Spyware / Malware / Virus Removal

[Resolved] Spyware Issues

79 min read

Looking for the outcome? Ask AI

Tomk

Post #16April 5, 2009, 9:13 PM UTC

ajones,

Can you delete the C:\Program Files\Comodo folder?

If you can, please do so.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::

Folder::
C:\5c53a17cf8b305426cbabac4fe
C:\e9e7b47f4d4a5cc2f3d0

RegLock::
[HKEY_USERS\S-1-5-21-1123561945-1897051121-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

ajones

Post #17April 6, 2009, 2:57 AM UTC last edited April 6, 2009, 2:58 AM UTC

Here's the ComboFix report(sorry about the delay but I didn't realize a second page was made until about 10 minutes ago). Also, I was about to delete the Comodo folder, but it only contained the BETA stuff from the last link you gave me.

ComboFix 09-04-03.01 - Owner 2009-04-05 21:46:54.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1535.991 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Outdated)
FW: COMODO Firewall Pro *enabled*
FW: Norton AntiVirus *enabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-05 21:44 . 2006-03-03 00:42 73,728 –a—— C:\pv.exe
2009-04-05 21:43 . 2009-04-05 21:44 d——– C:\32788R22FWJFW
2009-04-05 14:45 . 2009-04-05 14:45 d——– c:\program files\Comodo
2009-04-05 04:02 . 2009-04-05 04:02 d——– C:\33a6f45267d2e985e33369e5
2009-04-05 04:01 . 2009-04-05 04:02 d——– C:\3160a59d7cd17ac74303
2009-03-21 15:44 . 2009-03-21 15:50 d——– c:\documents and settings\Owner\Application Data\FOG Downloader
2009-03-16 15:09 . 2009-03-20 15:29 d——– c:\documents and settings\Owner\Application Data\ArcSoft
2009-03-16 15:09 . 2009-03-17 15:09 d——– c:\documents and settings\All Users\Application Data\ArcSoft
2009-03-16 15:04 . 2006-11-10 15:05 18,688 –a—— c:\windows\system32\drivers\afc.sys
2009-03-16 15:03 . 2009-03-16 15:03 d——– c:\program files\Kodak
2009-03-16 15:03 . 2009-03-16 15:04 d——– c:\program files\Common Files\ArcSoft
2009-03-08 18:54 . 2009-03-08 18:54 528 -r-hs—- c:\windows\egirllic151
2009-03-06 17:51 . 2009-03-06 17:49 410,984 –a—— c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-05 20:19 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-05 20:01 ——— d—–w c:\documents and settings\All Users\Application Data\comodo
2009-04-05 19:00 ——— d—–w c:\program files\Microsoft SQL Server
2009-04-05 18:31 ——— d—–w c:\program files\Common Files\Symantec Shared
2009-04-05 18:29 ——— d—–w c:\documents and settings\All Users\Application Data\PC Tools
2009-04-05 18:16 ——— d—–w c:\documents and settings\All Users\Application Data\SecTaskMan
2009-04-05 18:01 ——— d–h–w c:\program files\InstallShield Installation Information
2009-04-05 02:08 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-04 18:19 ——— d—–w c:\program files\Warcraft III
2009-04-04 15:31 ——— d—–w c:\program files\Symantec
2009-04-04 15:30 806 -c–a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-04-04 15:30 60,808 —-a-w c:\windows\system32\S32EVNT1.DLL
2009-04-04 15:30 124,464 —-a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-04-04 15:30 10,635 -c–a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-04-04 15:18 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-04-04 05:41 ——— d—–w c:\program files\Microsoft Games
2009-04-02 01:24 ——— d—–w c:\program files\World of Warcraft
2009-03-26 21:49 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 21:49 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-25 06:35 ——— d—–w c:\documents and settings\Owner\Application Data\GetRightToGo
2009-03-25 04:45 34 -c–a-w c:\documents and settings\Owner\jagex_runescape_preferences.dat
2009-03-25 01:45 ——— d—–w c:\documents and settings\Owner\Application Data\U3
2009-03-07 02:16 ——— d—–w c:\documents and settings\Owner\Application Data\Skype
2009-03-07 01:59 ——— d—–w c:\documents and settings\Owner\Application Data\skypePM
2009-03-06 22:48 ——— d—–w c:\program files\Java
2009-02-24 04:04 12,608 —-a-w c:\windows\system32\drivers\TfKbMon.sys
2009-02-19 19:03 579,464 —-a-w c:\windows\system32\SymNeti.dll
2009-02-19 19:03 207,240 —-a-w c:\windows\system32\SymRedir.dll
2009-02-19 18:31 96,560 —-a-w c:\windows\system32\drivers\symfw.sys
2009-02-19 18:31 9,844 —-a-w c:\windows\system32\drivers\SymRedir.cat
2009-02-19 18:31 41,008 —-a-w c:\windows\system32\drivers\symndisv.sys
2009-02-19 18:31 38,576 —-a-w c:\windows\system32\drivers\symids.sys
2009-02-19 18:31 37,424 —-a-w c:\windows\system32\drivers\symndis.sys
2009-02-19 18:31 31,280 —-a-w c:\windows\system32\drivers\SymIM.sys
2009-02-19 18:31 22,320 —-a-w c:\windows\system32\drivers\symredrv.sys
2009-02-19 18:31 184,496 —-a-w c:\windows\system32\drivers\symtdi.sys
2009-02-19 18:31 13,616 —-a-w c:\windows\system32\drivers\symdns.sys
2009-02-19 18:31 1,611 —-a-w c:\windows\system32\drivers\SymRedir.inf
2009-02-09 10:19 1,846,272 —-a-w c:\windows\system32\win32k.sys
2008-02-25 00:58 32 -c–a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2007-01-31 12:31 3,044 -c–a-w c:\documents and settings\Owner\Application Data\wklnhst.dat
2007-01-19 14:06 58,584 -c–a-w c:\documents and settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="c:\progra~1\Nero\data\Xtras\mssysmgr.exe" [2005-02-25 212992]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2007-04-23 1114112]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2008-07-08 2828184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-19 925696]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-06 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-19 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-19 86016]
"GamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-02-14 380928]
"GameFace Messenger"="c:\program files\GameFace Messenger\GameFace.exe" [2006-11-01 2154496]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2008-02-07 718704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-11-20 178688]
"VTTrayp"="VTtrayp.exe" [2005-03-11 c:\windows\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 c:\windows\system32\HdAShCut.exe]
"nwiz"="nwiz.exe" [2007-04-19 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Documents and Settings\\Owner\\Desktop\\Pokemon MMORPG\\Pokemon Game.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Documents and Settings\\Owner\\Desktop\\RoM_Downloader.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-06 101936]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys –> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys –> c:\windows\system32\drivers\TfSysMon.sys [?]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys –> c:\windows\system32\drivers\TfNetMon.sys [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - USNJSVC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\MI.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{07be2ad7-1265-11de-a105-00121771de70}]
\Shell\AutoRun\command - F:\MI.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aac27dd-bb3b-11dd-a0e4-0015f28791b4}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aac27de-bb3b-11dd-a0e4-0015f28791b4}]
\Shell\AutoRun\command - F:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21bacb4e-cd03-11dd-a0e8-0015f28791b4}]
\Shell\AutoRun\command - setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder

2009-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]

2009-04-02 c:\windows\Tasks\dfrg.job
- c:\windows\system32\dfrg.msc [2004-08-04 07:00]

2009-04-05 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 07:00]

2009-03-30 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 09:05]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
TCP: {3826337C-E293-4786-A1C1-D5C35F7E50F3} = 24.196.64.53,68.115.71.53
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\
FF - prefs.js: network.proxy.type - 2
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-05 21:51:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-05 21:55:09
ComboFix-quarantined-files.txt 2009-04-06 02:54:02
ComboFix2.txt 2009-04-04 04:37:16
ComboFix3.txt 2008-11-15 16:38:41
ComboFix4.txt 2008-07-05 22:32:56

Pre-Run: 8,746,692,608 bytes free
Post-Run: 8,839,700,480 bytes free

186 — E O F — 2009-04-05 19:00:56

Tomk

Post #18April 6, 2009, 3:22 AM UTC

ajones,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
F:\MI.exe

Folder::
c:\program files\Comodo
c:\documents and settings\All Users\Application Data\comodo

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{07be2ad7-1265-11de-a105-00121771de70}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aac27dd-bb3b-11dd-a0e4-0015f28791b4}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aac27de-bb3b-11dd-a0e4-0015f28791b4}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21bacb4e-cd03-11dd-a0e8-0015f28791b4}]

dirlook::
C:\33a6f45267d2e985e33369e5
C:\3160a59d7cd17ac74303

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

ajones

Post #19April 6, 2009, 3:41 AM UTC

Here's the next ComboFix report:

ComboFix 09-04-03.01 - Owner 2009-04-05 22:29:52.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1535.916 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Outdated)
FW: COMODO Firewall Pro *enabled*
FW: Norton AntiVirus *enabled*
* Created a new restore point

FILE ::
F:\MI.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\comodo
c:\documents and settings\All Users\Application Data\comodo\common\Pending\PendingList.txt

.
((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-05 04:02 . 2009-04-05 04:02 d——– C:\33a6f45267d2e985e33369e5
2009-04-05 04:01 . 2009-04-05 04:02 d——– C:\3160a59d7cd17ac74303
2009-03-21 15:44 . 2009-03-21 15:50 d——– c:\documents and settings\Owner\Application Data\FOG Downloader
2009-03-16 15:09 . 2009-03-20 15:29 d——– c:\documents and settings\Owner\Application Data\ArcSoft
2009-03-16 15:09 . 2009-03-17 15:09 d——– c:\documents and settings\All Users\Application Data\ArcSoft
2009-03-16 15:04 . 2006-11-10 15:05 18,688 –a—— c:\windows\system32\drivers\afc.sys
2009-03-16 15:03 . 2009-03-16 15:03 d——– c:\program files\Kodak
2009-03-16 15:03 . 2009-03-16 15:04 d——– c:\program files\Common Files\ArcSoft
2009-03-08 18:54 . 2009-03-08 18:54 528 -r-hs—- c:\windows\egirllic151
2009-03-06 17:51 . 2009-03-06 17:49 410,984 –a—— c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-05 20:19 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-05 19:00 ——— d—–w c:\program files\Microsoft SQL Server
2009-04-05 18:31 ——— d—–w c:\program files\Common Files\Symantec Shared
2009-04-05 18:29 ——— d—–w c:\documents and settings\All Users\Application Data\PC Tools
2009-04-05 18:16 ——— d—–w c:\documents and settings\All Users\Application Data\SecTaskMan
2009-04-05 18:01 ——— d–h–w c:\program files\InstallShield Installation Information
2009-04-05 02:08 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-04 18:19 ——— d—–w c:\program files\Warcraft III
2009-04-04 15:31 ——— d—–w c:\program files\Symantec
2009-04-04 15:30 806 -c–a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-04-04 15:30 60,808 —-a-w c:\windows\system32\S32EVNT1.DLL
2009-04-04 15:30 124,464 —-a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-04-04 15:30 10,635 -c–a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-04-04 15:18 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-04-04 05:41 ——— d—–w c:\program files\Microsoft Games
2009-04-02 01:24 ——— d—–w c:\program files\World of Warcraft
2009-03-26 21:49 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 21:49 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-25 06:35 ——— d—–w c:\documents and settings\Owner\Application Data\GetRightToGo
2009-03-25 04:45 34 -c–a-w c:\documents and settings\Owner\jagex_runescape_preferences.dat
2009-03-25 01:45 ——— d—–w c:\documents and settings\Owner\Application Data\U3
2009-03-07 02:16 ——— d—–w c:\documents and settings\Owner\Application Data\Skype
2009-03-07 01:59 ——— d—–w c:\documents and settings\Owner\Application Data\skypePM
2009-03-06 22:48 ——— d—–w c:\program files\Java
2009-02-24 04:04 12,608 —-a-w c:\windows\system32\drivers\TfKbMon.sys
2009-02-19 19:03 579,464 —-a-w c:\windows\system32\SymNeti.dll
2009-02-19 19:03 207,240 —-a-w c:\windows\system32\SymRedir.dll
2009-02-19 18:31 96,560 —-a-w c:\windows\system32\drivers\symfw.sys
2009-02-19 18:31 9,844 —-a-w c:\windows\system32\drivers\SymRedir.cat
2009-02-19 18:31 41,008 —-a-w c:\windows\system32\drivers\symndisv.sys
2009-02-19 18:31 38,576 —-a-w c:\windows\system32\drivers\symids.sys
2009-02-19 18:31 37,424 —-a-w c:\windows\system32\drivers\symndis.sys
2009-02-19 18:31 31,280 —-a-w c:\windows\system32\drivers\SymIM.sys
2009-02-19 18:31 22,320 —-a-w c:\windows\system32\drivers\symredrv.sys
2009-02-19 18:31 184,496 —-a-w c:\windows\system32\drivers\symtdi.sys
2009-02-19 18:31 13,616 —-a-w c:\windows\system32\drivers\symdns.sys
2009-02-19 18:31 1,611 —-a-w c:\windows\system32\drivers\SymRedir.inf
2009-02-09 10:19 1,846,272 —-a-w c:\windows\system32\win32k.sys
2008-02-25 00:58 32 -c–a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2007-01-31 12:31 3,044 -c–a-w c:\documents and settings\Owner\Application Data\wklnhst.dat
2007-01-19 14:06 58,584 -c–a-w c:\documents and settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

—- Directory of C:\3160a59d7cd17ac7430 —-

c:\3160a59d7cd17ac7430\

—- Directory of C:\33a6f45267d2e985e33369e5 —-

2008-11-25 21:37 5543424 –a—— c:\33a6f45267d2e985e33369e5\setup\sqlrun.msi
2008-11-25 21:35 6643712 –a—— c:\33a6f45267d2e985e33369e5\setup\sqlrun_sql.msi
2008-11-25 21:35 5182976 –a—— c:\33a6f45267d2e985e33369e5\setup\sqlrun_tools.msi
2008-11-25 21:35 2650 –a—— c:\33a6f45267d2e985e33369e5\setup\sqlrun_sql.ini
2008-11-25 21:23 9269248 –a—— c:\33a6f45267d2e985e33369e5\setup\sqlsupport.msi
2008-11-25 21:23 3615744 –a—— c:\33a6f45267d2e985e33369e5\setup\sqlncli.msi
2008-11-25 21:23 1306112 –a—— c:\33a6f45267d2e985e33369e5\setup\sqlwriter.msi
2008-11-25 17:15 6583808 –a—— c:\33a6f45267d2e985e33369e5\setup\sqlncli_x64.msi
2008-11-25 17:15 3295232 –a—— c:\33a6f45267d2e985e33369e5\setup\sqlwriter_x64.msi
2008-11-24 23:26 99168 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\replsync.dll
2008-11-24 23:26 895840 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.sqlenum.dll
2008-11-24 23:26 895840 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.sqlenum.dll
2008-11-24 23:26 867680 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\msxmlsql.dll
2008-11-24 23:26 783712 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\replrec.dll
2008-11-24 23:26 75616 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\microsoft.sqlserver.mgdsqldumper.dll
2008-11-24 23:26 68448 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.regsvrenum.dll
2008-11-24 23:26 68448 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.regsvrenum.dll
2008-11-24 23:26 642912 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\rdistcom.dll
2008-11-24 23:26 56672 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\odsole70.dll
2008-11-24 23:26 555872 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.rmo.dll
2008-11-24 23:26 555872 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.rmo.dll
2008-11-24 23:26 552288 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\replprov.dll
2008-11-24 23:26 543584 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft.net\adomd.net\microsoft.analysisservices.adomdclient.dll
2008-11-24 23:26 543584 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft.net\adomd.net\90\microsoft.analysisservices.adomdclient.dll
2008-11-24 23:26 51552 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\osql.exe
2008-11-24 23:26 445280 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\microsoft.sqlsac.public.dll
2008-11-24 23:26 43872 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.wmienum.dll
2008-11-24 23:26 43872 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.wmienum.dll
2008-11-24 23:26 406368 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\replsub.dll
2008-11-24 23:26 39776 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.servicebrokerenum.dll
2008-11-24 23:26 39776 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.servicebrokerenum.dll
2008-11-24 23:26 360800 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.batchparser.dll
2008-11-24 23:26 35680 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.datawarehouse.interfaces.dll
2008-11-24 23:26 318816 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\replmerg.exe
2008-11-24 23:26 30048 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\mergetxt.dll
2008-11-24 23:26 270688 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\replisapi.dll
2008-11-24 23:26 220000 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.smoenum.dll
2008-11-24 23:26 220000 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.smoenum.dll
2008-11-24 23:26 21344 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\msasxpress.dll
2008-11-24 23:26 197984 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\msgprox.dll
2008-11-24 23:26 1625952 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.replication.dll
2008-11-24 23:26 1625952 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\microsoft.sqlserver.replication.dll
2008-11-24 23:26 1604448 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.smo.dll
2008-11-24 23:26 1604448 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.smo.dll
2008-11-24 23:26 154464 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.connectioninfo.dll
2008-11-24 23:26 154464 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.connectioninfo.dll
2008-11-24 23:26 138080 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.analysisservices.deploymentengine.dll
2008-11-24 23:26 133984 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\microsoft.netenterpriseservers.exceptionmessagebox.dll
2008-11-24 23:26 1215328 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.analysisservices.dll
2008-11-24 23:26 111968 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\replerrx.dll
2008-11-24 23:25 14688 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\isacctchange.dll
2008-11-24 23:14 66400 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\bcp.exe
2008-11-24 23:14 125280 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\batchparser90.dll
2008-11-24 23:14 125280 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\batchparser90.dll
2008-11-24 22:31 97120 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlwtsn.exe
2008-11-24 22:31 89952 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlsvcsync.dll
2008-11-24 22:31 88416 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\sqlwep.dll
2008-11-24 22:31 84832 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\tablediff.exe
2008-11-24 22:31 80736 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sac.exe
2008-11-24 22:31 76128 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlmaint.exe
2008-11-24 22:31 71008 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\xprepl.dll
2008-11-24 22:31 673120 –a—— c:\33a6f45267d2e985e33369e5\sqlcu.dll
2008-11-24 22:31 66912 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqldumper.exe
2008-11-24 22:31 65888 –a—— c:\33a6f45267d2e985e33369e5\setup\system\sqlctr90.dll
2008-11-24 22:31 611680 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\svrenumapi.dll
2008-11-24 22:31 54624 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\xpqueue.dll
2008-11-24 22:31 500064 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\sqlmanager.dll
2008-11-24 22:31 48992 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\xpadsi90.exe
2008-11-24 22:31 47456 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlboot.dll
2008-11-24 22:31 47456 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlboot.dll
2008-11-24 22:31 45408 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqladhlp90.exe
2008-11-24 22:31 40800 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\ssravg.dll
2008-11-24 22:31 40288 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\ssradd.dll
2008-11-24 22:31 38752 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\ssrmin.dll
2008-11-24 22:31 38752 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\ssrmax.dll
2008-11-24 22:31 38240 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\xplog70.dll
2008-11-24 22:31 348000 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlaccess.dll
2008-11-24 22:31 297824 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\xpstar90.dll
2008-11-24 22:31 29263712 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlservr.exe
2008-11-24 22:31 28000 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\ssrpub.dll
2008-11-24 22:31 26976 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\ssrup.dll
2008-11-24 22:31 26976 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\ssrdown.dll
2008-11-24 22:31 25440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlftacct.dll
2008-11-24 22:31 239968 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlbrowser.exe
2008-11-24 22:31 234848 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlmgmprovider.dll
2008-11-24 22:31 2151776 –a—— c:\33a6f45267d2e985e33369e5\setup.exe
2008-11-24 22:31 19808 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\xpsqlbot.dll
2008-11-24 22:31 193376 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\xmlsub.dll
2008-11-24 22:31 192352 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\sqlmergx.dll
2008-11-24 22:31 174944 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\spresolv.dll
2008-11-24 22:31 167264 –a—— c:\33a6f45267d2e985e33369e5\xmlrw.dll
2008-11-24 22:31 167264 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\xmlrw.dll
2008-11-24 22:31 167264 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\xmlrw.dll
2008-11-24 22:31 16224 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlsecacctchg.dll
2008-11-24 22:31 15200 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlos.dll
2008-11-24 22:31 146272 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\sqldistx.dll
2008-11-24 22:31 141664 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\sqlcmd.exe
2008-11-24 22:31 138080 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlsqm.exe
2008-11-24 22:31 1244000 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlsac.exe
2008-11-24 22:31 121696 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlprov.exe
2008-11-24 22:31 121184 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\xmlrwbin.dll
2008-11-24 22:31 1073504 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\sqldiag.exe
2008-11-24 22:31 105824 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlsvc90.dll
2008-11-24 22:31 105824 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\sqlsvc90.dll
2008-11-24 22:14 52576 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\resources\1033\sqldiag.rll
2008-11-24 22:14 282976 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\common files\microsoft shared\database replication\resources\1033\replres.rll
2008-11-24 22:14 282976 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\resources\1033\replres.rll
2008-11-24 22:14 24928 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\resources\1033\sqlcmd.rll
2008-11-24 22:14 203616 –a—— c:\33a6f45267d2e985e33369e5\setup.rll
2008-11-24 22:14 20320 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\res\1033\sqlmaint.rll
2008-11-24 22:14 1737568 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\res\1033\sqlevn70.rll
2008-11-24 22:14 152928 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\res\1033\xpstar90.rll
2008-11-24 22:14 145248 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\resources\1033\sqlmanager.rll
2008-11-24 21:56 68448 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\distrib.exe
2008-11-24 21:51 1037152 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\dbghelp.dll
2008-11-24 21:51 1037152 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\dbghelp.dll
2008-11-24 21:51 1037152 –a—— c:\33a6f45267d2e985e33369e5\dbghelp.dll
2008-11-24 14:27 524288 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\data\mssqlsystemresource1.ldf
2008-11-24 14:27 40304640 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\data\mssqlsystemresource1.mdf
2008-11-24 13:01 1221164 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\sqlagent90_msdb_upgrade.sql
2008-11-24 12:57 141098 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlwep-xp.mof
2008-11-24 12:56 49786 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlctr.ini
2008-11-24 12:56 10863 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlctr.h
2008-11-21 18:41 523372 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\sysdbupg.sql
2008-11-21 18:37 16346 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\eula\license_expr_enu.txt
2008-11-21 18:37 16346 –a—— c:\33a6f45267d2e985e33369e5\license.txt
2008-11-17 15:55 24691 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\resources\1033\sqlcm.xml
2008-11-17 14:50 2664960 –a—— c:\33a6f45267d2e985e33369e5\setup\msxml6_x64.msi
2008-10-25 08:47 32255 –a—— c:\33a6f45267d2e985e33369e5\template.ini
2008-10-25 08:45 921656 –a—— c:\33a6f45267d2e985e33369e5\setup\images\autorun_silver_bground.png
2008-10-25 08:45 411320 –a—— c:\33a6f45267d2e985e33369e5\setup\images\splash.bmp
2008-10-25 08:40 5565 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\failoveranalysis.sql
2008-10-25 08:40 124052 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\sysdbupg_uninstall.sql
2008-10-25 08:32 1521152 –a—— c:\33a6f45267d2e985e33369e5\setup\msxml6.msi
2008-10-25 08:30 89854 –a—— c:\33a6f45267d2e985e33369e5\readmesqlexp2005.htm
2008-10-25 08:30 82996 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\en\microsoft.sqlserver.replication.xml
2008-10-25 08:30 554428 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\en\microsoft.sqlserver.rmo.xml
2008-10-25 08:30 498705 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft.net\adomd.net\90\en\microsoft.analysisservices.adomdclient.xml
2008-10-25 08:30 49709 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\en\microsoft.sqlserver.smoenum.xml
2008-10-25 08:30 3728264 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\en\microsoft.sqlserver.smo.xml
2008-10-25 08:30 264382 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\en\microsoft.sqlserver.sqlenum.xml
2008-10-25 08:30 216618 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\resources\1033\cmptmgr9.chm
2008-10-25 08:30 20405 –a—— c:\33a6f45267d2e985e33369e5\requirementssqlexp2005.htm
2008-10-25 08:30 1682069 –a—— c:\33a6f45267d2e985e33369e5\setup\help\1033\setupsql9.chm
2008-10-25 08:30 15815 –a—— c:\33a6f45267d2e985e33369e5\1033\finish.rtf
2008-10-25 08:30 157200 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\en\microsoft.sqlserver.connectioninfo.xml
2008-08-11 11:49 4567040 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\80\tools\binn\sqldmo.dll
2005-10-14 02:53 57560 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\common files\microsoft shared\sql debugging\ssdebugps.dll
2005-10-14 02:50 50904 –a—— c:\33a6f45267d2e985e33369e5\setup\setupex.dll
2005-10-14 02:50 40664 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\semmap90.dll
2005-10-14 02:50 29912 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlscm90.dll
2005-10-14 02:50 29912 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\sqlscm90.dll
2005-10-14 02:49 19160 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlresld90.dll
2005-10-14 02:49 19160 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\sqlresld90.dll
2005-10-14 02:49 19160 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\sqlresld90.dll
2005-10-14 02:49 17624 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlresourceloader.dll
2005-10-14 02:49 17624 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\sqlresourceloader.dll
2005-10-14 02:48 201944 –a—— c:\33a6f45267d2e985e33369e5\sqlcu.rll
2005-10-14 02:47 16600 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\resources\1033\semmap90.rll
2005-10-14 02:46 9432 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\res\1033\sqlsvc90.rll
2005-10-14 02:46 9432 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\resources\1033\sqlsvc90.rll
2005-10-14 02:46 49880 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\resources\1033\msxmlsql.rll
2005-10-14 02:46 43736 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\microsoft.sqlserver.sqltdiagm.dll
2005-10-14 02:46 355032 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\80\tools\binn\msvcr71.dll
2005-10-14 02:46 11992 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\res\1033\xplog70.rll
2005-10-14 02:46 11992 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\resources\1033\sqladevn90.rll
2005-10-14 02:45 84696 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\msclusterlib.dll
2005-10-14 02:45 21208 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\opends60.dll
2005-10-14 02:45 20184 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.sqlserver.sstring.dll
2005-10-14 02:45 20184 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\gac\microsoft.sqlserver.sstring.dll
2005-10-14 02:44 18648 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\res\1033\odsole70.rll
2005-10-14 02:44 16600 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\resources\1033\bcp.rll
2005-10-14 02:44 15064 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\resources\1033\osql.rll
2005-10-14 02:44 12504 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\resources\1033\axscphst90.rll
2005-10-14 02:44 11992 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\resources\1033\sbevent.rll
2005-10-14 02:43 133848 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\microsoft.exceptionmessagebox.dll
2005-10-14 02:43 133848 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\microsoft.exceptionmessagebox.dll
2005-10-14 02:42 47832 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\microsoft.sqlserver.replication.businesslogicsupport.dll
2005-10-14 02:42 47832 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\microsoft.sqlserver.replication.businesslogicsupport.dll
2005-10-14 02:42 16600 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\microsoft.sqlserver.instapi.dll
2005-10-14 02:37 35032 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\instapi.dll
2005-10-14 02:37 35032 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\instapi.dll
2005-10-14 02:31 42712 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\axscphst90.dll
2005-10-14 02:31 40664 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\custsat.dll
2005-10-14 01:06 524288 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\data\msdblog.ldf
2005-10-14 01:06 524288 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\data\modellog.ldf
2005-10-14 01:06 524288 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\data\mastlog.ldf
2005-10-14 01:06 4653056 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\data\msdbdata.mdf
2005-10-14 01:06 4194304 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\data\master.mdf
2005-10-14 01:06 1245184 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\data\model.mdf
2005-10-13 23:41 23138 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlmgmproviderxpsp2up.mof
2005-10-13 23:41 22980 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\sqlmgmprovider.mof
2005-10-13 23:41 19942 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\resources\1033\sqlmgmprovider.mfl
2005-10-13 23:33 140306 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\binn\sqlwep-uni.mof
2005-10-13 23:26 626688 –a—— c:\33a6f45267d2e985e33369e5\msvcr80.dll
2005-10-13 23:26 548864 –a—— c:\33a6f45267d2e985e33369e5\msvcp80.dll
2005-10-13 23:25 14719 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\repl_master.sql
2005-09-29 18:14 585728 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\80\tools\binn\resources\1033\sqldmo.rll
2005-09-23 07:02 7447 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\policies\2ggml9qs.lm8\8.0.50727.42.cat
2005-09-23 07:02 7447 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3ggml9qs.lm8\8.0.50727.42.cat
2005-09-23 07:02 7441 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\z8ww3aes.lm8\8.0.50727.42.cat
2005-09-23 07:02 7441 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\policies\y8ww3aes.lm8\8.0.50727.42.cat
2005-09-23 07:02 7441 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\policies\67wtistq.lm8\8.0.50727.42.cat
2005-09-23 07:02 7441 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\policies\2kfkwlwq.lm8\8.0.50727.42.cat
2005-09-23 07:02 7441 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\77wtistq.lm8\8.0.50727.42.cat
2005-09-23 07:02 7441 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kfkwlwq.lm8\8.0.50727.42.cat
2005-09-23 07:02 7436 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\manifests\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.cat
2005-09-23 07:02 7436 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.cat
2005-09-23 07:02 7423 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\r6hpravq.lm8\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat
2005-09-23 07:02 7423 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\manifests\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.cat
2005-09-23 07:02 7423 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat
2005-09-23 07:02 7423 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\manifests\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat
2005-09-23 07:02 7423 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\jwfvlhtq.lm8\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat
2005-09-23 07:02 7423 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\bql1q2cs.lm8\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.cat
2005-09-23 07:01 2370 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\manifests\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.manifest
2005-09-23 07:01 2370 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\bql1q2cs.lm8\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.manifest
2005-09-23 07:01 1868 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\r6hpravq.lm8\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest
2005-09-23 07:01 1868 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest
2005-09-23 01:16 718 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\policies\2ggml9qs.lm8\8.0.50727.42.policy
2005-09-23 01:16 718 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3ggml9qs.lm8\8.0.50727.42.policy
2005-09-23 01:16 712 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\z8ww3aes.lm8\8.0.50727.42.policy
2005-09-23 01:16 712 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\policies\y8ww3aes.lm8\8.0.50727.42.policy
2005-09-23 01:16 69632 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\bql1q2cs.lm8\mfcm80.dll
2005-09-23 01:16 69632 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\9ql1q2cs.lm8\mfcm80.dll
2005-09-23 01:16 69632 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfcm80.dll
2005-09-23 01:16 57344 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\bql1q2cs.lm8\mfcm80u.dll
2005-09-23 01:16 57344 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\9ql1q2cs.lm8\mfcm80u.dll
2005-09-23 01:16 57344 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfcm80u.dll
2005-09-23 01:16 1238 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\manifests\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.manifest
2005-09-23 01:16 1238 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.manifest
2005-09-23 01:16 1093632 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\bql1q2cs.lm8\mfc80.dll
2005-09-23 01:16 1093632 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\9ql1q2cs.lm8\mfc80.dll
2005-09-23 01:16 1093632 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80.dll
2005-09-23 01:16 1079808 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\bql1q2cs.lm8\mfc80u.dll
2005-09-23 01:16 1079808 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\9ql1q2cs.lm8\mfc80u.dll
2005-09-23 01:16 1079808 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80u.dll
2005-09-23 00:58 65536 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\mfc80deu.dll
2005-09-23 00:58 65536 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\1kn09qps.lm8\mfc80deu.dll
2005-09-23 00:58 65536 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80deu.dll
2005-09-23 00:58 61440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\mfc80ita.dll
2005-09-23 00:58 61440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\mfc80fra.dll
2005-09-23 00:58 61440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\mfc80esp.dll
2005-09-23 00:58 61440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\1kn09qps.lm8\mfc80ita.dll
2005-09-23 00:58 61440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\1kn09qps.lm8\mfc80fra.dll
2005-09-23 00:58 61440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\1kn09qps.lm8\mfc80esp.dll
2005-09-23 00:58 61440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80ita.dll
2005-09-23 00:58 61440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80fra.dll
2005-09-23 00:58 61440 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80esp.dll
2005-09-23 00:58 57344 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\mfc80enu.dll
2005-09-23 00:58 57344 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\1kn09qps.lm8\mfc80enu.dll
2005-09-23 00:58 57344 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80enu.dll
2005-09-23 00:58 49152 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\mfc80kor.dll
2005-09-23 00:58 49152 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\mfc80jpn.dll
2005-09-23 00:58 49152 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\1kn09qps.lm8\mfc80kor.dll
2005-09-23 00:58 49152 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\1kn09qps.lm8\mfc80jpn.dll
2005-09-23 00:58 49152 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80kor.dll
2005-09-23 00:58 49152 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80jpn.dll
2005-09-23 00:58 45056 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\mfc80cht.dll
2005-09-23 00:58 45056 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\1kn09qps.lm8\mfc80cht.dll
2005-09-23 00:58 45056 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80cht.dll
2005-09-23 00:58 40960 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kn09qps.lm8\mfc80chs.dll
2005-09-23 00:58 40960 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\1kn09qps.lm8\mfc80chs.dll
2005-09-23 00:58 40960 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\mfc80chs.dll
2005-09-22 23:49 95744 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\jwfvlhtq.lm8\atl80.dll
2005-09-22 23:49 95744 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\hwfvlhtq.lm8\atl80.dll
2005-09-22 23:49 95744 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\atl80.dll
2005-09-22 23:49 712 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\policies\67wtistq.lm8\8.0.50727.42.policy
2005-09-22 23:49 712 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\77wtistq.lm8\8.0.50727.42.policy
2005-09-22 23:49 464 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\manifests\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest
2005-09-22 23:49 464 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\jwfvlhtq.lm8\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest
2005-09-22 23:48 712 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\policies\2kfkwlwq.lm8\8.0.50727.42.policy
2005-09-22 23:48 712 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\3kfkwlwq.lm8\8.0.50727.42.policy
2005-09-22 23:48 626688 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\r6hpravq.lm8\msvcr80.dll
2005-09-22 23:48 626688 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\p6hpravq.lm8\msvcr80.dll
2005-09-22 23:48 626688 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\msvcr80.dll
2005-09-22 23:48 548864 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\r6hpravq.lm8\msvcp80.dll
2005-09-22 23:48 548864 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\p6hpravq.lm8\msvcp80.dll
2005-09-22 23:48 548864 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\msvcp80.dll
2005-09-22 23:48 479232 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\r6hpravq.lm8\msvcm80.dll
2005-09-22 23:48 479232 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\winsxs\p6hpravq.lm8\msvcm80.dll
2005-09-22 23:48 479232 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\msvcm80.dll
2005-09-22 23:48 114688 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\windows\system32\ansi\atl80.dll
2005-09-22 00:11 35840 –a—— c:\33a6f45267d2e985e33369e5\setup\msde2000.msp
2005-09-22 00:11 31744 –a—— c:\33a6f45267d2e985e33369e5\setup\libertysql.msp
2005-09-18 17:33 522 –a—— c:\33a6f45267d2e985e33369e5\microsoft.vc80.crt.manifest
2005-09-15 00:08 1139896 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\instmsdb.sql
2005-08-11 00:11 4236 –a—— c:\33a6f45267d2e985e33369e5\splash.hta
2005-08-09 00:13 13933 –a—— c:\33a6f45267d2e985e33369e5\default.hta
2005-08-08 00:09 9062 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\transaction_logfile.ico
2005-08-08 00:09 9062 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\shared\mdf_ndf_dbfiles.ico
2005-08-08 00:09 12543 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\bulkload\format\bulkloadschema.xsd
2005-08-05 00:07 60399 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\07\showplan\showplanxml.xsd
2005-08-05 00:07 5441 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\07\queryprocessor\memorygrantschema.xsd
2005-08-04 00:16 50418 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\07\dta\dtaschema.xsd
2005-07-29 00:13 13314 –a—— c:\33a6f45267d2e985e33369e5\default.htm
2005-07-27 00:11 55296 –a—— c:\33a6f45267d2e985e33369e5\setup\system\sqlservermanager.msc
2005-07-27 00:11 2198 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\xpstar.sql
2005-07-27 00:10 31258 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\en\microsoft.exceptionmessagebox.xml
2005-07-18 00:10 20790 –a—— c:\33a6f45267d2e985e33369e5\setup\images\browse_cd.gif
2005-07-18 00:10 19347 –a—— c:\33a6f45267d2e985e33369e5\setup\images\sql_website.gif
2005-07-18 00:10 19347 –a—— c:\33a6f45267d2e985e33369e5\setup\images\newsgroup.gif
2005-07-18 00:10 18647 –a—— c:\33a6f45267d2e985e33369e5\setup\images\server.gif
2005-07-18 00:10 18463 –a—— c:\33a6f45267d2e985e33369e5\setup\images\release_notes.gif
2005-07-18 00:10 18463 –a—— c:\33a6f45267d2e985e33369e5\setup\images\license_agreement.gif
2005-07-18 00:10 17888 –a—— c:\33a6f45267d2e985e33369e5\setup\images\setup.gif
2005-07-13 00:12 4351 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\en\microsoft.sqlserver.servicebrokerenum.xml
2005-07-11 00:11 98 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\dbengine_hotfix_install.sql
2005-07-11 00:11 102 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\dbengine_hotfix_uninstall.sql
2005-07-07 23:36 12701 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\sqldmo.sql
2005-07-07 00:23 2844 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\web.sql
2005-06-27 13:53 84938 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\80\tools\binn\sqldmo80.cnt
2005-06-27 13:53 2101214 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\80\tools\binn\sqldmo80.hlp
2005-06-20 00:10 6709 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\procsyst.sql
2005-06-13 13:19 9062 –a—— c:\33a6f45267d2e985e33369e5\setup.ico
2005-06-13 13:19 54 –a—— c:\33a6f45267d2e985e33369e5\autorun.inf
2005-06-13 13:19 1406 –a—— c:\33a6f45267d2e985e33369e5\autorun.ico
2005-06-13 12:38 5924 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\oledbsch.sql
2005-06-13 12:38 36527 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\u_tables.sql
2005-06-13 12:35 68 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\x86\install\odsole.sql
2005-06-13 12:15 9553 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\soap\options\sqlsoapoptions.xsd
2005-06-13 12:15 9229 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\sqltypes\sqltypes.xsd
2005-06-13 12:15 4001 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\soap\types\sqlparameter\sqlparameter.xsd
2005-06-13 12:15 3103 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\soap\types\sqlresultstream\sqlresultstream.xsd
2005-06-13 12:15 2735 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\soap\types\sqlmessage\sqlmessage.xsd
2005-06-13 12:15 2430 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\soap\types\sqltransaction\sqltransaction.xsd
2005-06-13 12:15 2354 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\soap\types\sqlsoaptypes.xsd
2005-06-13 12:15 1987 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\tools\binn\schemas\sqlserver\2004\soap\types\sqlrowcount\sqlrowcount.xsd
2005-06-13 11:47 6363 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\sdk\assemblies\en\microsoft.sqlserver.wmienum.xml
2005-06-13 11:46 28080 –a—— c:\33a6f45267d2e985e33369e5\setup\program files\microsoft sql server\90\com\en\microsoft.sqlserver.replication.businesslogicsupport.xml

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="c:\progra~1\Nero\data\Xtras\mssysmgr.exe" [2005-02-25 212992]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2007-04-23 1114112]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2008-07-08 2828184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-19 925696]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-06 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-19 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-19 86016]
"GamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-02-14 380928]
"GameFace Messenger"="c:\program files\GameFace Messenger\GameFace.exe" [2006-11-01 2154496]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2008-02-07 718704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-11-20 178688]
"VTTrayp"="VTtrayp.exe" [2005-03-11 c:\windows\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 c:\windows\system32\HdAShCut.exe]
"nwiz"="nwiz.exe" [2007-04-19 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Documents and Settings\\Owner\\Desktop\\Pokemon MMORPG\\Pokemon Game.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Documents and Settings\\Owner\\Desktop\\RoM_Downloader.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-01-25 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-06 101936]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys –> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys –> c:\windows\system32\drivers\TfSysMon.sys [?]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys –> c:\windows\system32\drivers\TfNetMon.sys [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - USNJSVC
.
Contents of the 'Scheduled Tasks' folder

2009-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]

2009-04-02 c:\windows\Tasks\dfrg.job
- c:\windows\system32\dfrg.msc [2004-08-04 07:00]

2009-04-05 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 07:00]

2009-03-30 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job
- c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 09:05]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
TCP: {3826337C-E293-4786-A1C1-D5C35F7E50F3} = 24.196.64.53,68.115.71.53
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\0c4bchap.default\
FF - prefs.js: network.proxy.type - 2
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-05 22:31:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-05 22:34:26
ComboFix-quarantined-files.txt 2009-04-06 03:33:22
ComboFix2.txt 2009-04-06 02:55:11
ComboFix3.txt 2009-04-04 04:37:16
ComboFix4.txt 2008-11-15 16:38:41
ComboFix5.txt 2009-04-06 03:28:41

Pre-Run: 8,786,231,296 bytes free
Post-Run: 8,807,596,032 bytes free

514 — E O F — 2009-04-05 19:00:56

Tomk

Post #20April 6, 2009, 4:34 AM UTC

ajones,

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

ajones

Post #21April 6, 2009, 4:50 AM UTC

I have one quick question Tomk. If I am unable to remove the spyware by the night's end, should I unplug my internet or what should I do?

Tomk

Post #22April 6, 2009, 5:01 AM UTC

ajones, We've removed everything I'm seeing. Kaspersky may find something I can't see. It will take hours to run. If it comes back clean, we will do a little housekeeping and be done. If we find something, we will deal with it.

ajones

Post #23April 6, 2009, 5:21 AM UTC last edited April 6, 2009, 11:30 AM UTC

What about the folders that I found within my C: drive that I mentioned earlier underneath "33a6f45267d2e985e33369e5"? Those are eating up a bunch of space(unable to defrag my computer because I'm below the recommended 15%) and I am unable to remove them by conventional means. Anyways, after doing a scan from Kaspersky, there is nothing that was found infected. I attempted to open a report of it, but it only appeared to be blank.

Tomk

Post #24April 6, 2009, 12:36 PM UTC

ajones, Everything in folder c:\33a6f45267d2e985e33369e5 has to do with Microsoft sql server. You didn't get any report with Kaspersky? It's a good thing to get a report that says there were no infections found. But you shouldn't get just a blank screen. Are you certain that Kaspersky was finished?

ajones

Post #25April 6, 2009, 9:30 PM UTC

I was certain that Kaspersky did not give me a report, as I let it sit for 10 minutes(distracted by video games) and nothing came up at all. Window did not freeze because I was able to open a new tab to go to another website.

Tomk

Post #26April 6, 2009, 10:50 PM UTC

ajones, OK. Sometimes Kaspersky appears to hang for 20 to 30 minutes at at time, but if it completed, it completed. Please let me have a new HijackThis log and let me know how it's running.

ajones

Post #27April 7, 2009, 12:11 AM UTC

Here you are Tomk.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:11:28 PM, on 4/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [GameFace Messenger] C:\Program Files\GameFace Messenger\GameFace.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /S
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - http://www.symantec.com/techsupp/activedata/nprdtinf.cab
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online/testAc…OnlineGames.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1189867229531
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/67/install/gtdownls.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{3826337C-E293-4786-A1C1-D5C35F7E50F3}: NameServer = 24.196.64.53,68.115.71.53
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

–
End of file - 9320 bytes

Tomk

Post #28April 7, 2009, 1:20 AM UTC

ajones,

Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Please re-enable any security that was disabled.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

ajones

Post #29April 7, 2009, 2:14 AM UTC last edited April 7, 2009, 2:17 AM UTC

Thank you very much for helping me Tomk with this ordeal. I'm a little confused on what you mean by "The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing."

However, before this thread is closed, I'm wondering if there's any way for me to get help and/or advice from here to clean up my machine a bit(before March I was able to defrag my computer but now I cannot since the leftover space on my C: drive is at 10%(15% needed to run it)).

Tomk

Post #30April 7, 2009, 2:49 AM UTC

ajones,

The only way to get more room is to delete things. Microsoft SQL server is a large program and appears to be new in march.
2009-04-03 09:12 ——— d—–w c:\program files\Microsoft SQL Server. I've assumed that you need it or you wouldn't have installed it. You also have alot of space taken up by games such as WOW, Age of empires, Runescape, etc. If you have stuff on your computer you don't want or need, delete/uninstall it.

I would further suggest that you also read this tutorial on slow running computers
and Help! My computer is slow! by miekiemoes.

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.scr to run the tool.
When done, DDS.txt will open.
Click Yes at the next prompt for Optional Scan.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

I'll look over the log and see if I can come up with some suggestions.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Spyware Issues

✨ Ask AI

Ask AI