[Resolved] Computer Lag ? Not sure. Need help

Aton Topic Starter

Post #1July 19, 2009, 7:26 PM UTC last edited July 22, 2009, 11:16 PM UTC

For some reason there's an HTML Gen that's messing up my computer. It brings up all previous programs which makes it look like computer lag but idk what's going on. Whatever is doing it keeps crashing my computer. Here's the log.

EDIT: Computer Picked up what appears to be HTML/Malicious.PDF.Gen. Was located in my Local Settings as a .tmp file called acrF862.tmp

**When I close a program (minimize or close) I wait 5 seconds and I see the program pop up again like the computer is lagging but it's not actually there…

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:21:37 PM, on 7/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\program files\steam\steam.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\ooVoo\ooVoo.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
c:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\AstSrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Avira\AntiVir Desktop\avwsc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystart.com?pr=oovoo2_0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\dtx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: ooVoo Toolbar - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\dtx.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [oovoo.exe] C:\Program Files\ooVoo\ooVoo.exe /minimized
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINDOWS\system32\AstSrv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 10138 bytes

Tomk

Post #2July 22, 2009, 11:44 PM UTC

Hi Aton,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Aton

Post #3July 23, 2009, 1:23 PM UTC last edited July 23, 2009, 1:42 PM UTC

Still acting a lil bit haywire. Not sure what it is. Also, google sometimes reconnects to a website not even close to being what it should be.

Malwarebytes' Anti-Malware 1.36
Database version: 2046
Windows 5.1.2600 Service Pack 3

7/23/2009 9:21:09 AM
mbam-log-2009-07-23 (09-21-09).txt

Scan type: Full Scan (C:\|)
Objects scanned: 178817
Time elapsed: 31 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:23:38 AM, on 7/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\AstSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystart.com?pr=oovoo2_0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\dtx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: ooVoo Toolbar - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\dtx.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [oovoo.exe] C:\Program Files\ooVoo\ooVoo.exe /minimized
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINDOWS\system32\AstSrv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 9897 bytes

Tomk

Post #4July 23, 2009, 2:57 PM UTC

Aton,

Please download gmer.zip from Gmer and save it to your desktop.

Right click on gmer.zip and select Extract All….
Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
Click on the Browse button. Click on Desktop. Then click OK.
Click Next. It will start extracting.
Once done, check (tick) the Show extracted files box and click Finish.
Double click on gmer.exe to run it.
Select the Rootkit tab.
On the right hand side, check all the items to be scanned, but leave Show All box unchecked.
Select all drives that are connected to your system to be scanned.
Click on the Scan button.
When the scan is finished, click Copy to save the scan log to the Windows clipboard.
Open Notepad or a similar text editor.
Paste the clipboard contents into the text editor.
Save the Gmer scan log and post it in your next reply.

Note: Do not run any programs while Gmer is running.

Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Aton

Post #5July 23, 2009, 8:50 PM UTC

Everything

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-23 16:42:00
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.15 —-

Code 8A58AA50 ZwEnumerateKey
Code 8A58AB28 ZwFlushInstructionCache
Code 8A58746E ZwSaveKey
Code 8A588D3E ZwSaveKeyEx
Code 8A588FD6 IofCallDriver
Code 8A588C66 IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!IofCallDriver 804EF1A6 5 Bytes JMP 8A588FDB
.text ntkrnlpa.exe!IofCompleteRequest 804EF236 5 Bytes JMP 8A588C6B
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 805B6812 5 Bytes JMP 8A58AB2C
PAGE ntkrnlpa.exe!ZwEnumerateKey 80623FF0 5 Bytes JMP 8A58AA54
PAGE ntkrnlpa.exe!ZwSaveKey 80625264 5 Bytes JMP 8A587472
PAGE ntkrnlpa.exe!ZwSaveKeyEx 8062534A 5 Bytes JMP 8A588D42

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\iPod\bin\iPodService.exe[344] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0071000A
.text C:\WINDOWS\Explorer.EXE[456] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00B5000A
.text C:\WINDOWS\Explorer.EXE[456] USER32.dll!GetCursor 7E42A91B 5 Bytes JMP 02551080 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\WINDOWS\Explorer.EXE[456] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 02551120 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\WINDOWS\Explorer.EXE[456] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 02551030 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[680] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003F000A
.text C:\WINDOWS\system32\winlogon.exe[700] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0066000A
.text C:\WINDOWS\system32\services.exe[748] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003A000A
.text C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe[892] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00AA000A
.text C:\WINDOWS\system32\Ati2evxx.exe[972] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0099000A
.text …
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[1776] USER32.dll!GetCursor 7E42A91B 5 Bytes JMP 01831080 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[1776] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 01831120 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[1776] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 01831030 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\Logitech\QuickCam\Quickcam.exe[1792] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0110000A
.text C:\WINDOWS\system32\ctfmon.exe[1852] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00BE000A
.text C:\Program Files\CursorXP\CursorXP.exe[1860] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0094000A
.text C:\Program Files\AIM6\aim6.exe[1896] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00C0000A
.text C:\Program Files\AIM6\aim6.exe[1896] USER32.dll!GetCursor 7E42A91B 5 Bytes JMP 02521080 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\AIM6\aim6.exe[1896] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 02521120 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\AIM6\aim6.exe[1896] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 02521030 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\WINDOWS\system32\AstSrv.exe[1924] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 006E000A
.text C:\Program Files\RocketDock\RocketDock.exe[1932] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003D000A
.text C:\Program Files\RocketDock\RocketDock.exe[1932] USER32.dll!GetCursor 7E42A91B 5 Bytes JMP 01A01080 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\RocketDock\RocketDock.exe[1932] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 01A01120 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\RocketDock\RocketDock.exe[1932] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 01A01030 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\ooVoo\ooVoo.exe[1960] USER32.dll!GetCursor 7E42A91B 5 Bytes JMP 037C1080 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\ooVoo\ooVoo.exe[1960] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 037C1120 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\ooVoo\ooVoo.exe[1960] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 037C1030 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[1976] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003E000A
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2104] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003E000A
.text C:\Program Files\Digital Line Detect\DLG.exe[2176] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00E6000A
.text c:\Program Files\Microsoft IntelliPoint\dpupdchk.exe[2324] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003E000A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2632] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0069000A
.text …
.text C:\Program Files\Mozilla Firefox\firefox.exe[3352] USER32.dll!GetCursor 7E42A91B 5 Bytes JMP 01B21080 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\Mozilla Firefox\firefox.exe[3352] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 01B21120 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\Mozilla Firefox\firefox.exe[3352] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 01B21030 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\AIM6\aolsoftware.exe[3400] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003A000A
.text C:\Documents and Settings\Aton\Desktop\gmer\gmer.exe[3420] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003A000A
.text C:\Documents and Settings\Aton\Desktop\gmer\gmer.exe[3420] USER32.dll!GetCursor 7E42A91B 5 Bytes JMP 01061080 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Documents and Settings\Aton\Desktop\gmer\gmer.exe[3420] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 01061120 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Documents and Settings\Aton\Desktop\gmer\gmer.exe[3420] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 01061030 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\WINDOWS\system32\wuauclt.exe[3936] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003C000A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3948] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 003E000A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3948] USER32.dll!GetCursor 7E42A91B 5 Bytes JMP 05251080 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3948] USER32.dll!DrawIconEx 7E42CB84 5 Bytes JMP 05251120 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3948] USER32.dll!GetIconInfo 7E42D427 5 Bytes JMP 05251030 C:\Program Files\CursorXP\CurXP0.dll (CursorXP control panel/ )

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\WINDOWS\Explorer.EXE[456] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [01B02F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[456] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [01B02C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[456] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [01B02CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[456] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [01B02CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[1792] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [03082F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[1792] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [03082C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[1792] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [03082CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Logitech\QuickCam\Quickcam.exe[1792] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [03082CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [01DF2F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [01DF2C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [01DF2CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [01DF2CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\MSVCRT.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\MSVCRT.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[1896] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [00561FE0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [00561E40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [00561E40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [00561E40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [00561FE0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [00561E40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [00561FE0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [00561E40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [00561F10] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [00561FE0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [00561E40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!SetFocus] [0053EA40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [00561E40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [00561FE0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [00561F10] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!SetFocus] [0053EA40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetScrollInfo] [0053E500] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!SetScrollInfo] [0053E610] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetScrollPos] [0053E560] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [00561E40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [00561FE0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [00561F10] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!SetFocus] [0053EA40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [00561E40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [00561FE0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\WININET.dll [USER32.dll!SetFocus] [0053EA40] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [005620B0] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\ooVoo\ooVoo.exe[1960] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [00561D70] C:\Program Files\ooVoo\ooVoo.exe (ooVoo/ooVoo)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\MSVCRT.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\MSVCRT.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[3400] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\iPod\bin\iPodService.exe [344] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [456] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\System32\alg.exe [668] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Avira\AntiVir Desktop\avguard.exe [680] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [700] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\services.exe [748] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [760] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe [892] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\Ati2evxx.exe [972] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\stsystra.exe [1052] 0x00960000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1068] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [1168] 0x003F0000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Dell\Media Experience\DMXLauncher.exe [1192] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\System32\DLA\DLACTRLW.EXE [1204] 0x00920000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1220] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1276] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [1284] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\Ati2evxx.exe [1336] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [1356] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1436] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1456] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe [1472] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Microsoft IntelliPoint\ipoint.exe [1516] 0x003E0000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [1548] 0x00E00000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\spoolsv.exe [1640] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Avira\AntiVir Desktop\sched.exe [1688] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\RUNDLL32.EXE [1720] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1764] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [1776] 0x003F0000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Logitech\QuickCam\Quickcam.exe [1792] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\iTunes\iTunesHelper.exe [1836] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\ctfmon.exe [1852] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\CursorXP\CursorXP.exe [1860] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\AIM6\aim6.exe [1896] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\AstSrv.exe [1924] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\RocketDock\RocketDock.exe [1932] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\ooVoo\ooVoo.exe [1960] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1976] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2104] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Digital Line Detect\DLG.exe [2176] 0x00DC0000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2276] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ c:\Program Files\Microsoft IntelliPoint\dpupdchk.exe [2324] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Bonjour\mDNSResponder.exe [2408] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2632] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2796] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Java\jre6\bin\jqs.exe [2828] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe [2844] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2876] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\nvsvc32.exe [3076] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [3168] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\wuauclt.exe [3248] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\Mozilla Firefox\firefox.exe [3352] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\AIM6\aolsoftware.exe [3400] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Documents and Settings\Aton\Desktop\gmer\gmer.exe [3420] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\WINDOWS\system32\wuauclt.exe [3936] 0x10000000
Library \\?\globalroot\systemroot\system32\geyekrrqrdktqs.dll (*** hidden *** ) @ C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe [3948] 0x10000000

—- EOF - GMER 1.0.15 —-

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\aton\applic~1\mozilla\firefox\profiles\af3719sg.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=vmn&type=vdio5&p=
FF - plugin: c:\program files\mozilla firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-4-30 11608]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-4-30 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-4-30 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-4-30 55640]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\CAMTHWDM.sys [2009-4-22 1051136]

=============== Created Last 30 ================

2009-07-08 14:14 –d—– c:\program files\iPod
2009-07-08 14:14 –d—– c:\program files\iTunes
2009-07-08 14:14 –d—– c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-08 14:13 –d—– c:\program files\Bonjour

==================== Find3M ====================

2009-07-23 16:35 0 a——- c:\windows\system32\drivers\lvuvc.hs
2009-07-23 16:35 0 a——- c:\windows\system32\drivers\logiflt.iad
2009-07-16 22:00 34 a——- c:\documents and settings\aton\jagex_runescape_preferences.dat
2009-06-16 10:36 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a——- c:\windows\system32\fontsub.dll
2009-06-16 10:36 119,808 ——– c:\windows\system32\dllcache\t2embed.dll
2009-06-16 10:36 81,920 ——– c:\windows\system32\dllcache\fontsub.dll
2009-06-14 22:45 8,742 a——- c:\docume~1\aton\applic~1\wklnhst.dat
2009-06-03 15:09 1,291,264 a——- c:\windows\system32\quartz.dll
2009-06-03 15:09 1,291,264 ——– c:\windows\system32\dllcache\quartz.dll
2009-05-07 11:32 345,600 a——- c:\windows\system32\localspl.dll
2009-05-07 11:32 345,600 ——– c:\windows\system32\dllcache\localspl.dll
2009-04-29 00:56 827,392 a——- c:\windows\system32\wininet.dll
2009-04-29 00:56 827,392 a——- c:\windows\system32\dllcache\wininet.dll
2009-04-29 00:56 233,472 ——– c:\windows\system32\dllcache\webcheck.dll
2009-04-29 00:56 1,159,680 a——- c:\windows\system32\dllcache\urlmon.dll
2009-04-29 00:56 671,232 a——- c:\windows\system32\dllcache\mstime.dll
2009-04-29 00:56 44,544 a——- c:\windows\system32\dllcache\pngfilt.dll
2009-04-29 00:56 105,984 ——– c:\windows\system32\dllcache\url.dll
2009-04-29 00:56 102,912 ——– c:\windows\system32\dllcache\occache.dll
2009-04-29 00:56 3,596,288 a——- c:\windows\system32\dllcache\mshtml.dll
2009-04-29 00:56 477,696 a——- c:\windows\system32\dllcache\mshtmled.dll
2009-04-29 00:56 193,024 a——- c:\windows\system32\dllcache\msrating.dll
2009-04-28 18:25 389,120 a——- c:\windows\system32\CF26563.exe
2009-04-28 05:05 70,656 ——– c:\windows\system32\dllcache\ie4uinit.exe
2009-04-28 05:05 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe
2009-04-25 01:27 636,088 ——– c:\windows\system32\dllcache\iexplore.exe
2009-04-25 01:26 161,792 a——- c:\windows\system32\dllcache\ieakui.dll
2001-06-20 16:19 40,960 ac—— c:\program files\ACMonitor_X83.exe
2008-08-22 19:13 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082220080823\index.dat

============= FINISH: 16:46:08.57 ===============

Attachments:

📎Attach.txt

Tomk

Post #6July 23, 2009, 9:14 PM UTC

Aton,

That is only part of the DDS log but gmer tells the story here. You have a nasty rootkit. Luckily one of our tools has just been updated for this infection and hopefully will be able to deal with your variant.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Aton

Post #7July 23, 2009, 10:00 PM UTC

ComboFix 09-07-23.02 - Aton 07/23/2009 17:50.3.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2670 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\geyekrbqhxvrgv.sys
c:\windows\system32\geyekrrbtqjriu.dat
c:\windows\system32\geyekrrqrdktqs.dll
c:\windows\system32\geyekrwkdxlbbm.dat
c:\windows\system32\geyekrxuwbomtp.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_geyekrmltimpux

((((((((((((((((((((((((( Files Created from 2009-06-23 to 2009-07-23 )))))))))))))))))))))))))))))))
.

2009-07-08 18:14 . 2009-07-08 18:14 ——– d—–w- c:\program files\iPod
2009-07-08 18:14 . 2009-07-08 18:14 ——– d—–w- c:\program files\iTunes
2009-07-08 18:14 . 2009-07-08 18:14 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-08 18:13 . 2009-07-08 18:13 ——– d—–w- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-23 21:48 . 2009-04-22 02:47 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2009-07-23 21:48 . 2009-04-22 02:45 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2009-07-23 20:36 . 2008-04-06 18:28 ——– d—–w- c:\program files\Steam
2009-07-17 02:00 . 2008-07-01 13:14 34 —-a-w- c:\documents and settings\Aton\jagex_runescape_preferences.dat
2009-07-08 21:31 . 2009-01-08 19:59 ——– d—–w- c:\program files\World of Warcraft
2009-07-08 18:14 . 2007-12-22 01:11 ——– d—–w- c:\program files\Common Files\Apple
2009-07-08 18:12 . 2007-05-30 17:47 ——– d—–w- c:\program files\QuickTime
2009-06-24 03:37 . 2007-12-21 22:33 ——– d—–w- c:\documents and settings\Aton\Application Data\LimeWire
2009-06-16 14:36 . 2004-08-10 16:51 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-08-10 16:51 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-15 02:45 . 2007-06-10 01:37 8742 —-a-w- c:\documents and settings\Aton\Application Data\wklnhst.dat
2009-06-14 15:37 . 2007-06-25 00:09 ——– d—–w- c:\program files\mIRC
2009-06-07 12:16 . 2007-05-30 17:47 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Viewpoint
2009-06-03 19:09 . 2004-08-10 16:51 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-07 15:32 . 2004-08-10 16:51 345600 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-10 16:51 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-10 16:51 78336 —-a-w- c:\windows\system32\ieencode.dll
2001-06-20 20:19 . 2001-06-19 20:34 40960 -c–a-w- c:\program files\ACMonitor_X83.exe
2009-07-22 12:48 . 2009-04-10 13:20 134648 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-27_01.55.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 06:19 . 2007-11-07 06:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 62976 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 46080 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 46592 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 64512 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 66048 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 56832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 66560 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 39936 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 38912 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
+ 2009-07-23 21:49 . 2009-07-23 21:49 16384 c:\windows\Temp\Perflib_Perfdata_2ac.dat
+ 2007-06-30 17:55 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
- 2007-06-30 17:55 . 2007-11-30 12:39 17272 c:\windows\system32\spmsg.dll
+ 2009-05-02 20:59 . 2008-04-14 00:12 53760 c:\windows\system32\ReinstallBackups\0030\DriverFiles\i386\vfwwdm32.dll
+ 2009-05-02 20:59 . 2008-04-14 00:12 16896 c:\windows\system32\ReinstallBackups\0030\DriverFiles\i386\msyuv.dll
+ 2009-05-02 20:59 . 2008-04-14 00:11 47616 c:\windows\system32\ReinstallBackups\0030\DriverFiles\i386\iyuv_32.dll
+ 2009-05-02 20:54 . 2008-12-17 06:01 41752 c:\windows\system32\ReinstallBackups\0029\DriverFiles\LVUSBSta.sys
+ 2009-05-02 20:54 . 2008-04-14 00:12 53760 c:\windows\system32\ReinstallBackups\0029\DriverFiles\i386\vfwwdm32.dll
+ 2009-05-02 20:54 . 2008-04-14 00:12 16896 c:\windows\system32\ReinstallBackups\0029\DriverFiles\i386\msyuv.dll
+ 2009-05-02 20:54 . 2008-04-14 00:11 47616 c:\windows\system32\ReinstallBackups\0029\DriverFiles\i386\iyuv_32.dll
+ 2009-05-02 20:54 . 2008-07-26 15:26 41752 c:\windows\system32\ReinstallBackups\0028\DriverFiles\LVUSBSta.sys
+ 2009-05-02 20:54 . 2008-04-14 00:12 23552 c:\windows\system32\ReinstallBackups\0028\DriverFiles\i386\wdmaud.drv
+ 2009-05-02 20:54 . 2008-04-13 18:45 60032 c:\windows\system32\ReinstallBackups\0028\DriverFiles\i386\USBAUDIO.sys
+ 2009-05-02 20:54 . 2008-04-13 18:45 49408 c:\windows\system32\ReinstallBackups\0028\DriverFiles\i386\stream.sys
+ 2009-05-02 20:54 . 2008-04-13 18:45 60160 c:\windows\system32\ReinstallBackups\0028\DriverFiles\i386\drmk.sys
+ 2009-05-02 20:54 . 2008-07-26 15:26 23832 c:\windows\system32\ReinstallBackups\0027\DriverFiles\lvuvcflt.sys
+ 2009-05-02 20:54 . 2008-04-13 18:45 32128 c:\windows\system32\ReinstallBackups\0027\DriverFiles\i386\usbccgp.sys
+ 2004-08-10 16:51 . 2009-04-29 04:56 44544 c:\windows\system32\pngfilt.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 44544 c:\windows\system32\pngfilt.dll
- 2006-11-08 01:03 . 2009-02-20 18:09 52224 c:\windows\system32\msfeedsbs.dll
+ 2006-11-08 01:03 . 2009-04-29 04:55 52224 c:\windows\system32\msfeedsbs.dll
+ 2008-06-28 15:14 . 2009-06-15 00:40 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
- 2008-06-28 15:14 . 2008-11-22 23:37 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2004-08-10 16:51 . 2009-04-29 04:55 27648 c:\windows\system32\jsproxy.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 27648 c:\windows\system32\jsproxy.dll
- 2006-11-07 07:26 . 2009-02-20 10:20 13824 c:\windows\system32\ieudinit.exe
+ 2006-11-07 07:26 . 2009-04-28 09:05 13824 c:\windows\system32\ieudinit.exe
+ 2004-08-10 16:51 . 2009-04-29 04:55 44544 c:\windows\system32\iernonce.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 44544 c:\windows\system32\iernonce.dll
- 2004-08-10 16:51 . 2009-02-20 10:20 70656 c:\windows\system32\ie4uinit.exe
+ 2004-08-10 16:51 . 2009-04-28 09:05 70656 c:\windows\system32\ie4uinit.exe
+ 2006-10-17 15:58 . 2009-04-29 04:55 63488 c:\windows\system32\icardie.dll
- 2006-10-17 15:58 . 2009-02-20 18:09 63488 c:\windows\system32\icardie.dll
+ 2009-07-08 18:10 . 2009-06-05 15:42 39424 c:\windows\system32\DRVSTORE\usbaapl_872A2434B7205D4BD84BBE53811BDCE15F347D5B\usbaapl.sys
+ 2009-07-08 18:10 . 2009-06-05 15:42 17408 c:\windows\system32\DRVSTORE\netaapl_F433E854B3FF3BEE74986FDE8E16A64162342BFF\netaapl.sys
+ 2009-05-02 20:54 . 2008-12-17 06:01 41752 c:\windows\system32\DRVSTORE\lvPRO5v_3494EAD41DC64D05E46AE15EF9CDDD2B02428AB3\LVUSBSta.sys
+ 2009-05-02 20:54 . 2008-12-17 06:01 41752 c:\windows\system32\DRVSTORE\lvPRO5s_9FC2121D88FC967CEF080BD575E14D11259C7669\LVUSBSta.sys
+ 2009-05-02 20:54 . 2008-12-17 06:00 66456 c:\windows\system32\DRVSTORE\lvPRO5s_9FC2121D88FC967CEF080BD575E14D11259C7669\lvselsus.sys
+ 2009-05-02 20:54 . 2008-12-17 06:02 23832 c:\windows\system32\DRVSTORE\lvPRO5c_E59B32AD8625D841BC7296DA66E465D57E9EA5E9\lvuvcflt.sys
+ 2009-05-02 20:54 . 2008-12-17 06:01 41752 c:\windows\system32\DRVSTORE\lvPEPI2v_64757B9EAE6D93AE33E6B1F663346906CC2D8A16\LVUSBSta.sys
+ 2009-05-02 20:54 . 2008-12-17 06:01 41752 c:\windows\system32\DRVSTORE\lvPEPI2s_C7E59535DB2D9328DFA15B65064636A46C5F0D63\LVUSBSta.sys
+ 2009-05-02 20:54 . 2008-12-17 05:53 13848 c:\windows\system32\DRVSTORE\lvPEPI2s_C7E59535DB2D9328DFA15B65064636A46C5F0D63\lv302af.sys
+ 2009-05-02 20:54 . 2008-12-17 06:01 41752 c:\windows\system32\DRVSTORE\lvELCHv_89D63E450CD00B62BAE1D53FC3B914A5EBF13271\LVUSBSta.sys
+ 2009-07-08 18:14 . 2009-03-19 20:32 23400 c:\windows\system32\DRVSTORE\GEARAspiWD_F475AF659D36685632E9BD97B57E9D9661FF3FFD\x86\GEARAspiWDM.sys
+ 2008-03-08 18:55 . 2009-06-11 01:46 28520 c:\windows\system32\drivers\ssmdrv.sys
- 2009-04-22 02:45 . 2008-07-26 15:26 23832 c:\windows\system32\drivers\lvuvcflt.sys
+ 2009-04-22 02:45 . 2008-12-17 06:02 23832 c:\windows\system32\drivers\lvuvcflt.sys
- 2009-04-22 02:46 . 2008-07-26 15:26 41752 c:\windows\system32\drivers\LVUSBSta.sys
+ 2009-04-22 02:46 . 2008-12-17 06:01 41752 c:\windows\system32\drivers\LVUSBSta.sys
- 2008-07-26 12:25 . 2008-07-26 12:25 25624 c:\windows\system32\drivers\LVPr2Mon.sys
+ 2008-12-17 01:58 . 2008-12-17 01:58 25624 c:\windows\system32\drivers\LVPr2Mon.sys
+ 2008-12-17 01:50 . 2008-12-17 01:50 13584 c:\windows\system32\drivers\iKeyLgFT.dll
+ 2008-01-29 16:01 . 2009-03-19 20:32 23400 c:\windows\system32\drivers\GEARAspiWDM.sys
+ 2009-04-30 20:29 . 2009-03-30 14:33 96104 c:\windows\system32\drivers\avipbb.sys
+ 2009-04-30 20:29 . 2009-02-13 16:29 22360 c:\windows\system32\drivers\avgntmgr.sys
+ 2009-04-30 20:29 . 2009-03-24 20:08 55640 c:\windows\system32\drivers\avgntflt.sys
+ 2009-04-30 20:29 . 2009-02-13 16:17 45416 c:\windows\system32\drivers\avgntdd.sys
+ 2008-12-12 15:11 . 2008-12-12 15:11 61440 c:\windows\system32\dnssd.dll
- 2008-08-29 14:53 . 2008-08-29 14:53 61440 c:\windows\system32\dnssd.dll
+ 2008-12-12 15:18 . 2008-12-12 15:18 87336 c:\windows\system32\dns-sd.exe
- 2008-08-29 15:18 . 2008-08-29 15:18 87336 c:\windows\system32\dns-sd.exe
+ 2007-05-30 17:37 . 2009-04-29 04:56 44544 c:\windows\system32\dllcache\pngfilt.dll
- 2007-05-30 17:37 . 2009-02-20 18:09 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2007-06-04 19:33 . 2009-04-29 04:55 52224 c:\windows\system32\dllcache\msfeedsbs.dll
- 2007-06-04 19:33 . 2009-02-20 18:09 52224 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2004-08-10 16:51 . 2009-04-29 04:55 27648 c:\windows\system32\dllcache\jsproxy.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 27648 c:\windows\system32\dllcache\jsproxy.dll
- 2007-06-04 19:33 . 2009-02-20 10:20 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2007-06-04 19:33 . 2009-04-28 09:05 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2004-08-10 16:51 . 2009-04-29 04:55 44544 c:\windows\system32\dllcache\iernonce.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 44544 c:\windows\system32\dllcache\iernonce.dll
- 2009-02-20 18:09 . 2009-02-20 18:09 78336 c:\windows\system32\dllcache\ieencode.dll
+ 2009-02-20 18:09 . 2009-04-29 04:55 78336 c:\windows\system32\dllcache\ieencode.dll
- 2006-11-07 07:26 . 2009-02-20 10:20 70656 c:\windows\system32\dllcache\ie4uinit.exe
+ 2006-11-07 07:26 . 2009-04-28 09:05 70656 c:\windows\system32\dllcache\ie4uinit.exe
+ 2007-08-20 10:04 . 2009-04-29 04:55 63488 c:\windows\system32\dllcache\icardie.dll
- 2007-08-20 10:04 . 2009-02-20 18:09 63488 c:\windows\system32\dllcache\icardie.dll
+ 2009-06-16 14:36 . 2009-06-16 14:36 81920 c:\windows\system32\dllcache\fontsub.dll
+ 2007-06-03 17:55 . 2009-07-23 20:35 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-06-03 17:55 . 2008-08-22 23:13 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-06-03 17:55 . 2008-08-22 23:13 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-06-03 17:55 . 2009-07-23 20:35 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-06-03 17:55 . 2009-07-23 20:35 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-06-03 17:55 . 2008-08-22 23:13 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2007-05-30 17:46 . 2007-05-30 17:46 72704 c:\windows\Installer\ac0d.msi
+ 2007-05-30 17:44 . 2007-05-30 17:44 55808 c:\windows\Installer\ac00.msi
+ 2008-11-23 20:04 . 2008-11-23 20:04 86528 c:\windows\Installer\1208580.msi
+ 2009-05-02 20:53 . 2009-05-02 20:53 57344 c:\windows\Installer\{937B232D-9776-471E-92BD-D424E514EF14}\QuickCamStartMenuS_65895B9BA1A04BCBAB7BF5673B44A0E4.exe
+ 2009-05-02 20:53 . 2009-05-02 20:53 57344 c:\windows\Installer\{937B232D-9776-471E-92BD-D424E514EF14}\QuickCamDesktopSho_C0678C37AA5341A4BE4781BAF94DE0CC.exe
+ 2009-05-02 20:53 . 2009-05-02 20:53 57344 c:\windows\Installer\{937B232D-9776-471E-92BD-D424E514EF14}\ARPPRODUCTICON.exe
+ 2009-07-08 18:13 . 2009-07-08 18:13 86016 c:\windows\Installer\{07287123-B8AC-41CE-8346-3D777245C35B}\PrntWzrdIco.exe
+ 2009-06-10 01:15 . 2009-02-20 18:09 44544 c:\windows\ie7updates\KB969897-IE7\pngfilt.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 52224 c:\windows\ie7updates\KB969897-IE7\msfeedsbs.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 27648 c:\windows\ie7updates\KB969897-IE7\jsproxy.dll
+ 2009-06-10 01:15 . 2009-02-20 10:20 13824 c:\windows\ie7updates\KB969897-IE7\ieudinit.exe
+ 2009-06-10 01:15 . 2009-02-20 18:09 44544 c:\windows\ie7updates\KB969897-IE7\iernonce.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 78336 c:\windows\ie7updates\KB969897-IE7\ieencode.dll
+ 2009-06-10 01:15 . 2009-02-20 10:20 70656 c:\windows\ie7updates\KB969897-IE7\ie4uinit.exe
+ 2009-06-10 01:15 . 2009-02-20 18:09 63488 c:\windows\ie7updates\KB969897-IE7\icardie.dll
+ 2009-07-17 01:59 . 2009-07-17 01:59 49152 c:\windows\.jagex_cache_32\runescape\jagmisc.dll
+ 2009-07-17 01:59 . 2009-07-17 01:59 81920 c:\windows\.jagex_cache_32\runescape\jaggl.dll
+ 2009-06-10 01:16 . 2007-11-30 12:39 26488 c:\windows\$hf_mig$\KB970238\update\spcustom.dll
+ 2009-06-10 01:16 . 2007-11-30 12:39 17272 c:\windows\$hf_mig$\KB970238\spmsg.dll
+ 2009-06-10 01:17 . 2007-11-30 12:39 26488 c:\windows\$hf_mig$\KB969898\update\spcustom.dll
+ 2009-06-10 01:17 . 2007-11-30 12:39 17272 c:\windows\$hf_mig$\KB969898\spmsg.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 26488 c:\windows\$hf_mig$\KB969897-IE7\update\spcustom.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 17272 c:\windows\$hf_mig$\KB969897-IE7\spmsg.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 44544 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\pngfilt.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 52224 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\msfeedsbs.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 27648 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\jsproxy.dll
+ 2009-04-28 09:56 . 2009-04-28 09:56 13824 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\ieudinit.exe
+ 2009-04-29 04:49 . 2009-04-29 04:49 44544 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\iernonce.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 78336 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\ieencode.dll
+ 2009-04-28 09:56 . 2009-04-28 09:56 70656 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\ie4uinit.exe
+ 2009-04-29 04:49 . 2009-04-29 04:49 63488 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\icardie.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 26488 c:\windows\$hf_mig$\KB968537\update\spcustom.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 17272 c:\windows\$hf_mig$\KB968537\spmsg.dll
+ 2009-06-10 01:17 . 2008-07-09 07:38 26488 c:\windows\$hf_mig$\KB961501\update\spcustom.dll
+ 2009-06-10 01:17 . 2008-07-09 07:38 17272 c:\windows\$hf_mig$\KB961501\spmsg.dll
+ 2009-05-02 20:59 . 2001-08-18 02:36 8192 c:\windows\system32\ReinstallBackups\0030\DriverFiles\i386\tsbyuv.dll
+ 2009-05-02 20:59 . 2008-04-14 00:11 4096 c:\windows\system32\ReinstallBackups\0030\DriverFiles\i386\ksuser.dll
+ 2009-05-02 20:54 . 2001-08-18 02:36 8192 c:\windows\system32\ReinstallBackups\0029\DriverFiles\i386\tsbyuv.dll
+ 2009-05-02 20:54 . 2008-04-14 00:11 4096 c:\windows\system32\ReinstallBackups\0029\DriverFiles\i386\ksuser.dll
+ 2009-05-02 20:54 . 2008-04-14 00:11 4096 c:\windows\system32\ReinstallBackups\0028\DriverFiles\i386\ksuser.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 572928 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
+ 2008-07-29 07:54 . 2008-07-29 07:54 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 161784 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
+ 2009-04-22 02:47 . 2008-12-17 06:02 145944 c:\windows\twain_32\QuickCam\lvWIAext.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 233472 c:\windows\system32\webcheck.dll
+ 2004-08-10 16:51 . 2009-04-29 04:56 233472 c:\windows\system32\webcheck.dll
+ 2004-08-10 16:51 . 2009-04-29 04:56 105984 c:\windows\system32\url.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 105984 c:\windows\system32\url.dll
+ 2004-08-10 16:51 . 2009-04-15 14:51 585216 c:\windows\system32\rpcrt4.dll
+ 2009-05-02 20:59 . 2008-04-14 00:12 294912 c:\windows\system32\ReinstallBackups\0030\DriverFiles\i386\msh263.drv
+ 2009-05-02 20:59 . 2008-04-13 19:16 141056 c:\windows\system32\ReinstallBackups\0030\DriverFiles\i386\ks.sys
+ 2009-05-02 20:54 . 2008-12-17 05:51 443664 c:\windows\system32\ReinstallBackups\0029\DriverFiles\WUApp32.exe
+ 2009-05-02 20:54 . 2008-12-17 06:02 145944 c:\windows\system32\ReinstallBackups\0029\DriverFiles\lvWIAext.dll
+ 2009-05-02 20:54 . 2008-12-17 06:01 432664 c:\windows\system32\ReinstallBackups\0029\DriverFiles\LVUI2RC.dll
+ 2009-05-02 20:54 . 2008-12-17 06:00 494104 c:\windows\system32\ReinstallBackups\0029\DriverFiles\LVUI2.dll
+ 2009-05-02 20:54 . 2008-07-26 15:23 195096 c:\windows\system32\ReinstallBackups\0029\DriverFiles\lvcoinst.dll
+ 2009-05-02 20:54 . 2008-12-17 05:55 416280 c:\windows\system32\ReinstallBackups\0029\DriverFiles\lvcodec2.dll
+ 2009-05-02 20:54 . 2008-04-14 00:12 294912 c:\windows\system32\ReinstallBackups\0029\DriverFiles\i386\msh263.drv
+ 2009-05-02 20:54 . 2008-04-13 19:16 141056 c:\windows\system32\ReinstallBackups\0029\DriverFiles\i386\ks.sys
+ 2009-05-02 20:54 . 2008-07-26 15:29 439568 c:\windows\system32\ReinstallBackups\0028\DriverFiles\WUApp32.exe
+ 2009-05-02 20:54 . 2008-07-26 15:25 627864 c:\windows\system32\ReinstallBackups\0028\DriverFiles\lvrs.sys
+ 2009-05-02 20:54 . 2008-07-26 15:23 195096 c:\windows\system32\ReinstallBackups\0028\DriverFiles\lvcoinst.dll
+ 2009-05-02 20:54 . 2008-04-13 19:19 146048 c:\windows\system32\ReinstallBackups\0028\DriverFiles\i386\portcls.sys
+ 2009-05-02 20:54 . 2008-04-13 19:16 141056 c:\windows\system32\ReinstallBackups\0028\DriverFiles\i386\ks.sys
+ 2004-08-10 16:51 . 2009-04-29 04:56 102912 c:\windows\system32\occache.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 102912 c:\windows\system32\occache.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 671232 c:\windows\system32\mstime.dll
+ 2004-08-10 16:51 . 2009-04-29 04:56 671232 c:\windows\system32\mstime.dll
+ 2004-08-10 16:51 . 2009-04-29 04:56 193024 c:\windows\system32\msrating.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 193024 c:\windows\system32\msrating.dll
+ 2004-08-10 16:51 . 2009-04-29 04:56 477696 c:\windows\system32\mshtmled.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 477696 c:\windows\system32\mshtmled.dll
- 2006-11-08 01:03 . 2009-02-20 18:09 459264 c:\windows\system32\msfeeds.dll
+ 2006-11-08 01:03 . 2009-04-29 04:55 459264 c:\windows\system32\msfeeds.dll
+ 2009-02-03 02:15 . 2009-02-03 02:15 240544 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2009-04-22 02:47 . 2008-12-17 06:01 432664 c:\windows\system32\LVUI2RC.dll
+ 2009-04-22 02:47 . 2008-12-17 06:00 494104 c:\windows\system32\LVUI2.dll
- 2009-04-22 02:47 . 2008-07-26 15:23 416280 c:\windows\system32\lvcodec2.dll
+ 2009-04-22 02:47 . 2008-12-17 05:55 416280 c:\windows\system32\lvcodec2.dll
+ 2009-05-02 20:54 . 2008-12-17 05:55 195096 c:\windows\system32\lvci11901262.dll
+ 2009-04-27 21:13 . 2009-03-09 09:19 148888 c:\windows\system32\javaws.exe
- 2008-12-12 19:55 . 2008-12-12 19:55 148888 c:\windows\system32\javaws.exe
+ 2009-04-27 21:13 . 2009-03-09 09:19 144792 c:\windows\system32\javaw.exe
- 2008-12-12 19:55 . 2008-12-12 19:55 144792 c:\windows\system32\javaw.exe
+ 2009-04-27 21:13 . 2009-03-09 09:19 144792 c:\windows\system32\java.exe
- 2008-12-12 19:55 . 2008-12-12 19:55 144792 c:\windows\system32\java.exe
+ 2006-10-17 15:57 . 2009-04-29 04:55 268288 c:\windows\system32\iertutil.dll
- 2006-10-17 15:57 . 2009-02-20 18:09 268288 c:\windows\system32\iertutil.dll
+ 2004-08-10 16:51 . 2009-04-29 04:55 385024 c:\windows\system32\iedkcs32.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 385024 c:\windows\system32\iedkcs32.dll
+ 2006-10-17 15:27 . 2009-04-29 04:55 383488 c:\windows\system32\ieapfltr.dll
- 2006-10-17 15:27 . 2009-02-20 18:09 383488 c:\windows\system32\ieapfltr.dll
- 2004-08-10 16:51 . 2009-02-20 05:14 161792 c:\windows\system32\ieakui.dll
+ 2004-08-10 16:51 . 2009-04-25 05:26 161792 c:\windows\system32\ieakui.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 230400 c:\windows\system32\ieaksie.dll
+ 2004-08-10 16:51 . 2009-04-29 04:55 230400 c:\windows\system32\ieaksie.dll
+ 2004-08-10 16:51 . 2009-04-29 04:55 153088 c:\windows\system32\ieakeng.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 153088 c:\windows\system32\ieakeng.dll
- 2008-01-29 16:02 . 2008-04-17 18:12 107368 c:\windows\system32\GEARAspi.dll
+ 2008-01-29 16:02 . 2008-04-17 16:12 107368 c:\windows\system32\GEARAspi.dll
+ 2004-08-10 16:57 . 2009-06-11 01:43 163528 c:\windows\system32\FNTCACHE.DAT
- 2004-08-10 16:57 . 2009-03-11 21:44 163528 c:\windows\system32\FNTCACHE.DAT
+ 2004-08-10 16:51 . 2009-04-29 04:55 133120 c:\windows\system32\extmgr.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 133120 c:\windows\system32\extmgr.dll
+ 2004-08-10 16:51 . 2009-04-29 04:55 214528 c:\windows\system32\dxtrans.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 214528 c:\windows\system32\dxtrans.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 347136 c:\windows\system32\dxtmsft.dll
+ 2004-08-10 16:51 . 2009-04-29 04:55 347136 c:\windows\system32\dxtmsft.dll
+ 2009-05-02 20:54 . 2008-12-17 05:51 443664 c:\windows\system32\DRVSTORE\lvPRO5v_3494EAD41DC64D05E46AE15EF9CDDD2B02428AB3\WUApp32.exe
+ 2009-05-02 20:54 . 2008-12-17 06:02 145944 c:\windows\system32\DRVSTORE\lvPRO5v_3494EAD41DC64D05E46AE15EF9CDDD2B02428AB3\lvWIAext.dll
+ 2009-05-02 20:54 . 2008-12-17 06:01 432664 c:\windows\system32\DRVSTORE\lvPRO5v_3494EAD41DC64D05E46AE15EF9CDDD2B02428AB3\LVUI2RC.dll
+ 2009-05-02 20:54 . 2008-12-17 06:00 494104 c:\windows\system32\DRVSTORE\lvPRO5v_3494EAD41DC64D05E46AE15EF9CDDD2B02428AB3\LVUI2.dll
+ 2009-05-02 20:54 . 2008-12-17 05:55 195096 c:\windows\system32\DRVSTORE\lvPRO5v_3494EAD41DC64D05E46AE15EF9CDDD2B02428AB3\lvcoinst.dll
+ 2009-05-02 20:54 . 2008-12-17 05:55 416280 c:\windows\system32\DRVSTORE\lvPRO5v_3494EAD41DC64D05E46AE15EF9CDDD2B02428AB3\lvcodec2.dll
+ 2009-05-02 20:54 . 2008-12-17 05:51 443664 c:\windows\system32\DRVSTORE\lvPRO5s_9FC2121D88FC967CEF080BD575E14D11259C7669\WUApp32.exe
+ 2009-05-02 20:54 . 2008-12-17 06:00 768024 c:\windows\system32\DRVSTORE\lvPRO5s_9FC2121D88FC967CEF080BD575E14D11259C7669\lvrs.sys
+ 2009-05-02 20:54 . 2008-12-17 05:58 114712 c:\windows\system32\DRVSTORE\lvPRO5s_9FC2121D88FC967CEF080BD575E14D11259C7669\lvpopflt.sys
+ 2009-05-02 20:54 . 2008-12-17 05:55 195096 c:\windows\system32\DRVSTORE\lvPRO5s_9FC2121D88FC967CEF080BD575E14D11259C7669\lvcoinst.dll
+ 2009-05-02 20:54 . 2008-12-17 05:51 443664 c:\windows\system32\DRVSTORE\lvPEPI2v_64757B9EAE6D93AE33E6B1F663346906CC2D8A16\WUApp32.exe
+ 2009-05-02 20:54 . 2008-12-17 06:02 145944 c:\windows\system32\DRVSTORE\lvPEPI2v_64757B9EAE6D93AE33E6B1F663346906CC2D8A16\lvWIAext.dll
+ 2009-05-02 20:54 . 2008-12-17 06:01 432664 c:\windows\system32\DRVSTORE\lvPEPI2v_64757B9EAE6D93AE33E6B1F663346906CC2D8A16\LVUI2RC.dll
+ 2009-05-02 20:54 . 2008-12-17 06:00 494104 c:\windows\system32\DRVSTORE\lvPEPI2v_64757B9EAE6D93AE33E6B1F663346906CC2D8A16\LVUI2.dll
+ 2009-05-02 20:54 . 2008-12-17 05:55 195096 c:\windows\system32\DRVSTORE\lvPEPI2v_64757B9EAE6D93AE33E6B1F663346906CC2D8A16\lvcoinst.dll
+ 2009-05-02 20:54 . 2008-12-17 05:55 416280 c:\windows\system32\DRVSTORE\lvPEPI2v_64757B9EAE6D93AE33E6B1F663346906CC2D8A16\lvcodec2.dll
+ 2009-05-02 20:54 . 2008-12-17 05:51 443664 c:\windows\system32\DRVSTORE\lvPEPI2s_C7E59535DB2D9328DFA15B65064636A46C5F0D63\WUApp32.exe
+ 2009-05-02 20:54 . 2008-12-17 06:00 768024 c:\windows\system32\DRVSTORE\lvPEPI2s_C7E59535DB2D9328DFA15B65064636A46C5F0D63\lvrs.sys
+ 2009-05-02 20:54 . 2008-12-17 05:55 195096 c:\windows\system32\DRVSTORE\lvPEPI2s_C7E59535DB2D9328DFA15B65064636A46C5F0D63\lvcoinst.dll
+ 2009-05-02 20:54 . 2008-12-17 05:51 443664 c:\windows\system32\DRVSTORE\lvELCHv_89D63E450CD00B62BAE1D53FC3B914A5EBF13271\WUApp32.exe
+ 2009-05-02 20:54 . 2008-12-17 06:02 145944 c:\windows\system32\DRVSTORE\lvELCHv_89D63E450CD00B62BAE1D53FC3B914A5EBF13271\lvWIAext.dll
+ 2009-05-02 20:54 . 2008-12-17 06:01 432664 c:\windows\system32\DRVSTORE\lvELCHv_89D63E450CD00B62BAE1D53FC3B914A5EBF13271\LVUI2RC.dll
+ 2009-05-02 20:54 . 2008-12-17 06:00 494104 c:\windows\system32\DRVSTORE\lvELCHv_89D63E450CD00B62BAE1D53FC3B914A5EBF13271\LVUI2.dll
+ 2009-05-02 20:54 . 2008-12-17 05:55 195096 c:\windows\system32\DRVSTORE\lvELCHv_89D63E450CD00B62BAE1D53FC3B914A5EBF13271\lvcoinst.dll
+ 2009-05-02 20:54 . 2008-12-17 05:55 416280 c:\windows\system32\DRVSTORE\lvELCHv_89D63E450CD00B62BAE1D53FC3B914A5EBF13271\lvcodec2.dll
+ 2009-05-02 20:54 . 2008-12-17 05:54 495640 c:\windows\system32\DRVSTORE\lvELCHv_89D63E450CD00B62BAE1D53FC3B914A5EBF13271\LV561AV.sys
+ 2009-07-08 18:14 . 2008-04-17 16:12 107368 c:\windows\system32\DRVSTORE\GEARAspiWD_F475AF659D36685632E9BD97B57E9D9661FF3FFD\x86\GEARAspi.dll
+ 2009-04-22 02:46 . 2008-12-17 06:00 768024 c:\windows\system32\drivers\lvrs.sys
+ 2007-05-30 17:37 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\wininet.dll
+ 2006-11-08 01:03 . 2009-04-29 04:56 233472 c:\windows\system32\dllcache\webcheck.dll
- 2006-11-08 01:03 . 2009-02-20 18:09 233472 c:\windows\system32\dllcache\webcheck.dll
+ 2006-10-17 16:05 . 2009-04-29 04:56 105984 c:\windows\system32\dllcache\url.dll
- 2006-10-17 16:05 . 2009-02-20 18:09 105984 c:\windows\system32\dllcache\url.dll
+ 2009-06-16 14:36 . 2009-06-16 14:36 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2009-04-15 14:51 . 2009-04-15 14:51 585216 c:\windows\system32\dllcache\rpcrt4.dll
+ 2006-10-17 16:04 . 2009-04-29 04:56 102912 c:\windows\system32\dllcache\occache.dll
- 2006-10-17 16:04 . 2009-02-20 18:09 102912 c:\windows\system32\dllcache\occache.dll
+ 2004-08-10 16:51 . 2009-04-29 04:56 671232 c:\windows\system32\dllcache\mstime.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 671232 c:\windows\system32\dllcache\mstime.dll
- 2007-05-30 17:37 . 2009-02-20 18:09 193024 c:\windows\system32\dllcache\msrating.dll
+ 2007-05-30 17:37 . 2009-04-29 04:56 193024 c:\windows\system32\dllcache\msrating.dll
- 2007-05-30 17:37 . 2009-02-20 18:09 477696 c:\windows\system32\dllcache\mshtmled.dll
+ 2007-05-30 17:37 . 2009-04-29 04:56 477696 c:\windows\system32\dllcache\mshtmled.dll
+ 2007-06-04 19:33 . 2009-04-29 04:55 459264 c:\windows\system32\dllcache\msfeeds.dll
- 2007-06-04 19:33 . 2009-02-20 18:09 459264 c:\windows\system32\dllcache\msfeeds.dll
+ 2009-05-07 15:32 . 2009-05-07 15:32 345600 c:\windows\system32\dllcache\localspl.dll
+ 2006-10-17 16:04 . 2009-04-25 05:27 636088 c:\windows\system32\dllcache\iexplore.exe
- 2007-06-04 19:33 . 2009-02-20 18:09 268288 c:\windows\system32\dllcache\iertutil.dll
+ 2007-06-04 19:33 . 2009-04-29 04:55 268288 c:\windows\system32\dllcache\iertutil.dll
+ 2006-11-07 07:27 . 2009-04-29 04:55 385024 c:\windows\system32\dllcache\iedkcs32.dll
- 2006-11-07 07:27 . 2009-02-20 18:09 385024 c:\windows\system32\dllcache\iedkcs32.dll
- 2007-06-04 19:33 . 2009-02-20 18:09 383488 c:\windows\system32\dllcache\ieapfltr.dll
+ 2007-06-04 19:33 . 2009-04-29 04:55 383488 c:\windows\system32\dllcache\ieapfltr.dll
+ 2004-08-10 16:51 . 2009-04-25 05:26 161792 c:\windows\system32\dllcache\ieakui.dll
- 2004-08-10 16:51 . 2009-02-20 05:14 161792 c:\windows\system32\dllcache\ieakui.dll
+ 2004-08-10 16:51 . 2009-04-29 04:55 230400 c:\windows\system32\dllcache\ieaksie.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 230400 c:\windows\system32\dllcache\ieaksie.dll
- 2004-08-10 16:51 . 2009-02-20 18:09 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2004-08-10 16:51 . 2009-04-29 04:55 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2007-05-30 17:37 . 2009-04-29 04:55 133120 c:\windows\system32\dllcache\extmgr.dll
- 2007-05-30 17:37 . 2009-02-20 18:09 133120 c:\windows\system32\dllcache\extmgr.dll
+ 2007-05-30 17:37 . 2009-04-29 04:55 214528 c:\windows\system32\dllcache\dxtrans.dll
- 2007-05-30 17:37 . 2009-02-20 18:09 214528 c:\windows\system32\dllcache\dxtrans.dll
- 2007-05-30 17:37 . 2009-02-20 18:09 347136 c:\windows\system32\dllcache\dxtmsft.dll
+ 2007-05-30 17:37 . 2009-04-29 04:55 347136 c:\windows\system32\dllcache\dxtmsft.dll
- 2006-11-07 07:26 . 2009-02-20 18:09 124928 c:\windows\system32\dllcache\advpack.dll
+ 2006-11-07 07:26 . 2009-04-29 04:55 124928 c:\windows\system32\dllcache\advpack.dll
- 2008-12-12 19:55 . 2008-12-12 19:55 410984 c:\windows\system32\deploytk.dll
+ 2008-12-12 19:55 . 2009-03-09 09:19 410984 c:\windows\system32\deploytk.dll
- 2004-08-10 16:50 . 2009-02-20 18:09 124928 c:\windows\system32\advpack.dll
+ 2004-08-10 16:50 . 2009-04-29 04:55 124928 c:\windows\system32\advpack.dll
+ 2008-08-22 22:46 . 2004-08-04 09:00 366080 c:\windows\ServicePackFiles\i386\digreqex.msi
+ 2008-08-22 22:46 . 2004-08-04 09:00 863232 c:\windows\ServicePackFiles\i386\digopt.msi
+ 2008-11-12 03:29 . 2008-11-12 03:29 432640 c:\windows\Installer\e6fc38.msi
+ 2007-05-30 17:52 . 2007-05-30 17:52 829440 c:\windows\Installer\ac6e.msi
+ 2007-05-30 17:52 . 2007-05-30 17:52 829440 c:\windows\Installer\ac66.msi
+ 2007-05-30 17:52 . 2007-05-30 17:52 829440 c:\windows\Installer\ac5e.msi
+ 2007-05-30 17:51 . 2007-05-30 17:51 439808 c:\windows\Installer\ac56.msi
+ 2007-05-30 17:49 . 2007-05-30 17:49 281600 c:\windows\Installer\ac3d.msi
+ 2007-05-30 17:48 . 2007-05-30 17:48 489984 c:\windows\Installer\ac29.msi
+ 2007-05-30 17:48 . 2007-05-30 17:48 752640 c:\windows\Installer\ac24.msi
+ 2007-05-30 17:47 . 2007-05-30 17:47 219136 c:\windows\Installer\ac1f.msi
+ 2007-05-30 17:47 . 2007-05-30 17:47 655360 c:\windows\Installer\ac1a.msi
+ 2007-05-30 17:46 . 2007-05-30 17:46 656896 c:\windows\Installer\ac11.msi
+ 2007-05-30 17:46 . 2007-05-30 17:46 669696 c:\windows\Installer\ac09.msi
+ 2007-05-30 17:45 . 2007-05-30 17:45 256000 c:\windows\Installer\ac05.msi
+ 2007-05-30 17:44 . 2007-05-30 17:44 398848 c:\windows\Installer\abfc.msi
+ 2007-05-30 17:44 . 2007-05-30 17:44 275968 c:\windows\Installer\abf7.msi
+ 2008-07-11 15:16 . 2008-07-11 15:16 289792 c:\windows\Installer\9f0717.msi
+ 2008-06-22 22:51 . 2008-06-22 22:51 213504 c:\windows\Installer\9c0a7.msi
+ 2008-06-22 22:51 . 2008-06-22 22:51 774144 c:\windows\Installer\9c09e.msi
+ 2008-02-08 22:02 . 2008-02-08 22:02 331264 c:\windows\Installer\90877b.msi
+ 2007-05-30 17:41 . 2007-05-30 17:41 648704 c:\windows\Installer\8248.msi
+ 2007-05-30 17:39 . 2007-05-30 17:39 221184 c:\windows\Installer\8244.msi
+ 2004-08-10 17:08 . 2004-08-10 17:08 264704 c:\windows\Installer\7506.msi
+ 2008-12-12 19:55 . 2008-12-12 19:55 562176 c:\windows\Installer\5751f.msi
+ 2007-11-16 19:30 . 2007-11-16 19:30 451584 c:\windows\Installer\4e331.msi
+ 2007-06-03 18:07 . 2007-06-03 18:07 268800 c:\windows\Installer\4a6a4.msi
+ 2009-04-30 20:25 . 2009-04-30 20:25 228352 c:\windows\Installer\34db8.msi
+ 2007-06-11 03:10 . 2007-06-11 03:10 390656 c:\windows\Installer\2d981bd.msi
+ 2007-08-15 23:13 . 2007-08-15 23:13 431104 c:\windows\Installer\253b185.msi
+ 2008-08-28 00:35 . 2008-08-28 00:35 697856 c:\windows\Installer\1d42adf.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 229376 c:\windows\Installer\1745ec.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 252416 c:\windows\Installer\1745e7.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 247296 c:\windows\Installer\1745e2.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 293888 c:\windows\Installer\1745dd.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 215040 c:\windows\Installer\1745d8.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 321024 c:\windows\Installer\1745d3.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 217088 c:\windows\Installer\1745ce.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 302080 c:\windows\Installer\1745c9.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 321024 c:\windows\Installer\1745c4.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 293376 c:\windows\Installer\1745bf.msi
+ 2007-06-04 01:36 . 2007-06-04 01:36 428544 c:\windows\Installer\17186af.msi
+ 2008-08-19 19:22 . 2008-08-19 19:22 301056 c:\windows\Installer\162c771.msi
+ 2008-08-19 19:22 . 2008-08-19 19:22 871424 c:\windows\Installer\162c757.msi
+ 2007-11-07 20:07 . 2007-11-07 20:07 999936 c:\windows\Installer\1208589.msp
+ 2007-11-07 19:56 . 2007-11-07 19:56 553472 c:\windows\Installer\1208586.msp
+ 2007-11-07 19:58 . 2007-11-07 19:58 908800 c:\windows\Installer\1208582.msp
+ 2007-11-07 19:54 . 2007-11-07 19:54 507392 c:\windows\Installer\1208581.msp
+ 2008-12-14 15:14 . 2008-12-14 15:14 875008 c:\windows\Installer\11fda9.msi
+ 2009-07-08 18:14 . 2009-07-08 18:14 102400 c:\windows\Installer\{5D601655-6D54-4384-B52C-17EC5385FBBD}\iTunesIco.exe
+ 2009-06-10 01:15 . 2009-03-03 00:18 826368 c:\windows\ie7updates\KB969897-IE7\wininet.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 233472 c:\windows\ie7updates\KB969897-IE7\webcheck.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 105984 c:\windows\ie7updates\KB969897-IE7\url.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 382840 c:\windows\ie7updates\KB969897-IE7\spuninst\updspapi.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 231288 c:\windows\ie7updates\KB969897-IE7\spuninst\spuninst.exe
+ 2009-06-10 01:15 . 2009-02-20 18:09 102912 c:\windows\ie7updates\KB969897-IE7\occache.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 671232 c:\windows\ie7updates\KB969897-IE7\mstime.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 193024 c:\windows\ie7updates\KB969897-IE7\msrating.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 477696 c:\windows\ie7updates\KB969897-IE7\mshtmled.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 459264 c:\windows\ie7updates\KB969897-IE7\msfeeds.dll
+ 2009-06-10 01:15 . 2009-02-28 04:54 636072 c:\windows\ie7updates\KB969897-IE7\iexplore.exe
+ 2009-06-10 01:15 . 2009-02-20 18:09 268288 c:\windows\ie7updates\KB969897-IE7\iertutil.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 385024 c:\windows\ie7updates\KB969897-IE7\iedkcs32.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 383488 c:\windows\ie7updates\KB969897-IE7\ieapfltr.dll
+ 2009-06-10 01:15 . 2009-02-20 05:14 161792 c:\windows\ie7updates\KB969897-IE7\ieakui.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 230400 c:\windows\ie7updates\KB969897-IE7\ieaksie.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 153088 c:\windows\ie7updates\KB969897-IE7\ieakeng.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 133120 c:\windows\ie7updates\KB969897-IE7\extmgr.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 214528 c:\windows\ie7updates\KB969897-IE7\dxtrans.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 347136 c:\windows\ie7updates\KB969897-IE7\dxtmsft.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 124928 c:\windows\ie7updates\KB969897-IE7\advpack.dll
+ 2007-05-30 17:41 . 2007-05-30 17:41 660992 c:\windows\Downloaded Installations\{D7027C31-E9CC-4B3F-A5A7-B36F69DB679E}\Banctec Service Agreement.msi
+ 2009-06-10 01:16 . 2007-11-30 12:39 382840 c:\windows\$NtUninstallKB970238$\spuninst\updspapi.dll
+ 2009-06-10 01:16 . 2007-11-30 12:39 231288 c:\windows\$NtUninstallKB970238$\spuninst\spuninst.exe
+ 2009-06-10 01:16 . 2008-04-14 00:12 584704 c:\windows\$NtUninstallKB970238$\rpcrt4.dll
+ 2009-06-10 01:17 . 2007-11-30 12:39 382840 c:\windows\$NtUninstallKB969898$\spuninst\updspapi.dll
+ 2009-06-10 01:17 . 2007-11-30 12:39 231288 c:\windows\$NtUninstallKB969898$\spuninst\spuninst.exe
+ 2009-06-10 01:15 . 2008-07-09 07:38 382840 c:\windows\$NtUninstallKB968537$\spuninst\updspapi.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 231288 c:\windows\$NtUninstallKB968537$\spuninst\spuninst.exe
+ 2009-06-10 01:17 . 2008-07-09 07:38 382840 c:\windows\$NtUninstallKB961501$\spuninst\updspapi.dll
+ 2009-06-10 01:17 . 2008-07-09 07:38 231288 c:\windows\$NtUninstallKB961501$\spuninst\spuninst.exe
+ 2009-06-10 01:17 . 2008-04-14 00:11 343040 c:\windows\$NtUninstallKB961501$\localspl.dll
+ 2009-06-10 01:16 . 2007-11-30 12:39 382840 c:\windows\$hf_mig$\KB970238\update\updspapi.dll
+ 2009-06-10 01:16 . 2007-11-30 12:39 755576 c:\windows\$hf_mig$\KB970238\update\update.exe
+ 2009-06-10 01:16 . 2007-11-30 12:39 231288 c:\windows\$hf_mig$\KB970238\spuninst.exe
+ 2009-04-15 15:24 . 2009-04-15 15:24 585216 c:\windows\$hf_mig$\KB970238\SP3QFE\rpcrt4.dll
+ 2009-06-10 01:17 . 2007-11-30 12:39 382840 c:\windows\$hf_mig$\KB969898\update\updspapi.dll
+ 2009-06-10 01:17 . 2007-11-30 12:39 755576 c:\windows\$hf_mig$\KB969898\update\update.exe
+ 2009-06-10 01:17 . 2007-11-30 12:39 231288 c:\windows\$hf_mig$\KB969898\spuninst.exe
+ 2009-06-10 01:15 . 2008-07-09 07:38 382840 c:\windows\$hf_mig$\KB969897-IE7\update\updspapi.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 755576 c:\windows\$hf_mig$\KB969897-IE7\update\update.exe
+ 2009-06-10 01:15 . 2008-07-09 07:38 231288 c:\windows\$hf_mig$\KB969897-IE7\spuninst.exe
+ 2009-04-29 04:49 . 2009-04-29 04:49 828928 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 233472 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\webcheck.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 105984 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\url.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 102912 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\occache.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 671232 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\mstime.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 193024 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\msrating.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 477696 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\mshtmled.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 459264 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\msfeeds.dll
+ 2009-04-25 05:27 . 2009-04-25 05:27 636088 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\iexplore.exe
+ 2009-04-29 04:49 . 2009-04-29 04:49 268288 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\iertutil.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 388608 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\iedkcs32.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 380928 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\ieapfltr.dll
+ 2009-04-25 05:26 . 2009-04-25 05:26 161792 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\ieakui.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 230400 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\ieaksie.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 153088 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\ieakeng.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 132608 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\extmgr.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 214528 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\dxtrans.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 347136 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\dxtmsft.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 124928 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\advpack.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 382840 c:\windows\$hf_mig$\KB968537\update\updspapi.dll
+ 2009-06-10 01:15 . 2008-07-09 07:38 755576 c:\windows\$hf_mig$\KB968537\update\update.exe
+ 2009-06-10 01:15 . 2008-07-09 07:38 231288 c:\windows\$hf_mig$\KB968537\spuninst.exe
+ 2009-06-10 01:17 . 2008-07-09 07:38 382840 c:\windows\$hf_mig$\KB961501\update\updspapi.dll
+ 2009-06-10 01:17 . 2008-07-09 07:38 755576 c:\windows\$hf_mig$\KB961501\update\update.exe
+ 2009-06-10 01:17 . 2008-07-09 07:38 231288 c:\windows\$hf_mig$\KB961501\spuninst.exe
+ 2009-05-07 15:14 . 2009-05-07 15:14 346112 c:\windows\$hf_mig$\KB961501\SP3QFE\localspl.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 3783672 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 3768312 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
+ 2004-08-10 16:51 . 2009-04-17 12:26 1847168 c:\windows\system32\win32k.sys
+ 2004-08-10 16:51 . 2004-08-04 09:00 1326080 c:\windows\system32\webfldrs.msi
+ 2004-08-10 16:51 . 2009-04-29 04:56 1159680 c:\windows\system32\urlmon.dll
+ 2009-05-02 20:59 . 2008-12-18 14:02 1051136 c:\windows\system32\ReinstallBackups\0030\DriverFiles\CAMTHWDM.sys
+ 2009-05-02 20:54 . 2008-07-26 15:26 4658584 c:\windows\system32\ReinstallBackups\0029\DriverFiles\lvuvc.sys
+ 2004-08-10 16:51 . 2009-04-29 04:56 3596288 c:\windows\system32\mshtml.dll
+ 2009-02-03 02:15 . 2009-02-03 02:15 3771296 c:\windows\system32\Macromed\Flash\NPSWF32.dll
- 2006-11-08 01:03 . 2009-02-20 18:09 6066176 c:\windows\system32\ieframe.dll
+ 2006-11-08 01:03 . 2009-04-29 04:55 6066176 c:\windows\system32\ieframe.dll
+ 2009-07-08 18:10 . 2009-06-05 15:42 2060288 c:\windows\system32\DRVSTORE\usbaapl_872A2434B7205D4BD84BBE53811BDCE15F347D5B\usbaaplrc.dll
+ 2009-07-08 18:10 . 2009-06-05 15:42 1419232 c:\windows\system32\DRVSTORE\netaapl_F433E854B3FF3BEE74986FDE8E16A64162342BFF\wdfcoinstaller01005.dll
+ 2009-05-02 20:54 . 2008-12-17 06:01 6364440 c:\windows\system32\DRVSTORE\lvPRO5v_3494EAD41DC64D05E46AE15EF9CDDD2B02428AB3\lvuvc.sys
+ 2009-05-02 20:54 . 2008-12-17 05:53 2686104 c:\windows\system32\DRVSTORE\lvPEPI2v_64757B9EAE6D93AE33E6B1F663346906CC2D8A16\LV302V32.SYS
+ 2009-04-22 02:47 . 2008-12-17 06:01 6364440 c:\windows\system32\drivers\lvuvc.sys
+ 2009-04-23 00:21 . 2008-12-18 14:02 1051136 c:\windows\system32\drivers\CAMTHWDM.sys
+ 2008-10-14 19:38 . 2009-04-17 12:26 1847168 c:\windows\system32\dllcache\win32k.sys
+ 2007-05-30 17:37 . 2009-04-29 04:56 1159680 c:\windows\system32\dllcache\urlmon.dll
+ 2008-05-07 05:12 . 2009-06-03 19:09 1291264 c:\windows\system32\dllcache\quartz.dll
+ 2007-05-30 17:37 . 2009-04-29 04:56 3596288 c:\windows\system32\dllcache\mshtml.dll
- 2007-06-04 19:33 . 2009-02-20 18:09 6066176 c:\windows\system32\dllcache\ieframe.dll
+ 2007-06-04 19:33 . 2009-04-29 04:55 6066176 c:\windows\system32\dllcache\ieframe.dll
+ 2008-08-22 22:48 . 2004-08-04 09:00 1326080 c:\windows\ServicePackFiles\i386\webfldrs.msi
+ 2008-08-22 22:47 . 2004-08-04 09:00 5080576 c:\windows\ServicePackFiles\i386\msnmsgs.msi
+ 2007-05-25 16:08 . 2007-05-25 16:08 9609728 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp
+ 2007-06-30 22:56 . 2007-06-30 22:56 2265600 c:\windows\Installer\fdfd02.msi
+ 2008-01-22 23:32 . 2008-01-22 23:32 1880576 c:\windows\Installer\e66c16.msi
+ 2009-01-25 20:12 . 2009-01-25 20:12 1405952 c:\windows\Installer\e6225.msi
+ 2007-12-30 19:41 . 2007-12-30 19:41 6668800 c:\windows\Installer\c5947d.msi
+ 2007-05-30 17:50 . 2007-05-30 17:50 3282432 c:\windows\Installer\ac4b.msi
+ 2007-05-30 17:49 . 2007-05-30 17:49 4537344 c:\windows\Installer\ac47.msi
+ 2007-05-30 17:48 . 2007-05-30 17:48 1150464 c:\windows\Installer\ac38.msi
+ 2007-05-30 17:48 . 2007-05-30 17:48 1144832 c:\windows\Installer\ac33.msi
+ 2007-05-30 17:43 . 2007-05-30 17:43 3412992 c:\windows\Installer\abf3.msi
+ 2008-09-17 01:59 . 2008-09-17 01:59 3429376 c:\windows\Installer\a98b45.msi
+ 2008-06-22 22:55 . 2008-06-22 22:55 3649536 c:\windows\Installer\9c1b1.msi
+ 2004-08-10 17:09 . 2004-08-10 17:10 3443712 c:\windows\Installer\50c4.msi
+ 2009-05-02 20:53 . 2009-05-02 20:53 4975104 c:\windows\Installer\1b6cd2d.msi
+ 2008-11-19 03:20 . 2008-11-19 03:20 1549312 c:\windows\Installer\186d43a.msi
+ 2008-11-19 03:13 . 2008-11-19 03:13 2329600 c:\windows\Installer\186ce64.msi
+ 2008-11-12 23:19 . 2008-11-12 23:19 1086976 c:\windows\Installer\1745f1.msi
+ 2007-06-04 01:35 . 2007-06-04 01:35 5864960 c:\windows\Installer\17186a8.msp
+ 2008-12-13 16:12 . 2008-12-13 16:12 1949184 c:\windows\Installer\16f8df.msi
+ 2008-08-19 19:22 . 2008-08-19 19:22 4429824 c:\windows\Installer\162c777.msi
+ 2007-08-13 18:43 . 2007-08-13 18:43 8230912 c:\windows\Installer\14fdd47.msi
+ 2009-07-08 18:14 . 2009-07-08 18:14 4074496 c:\windows\Installer\12a925c.msi
+ 2009-07-08 18:13 . 2009-07-08 18:13 1659392 c:\windows\Installer\12a8f3f.msi
+ 2009-07-08 18:12 . 2009-07-08 18:12 8992256 c:\windows\Installer\12a8f32.msi
+ 2009-07-08 18:10 . 2009-07-08 18:10 3295232 c:\windows\Installer\12a8c89.msi
+ 2007-11-07 19:50 . 2007-11-07 19:50 6055936 c:\windows\Installer\1208588.msp
+ 2007-11-07 20:00 . 2007-11-07 20:00 3407360 c:\windows\Installer\1208587.msp
+ 2007-11-07 19:46 . 2007-11-07 19:46 3010560 c:\windows\Installer\1208585.msp
+ 2007-11-07 20:02 . 2007-11-07 20:02 6473216 c:\windows\Installer\1208584.msp
+ 2007-11-07 20:12 . 2007-11-07 20:12 2533376 c:\windows\Installer\1208583.msp
+ 2008-04-06 18:28 . 2008-04-06 18:28 1098752 c:\windows\Installer\1162862.msi
+ 2009-06-10 01:15 . 2009-02-20 18:09 1160192 c:\windows\ie7updates\KB969897-IE7\urlmon.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 3595264 c:\windows\ie7updates\KB969897-IE7\mshtml.dll
+ 2009-06-10 01:15 . 2009-02-20 18:09 6066176 c:\windows\ie7updates\KB969897-IE7\ieframe.dll
+ 2009-06-10 01:15 . 2008-07-09 14:25 2455488 c:\windows\ie7updates\KB969897-IE7\ieapfltr.dat
+ 2009-06-10 01:15 . 2009-02-09 11:13 1846784 c:\windows\$NtUninstallKB968537$\win32k.sys
+ 2009-04-29 04:49 . 2009-04-29 04:49 1163264 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\urlmon.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 3598336 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\mshtml.dll
+ 2009-04-29 04:49 . 2009-04-29 04:49 6069248 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\ieframe.dll
+ 2009-06-09 21:31 . 2008-07-09 14:25 2455488 c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\ieapfltr.dat
+ 2009-04-17 10:50 . 2009-04-17 10:50 1847808 c:\windows\$hf_mig$\KB968537\SP3QFE\win32k.sys
+ 2009-05-14 03:22 . 2009-07-07 15:10 24539592 c:\windows\system32\MRT.exe
+ 2007-06-03 17:58 . 2007-05-30 17:39 12127744 c:\windows\system32\config\systemprofile\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}\J2SE Runtime Environment 5.0 Update 6.msi
+ 2007-06-29 21:28 . 2007-01-19 17:20 16633344 c:\windows\Installer\MSN Messenger 8.1.0178\MsnMsgs.Msi
+ 2007-07-12 01:22 . 2007-07-12 01:22 15256576 c:\windows\Installer\c84715.msp
+ 2004-08-10 17:10 . 2004-08-10 17:10 19204096 c:\windows\Installer\1599f.msp
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A1FB2F9A-D35E-11DD-8935-E46A56D89593}]
2009-03-16 13:53 87512 —-a-w- c:\program files\oovootb\dtx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A1FB2F9A-D35E-11DD-8935-E46A56D89593}"= "c:\program files\oovootb\dtx.dll" [2009-03-16 87512]

[HKEY_CLASSES_ROOT\clsid\{a1fb2f9a-d35e-11dd-8935-e46a56d89593}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"CursorXP"="c:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"Steam"="c:\program files\steam\steam.exe" [2009-06-11 1217784]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"oovoo.exe"="c:\program files\ooVoo\ooVoo.exe" [2009-02-25 14657328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"PrinTray"="c:\windows\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-25 36864]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-04 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-04 86016]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-12-20 2656528]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-07-24 282624]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-09-21 55824]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-11-04 1630208]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-5-30 24576]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-4-21 66864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.exe\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\SwiftSwitch\\SwiftSwitch.exe"=
"c:\\Program Files\\Steam\\steamapps\\fuarrow2\\counter-strike\\hl.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Teamspeak2_RC2\\server_windows.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Java\\jre1.6.0_01\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Aton\\Desktop\\utorrent.exe"=
"c:\\Program Files\\Steam\\steamapps\\fuarrow2\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP:ooVoo TCP port 443
"443:UDP"= 443:UDP:ooVoo UDP port 443
"37674:TCP"= 37674:TCP:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:ooVoo UDP port 37675

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [4/30/2009 4:29 PM 108289]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\CAMTHWDM.sys [4/22/2009 8:21 PM 1051136]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.mystart.com?pr=oovoo2_0
uInternet Settings,ProxyOverride = *.local
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
FF - ProfilePath - c:\docume~1\Aton\APPLIC~1\Mozilla\Firefox\Profiles\af3719sg.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr;=vmn&type;=vdio5&p;=
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-23 17:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:\docume~1\Aton\LOCALS~1\Temp\Perflib_Perfdata_e1c.dat 16384 bytes
c:\docume~1\Aton\APPLIC~1\Mozilla\Firefox\Profiles\af3719sg.default\pluginreg.dat.bak 14381 bytes

scan completed successfully
hidden files: 2

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(712)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-07-23 17:58
ComboFix-quarantined-files.txt 2009-07-23 21:58
ComboFix2.txt 2009-04-27 02:24
ComboFix3.txt 2009-04-27 01:59

Pre-Run: 140,633,858,048 bytes free
Post-Run: 140,600,123,392 bytes free

639

Tomk

Post #8July 23, 2009, 11:27 PM UTC

Aton,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\windows\system32\drivers\lvuvc.hs
c:\windows\system32\drivers\logiflt.iad

Rootkit::
c:\Documents and Settings\Aton\local settings\Temp\Perflib_Perfdata_e1c.dat
c:\Documents and Settings\Aton\Application Data\Mozilla\Firefox\Profiles\af3719sg.default\pluginreg.dat.bak

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

Aton

Post #9July 24, 2009, 4:55 AM UTC

Also, my computer is picking up something from c:\\windows\temp\logishrd\LVPrcInj01.dll

I keep "deleting it" but it keeps coming back

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-23 22:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:\docume~1\Aton\APPLIC~1\Mozilla\Firefox\Profiles\af3719sg.default\sessionstore.bak 14858 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(704)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(7044)
c:\program files\RocketDock\RocketDock.dll
c:\program files\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\CursorXP\CurXP0.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\AstSrv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Canon\IJPLM\ijplmsvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\nvsvc32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Microsoft IntelliPoint\dpupdchk.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Completion time: 2009-07-24 22:14 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-24 02:14
ComboFix2.txt 2009-07-23 21:58
ComboFix3.txt 2009-04-27 02:24
ComboFix4.txt 2009-04-27 01:59

Pre-Run: 140,631,629,824 bytes free
Post-Run: 140,592,062,464 bytes free

202

Attachments:

📎12541.txt

Tomk

Post #10July 24, 2009, 5:13 AM UTC

Aton,

That file is a required file for your Logitech QuickCam. Do you have such a piece of equipment?

That is only part of the CompoFix.Txt. Can you post the complete log?

Please:

Right click on START on the left end of your Windows toolbar (lower left corner of your screen)
Click on Explore
Click on Local Disk (C:) in the left-hand window pane
Look for ComboFix.txt in the right-hand window pane and right click on it
Put your cursor (arrow) on Open With
Move your cursor to the new menu that opens and click on Choose Program…
Click on Notepad

When file opens, Copy/Paste text here

Aton

Post #11July 24, 2009, 5:15 AM UTC last edited July 24, 2009, 5:19 AM UTC

Yes I do but my Antivirus keeps picking it up as a Trojan for some reason o.O

**Sorry for my next delay on post but it's 1:19AM and I gotta be up in 4 hours. I'll post back as soon as I can with my new log/whatever you need. I just need some sleep

ComboFix 09-07-23.02 - Aton 07/23/2009 19:30.4.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2431 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Aton\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\drivers\logiflt.iad"
"c:\windows\system32\drivers\lvuvc.hs"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\logiflt.iad
c:\windows\system32\drivers\lvuvc.hs
c:\windows\TEMP\logishrd\LVPrcInj01.dll

.
((((((((((((((((((((((((( Files Created from 2009-06-24 to 2009-07-24 )))))))))))))))))))))))))))))))
.

2009-07-23 22:11 . 2009-07-23 22:11 ——– d-sh–w- C:\found.000
2009-07-08 18:14 . 2009-07-08 18:14 ——– d—–w- c:\program files\iPod
2009-07-08 18:14 . 2009-07-08 18:14 ——– d—–w- c:\program files\iTunes
2009-07-08 18:14 . 2009-07-08 18:14 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-08 18:13 . 2009-07-08 18:13 ——– d—–w- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-24 02:08 . 2008-04-06 18:28 ——– d—–w- c:\program files\Steam
2009-07-17 02:00 . 2008-07-01 13:14 34 —-a-w- c:\documents and settings\Aton\jagex_runescape_preferences.dat
2009-07-08 21:31 . 2009-01-08 19:59 ——– d—–w- c:\program files\World of Warcraft
2009-07-08 18:14 . 2007-12-22 01:11 ——– d—–w- c:\program files\Common Files\Apple
2009-07-08 18:12 . 2007-05-30 17:47 ——– d—–w- c:\program files\QuickTime
2009-06-24 03:37 . 2007-12-21 22:33 ——– d—–w- c:\documents and settings\Aton\Application Data\LimeWire
2009-06-16 14:36 . 2004-08-10 16:51 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-08-10 16:51 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-15 02:45 . 2007-06-10 01:37 8742 —-a-w- c:\documents and settings\Aton\Application Data\wklnhst.dat
2009-06-14 15:37 . 2007-06-25 00:09 ——– d—–w- c:\program files\mIRC
2009-06-07 12:16 . 2007-05-30 17:47 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Viewpoint
2009-06-03 19:09 . 2004-08-10 16:51 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-07 15:32 . 2004-08-10 16:51 345600 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-10 16:51 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-10 16:51 78336 —-a-w- c:\windows\system32\ieencode.dll
2001-06-20 20:19 . 2001-06-19 20:34 40960 -c–a-w- c:\program files\ACMonitor_X83.exe
2009-07-22 12:48 . 2009-04-10 13:20 134648 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-07-23_21.56.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-23 23:38 . 2009-07-23 23:38 16384 c:\windows\Temp\Perflib_Perfdata_33c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A1FB2F9A-D35E-11DD-8935-E46A56D89593}]
2009-03-16 13:53 87512 —-a-w- c:\program files\oovootb\dtx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A1FB2F9A-D35E-11DD-8935-E46A56D89593}"= "c:\program files\oovootb\dtx.dll" [2009-03-16 87512]

[HKEY_CLASSES_ROOT\clsid\{a1fb2f9a-d35e-11dd-8935-e46a56d89593}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"CursorXP"="c:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"Steam"="c:\program files\steam\steam.exe" [2009-06-11 1217784]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-25 50528]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"oovoo.exe"="c:\program files\ooVoo\ooVoo.exe" [2009-02-25 14657328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"PrinTray"="c:\windows\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-25 36864]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-04 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-04 86016]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-12-20 2656528]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-07-24 282624]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-09-21 55824]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-11-04 1630208]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-5-30 24576]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-4-21 66864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.exe\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\SwiftSwitch\\SwiftSwitch.exe"=
"c:\\Program Files\\Steam\\steamapps\\fuarrow2\\counter-strike\\hl.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Teamspeak2_RC2\\server_windows.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Java\\jre1.6.0_01\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Aton\\Desktop\\utorrent.exe"=
"c:\\Program Files\\Steam\\steamapps\\fuarrow2\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP:ooVoo TCP port 443
"443:UDP"= 443:UDP:ooVoo UDP port 443
"37674:TCP"= 37674:TCP:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:ooVoo UDP port 37675

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [4/30/2009 4:29 PM 108289]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\CAMTHWDM.sys [4/22/2009 8:21 PM 1051136]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.mystart.com?pr=oovoo2_0
uInternet Settings,ProxyOverride = *.local
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
FF - ProfilePath - c:\docume~1\Aton\APPLIC~1\Mozilla\Firefox\Profiles\af3719sg.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr;=vmn&type;=vdio5&p;=
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-23 22:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:\docume~1\Aton\APPLIC~1\Mozilla\Firefox\Profiles\af3719sg.default\sessionstore.bak 14858 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(704)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(7044)
c:\program files\RocketDock\RocketDock.dll
c:\program files\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\CursorXP\CurXP0.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\AstSrv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Canon\IJPLM\ijplmsvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\nvsvc32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Microsoft IntelliPoint\dpupdchk.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Completion time: 2009-07-24 22:14 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-24 02:14
ComboFix2.txt 2009-07-23 21:58
ComboFix3.txt 2009-04-27 02:24
ComboFix4.txt 2009-04-27 01:59

Pre-Run: 140,631,629,824 bytes free
Post-Run: 140,592,062,464 bytes free

202

Tomk

Post #12July 24, 2009, 5:50 AM UTC

Aton,

Apparently that is not an uncommon issue. Some users have had some success by installing QuickCam 11.5.0.1169. If this is the only problem you have, I'll send you to the Tech Team to help solve.

JavaRa …by: Paul McLain and Fred de Vries

Please download JavaRa (Copyright © 2008 RaProducts.org) and unzip it to your desktop.
***Please close any instances of Internet Explorer before continuing!***
Print these instructions…you won't have Internet access during this particular phase!

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English or the appropriate language…and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location.
Copy and paste the contents of the JavaRa log, in your next reply.

Then give me a new HijackThis log and tell me about any issues you are still having.

Aton

Post #13July 24, 2009, 12:59 PM UTC

JavaRa 1.15 Removal Log.

Report follows after line.

————————————

The JavaRa removal process was started on Fri Jul 24 08:57:17 2009

Found and removed: C:\Program Files\Java\jre1.5.0_06

Found and removed: C:\Program Files\Java\jre1.6.0_01

Found and removed: C:\Program Files\Java\jre1.6.0_07

Found and removed: C:\Documents and Settings\Aton\Application Data\Sun\Java\jre1.6.0_11

Found and removed: C:\Documents and Settings\Aton\Application Data\Sun\Java\jre1.6.0_12

Found and removed: Software\JavaSoft\Java2D\1.5.0_06

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Classes\JavaPlugin.150_06

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_06

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_06

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510006

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150060}

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610001

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610001

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610001

Found and removed: SOFTWARE\Classes\JavaPlugin.160_01

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_01

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_01

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610001

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610001

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610001

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160010}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_06

Found and removed: Software\Classes\JavaPlugin.160_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_01

Found and removed: Software\JavaSoft\Java2D\1.6.0_01

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_07

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_07

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610007

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610007

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160070}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_06\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_01\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_01\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_07\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_01.b06\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core1.zip

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core2.zip

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip

JavaRa 1.15 Removal Log.

Report follows after line.

————————————

The JavaRa removal process was started on Fri Jul 24 08:57:44 2009

————————————

Finished reporting.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:58:43 AM, on 7/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\AstSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystart.com?pr=oovoo2_0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\dtx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: ooVoo Toolbar - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files\oovootb\dtx.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [oovoo.exe] C:\Program Files\ooVoo\ooVoo.exe /minimized
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINDOWS\system32\AstSrv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 9931 bytes

No more issues. fixed the logishrd and everything is all good now. Thank you TomK

Tomk

Post #14July 24, 2009, 2:15 PM UTC

Aton,

Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Please re-enable any security that was disabled.

Now to remove most of the tools that we have used in fixing your machine:

Make sure you have an Internet Connection.
Download OTC to your desktop and run it
A list of tool components used in the cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
Click Yes to begin the cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Aton

Post #15July 25, 2009, 2:13 AM UTC

Thank you TomK. I understand and I will message you in the future if I need it again. I really appreciate the help. Have a great week.

✨ Ask AI

Ask AI