortonAV
"1:TCP"= 1:TCP:Bitcomet
"16973:TCP"= 16973:TCP:NortonAV
"13951:TCP"= 13951:TCP:NortonAV
"14895:TCP"= 14895:TCP:NortonAV
"16601:TCP"= 16601:TCP:NortonAV
"15531:TCP"= 15531:TCP:NortonAV
"13258:TCP"= 13258:TCP:NortonAV
"12225:TCP"= 12225:TCP:NortonAV
"16331:TCP"= 16331:TCP:NortonAV
"15813:TCP"= 15813:TCP:NortonAV
"16983:TCP"= 16983:TCP:NortonAV
"3876:TCP"= 3876:TCP:igcpxf

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-02-23 28544]
R1 atitray;atitray;e:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [2008-01-28 17952]
R2 Qvod Terminal;Qvod Terminal;e:\program files\QvodPlayer\QvodTerminal.exe [2008-12-11 499712]
R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [2008-01-17 1088896]
S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys –> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
S3 dump_wmimmc;dump_wmimmc;\??\e:\runup_my\Luna\GameGuard\dump_wmimmc.sys –> e:\runup_my\Luna\GameGuard\dump_wmimmc.sys [?]
S3 XDva037;XDva037;\??\c:\windows\system32\XDva037.sys –> c:\windows\system32\XDva037.sys [?]
S3 XDva104;XDva104;\??\c:\windows\system32\XDva104.sys –> c:\windows\system32\XDva104.sys [?]
S3 XDva170;XDva170;\??\c:\windows\system32\XDva170.sys –> c:\windows\system32\XDva170.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-02-22 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 17:39]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
IE: &Clean; Traces - c:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download; with &DAP; - c:\program files\DAP\dapextie.htm
IE: &Windows; Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: Download &all; with DAP - c:\program files\DAP\dapextie2.htm
IE: Download with Star Downloader - c:\progra~1\STARDO~1\sdie.htm
IE: E&xport; to Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-23 04:17:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1409082233-1303643608-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1409082233-1303643608-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:73,62,4d,f4,25,e1,de,8b,65,c7,c1,1e,96,ce,3a,3f,ba,03,87,85,e5,7f,d4,
ec,a3,c9,dd,0e,c4,3a,ff,e9,fe,56,8c,1b,c0,ce,13,4c,ee,46,dd,af,9f,11,02,bb,\
"??"=hex:38,a8,d2,55,76,02,c1,cd,82,c5,05,9c,7c,de,e1,d1
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(944)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
———————— Other Running Processes ————————
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe
c:\progra~1\Grisoft\AVG7\avgamsvr.exe
c:\progra~1\Grisoft\AVG7\avgupsvc.exe
c:\progra~1\Grisoft\AVG7\avgemc.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
c:\docume~1\User\LOCALS~1\temp\RtkBtMnt.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2009-02-23 4:22:47 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-22 20:22:43
ComboFix2.txt 2009-02-19 22:07:21
ComboFix3.txt 2009-02-19 15:57:58
ComboFix4.txt 2008-11-03 15:18:54
ComboFix5.txt 2009-02-22 20:23:11

Pre-Run: 9,002,602,496 bytes free
Post-Run: 9,082,040,320 bytes free

654

Tomk

Post #29February 27, 2009, 4:07 AM UTC

BennyLCB, What is your J: drive?

BennyLCB

Post #30February 27, 2009, 9:54 AM UTC

Mr,Tomk, im not sure too.. i dont have a J drive in my com.. C and D.. dont know wher it came from.. but hope its not smthg important.. lol

[Resolved] Laptop sometimes hang on start up

✨ Ask AI

Ask AI