What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Renos.IO Troubles!

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Okay, I'm quite new to the forums, and I seen the staff at What The Tech Forums solve simalar cases. I'm quite young and confused. This thing called "b.exe" plays random audio and makes loads of pop ups, it also slows down my net and I would like to stop it in it's track. Can you guys please help me?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:38:03, on 24/07/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\T-Mobile\web'n'walk Manager\WTGU.exe
C:\Program Files\Malwarebytes' Anti-Malware\mb.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThiss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: RefresherBand Class - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\PROGRA~1\YREFRE~1\YREFRE~1.DLL
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Update Manager] C:\Windows\system32\WinUpdate.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [DataCardMonitor] C:\Program Files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe
O4 - HKLM\..\Run: [Wireless Manager] "C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe" startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [bike hold] "C:\ProgramData\book proxy proxy.t5323yq"
O4 - HKCU\..\Run: [Base road long save] "C:\ProgramData\thunk close bolt.d1vuxv"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Windows Update Manager] C:\Users\ravi\AppData\Roaming\WinUpdate.exe
O4 - HKCU\..\Run: [Updater shortcut] C:\Program Files\T-Mobile\web'n'walk Manager\WTGU.exe
O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{53786C01-0B0C-464C-8447-8AB5FE3894D1}: NameServer = 85.255.112.107,85.255.112.226
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.107,85.255.112.226
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.107,85.255.112.226
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

–
End of file - 5882 bytes
Post #2 last edited
Hi and Welcome,

NOTE:
  • Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
  • Absence of symptoms does not always mean the computer is clean
  • Kindly follow my instructions in the order posted.
  • Please DO NOT run any scans or fix items without my direction.



Please do the following:

STEP #1

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


STEP #2


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
I donloaded DDS as you wanted, but when I run it, it doesn't do anything, it just says about disabling Script Tools or something. I turned off all my anti-virus and Firewall
Post #4
Hi,

It should continue to run if you keep pressing OK, but if it doesn't then please run this tool instead:

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Post #5
OTL logfile created on: 25/07/2009 16:37:11 - Run 1
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Users\ravi\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1022.58 Mb Total Physical Memory | 460.54 Mb Available Physical Memory | 45.04% Memory free
2.26 Gb Paging File | 1.31 Gb Available in Paging File | 58.12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 113.02 Gb Free Space | 75.83% Space Free | Partition Type: NTFS
Drive D: | 12.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 3.94 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RAVII-PC
Current User Name: ravi
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe (Affinegy, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET)
PRC - C:\Program Files\NETGATE\Spy Emergency 2009\SpyEmergencySrv.exe (NETGATE Technologies s.r.o.)
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe (Affinegy, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
PRC - C:\Windows\ehome\ehmsas.exe (Microsoft Corporation)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Internet Explorer\ieuser.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre6\bin\jp2launcher.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre6\bin\java.exe (Sun Microsystems, Inc.)
PRC - C:\Users\ravi\AppData\Local\Temp\c.exe ()
PRC - C:\Program Files\T-Mobile\web'n'walk Manager\WTGU.exe ()
PRC - C:\Users\ravi\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (AffinegyService [Auto | Running]) – C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe (Affinegy, Inc.)
SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service [Auto | Running]) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ehRecvr [On_Demand | Stopped]) – C:\Windows\ehome\ehRecvr.exe (Microsoft Corporation)
SRV - (ehSched [On_Demand | Stopped]) – C:\Windows\ehome\ehsched.exe (Microsoft Corporation)
SRV - (ehstart [Auto | Stopped]) – C:\Windows\ehome\ehstart.dll (Microsoft Corporation)
SRV - (EhttpSrv [On_Demand | Stopped]) – C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (ESET)
SRV - (ekrn [Auto | Running]) – C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET)
SRV - (Eventlog [Auto | Running]) – C:\Windows\System32\wevtsvc.dll (Microsoft Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (idsvc [Unknown | Stopped]) – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Irmon [Auto | Running]) – C:\Windows\System32\irmon.dll (Microsoft Corporation)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (SpyEmrgSrv [Auto | Running]) – C:\Program Files\NETGATE\Spy Emergency 2009\SpyEmergencySrv.exe (NETGATE Technologies s.r.o.)
SRV - (WinDefend [Auto | Running]) – C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (adp94xx [Disabled | Stopped]) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (adpahci [Disabled | Stopped]) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (adpu160m [Disabled | Stopped]) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (adpu320 [Disabled | Stopped]) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (AFGSp50 [On_Demand | Running]) – C:\Windows\System32\Drivers\AFGSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (aic78xx [Disabled | Stopped]) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (aliide [Disabled | Stopped]) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (arc [Disabled | Stopped]) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (arcsas [Disabled | Stopped]) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (BrFiltLo [On_Demand | Stopped]) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp [On_Demand | Stopped]) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (Brserid [Disabled | Stopped]) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrSerWdm [Disabled | Stopped]) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm [Disabled | Stopped]) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer [On_Demand | Stopped]) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (cmdide [Disabled | Stopped]) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (E1G60 [On_Demand | Stopped]) – C:\Windows\System32\DRIVERS\E1G60I32.sys (Intel Corporation)
DRV - (eamon [Auto | Running]) – C:\Windows\System32\DRIVERS\eamon.sys (ESET)
DRV - (easdrv [System | Running]) – C:\Windows\System32\DRIVERS\easdrv.sys (ESET)
DRV - (elxstor [Disabled | Stopped]) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (epfw [Auto | Running]) – C:\Windows\System32\DRIVERS\epfw.sys (ESET)
DRV - (Epfwndis [On_Demand | Running]) – C:\Windows\System32\DRIVERS\Epfwndis.sys (ESET)
DRV - (epfwtdi [System | Running]) – C:\Windows\System32\DRIVERS\epfwtdi.sys (ESET)
DRV - (GarenaPEngine [On_Demand | Stopped]) – C:\Windows\TEMP\RCO1CBF.tmp ()
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\Windows\System32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HpCISSs [Disabled | Stopped]) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (hwdatacard [On_Demand | Stopped]) – C:\Windows\System32\DRIVERS\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (iaStorV [Disabled | Stopped]) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (iirsp [Disabled | Stopped]) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (irsir [On_Demand | Running]) – C:\Windows\System32\DRIVERS\irsir.sys (Microsoft Corporation)
DRV - (iteatapi [Disabled | Stopped]) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (iteraid [Disabled | Stopped]) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (LSI_FC [Disabled | Stopped]) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (LSI_SAS [Disabled | Stopped]) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (LSI_SCSI [Disabled | Stopped]) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (MBAMSwissArmy [On_Demand | Stopped]) – C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (mcdbus [On_Demand | Running]) – C:\Windows\System32\DRIVERS\mcdbus.sys (MagicISO, Inc.)
DRV - (megasas [Disabled | Stopped]) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (MegaSR [Disabled | Stopped]) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (Mraid35x [Disabled | Stopped]) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (nfrd960 [Disabled | Stopped]) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (ntrigdigi [Disabled | Stopped]) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (NVENETFD [On_Demand | Running]) – C:\Windows\System32\DRIVERS\nvm60x32.sys (NVIDIA Corporation)
DRV - (nvlddmkm [On_Demand | Running]) – C:\Windows\System32\DRIVERS\nvlddmkm.sys (NVIDIA Corporation)
DRV - (nvraid [Disabled | Stopped]) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor [Boot | Running]) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (ql2300 [Disabled | Stopped]) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (ql40xx [Disabled | Stopped]) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (secdrv [Auto | Running]) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SiSRaid4 [Disabled | Stopped]) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (SpyEmrg [System | Running]) – C:\Windows\System32\Drivers\spyemrg.sys (NETGATE Technologies s.r.o.)
DRV - (SpyEmrgAccess [On_Demand | Running]) – C:\Windows\System32\Drivers\spyemrg_access.sys (NETGATE Technologies s.r.o.)
DRV - (SpyEmrgGuard [On_Demand | Running]) – C:\Windows\System32\Drivers\spyemrg_guard.sys (NETGATE Technologies s.r.o.)
DRV - (Symc8xx [Disabled | Stopped]) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_hi [Disabled | Stopped]) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Sym_u3 [Disabled | Stopped]) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (uliahci [Disabled | Stopped]) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (UlSata [Disabled | Stopped]) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (ulsata2 [Disabled | Stopped]) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (USBAAPL [On_Demand | Stopped]) – C:\Windows\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (viaide [Disabled | Stopped]) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (vsmraid [Disabled | Stopped]) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/07/06 02:38:21 | 00,000,000 | —D | M]


O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (RefresherBand Class) - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\Program Files\YRefresher\YRefresher.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (RefresherBand Class) - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\Program Files\YRefresher\YRefresher.dll ()
O4 - HKLM..\Run: [DataCardMonitor] C:\Program Files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Update Manager] C:\Windows\System32\WinUpdate.exe ()
O4 - HKLM..\Run: [Wireless Manager] C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe (Affinegy, Inc.)
O4 - HKCU..\Run: [Base road long save] C:\ProgramData\16 heart wipe.oip File not found
O4 - HKCU..\Run: [bike hold] C:\ProgramData\book proxy proxy.45z File not found
O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (Microsoft Corporation)
O4 - HKCU..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SpyEmergency] C:\Program Files\NETGATE\Spy Emergency 2009\SpyEmergency.exe (NETGATE Technologies s.r.o.)
O4 - HKCU..\Run: [Updater shortcut] C:\Program Files\T-Mobile\web'n'walk Manager\WTGU.exe ()
O4 - HKCU..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe (WhatPulse.org)
O4 - HKCU..\Run: [Windows Update Manager] C:\Users\ravi\AppData\Roaming\WinUpdate.exe ()
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.DLL (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.107,85.255.112.226
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 00,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2005/08/31 18:37:18 | 00,000,025 | R— | M] () - D:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2005/02/25 17:24:46 | 00,000,051 | R— | M] () - E:\autorun.inf – [ UDF ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2 C:\Windows\*.tmp files]
[2009/07/24 22:30:41 | 00,000,924 | —- | C] () – C:\Users\Public\Desktop\Spy Emergency 2009.lnk
[2009/07/24 22:30:34 | 00,015,672 | —- | C] (NETGATE Technologies s.r.o.) – C:\Windows\System32\drivers\spyemrg_access.sys
[2009/07/24 22:30:34 | 00,014,392 | —- | C] (NETGATE Technologies s.r.o.) – C:\Windows\System32\drivers\spyemrg_guard.sys
[2009/07/24 22:30:34 | 00,012,344 | —- | C] (NETGATE Technologies s.r.o.) – C:\Windows\System32\drivers\spyemrg.sys
[2009/07/24 22:30:33 | 00,000,000 | —D | C] – C:\ProgramData\NETGATE
[2009/07/24 22:30:33 | 00,000,000 | —D | C] – C:\Program Files\NETGATE
[2009/07/24 21:46:53 | 00,090,128 | —- | C] () – C:\ProgramData\16 heart wipe.oip00
[2009/07/24 21:45:52 | 00,397,328 | —- | C] () – C:\ProgramData\book proxy proxy.zfung
[2009/07/24 21:45:52 | 00,393,232 | —- | C] () – C:\ProgramData\book proxy proxy.45za4u
[2009/07/24 21:24:27 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/07/24 21:11:32 | 00,000,818 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/07/24 21:11:29 | 00,038,160 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2009/07/24 21:11:28 | 00,019,096 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2009/07/24 21:11:28 | 00,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2009/07/24 21:11:28 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/07/24 18:36:13 | 00,148,888 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2009/07/24 18:36:13 | 00,144,792 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2009/07/24 18:36:13 | 00,144,792 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2009/07/24 18:35:46 | 00,000,000 | —D | C] – C:\Program Files\Java
[2009/07/24 18:35:04 | 00,000,000 | —D | C] – C:\ProgramData\McAfee
[2009/07/24 16:38:08 | 00,027,072 | —- | C] (Printing Communications Assoc., Inc. (PCAUSA)) – C:\Windows\System32\drivers\AFGSp50.sys
[2009/07/24 16:38:08 | 00,001,651 | —- | C] () – C:\Users\Public\Desktop\Wireless Manager.lnk
[2009/07/24 16:37:13 | 00,000,000 | —D | C] – C:\ProgramData\Affinegy
[2009/07/24 16:37:13 | 00,000,000 | —D | C] – C:\Program Files\Virgin Broadband Wireless
[2009/07/23 01:50:15 | 00,001,051 | —- | C] () – C:\Users\Public\Desktop\web'n'walk Manager.lnk
[2009/07/23 01:50:06 | 00,872,192 | —- | C] (DiBcom SA) – C:\Windows\System32\drivers\mod7700.sys
[2009/07/23 01:50:06 | 00,103,680 | —- | C] (Huawei Technologies Co., Ltd.) – C:\Windows\System32\drivers\ewusbfake.sys
[2009/07/23 01:50:06 | 00,101,632 | —- | C] (Huawei Technologies Co., Ltd.) – C:\Windows\System32\drivers\ewusbmdm.sys
[2009/07/23 01:50:06 | 00,100,864 | —- | C] (Huawei Technologies Co., Ltd.) – C:\Windows\System32\drivers\ewusbnet.sys
[2009/07/23 01:50:06 | 00,023,424 | —- | C] (Huawei Tech. Co., Ltd.) – C:\Windows\System32\drivers\ewdcsc.sys
[2009/07/23 01:31:53 | 00,719,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bmutil.dll
[2009/07/23 01:31:53 | 00,471,040 | —- | C] (Bytemobile, Inc.) – C:\Windows\System32\bmnet.dll
[2009/07/23 01:31:53 | 00,270,336 | —- | C] (Bytemobile, Inc.) – C:\Windows\System32\bminstall.dll
[2009/07/23 01:31:53 | 00,126,976 | —- | C] (Bytemobile, Inc.) – C:\Windows\System32\bmdumpd.bin
[2009/07/23 01:31:53 | 00,018,816 | —- | C] (Bytemobile, Inc.) – C:\Windows\System32\drivers\tcpipBM.sys
[2009/07/23 01:31:53 | 00,008,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sporder.dll
[2009/07/23 01:31:17 | 00,000,000 | —D | C] – C:\Program Files\T-Mobile
[2009/07/22 05:36:11 | 00,000,000 | —D | C] – C:\ProgramData\ESET
[2009/07/22 05:36:11 | 00,000,000 | —D | C] – C:\Program Files\ESET
[2009/07/22 03:42:01 | 00,000,278 | -H– | C] () – C:\Windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
[2009/07/22 03:41:58 | 00,000,278 | -H– | C] () – C:\Windows\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
[2009/07/21 21:37:31 | 00,000,000 | —D | C] – C:\Program Files\Ventrilo
[2009/07/21 21:37:27 | 00,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/07/21 21:36:41 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2009/07/21 13:42:39 | 00,033,280 | —- | C] () – C:\Windows\System32\WinUpdate.exe
[2009/07/19 14:20:01 | 00,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2009/07/19 14:20:01 | 00,000,000 | —D | C] – C:\Program Files\Rockstar Games
[2009/07/19 14:19:46 | 00,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2009/07/19 14:18:25 | 00,116,736 | —- | C] (MagicISO, Inc.) – C:\Windows\System32\drivers\mcdbus.sys
[2009/07/19 14:18:24 | 00,000,000 | —D | C] – C:\Program Files\MagicDisc
[2009/07/19 01:49:35 | 00,000,000 | —D | C] – C:\ProgramData\Google
[2009/07/19 01:49:35 | 00,000,000 | —D | C] – C:\Program Files\Google
[2009/07/19 01:49:09 | 00,000,000 | —D | C] – C:\ProgramData\NOS
[2009/07/16 20:49:16 | 00,034,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lhacm.acm
[2009/07/16 20:49:10 | 00,000,000 | —D | C] – C:\Program Files\Teamspeak2_RC2
[2009/07/15 14:39:45 | 00,289,792 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2009/07/15 14:39:45 | 00,156,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2009/07/15 14:39:45 | 00,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fontsub.dll
[2009/07/15 14:39:44 | 00,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dciman32.dll
[2009/07/09 03:10:01 | 00,000,000 | —D | C] – C:\Program Files\Garena
[2009/07/09 02:06:29 | 01,846,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_41.dll
[2009/07/09 02:06:29 | 00,453,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_41.dll
[2009/07/09 02:06:27 | 04,178,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_41.dll
[2009/07/09 02:06:26 | 02,036,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_40.dll
[2009/07/09 02:06:26 | 00,517,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_4.dll
[2009/07/09 02:06:26 | 00,452,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_40.dll
[2009/07/09 02:06:26 | 00,235,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_4.dll
[2009/07/09 02:06:26 | 00,069,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_3.dll
[2009/07/09 02:06:26 | 00,022,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_6.dll
[2009/07/09 02:06:25 | 04,379,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_40.dll
[2009/07/09 02:06:25 | 00,514,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_3.dll
[2009/07/09 02:06:25 | 00,070,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_2.dll
[2009/07/09 02:06:24 | 00,509,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_2.dll
[2009/07/09 02:06:24 | 00,235,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_3.dll
[2009/07/09 02:06:24 | 00,068,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_1.dll
[2009/07/09 02:06:24 | 00,023,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_5.dll
[2009/07/09 02:06:23 | 01,493,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_39.dll
[2009/07/09 02:06:23 | 00,467,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_39.dll
[2009/07/09 02:06:23 | 00,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_2.dll
[2009/07/09 02:06:22 | 03,851,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_39.dll
[2009/07/09 02:06:22 | 00,507,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_1.dll
[2009/07/09 02:06:22 | 00,065,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAPOFX1_0.dll
[2009/07/09 02:06:21 | 00,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_1.dll
[2009/07/09 02:06:21 | 00,025,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_4.dll
[2009/07/09 02:06:20 | 03,850,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_38.dll
[2009/07/09 02:06:20 | 01,491,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_38.dll
[2009/07/09 02:06:20 | 00,467,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_38.dll
[2009/07/09 02:06:19 | 00,479,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XAudio2_0.dll
[2009/07/09 02:06:18 | 03,786,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_37.dll
[2009/07/09 02:06:18 | 01,420,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_37.dll
[2009/07/09 02:06:18 | 00,462,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_37.dll
[2009/07/09 02:06:18 | 00,238,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine3_0.dll
[2009/07/09 02:06:18 | 00,025,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_3.dll
[2009/07/09 02:06:17 | 00,267,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_10.dll
[2009/07/09 02:06:16 | 03,734,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_36.dll
[2009/07/09 02:06:16 | 01,374,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_36.dll
[2009/07/09 02:06:16 | 00,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_36.dll
[2009/07/09 02:06:15 | 01,358,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_35.dll
[2009/07/09 02:06:15 | 00,444,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_35.dll
[2009/07/09 02:06:15 | 00,267,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_9.dll
[2009/07/09 02:06:14 | 03,727,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_35.dll
[2009/07/09 02:06:14 | 01,124,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_34.dll
[2009/07/09 02:06:14 | 00,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_34.dll
[2009/07/09 02:06:14 | 00,266,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_8.dll
[2009/07/09 02:06:14 | 00,017,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\X3DAudio1_2.dll
[2009/07/09 02:06:13 | 03,497,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_34.dll
[2009/07/09 02:06:13 | 00,081,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xinput1_3.dll
[2009/07/09 02:06:11 | 03,495,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_33.dll
[2009/07/09 02:06:11 | 01,123,696 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_33.dll
[2009/07/09 02:06:11 | 00,443,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10_33.dll
[2009/07/09 02:06:11 | 00,261,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_7.dll
[2009/07/09 02:06:10 | 00,440,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx10.dll
[2009/07/09 02:06:10 | 00,255,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_6.dll
[2009/07/09 02:06:10 | 00,251,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_5.dll
[2009/07/09 02:06:09 | 03,426,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_32.dll
[2009/07/09 02:06:09 | 02,414,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_31.dll
[2009/07/09 02:06:09 | 00,237,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_4.dll
[2009/07/09 02:06:09 | 00,236,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_3.dll
[2009/07/09 02:06:09 | 00,015,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\x3daudio1_1.dll
[2009/07/09 02:06:08 | 00,230,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_2.dll
[2009/07/09 02:06:08 | 00,229,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_1.dll
[2009/07/09 02:06:08 | 00,062,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xinput1_2.dll
[2009/07/09 02:06:08 | 00,062,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xinput1_1.dll
[2009/07/09 02:06:05 | 02,388,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_30.dll
[2009/07/09 02:06:02 | 00,230,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xactengine2_0.dll
[2009/07/09 02:06:02 | 00,014,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\x3daudio1_0.dll
[2009/07/09 02:06:01 | 02,332,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_29.dll
[2009/07/09 02:06:01 | 02,323,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_28.dll
[2009/07/09 02:06:01 | 02,319,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_27.dll
[2009/07/09 02:06:01 | 02,297,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_26.dll
[2009/07/09 02:06:01 | 02,222,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_24.dll
[2009/07/09 02:04:23 | 00,000,000 | -H-D | C] – C:\Windows\msdownld.tmp
[2009/07/09 02:04:19 | 00,000,000 | —D | C] – C:\Windows\System32\directx
[2009/07/09 00:41:57 | 00,000,000 | —D | C] – C:\Program Files\WinRAR
[2009/07/08 22:05:06 | 00,000,000 | —D | C] – C:\Program Files\SystemRequirementsLab
[2009/07/08 21:47:20 | 00,000,000 | —D | C] – C:\Program Files\BitTorrent
[2009/07/08 21:47:16 | 00,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2009/07/08 21:47:16 | 00,000,000 | —D | C] – C:\Program Files\AskBarDis
[2009/07/08 17:42:31 | 00,000,000 | —D | C] – C:\Program Files\YRefresher
[2009/07/08 17:12:29 | 00,000,000 | —D | C] – C:\Program Files\WhatPulse
[2009/07/08 03:01:47 | 00,410,984 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\deploytk.dll
[2009/07/08 00:28:35 | 00,000,000 | —D | C] – C:\ProgramData\Messenger Plus!
[2009/07/06 22:17:20 | 00,000,000 | —D | C] – C:\ProgramData\File dvd base road
[2009/07/06 22:16:56 | 00,040,976 | —- | C] () – C:\ProgramData\book proxy proxy.qbfq7an
[2009/07/06 22:16:56 | 00,000,000 | —D | C] – C:\ProgramData\inside obj
[2009/07/06 22:16:37 | 00,000,000 | —D | C] – C:\Program Files\Crcle Developement
[2009/07/06 22:16:35 | 00,000,000 | —D | C] – C:\Program Files\Messenger Plus! Live
[2009/07/06 14:08:20 | 00,001,804 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2009/07/06 14:08:08 | 00,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\System32\GEARAspi.dll
[2009/07/06 14:08:08 | 00,023,400 | —- | C] (GEAR Software Inc.) – C:\Windows\System32\drivers\GEARAspiWDM.sys
[2009/07/06 14:08:08 | 00,000,000 | —D | C] – C:\Windows\System32\DRVSTORE
[2009/07/06 14:07:49 | 00,000,000 | —D | C] – C:\Program Files\iPod
[2009/07/06 14:07:42 | 00,000,000 | —D | C] – C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/07/06 14:07:42 | 00,000,000 | —D | C] – C:\Program Files\iTunes
[2009/07/06 14:06:33 | 00,000,000 | —D | C] – C:\Program Files\Bonjour
[2009/07/06 14:05:58 | 00,001,726 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2009/07/06 14:05:30 | 00,000,000 | —D | C] – C:\Program Files\QuickTime
[2009/07/06 14:05:29 | 00,000,000 | —D | C] – C:\ProgramData\Apple Computer
[2009/07/06 14:04:48 | 00,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2009/07/06 14:02:50 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2009/07/06 14:02:49 | 00,000,000 | —D | C] – C:\ProgramData\Apple
[2009/07/06 14:00:57 | 00,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2009/07/06 14:00:02 | 00,000,000 | —D | C] – C:\Program Files\Spotify
[2009/07/06 10:41:21 | 00,000,000 | —D | C] – C:\Windows\Panther
[2009/07/06 10:41:08 | 00,008,192 | R-S- | C] () – C:\BOOTSECT.BAK
[2009/07/06 10:41:07 | 00,333,203 | RHS- | C] () – C:\bootmgr
[2009/07/06 10:41:07 | 00,000,000 | -HSD | C] – C:\Boot
[2009/07/06 10:40:49 | 00,000,024 | RH– | C] () – C:\Windows\dell_version
[2009/07/06 10:40:49 | 00,000,000 | —D | C] – C:\Windows\System32\OEM
[2009/07/06 02:53:25 | 00,106,605 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/07/06 02:53:25 | 00,034,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msscb.dll
[2009/07/06 02:53:25 | 00,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/07/06 02:53:25 | 00,011,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msshooks.dll
[2009/07/06 02:53:24 | 00,754,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\propsys.dll
[2009/07/06 02:53:24 | 00,313,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\thawbrkr.dll
[2009/07/06 02:53:24 | 00,301,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srchadmin.dll
[2009/07/06 02:53:24 | 00,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msshsq.dll
[2009/07/06 02:53:24 | 00,143,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\korwbrkr.dll
[2009/07/06 02:53:24 | 00,087,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SearchFilterHost.exe
[2009/07/06 02:53:24 | 00,087,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssitlb.dll
[2009/07/06 02:53:24 | 00,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\propdefs.dll
[2009/07/06 02:53:24 | 00,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msstrc.dll
[2009/07/06 02:53:24 | 00,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssprxy.dll
[2009/07/06 02:53:23 | 11,967,524 | —- | C] () – C:\Windows\System32\korwbrkr.lex
[2009/07/06 02:53:23 | 06,103,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\chtbrkr.dll
[2009/07/06 02:53:23 | 01,671,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\chsbrkr.dll
[2009/07/06 02:53:23 | 01,582,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tquery.dll
[2009/07/06 02:53:23 | 01,418,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssrch.dll
[2009/07/06 02:53:23 | 00,670,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssvp.dll
[2009/07/06 02:53:23 | 00,439,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SearchIndexer.exe
[2009/07/06 02:53:23 | 00,350,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssph.dll
[2009/07/06 02:53:23 | 00,203,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssphtb.dll
[2009/07/06 02:53:23 | 00,194,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\offfilt.dll
[2009/07/06 02:53:23 | 00,184,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SearchProtocolHost.exe
[2009/07/06 02:53:23 | 00,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nlhtml.dll
[2009/07/06 02:53:23 | 00,060,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msscntrs.dll
[2009/07/06 02:53:23 | 00,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xmlfilter.dll
[2009/07/06 02:53:23 | 00,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mimefilt.dll
[2009/07/06 02:53:23 | 00,038,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rtffilt.dll
[2009/07/06 02:53:23 | 00,029,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsepno.dll
[2009/07/06 02:52:27 | 00,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2009/07/06 02:34:17 | 00,105,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
[2009/07/06 02:34:17 | 00,097,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\infocardapi.dll
[2009/07/06 02:34:16 | 00,622,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\icardagt.exe
[2009/07/06 02:34:16 | 00,043,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2009/07/06 02:34:16 | 00,037,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\infocardcpl.cpl
[2009/07/06 02:34:16 | 00,011,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\icardres.dll
[2009/07/06 02:34:14 | 00,781,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationNative_v0300.dll
[2009/07/06 02:34:11 | 00,326,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2009/07/06 02:28:38 | 00,096,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dfshim.dll
[2009/07/06 02:28:36 | 00,282,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscoree.dll
[2009/07/06 02:28:36 | 00,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2009/07/06 02:28:31 | 00,158,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscorier.dll
[2009/07/06 02:28:27 | 00,083,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscories.dll
[2009/07/06 02:24:04 | 01,255,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lsasrv.dll
[2009/07/06 02:24:04 | 00,888,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kernel32.dll
[2009/07/06 02:24:03 | 00,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secur32.dll
[2009/07/06 02:24:03 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\amxread.dll
[2009/07/06 02:24:03 | 00,013,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\apilogen.dll
[2009/07/06 02:24:02 | 00,269,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\es.dll
[2009/07/06 02:24:01 | 00,738,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcomm.dll
[2009/07/06 02:23:29 | 12,240,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0007.dll
[2009/07/06 02:23:26 | 02,644,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NlsLexicons0009.dll
[2009/07/06 02:23:14 | 00,801,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NaturalLanguage6.dll
[2009/07/06 02:22:31 | 00,428,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2009/07/06 02:22:31 | 00,217,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisrndr.ax
[2009/07/06 02:22:30 | 00,293,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2009/07/06 02:22:27 | 00,177,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2009/07/06 02:22:27 | 00,080,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSNP.ax
[2009/07/06 02:22:27 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSDvbNP.ax
[2009/07/06 02:22:21 | 03,581,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.dll
[2009/07/06 02:22:20 | 06,069,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieframe.dll
[2009/07/06 02:22:19 | 01,166,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\urlmon.dll
[2009/07/06 02:22:19 | 00,827,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wininet.dll
[2009/07/06 02:22:19 | 00,270,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iertutil.dll
[2009/07/06 02:22:18 | 01,383,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2009/07/06 02:22:18 | 00,671,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2009/07/06 02:22:18 | 00,458,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2009/07/06 02:22:18 | 00,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2009/07/06 02:22:18 | 00,389,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2009/07/06 02:22:18 | 00,230,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2009/07/06 02:22:18 | 00,102,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\occache.dll
[2009/07/06 02:22:18 | 00,078,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieencode.dll
[2009/07/06 02:22:18 | 00,028,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2009/07/06 02:22:18 | 00,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2009/07/06 02:22:12 | 11,580,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shell32.dll
[2009/07/06 02:22:06 | 00,019,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kd1394.dll
[2009/07/06 02:22:05 | 00,988,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winload.exe
[2009/07/06 02:22:05 | 00,927,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winresume.exe
[2009/07/06 02:22:05 | 00,615,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ci.dll
[2009/07/06 02:22:05 | 00,378,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srcore.dll
[2009/07/06 02:22:05 | 00,318,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rstrui.exe
[2009/07/06 02:22:05 | 00,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setbcdlocale.dll
[2009/07/06 02:22:05 | 00,040,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srclient.dll
[2009/07/06 02:22:05 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srdelayed.exe
[2009/07/06 02:22:04 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kbd106n.dll
[2009/07/06 02:21:55 | 02,868,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2009/07/06 02:21:55 | 02,386,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVCORE.DLL
[2009/07/06 02:21:54 | 00,996,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMNetMgr.dll
[2009/07/06 02:21:54 | 00,094,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logagent.exe
[2009/07/06 02:21:52 | 00,712,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WindowsCodecs.dll
[2009/07/06 02:21:52 | 00,425,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PhotoMetadataHandler.dll
[2009/07/06 02:21:52 | 00,347,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WindowsCodecsExt.dll
[2009/07/06 02:21:49 | 10,622,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmp.dll
[2009/07/06 02:21:47 | 08,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2009/07/06 02:21:47 | 00,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwmp.dll
[2009/07/06 02:21:47 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdxm.ocx
[2009/07/06 02:21:47 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxmasf.dll
[2009/07/06 02:21:43 | 00,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2009/07/06 02:21:42 | 04,240,384 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2009/07/06 02:21:42 | 01,695,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\gameux.dll
[2009/07/06 02:21:37 | 03,547,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2009/07/06 02:21:37 | 00,551,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rpcss.dll
[2009/07/06 02:21:36 | 03,599,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2009/07/06 02:21:36 | 00,666,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelinesvc.exe
[2009/07/06 02:21:35 | 00,183,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sdohlp.dll
[2009/07/06 02:21:35 | 00,098,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasrecst.dll
[2009/07/06 02:21:35 | 00,054,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasads.dll
[2009/07/06 02:21:35 | 00,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasdatastore.dll
[2009/07/06 02:21:35 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelineprxy.dll
[2009/07/06 02:21:35 | 00,017,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iashost.exe
[2009/07/06 02:21:33 | 00,288,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\srv.sys
[2009/07/06 02:21:30 | 02,033,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2009/07/06 02:21:29 | 00,303,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpeffects.dll
[2009/07/06 02:21:28 | 00,636,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\localspl.dll
[2009/07/06 02:21:26 | 02,927,104 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2009/07/06 02:21:25 | 00,562,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdtcprx.dll
[2009/07/06 02:21:25 | 00,038,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xolehlp.dll
[2009/07/06 02:21:23 | 00,784,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rpcrt4.dll
[2009/07/06 02:21:22 | 00,268,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schannel.dll
[2009/07/06 02:21:21 | 01,191,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml3.dll
[2009/07/06 02:21:20 | 00,376,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winhttp.dll
[2009/07/06 02:21:18 | 00,891,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\tcpip.sys
[2009/07/06 02:21:18 | 00,072,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\pacer.sys
[2009/07/06 02:21:18 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pacerprf.dll
[2009/07/06 02:21:17 | 00,466,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netapi32.dll
[2009/07/06 02:21:14 | 00,361,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\IPSECSVC.DLL
[2009/07/06 02:21:13 | 00,443,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32spl.dll
[2009/07/06 02:21:10 | 00,241,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceApi.dll
[2009/07/06 02:21:06 | 00,296,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\gdi32.dll
[2009/07/06 02:21:03 | 00,212,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\mrxsmb10.sys
[2009/07/06 02:21:02 | 00,512,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2009/07/06 02:21:02 | 00,430,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2009/07/06 02:21:02 | 00,180,224 | —- | C] (Microsoft Corporation) – C:\Windows\System32\scrobj.dll
[2009/07/06 02:21:02 | 00,172,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\scrrun.dll
[2009/07/06 02:21:02 | 00,155,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wscript.exe
[2009/07/06 02:21:02 | 00,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wshom.ocx
[2009/07/06 02:21:02 | 00,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cscript.exe
[2009/07/06 02:21:02 | 00,090,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wshext.dll
[2009/07/06 02:21:00 | 00,625,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\dxgkrnl.sys
[2009/07/06 02:21:00 | 00,565,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\emdmgmt.dll
[2009/07/06 02:21:00 | 00,148,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\nwifi.sys
[2009/07/06 02:21:00 | 00,045,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dataclen.dll
[2009/07/06 02:21:00 | 00,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2009/07/06 02:20:59 | 01,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2009/07/06 02:20:57 | 00,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Faultrep.dll
[2009/07/06 02:20:57 | 00,125,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wersvc.dll
[2009/07/06 02:20:56 | 00,113,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\rmcast.sys
[2009/07/06 02:20:49 | 01,645,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\connect.dll
[2009/07/06 02:16:21 | 00,000,000 | —D | C] – C:\Windows\System32\Macromed
[2009/07/06 02:15:01 | 01,334,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml6.dll
[2009/07/06 02:05:32 | 00,000,000 | —D | C] – C:\b31d8b6333464bfd1926491d
[2009/07/06 02:02:10 | 00,000,000 | —D | C] – C:\Program Files\Microsoft
[2009/07/06 02:02:00 | 00,000,000 | —D | C] – C:\Users\Public\Documents\microsoft
[2009/07/06 02:01:41 | 00,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2009/07/06 02:01:23 | 00,000,000 | —D | C] – C:\Program Files\Windows Live
[2009/07/06 02:01:03 | 00,000,000 | —D | C] – C:\Windows\PCHEALTH
[2009/07/06 02:01:00 | 00,000,000 | -HSD | C] – C:\Windows\Installer
[2009/07/06 01:59:51 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2009/07/06 01:56:15 | 00,000,000 | —D | C] – C:\Windows\Minidump
[2009/07/06 01:48:54 | 01,809,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuaueng.dll
[2009/07/06 01:48:54 | 01,524,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wucltux.dll
[2009/07/06 01:48:54 | 00,051,224 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuauclt.exe
[2009/07/06 01:48:54 | 00,043,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wups2.dll
[2009/07/06 01:48:43 | 00,561,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuapi.dll
[2009/07/06 01:48:43 | 00,083,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wudriver.dll
[2009/07/06 01:48:43 | 00,034,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wups.dll
[2009/07/06 01:48:31 | 00,162,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuwebv.dll
[2009/07/06 01:48:31 | 00,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuapp.exe
[2009/07/06 01:47:24 | 00,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2009/07/06 01:47:15 | 00,000,000 | —D | C] – C:\Windows\Debug
[2009/07/06 01:42:03 | 00,000,000 | —D | C] – C:\Windows\Prefetch
[2009/07/06 01:41:57 | 00,000,000 | -HSD | C] – C:\System Volume Information
[2006/11/02 13:35:32 | 00,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:23:31 | 00,000,219 | —- | C] () – C:\Windows\system.ini
[2006/11/02 11:23:31 | 00,000,144 | —- | C] () – C:\Windows\win.ini
[2006/11/02 08:40:29 | 00,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== Files - Modified Within 30 Days ==========

[2 C:\Windows\*.tmp files]
[2009/07/25 16:22:48 | 00,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/07/25 16:22:48 | 00,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/07/25 16:00:05 | 00,000,278 | -H– | M] () – C:\Windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
[2009/07/25 16:00:04 | 00,000,278 | -H– | M] () – C:\Windows\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
[2009/07/25 14:27:49 | 00,690,960 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2009/07/25 14:27:49 | 00,599,942 | —- | M] () – C:\Windows\System32\perfh009.dat
[2009/07/25 14:27:49 | 00,105,448 | —- | M] () – C:\Windows\System32\perfc009.dat
[2009/07/25 14:22:48 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/07/25 14:22:47 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/07/24 22:30:41 | 00,000,924 | —- | M] () – C:\Users\Public\Desktop\Spy Emergency 2009.lnk
[2009/07/24 21:46:53 | 00,090,128 | —- | M] () – C:\ProgramData\16 heart wipe.oip00
[2009/07/24 21:45:52 | 00,397,328 | —- | M] () – C:\ProgramData\book proxy proxy.zfung
[2009/07/24 21:45:52 | 00,393,232 | —- | M] () – C:\ProgramData\book proxy proxy.45za4u
[2009/07/24 21:11:32 | 00,000,818 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/07/24 18:35:53 | 00,410,984 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\deploytk.dll
[2009/07/24 18:35:53 | 00,148,888 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2009/07/24 18:35:53 | 00,144,792 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2009/07/24 18:35:53 | 00,144,792 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2009/07/24 16:38:08 | 00,001,651 | —- | M] () – C:\Users\Public\Desktop\Wireless Manager.lnk
[2009/07/23 01:50:15 | 00,001,051 | —- | M] () – C:\Users\Public\Desktop\web'n'walk Manager.lnk
[2009/07/21 21:37:37 | 00,000,262 | —- | M] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/07/21 13:42:39 | 00,033,280 | —- | M] () – C:\Windows\System32\WinUpdate.exe
[2009/07/19 21:24:51 | 00,230,120 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/16 20:49:16 | 00,034,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lhacm.acm
[2009/07/13 13:36:34 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2009/07/13 13:36:12 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2009/07/07 08:10:58 | 24,539,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mrt.exe
[2009/07/06 22:16:56 | 00,040,976 | —- | M] () – C:\ProgramData\book proxy proxy.qbfq7an
[2009/07/06 14:08:20 | 00,001,804 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2009/07/06 14:05:58 | 00,001,726 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2009/07/06 14:00:57 | 00,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2009/07/06 10:41:08 | 00,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2009/07/06 01:45:16 | 00,047,092 | —- | M] () – C:\Windows\System32\license.rtf

========== LOP Check ==========

[2009/07/25 14:22:48 | 00,000,006 | -H– | M] () – C:\Windows\Tasks\SA.DAT
[2009/07/23 20:58:28 | 00,015,276 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2009/07/25 16:00:05 | 00,000,278 | -H– | M] () – C:\Windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
[2009/07/25 16:00:04 | 00,000,278 | -H– | M] () – C:\Windows\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job

========== Purity Check ==========


< End of report >
Post #6
OTL Extras logfile created on: 25/07/2009 16:37:12 - Run 1
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Users\ravi\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1022.58 Mb Total Physical Memory | 460.54 Mb Available Physical Memory | 45.04% Memory free
2.26 Gb Paging File | 1.31 Gb Available in Paging File | 58.12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 113.02 Gb Free Space | 75.83% Space Free | Partition Type: NTFS
Drive D: | 12.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 3.94 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RAVII-PC
Current User Name: ravi
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – (BitTorrent, Inc.)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1D146B1A-2950-4667-BE23-1D4E69080655}" = rport=137 | protocol=17 | dir=out | app=system |
"{23F89EA4-BE73-4F01-9305-6F5F73104174}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{385671F5-C877-4EEE-9534-9BC4D666477D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{56D576B1-9182-4868-8E94-2FA941948863}" = lport=137 | protocol=17 | dir=in | app=system |
"{5EB4AC03-B6E2-4304-A98C-00F293F50368}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{66610C5F-D962-4C30-AD24-DC18B63DBFD1}" = rport=139 | protocol=6 | dir=out | app=system |
"{6A3E85B4-035D-4184-9343-0349A046878F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7798FD2B-8BC0-4640-AB3D-42E6C2561B6B}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{8972C659-C7AA-4DFC-B756-CC9059E1F221}" = lport=445 | protocol=6 | dir=in | app=system |
"{8A974D55-DA69-4CB6-A4CC-5FD8E1EFE354}" = lport=2869 | protocol=6 | dir=in | app=system |
"{9636666C-FD0E-4C2C-8A34-A6200C092D25}" = lport=139 | protocol=6 | dir=in | app=system |
"{96C7308D-AE10-4850-9716-9C98BD6F137D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A31B1A81-7089-4678-AC45-3C7C467AA4BD}" = rport=138 | protocol=17 | dir=out | app=system |
"{A985F887-30E0-4BDA-BDEE-47DAD3AA6F78}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{ADC20D14-67E5-426D-AB6C-B91C48F4EB28}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C3F8B98F-86EA-447C-9EA4-82472B7283E5}" = lport=138 | protocol=17 | dir=in | app=system |
"{CB963083-146A-42A2-9935-D300A7E65E6E}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{E3FEFC51-DD9D-43A7-BEEC-227F77E5E3B6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E833A8CE-A268-45F7-B029-8A513D51581C}" = rport=445 | protocol=6 | dir=out | app=system |
"{FBE61F4C-5707-49EC-87E6-27EE2DE5698A}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01082FCC-4E1C-4309-9E06-04624E94E590}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{10784326-E1A4-4174-A87A-00F3FFBC63B9}" = protocol=6 | dir=in | app=c:\program files\virgin broadband wireless\wireless manager.exe |
"{242D1DDC-08F0-4C48-B945-7CCDAF8125DD}" = protocol=17 | dir=in | app=c:\program files\virgin broadband wireless\wireless manager.exe |
"{6A51E8BC-9D97-440D-A722-89DBB22AA728}" = protocol=6 | dir=in | app=c:\program files\virgin broadband wireless\wireless manager.exe |
"{70611C50-20C8-4485-A019-FBD09229CCD1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7F3E2933-D54B-4032-94FA-400E1F2B4160}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{80A67473-3367-48BE-8D51-6C81F2EA7107}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{95747E76-711A-46C8-980A-178EE93FFEE8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{96E24F4F-83A8-49C9-A023-BDB21E0886DD}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{9943BDD2-3F48-4AC6-B46E-6E9AB2A5003D}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{9ED8B9A1-166E-4FC0-BF86-E5B5A0EBF5F5}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{A12AE0E9-F0BC-4A0A-B577-DE585DB4A491}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{A3FBE405-2AC2-493E-BF73-201F6BD885C6}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{ACE63434-FAE2-4376-91B2-BA7B6EFD1E01}" = protocol=6 | dir=in | app=c:\program files\virgin broadband wireless\wireless manager.exe |
"{AEF416B7-6BFC-4CCB-AE1D-9F88BA56FC1A}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B82123FF-1271-4943-985B-8C21EF89E4C7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{C262CDCB-B661-4C38-AF0B-6529E421C950}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{C588E013-149B-40CE-9808-1247FD939C38}" = protocol=17 | dir=in | app=c:\program files\virgin broadband wireless\wireless manager.exe |
"{C77D8FF0-57EF-4DAC-98DD-1C335E177A0F}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{D906B807-2592-44C1-8436-AEA33710CE9B}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{F751B5D8-1981-4A1E-BE27-DCE8D9F6A66F}" = protocol=17 | dir=in | app=c:\program files\virgin broadband wireless\wireless manager.exe |
"TCP Query User{04189B58-C213-411E-A9DA-C73BAFB5B717}C:\users\ravi\appdata\local\temp\rar$ex00.938\samproxy_v2.03.exe" = protocol=6 | dir=in | app=c:\users\ravi\appdata\local\temp\rar$ex00.938\samproxy_v2.03.exe |
"TCP Query User{0BCD617C-2E3D-4567-92C1-70806078A3C1}C:\program files\garena\garena.exe" = protocol=6 | dir=in | app=c:\program files\garena\garena.exe |
"TCP Query User{13617B47-F71C-4746-89CF-213E0C87CE06}C:\program files\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\program files\spotify\spotify.exe |
"TCP Query User{4137185A-5CFC-45B0-88B9-EC272FE5FE2F}C:\users\ravi\documents\left 4 dead\left4dead.exe" = protocol=6 | dir=in | app=c:\users\ravi\documents\left 4 dead\left4dead.exe |
"TCP Query User{4A291236-51B5-4408-84DE-B5959DFFD1C6}C:\program files\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\program files\spotify\spotify.exe |
"TCP Query User{5AEE7982-3C97-489D-BB7C-18333AD3213C}C:\users\ravi\documents\left 4 dead\left4dead.exe" = protocol=6 | dir=in | app=c:\users\ravi\documents\left 4 dead\left4dead.exe |
"TCP Query User{70E81149-B2F9-490F-B4F1-944FBB6F900C}C:\program files\garena\garena.exe" = protocol=6 | dir=in | app=c:\program files\garena\garena.exe |
"TCP Query User{85EEF171-1B5A-4E93-9849-FDC8454F6E2E}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{8DABDBAE-E939-4D5F-9096-B51C2710DD5B}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{BC6DE359-A771-4D4B-BC3A-3479EE6A435E}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{F33781A2-C445-47BB-A187-5990F07B539C}C:\users\ravi\appdata\local\temp\rar$ex01.140\samproxy_v2.03.exe" = protocol=6 | dir=in | app=c:\users\ravi\appdata\local\temp\rar$ex01.140\samproxy_v2.03.exe |
"UDP Query User{103183D3-6AE8-414F-82A7-4F3F4E2242F9}C:\users\ravi\documents\left 4 dead\left4dead.exe" = protocol=17 | dir=in | app=c:\users\ravi\documents\left 4 dead\left4dead.exe |
"UDP Query User{128EB110-CD0F-4D84-899A-E24EC6652081}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"UDP Query User{13D2A111-8505-481D-B885-49F23AF51F9C}C:\users\ravi\appdata\local\temp\rar$ex00.938\samproxy_v2.03.exe" = protocol=17 | dir=in | app=c:\users\ravi\appdata\local\temp\rar$ex00.938\samproxy_v2.03.exe |
"UDP Query User{32BF60F8-CD92-4507-AD49-03F166E6B6DA}C:\program files\garena\garena.exe" = protocol=17 | dir=in | app=c:\program files\garena\garena.exe |
"UDP Query User{46D7469A-D1D2-4478-B9D8-199C4BF4A8A8}C:\users\ravi\appdata\local\temp\rar$ex01.140\samproxy_v2.03.exe" = protocol=17 | dir=in | app=c:\users\ravi\appdata\local\temp\rar$ex01.140\samproxy_v2.03.exe |
"UDP Query User{4A23641F-81A4-4A85-A6D8-7D0818E3CFF3}C:\program files\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\program files\spotify\spotify.exe |
"UDP Query User{BA0DF90C-EBFC-48E5-A110-0FC6B3E55F0A}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{D856AB28-E6CE-4361-A26E-26D68A959B27}C:\program files\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\program files\spotify\spotify.exe |
"UDP Query User{EB500B3F-E06D-4036-BF43-77D8B6C06912}C:\program files\garena\garena.exe" = protocol=17 | dir=in | app=c:\program files\garena\garena.exe |
"UDP Query User{EC835D42-B5C8-4CAC-9CA1-312693399E57}C:\users\ravi\documents\left 4 dead\left4dead.exe" = protocol=17 | dir=in | app=c:\users\ravi\documents\left 4 dead\left4dead.exe |
"UDP Query User{FE04C52C-2651-448D-8156-5C6739E824A4}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 14
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{58E05C78-4785-443D-8A1B-CBFF49C2A84E}" = ESET Smart Security
"{5D601655-6D54-4384-B52C-17EC5385FBBD}" = iTunes
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{8355F970-601D-442D-A79B-1D7DB4F24CAD}" = Apple Mobile Device Support
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{92B94569-6683-4617-8C54-EB27A1B51B30}" = GTAIII
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}" = GTA San Andreas
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"2B0D8F3C-18AD-4D8E-879A-74A867C5C3CB_is1" = Wireless Manager
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Ask Toolbar_is1" = Ask Toolbar
"Garena" = Garena
"HijackThis" = HijackThis 2.0.2
"L4DSP" = Left 4 Dead Standalone Patch
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live & Sponsor (CiD)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Spotify" = Spotify
"Spy Emergency_is1" = Spy Emergency 2009
"SystemRequirementsLab" = System Requirements Lab
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"web'n'walk Manager" = web'n'walk Manager
"WhatPulse" = WhatPulse [removed]
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"YRefresher_is1" = Yrefresher 1.00

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >
Post #8
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-25 16:52:40
Windows 6.0.6001 Service Pack 1


—- System - GMER 1.0.15 —-

Code 89F072D8 ZwEnumerateKey
Code 855F9640 ZwFlushInstructionCache
Code 855D663D IofCallDriver
Code 89F273A6 IofCompleteRequest
Code 855F563D ZwSaveKey
Code 855E263D ZwSaveKeyEx

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\tdx \Device\Tcp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\tdx \Device\Udp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\tdx \Device\RawIp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR

—- EOF - GMER 1.0.15 —-

The Root Repeal kept saying something about disc analazation or sector levels.

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/07/25 16:54
Program Version: Version 1.3.2.0
Windows Version: Windows Vista SP1
==================================================

Drivers
——————-
Name: aujasnkj.sys
Image Path: C:\Windows\TEMP\aujasnkj.sys
Address: 0x95D01000 Size: 81664 File Visible: No Signed: -
Status: -

Name: dump_diskdump.sys
Image Path: C:\Windows\System32\Drivers\dump_diskdump.sys
Address: 0x8AA51000 Size: 40960 File Visible: No Signed: -
Status: -

Name: dump_nvstor.sys
Image Path: C:\Windows\System32\Drivers\dump_nvstor.sys
Address: 0x8AA5B000 Size: 53248 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0x95D15000 Size: 49152 File Visible: No Signed: -
Status: -

Processes
——————-
Path: System
PID: 4 Status: Locked to the Windows API!

Path: C:\Windows\System32\audiodg.exe
PID: 1164 Status: Locked to the Windows API!

Stealth Objects
——————-
Object: Hidden Module [Name: ESQULxkbegmvgpurvrtjuxhagtiqavccgkpyd.dll]
Process: svchost.exe (PID: 844) Address: 0x10000000 Address: 57344

Object: Hidden Module [Name: ESQULskagjevitdsofbrubjjkmpothcvunyxf.dll]
Process: iexplore.exe (PID: 2896) Address: 0x10000000 Address: 237568

==EOF==
Post #9
Hi,

Please do the following:

Download Combofix from either of the links below. You must rename it before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".


Link 1
Link 2



During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]


[external image: Posted Image]
——————————————————————–
  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.


———————————————————–

  • Double click on Combo-Fix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\Combo-Fix.txt" for further review.
    **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**


    ———————————————————–

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    ———————————————————–

Post #10
ComboFix 09-07-24.01 - ravi 25/07/2009 19:10.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.1023.407 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\Combo-Fix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: ESET Smart Security 3.0 *enabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: Spy Emergency *disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\f05d62.msi
c:\windows\System32\drivers\ESQULrvjktqdmaaxopjllaupbrwhsqhjrxxbo.sys
c:\windows\System32\ESQULskagjevitdsofbrubjjkmpothcvunyxf.dll
c:\windows\System32\ESQULxkbegmvgpurvrtjuxhagtiqavccgkpyd.dll
c:\windows\system32\ESQULzcounter
c:\windows\system32\winupdate.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_ESQULserv.sys
——-\Service_ESQULserv.sys


((((((((((((((((((((((((( Files Created from 2009-06-25 to 2009-07-25 )))))))))))))))))))))))))))))))
.

2009-07-24 21:30 . 2009-02-14 12:08 15672 —-a-w- c:\windows\system32\drivers\spyemrg_access.sys
2009-07-24 21:30 . 2009-02-04 16:42 14392 —-a-w- c:\windows\system32\drivers\spyemrg_guard.sys
2009-07-24 21:30 . 2009-02-04 16:42 12344 —-a-w- c:\windows\system32\drivers\spyemrg.sys
2009-07-24 21:30 . 2009-07-24 21:30 ——– d—–w- c:\program files\NETGATE
2009-07-24 21:30 . 2009-07-24 21:30 ——– d—–w- c:\progra~2\NETGATE
2009-07-24 20:24 . 2009-07-24 20:24 ——– d—–w- c:\program files\Trend Micro
2009-07-24 20:11 . 2009-07-13 12:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-24 20:11 . 2009-07-24 20:34 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-24 20:11 . 2009-07-24 20:11 ——– d—–w- c:\progra~2\Malwarebytes
2009-07-24 20:11 . 2009-07-13 12:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-24 17:35 . 2009-07-24 17:35 ——– d—–w- c:\program files\Java
2009-07-24 17:35 . 2009-07-24 17:35 ——– d—–w- c:\progra~2\McAfee
2009-07-24 15:38 . 2008-05-26 15:09 27072 —-a-w- c:\windows\system32\drivers\AFGSp50.sys
2009-07-24 15:37 . 2009-07-24 15:39 ——– d—–w- c:\program files\Virgin Broadband Wireless
2009-07-24 15:37 . 2009-07-24 15:38 ——– d—–w- c:\progra~2\Affinegy
2009-07-23 00:50 . 2008-04-17 14:42 872192 —-a-w- c:\windows\system32\drivers\mod7700.sys
2009-07-23 00:50 . 2008-04-17 14:42 100864 —-a-w- c:\windows\system32\drivers\ewusbnet.sys
2009-07-23 00:50 . 2008-04-17 14:42 101632 —-a-w- c:\windows\system32\drivers\ewusbmdm.sys
2009-07-23 00:50 . 2008-04-17 14:42 103680 —-a-w- c:\windows\system32\drivers\ewusbfake.sys
2009-07-23 00:50 . 2008-04-17 14:42 23424 —-a-w- c:\windows\system32\drivers\ewdcsc.sys
2009-07-23 00:43 . 2009-07-23 00:43 ——– d—–w- c:\users\ravi\{aaab0dba-78fd-4fc1-8c61-fa66fd72a8b8}
2009-07-23 00:33 . 2009-07-23 00:33 ——– d—–w- c:\users\ravi\{22c4240c-5aeb-4cb7-8a4c-2eb2b51c1936}
2009-07-23 00:31 . 2008-05-08 19:52 18816 —-a-w- c:\windows\system32\drivers\tcpipBM.sys
2009-07-23 00:31 . 2008-05-08 18:45 8464 —-a-w- c:\windows\system32\sporder.dll
2009-07-23 00:31 . 2008-05-08 18:43 471040 —-a-w- c:\windows\system32\bmnet.dll
2009-07-23 00:31 . 2008-05-08 18:42 270336 —-a-w- c:\windows\system32\bminstall.dll
2009-07-23 00:31 . 2008-05-08 18:42 126976 —-a-w- c:\windows\system32\bmdumpd.bin
2009-07-23 00:31 . 2008-05-08 18:42 719360 —-a-w- c:\windows\system32\bmutil.dll
2009-07-23 00:31 . 2009-07-23 00:31 ——– d—–w- c:\program files\T-Mobile
2009-07-22 04:36 . 2009-07-22 04:36 ——– d—–w- c:\program files\ESET
2009-07-21 20:37 . 2009-07-21 20:37 ——– d—–w- c:\program files\Ventrilo
2009-07-21 20:36 . 2009-07-21 20:36 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-19 13:20 . 2009-07-23 02:08 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-19 13:20 . 2009-07-23 02:08 ——– d—–w- c:\program files\Rockstar Games
2009-07-19 13:19 . 2009-07-23 02:08 ——– d—–w- c:\program files\Common Files\InstallShield
2009-07-19 13:18 . 2009-02-24 17:42 116736 —-a-w- c:\windows\system32\drivers\mcdbus.sys
2009-07-19 13:18 . 2009-07-19 13:19 ——– d—–w- c:\program files\MagicDisc
2009-07-19 00:49 . 2009-07-19 00:49 ——– d—–w- c:\program files\Google
2009-07-19 00:49 . 2009-07-19 00:52 ——– d—–w- c:\progra~2\NOS
2009-07-16 19:49 . 2009-07-16 19:49 ——– d—–w- c:\program files\Teamspeak2_RC2
2009-07-15 13:39 . 2009-06-15 15:24 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-07-15 13:39 . 2009-06-15 15:20 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-07-15 13:39 . 2009-06-15 12:52 289792 —-a-w- c:\windows\system32\atmfd.dll
2009-07-15 13:39 . 2009-06-15 15:20 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-07-09 02:10 . 2009-07-25 17:06 ——– d—–w- c:\program files\Garena
2009-07-09 01:04 . 2009-07-09 01:05 ——– d–h–w- c:\windows\msdownld.tmp
2009-07-08 21:05 . 2009-07-08 21:05 ——– d—–w- c:\program files\SystemRequirementsLab
2009-07-08 20:47 . 2009-07-08 20:47 ——– d—–w- c:\program files\BitTorrent
2009-07-08 20:47 . 2009-07-08 20:47 ——– d—–w- c:\program files\AskBarDis
2009-07-08 16:42 . 2009-07-08 16:42 ——– d—–w- c:\program files\YRefresher
2009-07-08 16:12 . 2009-07-08 16:13 ——– d—–w- c:\program files\WhatPulse
2009-07-08 02:01 . 2009-07-24 17:35 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-07-07 23:28 . 2009-07-18 01:13 ——– d—–w- c:\progra~2\Messenger Plus!
2009-07-06 21:16 . 2009-07-24 20:46 ——– d—–w- c:\progra~2\inside obj
2009-07-06 13:08 . 2009-07-06 13:08 ——– dc—-w- c:\windows\system32\DRVSTORE
2009-07-06 13:08 . 2009-03-19 15:32 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-07-06 13:08 . 2008-04-17 11:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2009-07-06 13:07 . 2009-07-06 13:07 ——– d—–w- c:\program files\iPod
2009-07-06 13:07 . 2009-07-06 13:08 ——– d—–w- c:\program files\iTunes
2009-07-06 13:07 . 2009-07-06 13:08 ——– d—–w- c:\progra~2\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-06 13:06 . 2009-07-06 13:06 ——– d—–w- c:\program files\Bonjour
2009-07-06 13:05 . 2009-07-06 13:06 ——– d—–w- c:\program files\QuickTime
2009-07-06 13:05 . 2009-07-06 13:07 ——– d—–w- c:\progra~2\Apple Computer
2009-07-06 13:04 . 2009-07-06 13:04 ——– d—–w- c:\program files\Apple Software Update
2009-07-06 13:02 . 2009-07-06 13:07 ——– d—–w- c:\program files\Common Files\Apple
2009-07-06 13:02 . 2009-07-06 13:02 ——– d—–w- c:\progra~2\Apple
2009-07-06 13:00 . 2009-07-06 13:00 ——– d—–w- c:\program files\Spotify
2009-07-06 09:41 . 2009-07-06 00:46 ——– d—–w- c:\windows\Panther
2009-07-06 09:41 . 2009-07-25 18:16 ——– d-sh–w- C:\Boot
2009-07-06 09:40 . 2009-07-06 09:40 ——– d—–w- c:\windows\system32\OEM
2009-07-06 01:52 . 2008-10-22 01:22 2048 —-a-w- c:\windows\system32\tzres.dll
2009-07-06 01:34 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-07-06 01:34 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2009-07-06 01:34 . 2008-06-20 01:14 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2009-07-06 01:34 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2009-07-06 01:34 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2009-07-06 01:34 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-07-06 01:34 . 2008-06-20 01:14 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2009-07-06 01:28 . 2008-07-27 18:03 96760 —-a-w- c:\windows\system32\dfshim.dll
2009-07-06 01:28 . 2008-07-27 18:03 41984 —-a-w- c:\windows\system32\netfxperf.dll
2009-07-06 01:28 . 2008-07-27 18:03 282112 —-a-w- c:\windows\system32\mscoree.dll
2009-07-06 01:28 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2009-07-06 01:28 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2009-07-06 01:24 . 2009-02-13 08:49 1255936 —-a-w- c:\windows\system32\lsasrv.dll
2009-07-06 01:24 . 2009-03-17 03:38 13824 —-a-w- c:\windows\system32\apilogen.dll
2009-07-06 01:24 . 2009-03-17 03:38 24064 —-a-w- c:\windows\system32\amxread.dll
2009-07-06 01:24 . 2009-02-13 08:49 72704 —-a-w- c:\windows\system32\secur32.dll
2009-07-06 01:24 . 2008-04-18 05:48 269312 —-a-w- c:\windows\system32\es.dll
2009-07-06 01:24 . 2008-04-10 05:12 738304 —-a-w- c:\windows\system32\inetcomm.dll
2009-07-06 01:23 . 2008-06-26 01:45 12240896 —-a-w- c:\windows\system32\NlsLexicons0007.dll
2009-07-06 01:23 . 2008-06-26 01:45 2644480 —-a-w- c:\windows\system32\NlsLexicons0009.dll
2009-07-06 01:23 . 2008-06-26 03:29 801280 —-a-w- c:\windows\system32\NaturalLanguage6.dll
2009-07-06 01:21 . 2008-06-23 01:59 2868736 —-a-w- c:\windows\system32\mf.dll
2009-07-06 01:20 . 2008-04-26 08:08 1314816 —-a-w- c:\windows\system32\quartz.dll
2009-07-06 01:20 . 2008-09-18 04:56 125952 —-a-w- c:\windows\system32\wersvc.dll
2009-07-06 01:20 . 2008-09-18 04:56 147456 —-a-w- c:\windows\system32\Faultrep.dll
2009-07-06 01:20 . 2008-05-10 01:33 113664 —-a-w- c:\windows\system32\drivers\rmcast.sys
2009-07-06 01:20 . 2008-10-21 05:25 1645568 —-a-w- c:\windows\system32\connect.dll
2009-07-06 01:16 . 2009-07-06 01:16 ——– d—–w- c:\windows\system32\Macromed
2009-07-06 01:15 . 2008-09-10 03:40 1334272 —-a-w- c:\windows\system32\msxml6.dll
2009-07-06 01:05 . 2009-07-06 01:05 ——– d—–w- C:\b31d8b6333464bfd1926491d
2009-07-06 01:02 . 2009-07-24 20:45 ——– d—–w- c:\users\ravi\Tracing
2009-07-06 01:02 . 2009-07-06 01:02 ——– d—–w- c:\program files\Microsoft
2009-07-06 01:01 . 2009-07-06 01:01 ——– d—–w- c:\program files\Windows Live SkyDrive
2009-07-06 01:01 . 2009-07-06 01:02 ——– d—–w- c:\program files\Windows Live
2009-07-06 01:01 . 2009-07-06 01:01 ——– d—–w- c:\windows\PCHEALTH
2009-07-06 01:01 . 2009-07-25 18:15 ——– d-sh–w- c:\windows\Installer
2009-07-06 00:59 . 2009-07-06 00:59 ——– d—–w- c:\program files\Common Files\Windows Live
2009-07-06 00:48 . 2008-10-16 21:13 1809944 —-a-w- c:\windows\system32\wuaueng.dll
2009-07-06 00:48 . 2008-10-16 21:09 51224 —-a-w- c:\windows\system32\wuauclt.exe
2009-07-06 00:48 . 2008-10-16 21:09 43544 —-a-w- c:\windows\system32\wups2.dll
2009-07-06 00:48 . 2008-10-16 20:56 1524736 —-a-w- c:\windows\system32\wucltux.dll
2009-07-06 00:48 . 2008-10-16 21:12 561688 —-a-w- c:\windows\system32\wuapi.dll
2009-07-06 00:48 . 2008-10-16 21:08 34328 —-a-w- c:\windows\system32\wups.dll
2009-07-06 00:48 . 2008-10-16 20:55 83456 —-a-w- c:\windows\system32\wudriver.dll
2009-07-06 00:48 . 2008-10-16 13:08 162064 —-a-w- c:\windows\system32\wuwebv.dll
2009-07-06 00:48 . 2008-10-16 12:56 31232 —-a-w- c:\windows\system32\wuapp.exe
2009-07-06 00:47 . 2009-07-06 00:56 ——– d—–w- c:\windows\Debug

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-24 20:46 . 2009-07-24 20:46 819200 —-a-w- c:\progra~2\File dvd base road\mode ping.exe
2009-07-24 20:45 . 2009-07-06 21:16 516096 —-a-w- c:\progra~2\inside obj\show aim.exe
2009-07-23 00:37 . 2009-07-06 00:41 138262897 —-a-w- c:\windows\DUMP2088.tmp
2009-07-16 02:01 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-07-06 21:16 . 2009-07-06 21:16 ——– d—–w- c:\program files\Crcle Developement
2009-07-06 21:16 . 2009-07-06 21:16 ——– d—–w- c:\program files\Messenger Plus! Live
2009-07-06 13:00 . 2009-07-06 13:00 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-07-06 04:43 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\progra~2\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 10:42 . 2009-06-05 10:42 39424 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-05 10:42 . 2009-06-05 10:42 2060288 —-a-w- c:\windows\system32\usbaaplrc.dll
2009-04-30 12:37 . 2009-07-06 01:22 293376 —-a-w- c:\windows\system32\psisdecd.dll
2009-04-30 12:37 . 2009-07-06 01:22 428544 —-a-w- c:\windows\system32\EncDec.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-29 16:24 325000 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"bike hold"="c:\programdata\book proxy proxy.45za4u" [X]
"Base road long save"="c:\programdata\16 heart wipe.oip00" [X]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Windows Update Manager"="c:\users\ravi\AppData\Roaming\WinUpdate.exe" [2009-07-20 33280]
"Updater shortcut"="c:\program files\T-Mobile\web'n'walk Manager\WTGU.exe" [2008-06-19 857544]
"WhatPulse"="c:\program files\WhatPulse\WhatPulse.exe" [2009-04-08 2814976]
"SpyEmergency"="c:\program files\NETGATE\Spy Emergency 2009\SpyEmergency.exe" [2009-07-24 1940024]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-06-10 1447168]
"DataCardMonitor"="c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe" [2009-07-23 253952]
"Wireless Manager"="c:\program files\Virgin Broadband Wireless\Wireless Manager.exe" [2008-05-26 585728]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-24 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{13617B47-F71C-4746-89CF-213E0C87CE06}c:\\program files\\spotify\\spotify.exe"= UDP:c:\program files\spotify\spotify.exe:Spotify
"UDP Query User{D856AB28-E6CE-4361-A26E-26D68A959B27}c:\\program files\\spotify\\spotify.exe"= TCP:c:\program files\spotify\spotify.exe:Spotify
"{AEF416B7-6BFC-4CCB-AE1D-9F88BA56FC1A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{70611C50-20C8-4485-A019-FBD09229CCD1}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C262CDCB-B661-4C38-AF0B-6529E421C950}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9ED8B9A1-166E-4FC0-BF86-E5B5A0EBF5F5}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{8DABDBAE-E939-4D5F-9096-B51C2710DD5B}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java™ Platform SE binary
"UDP Query User{BA0DF90C-EBFC-48E5-A110-0FC6B3E55F0A}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java™ Platform SE binary
"{C77D8FF0-57EF-4DAC-98DD-1C335E177A0F}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{9943BDD2-3F48-4AC6-B46E-6E9AB2A5003D}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{4137185A-5CFC-45B0-88B9-EC272FE5FE2F}c:\\users\\ravi\\documents\\left 4 dead\\left4dead.exe"= UDP:c:\users\ravi\documents\left 4 dead\left4dead.exe:left4dead.exe
"UDP Query User{EC835D42-B5C8-4CAC-9CA1-312693399E57}c:\\users\\ravi\\documents\\left 4 dead\\left4dead.exe"= TCP:c:\users\ravi\documents\left 4 dead\left4dead.exe:left4dead.exe
"TCP Query User{70E81149-B2F9-490F-B4F1-944FBB6F900C}c:\\program files\\garena\\garena.exe"= UDP:c:\program files\garena\garena.exe:Garena
"UDP Query User{EB500B3F-E06D-4036-BF43-77D8B6C06912}c:\\program files\\garena\\garena.exe"= TCP:c:\program files\garena\garena.exe:Garena
"{D906B807-2592-44C1-8436-AEA33710CE9B}"= UDP:c:\program files\Ventrilo\Ventrilo.exe:Ventrilo.exe
"{96E24F4F-83A8-49C9-A023-BDB21E0886DD}"= TCP:c:\program files\Ventrilo\Ventrilo.exe:Ventrilo.exe
"TCP Query User{BC6DE359-A771-4D4B-BC3A-3479EE6A435E}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:BitTorrent
"UDP Query User{128EB110-CD0F-4D84-899A-E24EC6652081}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:BitTorrent
"TCP Query User{5AEE7982-3C97-489D-BB7C-18333AD3213C}c:\\users\\ravi\\documents\\left 4 dead\\left4dead.exe"= UDP:c:\users\ravi\documents\left 4 dead\left4dead.exe:left4dead.exe
"UDP Query User{103183D3-6AE8-414F-82A7-4F3F4E2242F9}c:\\users\\ravi\\documents\\left 4 dead\\left4dead.exe"= TCP:c:\users\ravi\documents\left 4 dead\left4dead.exe:left4dead.exe
"TCP Query User{04189B58-C213-411E-A9DA-C73BAFB5B717}c:\\users\\ravi\\appdata\\local\\temp\\rar$ex00.938\\samproxy_v2.03.exe"= UDP:c:\users\ravi\appdata\local\temp\rar$ex00.938\samproxy_v2.03.exe:samproxy_v2.03.exe
"UDP Query User{13D2A111-8505-481D-B885-49F23AF51F9C}c:\\users\\ravi\\appdata\\local\\temp\\rar$ex00.938\\samproxy_v2.03.exe"= TCP:c:\users\ravi\appdata\local\temp\rar$ex00.938\samproxy_v2.03.exe:samproxy_v2.03.exe
"TCP Query User{F33781A2-C445-47BB-A187-5990F07B539C}c:\\users\\ravi\\appdata\\local\\temp\\rar$ex01.140\\samproxy_v2.03.exe"= UDP:c:\users\ravi\appdata\local\temp\rar$ex01.140\samproxy_v2.03.exe:samproxy_v2.03.exe
"UDP Query User{46D7469A-D1D2-4478-B9D8-199C4BF4A8A8}c:\\users\\ravi\\appdata\\local\\temp\\rar$ex01.140\\samproxy_v2.03.exe"= TCP:c:\users\ravi\appdata\local\temp\rar$ex01.140\samproxy_v2.03.exe:samproxy_v2.03.exe
"{10784326-E1A4-4174-A87A-00F3FFBC63B9}"= UDP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{F751B5D8-1981-4A1E-BE27-DCE8D9F6A66F}"= TCP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{6A51E8BC-9D97-440D-A722-89DBB22AA728}"= UDP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{C588E013-149B-40CE-9808-1247FD939C38}"= TCP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{ACE63434-FAE2-4376-91B2-BA7B6EFD1E01}"= UDP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{242D1DDC-08F0-4C48-B945-7CCDAF8125DD}"= TCP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"TCP Query User{85EEF171-1B5A-4E93-9849-FDC8454F6E2E}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java™ Platform SE binary
"UDP Query User{FE04C52C-2651-448D-8156-5C6739E824A4}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java™ Platform SE binary
"TCP Query User{0BCD617C-2E3D-4567-92C1-70806078A3C1}c:\\program files\\garena\\garena.exe"= UDP:c:\program files\garena\garena.exe:Garena
"UDP Query User{32BF60F8-CD92-4507-AD49-03F166E6B6DA}c:\\program files\\garena\\garena.exe"= TCP:c:\program files\garena\garena.exe:Garena
"TCP Query User{4676167D-9D49-419A-A7C2-08037F7ABD60}c:\\windows\\temp\\rar$ex00.094\\samproxy_v2.03.exe"= UDP:c:\windows\temp\rar$ex00.094\samproxy_v2.03.exe:samproxy_v2.03.exe
"UDP Query User{8A62F8EA-57DE-48EF-91FB-A4F07C8F3E65}c:\\windows\\temp\\rar$ex00.094\\samproxy_v2.03.exe"= TCP:c:\windows\temp\rar$ex00.094\samproxy_v2.03.exe:samproxy_v2.03.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R1 SpyEmrg;Spy Emergency Driver;c:\windows\System32\drivers\spyemrg.sys [24/07/2009 22:30 12344]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [21/12/2007 08:21 468224]
R2 SpyEmrgSrv;Spy Emergency Engine Service;c:\program files\NETGATE\Spy Emergency 2009\SpyEmergencySrv.exe [24/07/2009 22:30 1788472]
R3 SpyEmrgAccess;Spy Emergency OnAccess Driver;c:\windows\System32\drivers\spyemrg_access.sys [24/07/2009 22:30 15672]
R3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver;c:\windows\System32\drivers\spyemrg_guard.sys [24/07/2009 22:30 14392]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [24/07/2009 21:11 38160]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-25 19:18
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DataCardMonitor = c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe?tem\QTJava.zip?SystemDrive=C:?S?????W???7??????dows?TEMP=c:\users\ravi\AppData\Local\Temp?TMP=c:\users\ravi\AppData\Local\Temp?TRACE_FORMAT_SEARCH_PATH=\\NTREL202.ntdev.corp.microsoft.com\4F1

scanning hidden files …


c:\users\ravi\AppData\Roaming\HCM Updater\Downloads\list.txt 0 bytes
c:\users\ravi\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt 4906 bytes

scan completed successfully
hidden files: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\windows\TEMP\FUNF56C.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
———————— Other Running Processes ————————
.
c:\windows\System32\audiodg.exe
c:\users\ravi\AppData\Local\Temp\c.exe
c:\program files\Virgin Broadband Wireless\AffinegyService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Completion time: 2009-07-25 19:23 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-25 18:23

Pre-Run: 119,718,035,456 bytes free
Post-Run: 119,648,780,288 bytes free

299 — E O F — 2009-07-24 21:09
Post #11
Hi,

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Renos_IO_Troubles_t105505.html&view=findpost&p=581792#entry581792

Collect::
c:\users\ravi\AppData\Local\Temp\c.exe

File::
c:\windows\DUMP2088.tmp
c:\windows\TEMP\FUNF56C.tmp

Folder::
c:\program files\Crcle Developement

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"bike hold"=-
"Base road long save"=-

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.


NEXT

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


NEXT

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


In your next reply please include
  • ComboFix log
  • MBAM Log
  • Kaspersky report
Post #12
ComboFix 09-07-24.03 - ravi 26/07/2009 4:03.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.1023.367 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\users\ravi\Desktop\CFScript.txt
SP: Spy Emergency *disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point

FILE ::
"c:\windows\DUMP2088.tmp"
"c:\windows\TEMP\FUNF56C.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Crcle Developement
c:\program files\Crcle Developement\Uninstall.exe
c:\windows\DUMP2088.tmp
c:\windows\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job

.
((((((((((((((((((((((((( Files Created from 2009-06-26 to 2009-07-26 )))))))))))))))))))))))))))))))
.

2009-07-26 02:58 . 2009-07-26 02:58 ——– d-sh–w- C:\found.000
2009-07-24 21:30 . 2009-02-14 12:08 15672 —-a-w- c:\windows\system32\drivers\spyemrg_access.sys
2009-07-24 21:30 . 2009-02-04 16:42 14392 —-a-w- c:\windows\system32\drivers\spyemrg_guard.sys
2009-07-24 21:30 . 2009-02-04 16:42 12344 —-a-w- c:\windows\system32\drivers\spyemrg.sys
2009-07-24 21:30 . 2009-07-24 21:30 ——– d—–w- c:\programdata\NETGATE
2009-07-24 21:30 . 2009-07-24 21:30 ——– d—–w- c:\program files\NETGATE
2009-07-24 20:24 . 2009-07-24 20:24 ——– d—–w- c:\program files\Trend Micro
2009-07-24 20:11 . 2009-07-13 12:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-24 20:11 . 2009-07-24 20:34 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-24 20:11 . 2009-07-24 20:11 ——– d—–w- c:\programdata\Malwarebytes
2009-07-24 20:11 . 2009-07-13 12:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-24 17:35 . 2009-07-24 17:35 ——– d—–w- c:\program files\Java
2009-07-24 17:35 . 2009-07-24 17:35 ——– d—–w- c:\programdata\McAfee
2009-07-24 15:38 . 2008-05-26 15:09 27072 —-a-w- c:\windows\system32\drivers\AFGSp50.sys
2009-07-24 15:37 . 2009-07-24 15:39 ——– d—–w- c:\program files\Virgin Broadband Wireless
2009-07-24 15:37 . 2009-07-24 15:38 ——– d—–w- c:\programdata\Affinegy
2009-07-23 00:50 . 2008-04-17 14:42 872192 —-a-w- c:\windows\system32\drivers\mod7700.sys
2009-07-23 00:50 . 2008-04-17 14:42 100864 —-a-w- c:\windows\system32\drivers\ewusbnet.sys
2009-07-23 00:50 . 2008-04-17 14:42 101632 —-a-w- c:\windows\system32\drivers\ewusbmdm.sys
2009-07-23 00:50 . 2008-04-17 14:42 103680 —-a-w- c:\windows\system32\drivers\ewusbfake.sys
2009-07-23 00:50 . 2008-04-17 14:42 23424 —-a-w- c:\windows\system32\drivers\ewdcsc.sys
2009-07-23 00:43 . 2009-07-23 00:43 ——– d—–w- c:\users\ravi\{aaab0dba-78fd-4fc1-8c61-fa66fd72a8b8}
2009-07-23 00:33 . 2009-07-23 00:33 ——– d—–w- c:\users\ravi\{22c4240c-5aeb-4cb7-8a4c-2eb2b51c1936}
2009-07-23 00:31 . 2008-05-08 19:52 18816 —-a-w- c:\windows\system32\drivers\tcpipBM.sys
2009-07-23 00:31 . 2008-05-08 18:45 8464 —-a-w- c:\windows\system32\sporder.dll
2009-07-23 00:31 . 2008-05-08 18:43 471040 —-a-w- c:\windows\system32\bmnet.dll
2009-07-23 00:31 . 2008-05-08 18:42 270336 —-a-w- c:\windows\system32\bminstall.dll
2009-07-23 00:31 . 2008-05-08 18:42 126976 —-a-w- c:\windows\system32\bmdumpd.bin
2009-07-23 00:31 . 2008-05-08 18:42 719360 —-a-w- c:\windows\system32\bmutil.dll
2009-07-23 00:31 . 2009-07-23 00:31 ——– d—–w- c:\program files\T-Mobile
2009-07-21 20:37 . 2009-07-21 20:37 ——– d—–w- c:\program files\Ventrilo
2009-07-21 20:36 . 2009-07-21 20:36 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-19 13:20 . 2009-07-23 02:08 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-19 13:20 . 2009-07-23 02:08 ——– d—–w- c:\program files\Rockstar Games
2009-07-19 13:19 . 2009-07-23 02:08 ——– d—–w- c:\program files\Common Files\InstallShield
2009-07-19 13:18 . 2009-02-24 17:42 116736 —-a-w- c:\windows\system32\drivers\mcdbus.sys
2009-07-19 13:18 . 2009-07-19 13:19 ——– d—–w- c:\program files\MagicDisc
2009-07-19 00:49 . 2009-07-19 00:49 ——– d—–w- c:\program files\Google
2009-07-19 00:49 . 2009-07-19 00:52 ——– d—–w- c:\programdata\NOS
2009-07-16 19:49 . 2009-07-16 19:49 ——– d—–w- c:\program files\Teamspeak2_RC2
2009-07-15 13:39 . 2009-06-15 15:24 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-07-15 13:39 . 2009-06-15 15:20 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-07-15 13:39 . 2009-06-15 12:52 289792 —-a-w- c:\windows\system32\atmfd.dll
2009-07-15 13:39 . 2009-06-15 15:20 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-07-09 02:10 . 2009-07-25 17:06 ——– d—–w- c:\program files\Garena
2009-07-09 01:04 . 2009-07-09 01:05 ——– d–h–w- c:\windows\msdownld.tmp
2009-07-08 21:05 . 2009-07-08 21:05 ——– d—–w- c:\program files\SystemRequirementsLab
2009-07-08 20:47 . 2009-07-08 20:47 ——– d—–w- c:\program files\BitTorrent
2009-07-08 20:47 . 2009-07-08 20:47 ——– d—–w- c:\program files\AskBarDis
2009-07-08 16:42 . 2009-07-08 16:42 ——– d—–w- c:\program files\YRefresher
2009-07-08 16:12 . 2009-07-08 16:13 ——– d—–w- c:\program files\WhatPulse
2009-07-08 02:01 . 2009-07-24 17:35 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-07-07 23:28 . 2009-07-18 01:13 ——– d—–w- c:\programdata\Messenger Plus!
2009-07-06 21:16 . 2009-07-24 20:46 ——– d—–w- c:\programdata\inside obj
2009-07-06 13:08 . 2009-07-06 13:08 ——– dc—-w- c:\windows\system32\DRVSTORE
2009-07-06 13:08 . 2009-03-19 15:32 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-07-06 13:08 . 2008-04-17 11:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2009-07-06 13:07 . 2009-07-06 13:07 ——– d—–w- c:\program files\iPod
2009-07-06 13:07 . 2009-07-06 13:08 ——– d—–w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-06 13:07 . 2009-07-06 13:08 ——– d—–w- c:\program files\iTunes
2009-07-06 13:06 . 2009-07-06 13:06 ——– d—–w- c:\program files\Bonjour
2009-07-06 13:05 . 2009-07-06 13:06 ——– d—–w- c:\program files\QuickTime
2009-07-06 13:05 . 2009-07-06 13:07 ——– d—–w- c:\programdata\Apple Computer
2009-07-06 13:04 . 2009-07-06 13:04 ——– d—–w- c:\program files\Apple Software Update
2009-07-06 13:02 . 2009-07-06 13:07 ——– d—–w- c:\program files\Common Files\Apple
2009-07-06 13:02 . 2009-07-06 13:02 ——– d—–w- c:\programdata\Apple
2009-07-06 13:00 . 2009-07-06 13:00 ——– d—–w- c:\program files\Spotify
2009-07-06 09:41 . 2009-07-06 00:46 ——– d—–w- c:\windows\Panther
2009-07-06 09:41 . 2009-07-25 18:16 ——– d-sh–w- C:\Boot
2009-07-06 09:40 . 2009-07-06 09:40 ——– d—–w- c:\windows\system32\OEM
2009-07-06 01:52 . 2008-10-22 01:22 2048 —-a-w- c:\windows\system32\tzres.dll
2009-07-06 01:34 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-07-06 01:34 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2009-07-06 01:34 . 2008-06-20 01:14 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2009-07-06 01:34 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2009-07-06 01:34 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2009-07-06 01:34 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-07-06 01:34 . 2008-06-20 01:14 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2009-07-06 01:28 . 2008-07-27 18:03 96760 —-a-w- c:\windows\system32\dfshim.dll
2009-07-06 01:28 . 2008-07-27 18:03 41984 —-a-w- c:\windows\system32\netfxperf.dll
2009-07-06 01:28 . 2008-07-27 18:03 282112 —-a-w- c:\windows\system32\mscoree.dll
2009-07-06 01:28 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2009-07-06 01:28 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2009-07-06 01:24 . 2009-02-13 08:49 1255936 —-a-w- c:\windows\system32\lsasrv.dll
2009-07-06 01:24 . 2009-03-17 03:38 13824 —-a-w- c:\windows\system32\apilogen.dll
2009-07-06 01:24 . 2009-03-17 03:38 24064 —-a-w- c:\windows\system32\amxread.dll
2009-07-06 01:24 . 2009-02-13 08:49 72704 —-a-w- c:\windows\system32\secur32.dll
2009-07-06 01:24 . 2008-04-18 05:48 269312 —-a-w- c:\windows\system32\es.dll
2009-07-06 01:24 . 2008-04-10 05:12 738304 —-a-w- c:\windows\system32\inetcomm.dll
2009-07-06 01:23 . 2008-06-26 01:45 12240896 —-a-w- c:\windows\system32\NlsLexicons0007.dll
2009-07-06 01:23 . 2008-06-26 01:45 2644480 —-a-w- c:\windows\system32\NlsLexicons0009.dll
2009-07-06 01:23 . 2008-06-26 03:29 801280 —-a-w- c:\windows\system32\NaturalLanguage6.dll
2009-07-06 01:21 . 2008-06-23 01:59 2868736 —-a-w- c:\windows\system32\mf.dll
2009-07-06 01:20 . 2008-04-26 08:08 1314816 —-a-w- c:\windows\system32\quartz.dll
2009-07-06 01:20 . 2008-09-18 04:56 125952 —-a-w- c:\windows\system32\wersvc.dll
2009-07-06 01:20 . 2008-09-18 04:56 147456 —-a-w- c:\windows\system32\Faultrep.dll
2009-07-06 01:20 . 2008-05-10 01:33 113664 —-a-w- c:\windows\system32\drivers\rmcast.sys
2009-07-06 01:20 . 2008-10-21 05:25 1645568 —-a-w- c:\windows\system32\connect.dll
2009-07-06 01:16 . 2009-07-06 01:16 ——– d—–w- c:\windows\system32\Macromed
2009-07-06 01:15 . 2008-09-10 03:40 1334272 —-a-w- c:\windows\system32\msxml6.dll
2009-07-06 01:05 . 2009-07-06 01:05 ——– d—–w- C:\b31d8b6333464bfd1926491d
2009-07-06 01:02 . 2009-07-24 20:45 ——– d—–w- c:\users\ravi\Tracing
2009-07-06 01:02 . 2009-07-06 01:02 ——– d—–w- c:\program files\Microsoft
2009-07-06 01:01 . 2009-07-06 01:01 ——– d—–w- c:\program files\Windows Live SkyDrive
2009-07-06 01:01 . 2009-07-06 01:02 ——– d—–w- c:\program files\Windows Live
2009-07-06 01:01 . 2009-07-06 01:01 ——– d—–w- c:\windows\PCHEALTH
2009-07-06 01:01 . 2009-07-26 02:52 ——– d-sh–w- c:\windows\Installer
2009-07-06 00:59 . 2009-07-06 00:59 ——– d—–w- c:\program files\Common Files\Windows Live
2009-07-06 00:48 . 2008-10-16 21:13 1809944 —-a-w- c:\windows\system32\wuaueng.dll
2009-07-06 00:48 . 2008-10-16 21:09 51224 —-a-w- c:\windows\system32\wuauclt.exe
2009-07-06 00:48 . 2008-10-16 21:09 43544 —-a-w- c:\windows\system32\wups2.dll
2009-07-06 00:48 . 2008-10-16 20:56 1524736 —-a-w- c:\windows\system32\wucltux.dll
2009-07-06 00:48 . 2008-10-16 21:12 561688 —-a-w- c:\windows\system32\wuapi.dll
2009-07-06 00:48 . 2008-10-16 21:08 34328 —-a-w- c:\windows\system32\wups.dll
2009-07-06 00:48 . 2008-10-16 20:55 83456 —-a-w- c:\windows\system32\wudriver.dll
2009-07-06 00:48 . 2008-10-16 13:08 162064 —-a-w- c:\windows\system32\wuwebv.dll
2009-07-06 00:48 . 2008-10-16 12:56 31232 —-a-w- c:\windows\system32\wuapp.exe
2009-07-06 00:47 . 2009-07-06 00:56 ——– d—–w- c:\windows\Debug

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-24 20:46 . 2009-07-24 20:46 819200 —-a-w- c:\programdata\File dvd base road\mode ping.exe
2009-07-24 20:45 . 2009-07-06 21:16 516096 —-a-w- c:\programdata\inside obj\show aim.exe
2009-07-16 02:01 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-07-06 21:16 . 2009-07-06 21:16 ——– d—–w- c:\program files\Messenger Plus! Live
2009-07-06 13:00 . 2009-07-06 13:00 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-07-06 04:43 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 12:57 . 2009-06-05 12:57 75048 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 10:42 . 2009-06-05 10:42 39424 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-05 10:42 . 2009-06-05 10:42 2060288 —-a-w- c:\windows\system32\usbaaplrc.dll
2009-04-30 12:37 . 2009-07-06 01:22 293376 —-a-w- c:\windows\system32\psisdecd.dll
2009-04-30 12:37 . 2009-07-06 01:22 428544 —-a-w- c:\windows\system32\EncDec.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-25_18.18.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-26 03:08 . 2009-07-26 03:08 53248 c:\windows\Temp\catchme.dll
+ 2006-11-02 13:05 . 2009-07-26 03:01 57738 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-06 00:58 . 2009-07-25 23:02 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-06 00:58 . 2009-07-25 17:11 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-06 00:58 . 2009-07-25 17:11 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-06 00:58 . 2009-07-25 23:02 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-06 00:58 . 2009-07-25 17:11 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-06 00:58 . 2009-07-25 23:02 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2006-11-02 10:25 . 2009-07-24 15:38 86016 c:\windows\inf\infstrng.dat
+ 2006-11-02 10:25 . 2009-07-26 02:52 86016 c:\windows\inf\infstrng.dat
- 2006-11-02 10:25 . 2009-07-24 15:38 86016 c:\windows\inf\infstor.dat
+ 2006-11-02 10:25 . 2009-07-26 02:52 86016 c:\windows\inf\infstor.dat
+ 2006-11-02 10:25 . 2009-07-26 02:52 51200 c:\windows\inf\infpub.dat
- 2006-11-02 10:25 . 2009-07-24 15:38 51200 c:\windows\inf\infpub.dat
+ 2009-07-06 00:59 . 2009-07-26 03:01 8506 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1013311773-500551847-2372975027-1000_UserData.bin
+ 2009-07-25 18:17 . 2009-07-26 02:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-07-25 18:17 . 2009-07-26 02:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-25 18:17 . 2009-07-25 18:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2006-11-02 10:33 . 2009-07-25 18:14 599942 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-07-26 03:06 599942 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-07-26 03:06 105448 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-07-25 18:14 105448 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-29 16:24 325000 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Windows Update Manager"="c:\users\ravi\AppData\Roaming\WinUpdate.exe" [2009-07-20 33280]
"WhatPulse"="c:\program files\WhatPulse\WhatPulse.exe" [2009-04-08 2814976]
"SpyEmergency"="c:\program files\NETGATE\Spy Emergency 2009\SpyEmergency.exe" [2009-07-24 1940024]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"DataCardMonitor"="c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe" [2009-07-23 253952]
"Wireless Manager"="c:\program files\Virgin Broadband Wireless\Wireless Manager.exe" [2008-05-26 585728]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-24 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{13617B47-F71C-4746-89CF-213E0C87CE06}c:\\program files\\spotify\\spotify.exe"= UDP:c:\program files\spotify\spotify.exe:Spotify
"UDP Query User{D856AB28-E6CE-4361-A26E-26D68A959B27}c:\\program files\\spotify\\spotify.exe"= TCP:c:\program files\spotify\spotify.exe:Spotify
"{AEF416B7-6BFC-4CCB-AE1D-9F88BA56FC1A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{70611C50-20C8-4485-A019-FBD09229CCD1}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C262CDCB-B661-4C38-AF0B-6529E421C950}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9ED8B9A1-166E-4FC0-BF86-E5B5A0EBF5F5}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{8DABDBAE-E939-4D5F-9096-B51C2710DD5B}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java™ Platform SE binary
"UDP Query User{BA0DF90C-EBFC-48E5-A110-0FC6B3E55F0A}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java™ Platform SE binary
"{C77D8FF0-57EF-4DAC-98DD-1C335E177A0F}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{9943BDD2-3F48-4AC6-B46E-6E9AB2A5003D}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{4137185A-5CFC-45B0-88B9-EC272FE5FE2F}c:\\users\\ravi\\documents\\left 4 dead\\left4dead.exe"= UDP:c:\users\ravi\documents\left 4 dead\left4dead.exe:left4dead.exe
"UDP Query User{EC835D42-B5C8-4CAC-9CA1-312693399E57}c:\\users\\ravi\\documents\\left 4 dead\\left4dead.exe"= TCP:c:\users\ravi\documents\left 4 dead\left4dead.exe:left4dead.exe
"TCP Query User{70E81149-B2F9-490F-B4F1-944FBB6F900C}c:\\program files\\garena\\garena.exe"= UDP:c:\program files\garena\garena.exe:Garena
"UDP Query User{EB500B3F-E06D-4036-BF43-77D8B6C06912}c:\\program files\\garena\\garena.exe"= TCP:c:\program files\garena\garena.exe:Garena
"{D906B807-2592-44C1-8436-AEA33710CE9B}"= UDP:c:\program files\Ventrilo\Ventrilo.exe:Ventrilo.exe
"{96E24F4F-83A8-49C9-A023-BDB21E0886DD}"= TCP:c:\program files\Ventrilo\Ventrilo.exe:Ventrilo.exe
"TCP Query User{BC6DE359-A771-4D4B-BC3A-3479EE6A435E}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:BitTorrent
"UDP Query User{128EB110-CD0F-4D84-899A-E24EC6652081}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:BitTorrent
"TCP Query User{5AEE7982-3C97-489D-BB7C-18333AD3213C}c:\\users\\ravi\\documents\\left 4 dead\\left4dead.exe"= UDP:c:\users\ravi\documents\left 4 dead\left4dead.exe:left4dead.exe
"UDP Query User{103183D3-6AE8-414F-82A7-4F3F4E2242F9}c:\\users\\ravi\\documents\\left 4 dead\\left4dead.exe"= TCP:c:\users\ravi\documents\left 4 dead\left4dead.exe:left4dead.exe
"TCP Query User{04189B58-C213-411E-A9DA-C73BAFB5B717}c:\\users\\ravi\\appdata\\local\\temp\\rar$ex00.938\\samproxy_v2.03.exe"= UDP:c:\users\ravi\appdata\local\temp\rar$ex00.938\samproxy_v2.03.exe:samproxy_v2.03.exe
"UDP Query User{13D2A111-8505-481D-B885-49F23AF51F9C}c:\\users\\ravi\\appdata\\local\\temp\\rar$ex00.938\\samproxy_v2.03.exe"= TCP:c:\users\ravi\appdata\local\temp\rar$ex00.938\samproxy_v2.03.exe:samproxy_v2.03.exe
"TCP Query User{F33781A2-C445-47BB-A187-5990F07B539C}c:\\users\\ravi\\appdata\\local\\temp\\rar$ex01.140\\samproxy_v2.03.exe"= UDP:c:\users\ravi\appdata\local\temp\rar$ex01.140\samproxy_v2.03.exe:samproxy_v2.03.exe
"UDP Query User{46D7469A-D1D2-4478-B9D8-199C4BF4A8A8}c:\\users\\ravi\\appdata\\local\\temp\\rar$ex01.140\\samproxy_v2.03.exe"= TCP:c:\users\ravi\appdata\local\temp\rar$ex01.140\samproxy_v2.03.exe:samproxy_v2.03.exe
"{10784326-E1A4-4174-A87A-00F3FFBC63B9}"= UDP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{F751B5D8-1981-4A1E-BE27-DCE8D9F6A66F}"= TCP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{6A51E8BC-9D97-440D-A722-89DBB22AA728}"= UDP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{C588E013-149B-40CE-9808-1247FD939C38}"= TCP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{ACE63434-FAE2-4376-91B2-BA7B6EFD1E01}"= UDP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{242D1DDC-08F0-4C48-B945-7CCDAF8125DD}"= TCP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"TCP Query User{85EEF171-1B5A-4E93-9849-FDC8454F6E2E}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java™ Platform SE binary
"UDP Query User{FE04C52C-2651-448D-8156-5C6739E824A4}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java™ Platform SE binary
"TCP Query User{0BCD617C-2E3D-4567-92C1-70806078A3C1}c:\\program files\\garena\\garena.exe"= UDP:c:\program files\garena\garena.exe:Garena
"UDP Query User{32BF60F8-CD92-4507-AD49-03F166E6B6DA}c:\\program files\\garena\\garena.exe"= TCP:c:\program files\garena\garena.exe:Garena
"TCP Query User{4676167D-9D49-419A-A7C2-08037F7ABD60}c:\\windows\\temp\\rar$ex00.094\\samproxy_v2.03.exe"= UDP:c:\windows\temp\rar$ex00.094\samproxy_v2.03.exe:samproxy_v2.03.exe
"UDP Query User{8A62F8EA-57DE-48EF-91FB-A4F07C8F3E65}c:\\windows\\temp\\rar$ex00.094\\samproxy_v2.03.exe"= TCP:c:\windows\temp\rar$ex00.094\samproxy_v2.03.exe:samproxy_v2.03.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R1 SpyEmrg;Spy Emergency Driver;c:\windows\System32\drivers\spyemrg.sys [24/07/2009 22:30 12344]
R2 SpyEmrgSrv;Spy Emergency Engine Service;c:\program files\NETGATE\Spy Emergency 2009\SpyEmergencySrv.exe [24/07/2009 22:30 1788472]
R3 SpyEmrgAccess;Spy Emergency OnAccess Driver;c:\windows\System32\drivers\spyemrg_access.sys [24/07/2009 22:30 15672]
R3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver;c:\windows\System32\drivers\spyemrg_guard.sys [24/07/2009 22:30 14392]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [24/07/2009 21:11 38160]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-26 04:08
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DataCardMonitor = c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe?tem\QTJava.zip?SystemDrive=C:?S?????W???7??????dows?TEMP=c:\users\ravi\AppData\Local\Temp?TMP=c:\users\ravi\AppData\Local\Temp?TRACE_FORMAT_SEARCH_PATH=\\NTREL202.ntdev.corp.microsoft.com\4F1

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\windows\TEMP\FUNF56C.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-07-26 4:09
ComboFix-quarantined-files.txt 2009-07-26 03:09
ComboFix2.txt 2009-07-25 18:23

Pre-Run: 121,529,196,544 bytes free
Post-Run: 121,528,692,736 bytes free

299 — E O F — 2009-07-25 18:45


Malwarebytes' Anti-Malware 1.39
Database version: 2502
Windows 6.0.6001 Service Pack 1

26/07/2009 04:26:20
mbam-log-2009-07-26 (04-26-20).txt

Scan type: Quick Scan
Objects scanned: 74954
Time elapsed: 5 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows update manager (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\ravi\AppData\Local\Temp\37833.exe (Rootkit.Dropper) -> Quarantined and deleted successfully.
c:\Users\ravi\AppData\Local\Temp\a.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\ravi\AppData\Local\Temp\msxml71.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\ravi\AppData\Roaming\WinUpdate.exe (Trojan.Downloader) -> Quarantined and deleted successfully.


The online Kasperky test always crashes in the middle, if my taskbar freezes there is no way solve it I gotta restart, since the first CB I'm crashin a lot
Post #13
Hi,

Please do the following:

Disable resident protections (Antivirus / security programs) - you'll re-enable them after the scan

Download Lop S&D >>here<<
  • Double-click Lop S&D.exe
  • Choose the language, then choose Option 1 (Search)
  • Wait till the end of the scan
  • Post the log which is created: (%SystemDrive%\lopR.txt)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI