What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Search Hijacker.H C:/windows/system32/geyekrnagyrahh.d

33 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Please Help. I was infected with a trojan a couple weeks ago. It was the Vundo trojan. I purchased STOPzilla, and it killed the trojan. Problem is, my disk defragmentor won't work and STOPzilla keeps finding a Search Hijacker.H file. C:/windows/system32/geyekrnagyrahh.dll. It redirects my searches and slows my computer down majorly. I always keep my computer clean by running anti-malware every week, and STOPzilla removes detected infections every week as well. If it helps, I got the trojan by downloading a program off of Limewire. Here are the Hijackthis and Anti-Malware logs. Any help would be great! :)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:50:21 PM, on 7/31/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDrt.exe
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\STOPzilla!\SZOptions.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://denethor2.is.uindy.edu/cp/home/loginf
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1226608773731
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AntipyPro_12 (AntipPro2009_12) - Unknown owner - C:\WINDOWS\svchast.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe

–
End of file - 7267 bytes

________________________________________________________________________________
_____________________


Malwarebytes' Anti-Malware 1.39
Database version: 2438
Windows 5.1.2600 Service Pack 3

7/31/2009 3:48:10 PM
mbam-log-2009-07-31 (15-48-10).txt

Scan type: Quick Scan
Objects scanned: 79523
Time elapsed: 3 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Adware Professional (Rogue.AdwareProfessional) -> Quarantined and deleted successfully.

Files Infected:
c:\program files\adware professional\noadware4_073009.na (Rogue.AdwareProfessional) -> Quarantined and deleted successfully.
c:\program files\adware professional\nutilities.dll (Rogue.AdwareProfessional) -> Quarantined and deleted successfully.
Post #2
Hi and Welcome,

NOTE:
  • Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
  • Absence of symptoms does not always mean the computer is clean
  • Kindly follow my instructions in the order posted.
  • Please DO NOT run any scans or fix items without my direction.



Please do the following:

STEP #1

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


STEP #2


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
I could perform Step 1 successfully. I started step two, downloaded the file, extracted the files, but when i tried to run the .exe it hesitated, then the .exe icon disappeared with nothing starting. What should I do about that? Here are the DDS logs…. DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 18:12:31.06 on Fri 07/31/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_11 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.403 [GMT -4:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe svchost.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\IFXSPMGT.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\system32\IFXTCS.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ProtectTools\Embedded Security Software\PSDrt.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\CE User\Desktop\dds.scr ============== Pseudo HJT Report =============== uLocal Page = \blank.htm uStart Page = hxxp://denethor2.is.uindy.edu/cp/home/loginf uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch uInternet Settings,ProxyOverride = *.local BHO: STOPzilla Browser Helper Object: {e3215f20-3212-11d6-9f8b-00d0b743919d} - c:\program files\stopzilla!\SZIEBHO.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe mRun: [PTHOSTTR] c:\program files\hewlett-packard\hp protecttools security manager\PTHOSTTR.EXE /Start mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226608773731 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: avgrsstarter - avgrsstx.dll Notify: IfxWlxEN - IfxWlxEN.dll Notify: igfxcui - igfxdev.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-7-16 335752] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-7-16 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-7-16 108552] R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [2005-11-29 36768] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-7-16 907032] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-7-16 298776] R2 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [2009-5-12 61328] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2007-10-25 88192] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2005-10-21 36352] S1 rbadza;RAMDAC XGPU Controller;c:\windows\system32\rbadza.sys –> c:\windows\system32\rbadza.sys [?] S2 AntipPro2009_12;AntipyPro_12;c:\windows\svchast.exe –> c:\windows\svchast.exe [?] S3 PCX500;Cisco Wireless LAN Adapters Driver;c:\windows\system32\drivers\pcx500.sys [2007-10-24 169984] =============== Created Last 30 ================ 2009-07-31 16:12 376 a——- c:\windows\system32\drivers\kgpfr2.cfg 2009-07-31 16:11 1,896 a——- c:\windows\system32\drivers\kgpcpy.cfg 2009-07-31 02:35 a-d—– c:\windows\system32\images 2009-07-31 02:35 8,550 a——- c:\windows\system32\wispex.html 2009-07-31 00:24 4 a——- c:\windows\system32\bincd32.dat 2009-07-30 13:21 36 a——- c:\windows\system32\sysnet.dat 2009-07-30 13:21 9 a——- c:\windows\system32\bennuar.old 2009-07-30 13:21 65,536 a——- c:\windows\system32\desot.exe 2009-07-30 13:21 110 a——- c:\windows\system32\sonhelp.htm 2009-07-30 13:21 64 a——- c:\windows\ppp4.dat 2009-07-30 13:21 2 a——- c:\windows\ppp3.dat 2009-07-21 16:14 0 a——- c:\windows\INSTAB.INI 2009-07-21 12:05 –d-h— C:\$AVG8.VAULT$ 2009-07-20 13:17 –d—– c:\program files\iPod 2009-07-20 13:17 –d—– c:\program files\iTunes 2009-07-17 15:32 –d—– c:\program files\LimeWire 2009-07-16 21:03 –d—– c:\program files\Trend Micro 2009-07-16 20:58 –d—– c:\docume~1\ceuser~1\applic~1\Uniblue 2009-07-16 20:58 –d—– c:\docume~1\alluse~1\applic~1\DriverScanner 2009-07-16 20:16 –d—– c:\docume~1\alluse~1\applic~1\SecTaskMan 2009-07-16 20:15 –d—– c:\program files\Security Task Manager 2009-07-16 19:53 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-07-16 19:53 108,552 a——- c:\windows\system32\drivers\avgtdix.sys 2009-07-16 19:53 335,752 a——- c:\windows\system32\drivers\avgldx86.sys 2009-07-16 19:53 –d—– c:\windows\system32\drivers\Avg 2009-07-16 19:52 –d—– c:\docume~1\alluse~1\applic~1\avg8 2009-07-16 17:11 –d—– c:\windows\pss 2009-07-16 04:16 –d—– c:\docume~1\ceuser~1\applic~1\Malwarebytes 2009-07-16 04:16 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-16 04:16 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-07-16 04:16 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-07-16 04:16 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-07-16 04:04 -cd—– c:\windows\system32\dllcache\cache 2009-07-16 03:52 a-dshr– C:\cmdcons 2009-07-16 03:50 161,792 a——- c:\windows\SWREG.exe 2009-07-16 03:50 98,816 a——- c:\windows\sed.exe 2009-07-15 20:39 –d—– c:\program files\SUPERAntiSpyware 2009-07-15 16:39 –d—– c:\docume~1\alluse~1\applic~1\SITEguard 2009-07-15 16:38 –d—– c:\program files\STOPzilla! 2009-07-15 16:38 –d—– c:\program files\common files\iS3 2009-07-15 16:38 –d—– c:\docume~1\alluse~1\applic~1\STOPzilla! 2009-07-15 16:13 –d—– C:\Temp 2009-07-15 16:12 156,910 a——- c:\windows\WMSysPr8.prx 2009-07-15 16:12 665,424 a——- c:\windows\system32\wmv8dmoe.dll 2009-07-15 16:12 438,608 a——- c:\windows\system32\wmv8dmod.dll 2009-07-15 16:12 1,683,792 a——- c:\windows\system32\wmvcore2.dll 2009-07-15 16:12 572,752 a——- c:\windows\system32\wmvdmoe.dll 2009-07-15 16:12 285,184 a——- c:\windows\system32\wmidx2.ocx 2009-07-15 15:58 4 a——- c:\docume~1\ceuser~1\applic~1\NP.sys 2009-07-14 23:33 –d—– c:\program files\Full Tilt Poker 2009-07-13 15:08 17,408 a—-r– c:\windows\system32\SZIO5.dll 2009-07-13 15:07 311,296 a—-r– c:\windows\system32\SZBase5.dll 2009-07-13 15:06 540,672 a—-r– c:\windows\system32\SZComp5.dll 2009-07-09 15:52 126,976 a—-r– c:\windows\system32\IS3HTUI5.dll 2009-07-09 15:52 393,216 a—-r– c:\windows\system32\IS3DBA5.dll 2009-07-09 15:51 385,024 a—-r– c:\windows\system32\IS3UI5.dll 2009-07-09 15:51 61,440 a—-r– c:\windows\system32\IS3Hks5.dll 2009-07-09 15:51 23,040 a—-r– c:\windows\system32\IS3XDat5.dll 2009-07-09 15:50 225,280 a—-r– c:\windows\system32\IS3Win325.dll 2009-07-09 15:50 94,208 a—-r– c:\windows\system32\IS3Inet5.dll 2009-07-09 15:50 90,112 a—-r– c:\windows\system32\IS3Svc5.dll 2009-07-09 15:47 724,992 a—-r– c:\windows\system32\IS3Base5.dll 2009-07-08 05:58 116 a——- c:\windows\NeroDigital.ini 2009-07-05 07:58 754 a——- c:\windows\WORDPAD.INI 2009-07-04 19:10 –d—– c:\windows\system32\LogFiles 2009-07-01 22:55 –dsh— c:\documents and settings\ce user\IECompatCache 2009-07-01 19:59 –d—– c:\windows\system32\NtmsData ==================== Find3M ==================== 2009-07-31 15:49 596 a——- c:\program files\waazce.txt 2009-07-16 20:41 156 a——- c:\program files\zwsgk.txt 2009-07-03 13:09 915,456 a——- c:\windows\system32\wininet.dll 2009-06-16 10:36 119,808 a——- c:\windows\system32\t2embed.dll 2009-06-16 10:36 81,920 a——- c:\windows\system32\fontsub.dll 2009-06-03 15:09 1,291,264 a——- c:\windows\system32\quartz.dll 2009-05-07 11:32 345,600 a——- c:\windows\system32\localspl.dll ============= FINISH: 18:13:57.75 ===============

Attachments:

Post #4
Couple of things to try ….

Try renaming it to REMG.exe or run it in safe mode,

If that program wont run at all, try this one


Please download Sysprot Antirootkit from here

http://sites.google.com/site/sysprotantirootkit/

Unzip it into a folder on your desktop.

  • Double click Sysprot.exe to start the program.
  • Click on the Log tab.
  • In the Write to log box select all items.
  • Look near the bottom left, and Check "Hidden Objects Only"
  • Click on the Create Log button on the bottom right.
  • After a few seconds a new window should appear.
  • Select Scan Root Drive. Click on the Start button.
  • When it is complete a new window will appear to indicate that the scan is finished.
  • The log will be saved automatically in the same folder Sysprot.exe was extracted to.
  • Open the text file and copy/paste the log here.
Post #5
Here's the Sysprot log. SysProt AntiRootkit v1.0.1.0 by swatkat ******************************************************************************** ********** ******************************************************************************** ********** No Hidden Processes found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Modules: Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys Service Name: — Module Base: AACB7000 Module End: AACCF000 Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS Service Name: — Module Base: F7AC5000 Module End: F7AC7000 Hidden: Yes ******************************************************************************** ********** ******************************************************************************** ********** No SSDT Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Hooks: Hooked Function: ZwSaveKeyEx At Address: 8061BECA Jump To: 865702C2 Module Name: _unknown_ Hooked Function: ZwSaveKey At Address: 8061BDE4 Jump To: 85AE983A Module Name: _unknown_ Hooked Function: ZwFlushInstructionCache At Address: 805ABEC4 Jump To: 86565E84 Module Name: _unknown_ Hooked Function: ZwEnumerateKey At Address: 8061AB70 Jump To: 86570B04 Module Name: _unknown_ Hooked Function: IofCompleteRequest At Address: 804EE1C0 Jump To: 86456433 Module Name: _unknown_ Hooked Function: IofCallDriver At Address: 804EE130 Jump To: 864477A3 Module Name: _unknown_ ******************************************************************************** ********** ******************************************************************************** ********** No IRP Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Ports: Local Address: NC6220:4968 Remote Address: 192.168.1.1:5000 Type: TCP Process: C:\WINDOWS\system32\svchost.exe State: ESTABLISHED Local Address: NC6220:NETBIOS-SSN Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: NC6220:27015 Remote Address: LOCALHOST:1026 Type: TCP Process: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe State: ESTABLISHED Local Address: NC6220:27015 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe State: LISTENING Local Address: NC6220:18080 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe State: LISTENING Local Address: NC6220:13128 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe State: LISTENING Local Address: NC6220:10110 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\PROGRA~1\AVG\AVG8\avgemc.exe State: LISTENING Local Address: NC6220:10080 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe State: LISTENING Local Address: NC6220:5354 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Bonjour\mDNSResponder.exe State: LISTENING Local Address: NC6220:5152 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Java\jre6\bin\jqs.exe State: LISTENING Local Address: NC6220:1488 Remote Address: LOCALHOST:10080 Type: TCP Process: C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe State: CLOSE_WAIT Local Address: NC6220:1030 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\system32\alg.exe State: LISTENING Local Address: NC6220:1026 Remote Address: LOCALHOST:27015 Type: TCP Process: C:\Program Files\iTunes\iTunesHelper.exe State: ESTABLISHED Local Address: NC6220:2869 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\system32\svchost.exe State: LISTENING Local Address: NC6220:MICROSOFT-DS Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: NC6220:5353 Remote Address: NA Type: UDP Process: C:\Program Files\Bonjour\mDNSResponder.exe State: NA Local Address: NC6220:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: NC6220:138 Remote Address: NA Type: UDP Process: System State: NA Local Address: NC6220:NETBIOS-NS Remote Address: NA Type: UDP Process: System State: NA Local Address: NC6220:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: NC6220:4542 Remote Address: NA Type: UDP Process: C:\Program Files\Internet Explorer\iexplore.exe State: NA Local Address: NC6220:4431 Remote Address: NA Type: UDP Process: C:\Program Files\Internet Explorer\iexplore.exe State: NA Local Address: NC6220:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: NC6220:1036 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: NC6220:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: NC6220:62399 Remote Address: NA Type: UDP Process: C:\Program Files\Bonjour\mDNSResponder.exe State: NA Local Address: NC6220:4500 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\lsass.exe State: NA Local Address: NC6220:1025 Remote Address: NA Type: UDP Process: C:\Program Files\Bonjour\mDNSResponder.exe State: NA Local Address: NC6220:500 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\lsass.exe State: NA Local Address: NC6220:MICROSOFT-DS Remote Address: NA Type: UDP Process: System State: NA ******************************************************************************** ********** ******************************************************************************** ********** Hidden files/folders: Object: C:\Documents and Settings\All Users\Application Data\SecTaskMan\geyekrnagyrahh.dll.q_Quarantine_1BB50_q.ini Status: Hidden Object: C:\Documents and Settings\CE User\Local Settings\Temp\geyekrrysvlxxo000 Status: Hidden Object: C:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: C:\System Volume Information\tracking.log Status: Access denied Object: C:\System Volume Information\_restore{02933101-065A-4CC3-9CDA-04D637136CB6} Status: Access denied Object: C:\WINDOWS\system32\drivers\geyekrfukfraat.sys Status: Hidden Object: C:\WINDOWS\system32\geyekrcseuavos.dat Status: Hidden Object: C:\WINDOWS\system32\geyekrnagyrahh.dll Status: Hidden Object: C:\WINDOWS\system32\geyekrwnqyqmmx.dll Status: Hidden Object: C:\WINDOWS\system32\geyekrwrrnylch.dat Status: Hidden
Post #6
Hi,

Please do the following:

Download Combofix from either of the links below. You must rename it before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".


Link 1
Link 2



During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]


[external image: Posted Image]
——————————————————————–
  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.


———————————————————–

  • Double click on Combo-Fix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\Combo-Fix.txt" for further review.
    **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**


    ———————————————————–

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    ———————————————————–

Post #7
Here's the combo fix log. I'm starting to see the files that need deleted in these logs.

ComboFix 09-07-31.04 - CE User 08/01/2009 14:42.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.647 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

Overlay aborted … Please run ComboFix once more
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_RBADZA
——-\Service_rbadza


((((((((((((((((((((((((( Files Created from 2009-07-01 to 2009-08-01 )))))))))))))))))))))))))))))))
.

2009-07-31 06:35 . 2008-11-27 22:47 ——– d—a-w- c:\windows\system32\images
2009-07-31 04:24 . 2009-07-31 06:31 4 —-a-w- c:\windows\system32\bincd32.dat
2009-07-30 17:21 . 2009-07-30 17:21 36 —-a-w- c:\windows\system32\sysnet.dat
2009-07-30 17:21 . 2009-07-31 06:35 65536 —-a-w- c:\windows\system32\desot.exe
2009-07-30 17:21 . 2009-07-31 06:35 64 —-a-w- c:\windows\ppp4.dat
2009-07-30 17:21 . 2009-07-31 06:35 2 —-a-w- c:\windows\ppp3.dat
2009-07-24 22:10 . 2009-07-24 22:10 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\WMTools Downloaded Files
2009-07-21 16:05 . 2009-07-26 16:08 ——– d–h–w- C:\$AVG8.VAULT$
2009-07-20 17:17 . 2009-07-20 17:17 ——– d—–w- c:\program files\iPod
2009-07-20 17:17 . 2009-07-20 17:17 ——– d—–w- c:\program files\iTunes
2009-07-17 19:32 . 2009-07-17 19:33 ——– d—–w- c:\program files\LimeWire
2009-07-17 05:45 . 2009-07-17 05:45 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\Ahead
2009-07-17 01:03 . 2009-07-17 01:03 ——– d—–w- c:\program files\Trend Micro
2009-07-17 00:58 . 2009-07-17 01:10 ——– d—–w- c:\documents and settings\CE User\Application Data\Uniblue
2009-07-17 00:58 . 2009-07-17 01:10 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\DriverScanner
2009-07-17 00:18 . 2009-07-17 00:18 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\Help
2009-07-17 00:16 . 2009-07-21 16:05 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\SecTaskMan
2009-07-17 00:15 . 2009-07-24 17:01 ——– d—–w- c:\program files\Security Task Manager
2009-07-16 23:53 . 2009-07-16 23:53 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-07-16 23:53 . 2009-07-16 23:53 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-07-16 23:53 . 2009-07-17 18:02 335752 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-16 23:53 . 2009-07-16 23:53 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-16 23:53 . 2009-08-01 18:23 ——– d—–w- c:\windows\system32\drivers\Avg
2009-07-16 23:52 . 2009-07-16 23:52 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-16 08:16 . 2009-07-16 08:16 ——– d—–w- c:\documents and settings\CE User\Application Data\Malwarebytes
2009-07-16 08:16 . 2009-07-13 17:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-16 08:16 . 2009-07-16 08:16 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-16 08:16 . 2009-07-16 08:16 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-07-16 08:16 . 2009-07-13 17:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-16 00:47 . 2009-07-16 03:07 ——– d—a-w- c:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-07-16 00:39 . 2009-07-17 00:26 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-07-15 21:50 . 2009-07-15 21:50 ——– d-sh–w- c:\windows\system32\config\systemprofile\PrivacIE
2009-07-15 21:07 . 2009-07-15 21:07 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2009-07-15 20:58 . 2009-07-15 20:58 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-07-15 20:55 . 2009-07-17 01:12 ——– d—–w- c:\program files\Windows Live Safety Center
2009-07-15 20:39 . 2009-07-16 04:15 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\SITEguard
2009-07-15 20:38 . 2009-07-15 20:38 ——– d—–w- c:\program files\STOPzilla!
2009-07-15 20:38 . 2009-07-15 20:38 ——– d—–w- c:\program files\Common Files\iS3
2009-07-15 20:38 . 2009-08-01 18:40 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\STOPzilla!
2009-07-15 20:13 . 2009-07-15 20:14 ——– d—–w- C:\Temp
2009-07-15 20:12 . 2009-07-15 20:12 ——– d—–w- c:\documents and settings\CE User\Application Data\Syntrillium
2009-07-15 20:12 . 2001-10-19 18:40 438608 —-a-w- c:\windows\system32\wmv8dmod.dll
2009-07-15 20:12 . 2001-10-19 18:40 665424 —-a-w- c:\windows\system32\wmv8dmoe.dll
2009-07-15 20:12 . 2001-10-19 18:40 1683792 —-a-w- c:\windows\system32\wmvcore2.dll
2009-07-15 20:12 . 2001-10-19 18:39 572752 —-a-w- c:\windows\system32\wmvdmoe.dll
2009-07-15 19:58 . 2009-07-15 19:58 4 —-a-w- c:\documents and settings\CE User\Application Data\NP.sys
2009-07-15 03:34 . 2009-07-15 05:55 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\FullTiltPoker
2009-07-15 03:33 . 2009-07-22 20:28 ——– d—–w- c:\program files\Full Tilt Poker
2009-07-13 19:08 . 2009-07-13 19:08 17408 —-a-r- c:\windows\system32\SZIO5.dll
2009-07-13 19:07 . 2009-07-13 19:07 311296 —-a-r- c:\windows\system32\SZBase5.dll
2009-07-13 19:06 . 2009-07-13 19:06 540672 —-a-r- c:\windows\system32\SZComp5.dll
2009-07-13 17:12 . 2009-07-13 17:12 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-07-09 19:52 . 2009-07-09 19:52 126976 —-a-r- c:\windows\system32\IS3HTUI5.dll
2009-07-09 19:52 . 2009-07-09 19:52 393216 —-a-r- c:\windows\system32\IS3DBA5.dll
2009-07-09 19:51 . 2009-07-09 19:51 385024 —-a-r- c:\windows\system32\IS3UI5.dll
2009-07-09 19:51 . 2009-07-09 19:51 61440 —-a-r- c:\windows\system32\IS3Hks5.dll
2009-07-09 19:51 . 2009-07-09 19:51 23040 —-a-r- c:\windows\system32\IS3XDat5.dll
2009-07-09 19:50 . 2009-07-09 19:50 225280 —-a-r- c:\windows\system32\IS3Win325.dll
2009-07-09 19:50 . 2009-07-09 19:50 94208 —-a-r- c:\windows\system32\IS3Inet5.dll
2009-07-09 19:50 . 2009-07-09 19:50 90112 —-a-r- c:\windows\system32\IS3Svc5.dll
2009-07-09 19:47 . 2009-07-09 19:47 724992 —-a-r- c:\windows\system32\IS3Base5.dll
2009-07-07 08:57 . 2009-07-07 08:57 ——– d—–w- c:\documents and settings\CE User\Application Data\CyberLink
2009-07-05 04:44 . 2009-07-05 04:44 ——– d—–w- c:\windows\Sun
2009-07-04 23:10 . 2009-07-04 23:10 ——– d—–w- c:\windows\system32\LogFiles
2009-07-03 01:37 . 2009-07-03 01:37 ——– d—–w- c:\program files\Common Files\Adobe
2009-07-03 01:36 . 2009-02-12 09:35 38208 —-a-w- c:\documents and settings\CE User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-07-03 01:36 . 2009-07-03 01:36 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-07-03 01:35 . 2009-07-03 01:39 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\Adobe
2009-07-03 01:35 . 2009-07-05 11:47 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\NOS
2009-07-03 01:35 . 2009-07-05 11:47 ——– d—–w- c:\program files\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-31 22:31 . 2009-07-01 04:07 1 —-a-w- c:\documents and settings\CE User\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-07-31 19:49 . 2009-07-31 19:49 596 —-a-w- c:\program files\waazce.txt
2009-07-24 20:00 . 2009-07-01 20:07 ——– d—–w- c:\documents and settings\CE User\Application Data\LimeWire
2009-07-20 17:17 . 2009-07-01 02:49 ——– d—–w- c:\program files\Common Files\Apple
2009-07-17 00:41 . 2009-07-17 00:41 156 —-a-w- c:\program files\zwsgk.txt
2009-07-15 03:33 . 2007-10-25 20:26 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-03 17:09 . 2004-08-04 05:56 915456 —-a-w- c:\windows\system32\wininet.dll
2009-07-01 04:52 . 2009-07-01 04:52 0 —-a-w- c:\windows\nsreg.dat
2009-07-01 04:06 . 2009-07-01 04:06 ——– d—–w- c:\documents and settings\CE User\Application Data\OpenOffice.org
2009-07-01 03:07 . 2009-07-01 02:51 ——– d—–w- c:\documents and settings\CE User\Application Data\Apple Computer
2009-07-01 02:51 . 2009-07-01 02:51 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-01 02:51 . 2009-07-01 02:50 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Apple Computer
2009-07-01 02:50 . 2009-07-01 02:50 ——– d—–w- c:\program files\Bonjour
2009-07-01 02:50 . 2009-07-01 02:50 ——– d—–w- c:\program files\QuickTime
2009-07-01 02:50 . 2009-07-01 02:50 ——– d—–w- c:\program files\Apple Software Update
2009-07-01 02:49 . 2009-07-01 02:49 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Apple
2009-07-01 02:40 . 2009-07-01 02:40 18864 —-a-w- c:\documents and settings\CE User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 14:28 . 2009-06-29 14:28 ——– d—–w- c:\program files\AVG
2009-06-16 14:36 . 2004-08-04 05:56 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2003-03-31 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-03 19:09 . 2004-08-04 05:56 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-12 18:13 . 2009-05-12 18:13 61328 —-a-r- c:\windows\system32\drivers\SZKG.sys
2009-05-07 15:32 . 2004-08-04 05:56 345600 —-a-w- c:\windows\system32\localspl.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-16_08.04.19 )))))))))))))))))))))))))))))))))))))))))
.
- 2003-03-31 12:00 . 2009-07-16 03:36 40394 c:\windows\system32\perfc009.dat
+ 2003-03-31 12:00 . 2009-07-21 20:59 40394 c:\windows\system32\perfc009.dat
- 2007-08-13 23:54 . 2009-03-08 09:31 55296 c:\windows\system32\msfeedsbs.dll
+ 2007-08-13 23:54 . 2009-07-03 17:09 55296 c:\windows\system32\msfeedsbs.dll
- 2004-08-04 05:56 . 2009-04-30 21:22 25600 c:\windows\system32\jsproxy.dll
+ 2004-08-04 05:56 . 2009-07-03 17:09 25600 c:\windows\system32\jsproxy.dll
+ 2009-06-29 14:28 . 2009-07-03 17:09 12800 c:\windows\system32\dllcache\xpshims.dll
- 2009-06-29 14:28 . 2009-04-30 21:22 12800 c:\windows\system32\dllcache\xpshims.dll
- 2007-10-25 19:54 . 2009-03-08 09:31 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2007-10-25 19:54 . 2009-07-03 17:09 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2004-08-04 05:56 . 2009-04-30 21:22 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2004-08-04 05:56 . 2009-07-03 17:09 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2009-07-30 17:22 . 2009-07-30 17:21 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009073020090731\index.dat
+ 2009-07-30 17:22 . 2009-07-30 17:21 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009071320090720\index.dat
- 2007-10-25 01:04 . 2009-07-16 03:32 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-10-25 01:04 . 2009-08-01 18:40 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-10-25 01:04 . 2009-07-16 03:32 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2007-10-25 01:04 . 2009-08-01 18:40 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-21 18:48 . 2007-03-06 01:22 22752 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\update\spcustom.dll
+ 2008-08-21 18:48 . 2007-03-06 01:22 14048 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\spmsg.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 44544 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\pngfilt.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 52224 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\msfeedsbs.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 27648 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\jsproxy.dll
+ 2008-08-21 18:48 . 2008-06-23 08:23 13824 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\ieudinit.exe
+ 2008-08-21 18:48 . 2008-06-23 16:01 44544 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\iernonce.dll
+ 2008-08-21 18:48 . 2008-06-23 08:23 70656 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\ie4uinit.exe
+ 2008-08-21 18:48 . 2008-06-23 16:01 63488 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\icardie.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 44544 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\pngfilt.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 52224 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\msfeedsbs.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 27648 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\jsproxy.dll
+ 2008-08-21 18:48 . 2008-06-23 09:20 13824 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\ieudinit.exe
+ 2008-08-21 18:48 . 2008-06-23 16:57 44544 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\iernonce.dll
+ 2008-08-21 18:48 . 2008-06-23 09:20 70656 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\ie4uinit.exe
+ 2008-08-21 18:48 . 2008-06-23 16:57 63488 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\icardie.dll
+ 2009-07-14 19:22 . 2008-07-08 13:02 26488 c:\windows\SD_OLD\Download\cfb5c33fcc73ed7dcd60250b085691a5\update\spcustom.dll
+ 2009-07-14 19:22 . 2008-07-08 13:02 17272 c:\windows\SD_OLD\Download\cfb5c33fcc73ed7dcd60250b085691a5\spmsg.dll
+ 2008-08-21 18:49 . 2007-11-30 12:39 26488 c:\windows\SD_OLD\Download\cb5a6e6205e8e4bf4d746b7f5bcdd148\update\spcustom.dll
+ 2008-08-21 18:49 . 2007-11-30 12:39 17272 c:\windows\SD_OLD\Download\cb5a6e6205e8e4bf4d746b7f5bcdd148\spmsg.dll
+ 2008-08-21 18:49 . 2007-03-06 01:22 22752 c:\windows\SD_OLD\Download\c286b650f35378bdc0c45de56f787772\update\spcustom.dll
+ 2008-08-21 18:49 . 2007-03-06 01:22 14048 c:\windows\SD_OLD\Download\c286b650f35378bdc0c45de56f787772\spmsg.dll
+ 2008-08-20 20:35 . 2007-03-06 01:22 22752 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\update\spcustom.dll
+ 2008-08-20 20:35 . 2007-03-06 01:22 14048 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\spmsg.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 53279 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msjter40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 53279 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msjter40.dll
+ 2009-07-14 19:22 . 2008-07-08 13:02 26488 c:\windows\SD_OLD\Download\97f18c7ac91916468f96bb79c87bff6c\update\spcustom.dll
+ 2009-07-14 19:22 . 2008-07-08 13:02 17272 c:\windows\SD_OLD\Download\97f18c7ac91916468f96bb79c87bff6c\spmsg.dll
+ 2009-07-14 19:22 . 2008-07-08 13:02 26488 c:\windows\SD_OLD\Download\40fc5c00ee89ac515590995374843d78\update\spcustom.dll
+ 2009-07-14 19:22 . 2008-07-08 13:02 17272 c:\windows\SD_OLD\Download\40fc5c00ee89ac515590995374843d78\spmsg.dll
+ 2009-06-16 14:43 . 2009-06-16 14:43 81920 c:\windows\SD_OLD\Download\40fc5c00ee89ac515590995374843d78\sp3qfe\fontsub.dll
+ 2009-06-16 14:36 . 2009-06-16 14:36 81920 c:\windows\SD_OLD\Download\40fc5c00ee89ac515590995374843d78\sp3gdr\fontsub.dll
+ 2007-10-25 19:51 . 2005-10-12 23:12 22752 c:\windows\SD_OLD\Download\355f788b6de8a3ec79e9aa172e6317f1\update\spcustom.dll
+ 2007-10-25 19:51 . 2005-10-12 23:12 14048 c:\windows\SD_OLD\Download\355f788b6de8a3ec79e9aa172e6317f1\spmsg.dll
+ 2006-03-24 04:47 . 2006-03-24 04:47 49152 c:\windows\SD_OLD\Download\355f788b6de8a3ec79e9aa172e6317f1\sp2qfe\wdigest.dll
+ 2006-03-24 04:37 . 2006-03-24 04:37 49152 c:\windows\SD_OLD\Download\355f788b6de8a3ec79e9aa172e6317f1\sp2gdr\wdigest.dll
+ 2009-05-01 15:15 . 2007-11-30 12:39 26488 c:\windows\SD_OLD\Download\127e503e3f80c0d9923e937ca2857f6b\update\spcustom.dll
+ 2009-05-01 15:15 . 2007-11-30 12:39 17272 c:\windows\SD_OLD\Download\127e503e3f80c0d9923e937ca2857f6b\spmsg.dll
+ 2007-10-25 19:51 . 2005-10-12 23:12 22752 c:\windows\SD_OLD\Download\0facce6115ab861022eae3087e064a2a\update\spcustom.dll
+ 2007-10-25 19:51 . 2005-10-12 23:12 14048 c:\windows\SD_OLD\Download\0facce6115ab861022eae3087e064a2a\spmsg.dll
+ 2007-10-25 19:51 . 2006-06-03 11:40 33792 c:\windows\SD_OLD\Download\0facce6115ab861022eae3087e064a2a\SP2QFE\custsat.dll
+ 2007-10-25 19:52 . 2007-03-06 01:22 22752 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\update\spcustom.dll
+ 2007-10-25 19:52 . 2007-03-06 01:22 14048 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\spmsg.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 52224 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\msfeedsbs.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 27648 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\jsproxy.dll
+ 2007-10-25 19:52 . 2007-08-17 10:12 13824 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\ieudinit.exe
+ 2007-10-25 19:52 . 2007-08-20 10:02 44544 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\iernonce.dll
+ 2007-10-25 19:52 . 2007-08-17 10:12 70656 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\ie4uinit.exe
+ 2007-10-25 19:52 . 2007-08-20 10:02 63488 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\icardie.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 52224 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\msfeedsbs.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 27648 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\jsproxy.dll
+ 2007-10-25 19:52 . 2007-08-17 10:20 13824 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\ieudinit.exe
+ 2007-10-25 19:52 . 2007-08-20 10:04 44544 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\iernonce.dll
+ 2007-10-25 19:52 . 2007-08-17 10:20 63488 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\ie4uinit.exe
+ 2007-10-25 19:52 . 2007-08-20 10:04 63488 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\icardie.dll
+ 2009-07-29 16:32 . 2009-04-30 21:22 12800 c:\windows\ie8updates\KB972260-IE8\xpshims.dll
+ 2009-07-29 16:32 . 2009-03-08 09:31 55296 c:\windows\ie8updates\KB972260-IE8\msfeedsbs.dll
+ 2009-07-29 16:32 . 2009-04-30 21:22 25600 c:\windows\ie8updates\KB972260-IE8\jsproxy.dll
- 2003-03-31 12:00 . 2009-07-16 03:36 312172 c:\windows\system32\perfh009.dat
+ 2003-03-31 12:00 . 2009-07-21 20:59 312172 c:\windows\system32\perfh009.dat
+ 2004-08-04 05:56 . 2009-07-03 17:09 206848 c:\windows\system32\occache.dll
- 2007-08-13 23:54 . 2009-03-08 09:32 594432 c:\windows\system32\msfeeds.dll
+ 2007-08-13 23:54 . 2009-07-03 17:09 594432 c:\windows\system32\msfeeds.dll
+ 2004-08-04 05:56 . 2009-07-03 17:09 184320 c:\windows\system32\iepeers.dll
+ 2004-08-04 05:56 . 2009-07-03 17:09 386048 c:\windows\system32\iedkcs32.dll
+ 2004-08-04 05:56 . 2009-07-03 11:01 173056 c:\windows\system32\ie4uinit.exe
- 2004-08-04 05:56 . 2009-04-30 11:21 173056 c:\windows\system32\ie4uinit.exe
- 2004-08-04 05:56 . 2009-05-13 05:15 915456 c:\windows\system32\dllcache\wininet.dll
+ 2004-08-04 05:56 . 2009-07-03 17:09 915456 c:\windows\system32\dllcache\wininet.dll
+ 2004-08-04 05:56 . 2009-07-03 17:09 206848 c:\windows\system32\dllcache\occache.dll
- 2007-10-25 19:54 . 2009-03-08 09:32 594432 c:\windows\system32\dllcache\msfeeds.dll
+ 2007-10-25 19:54 . 2009-07-03 17:09 594432 c:\windows\system32\dllcache\msfeeds.dll
+ 2009-06-29 14:28 . 2009-07-03 17:09 246272 c:\windows\system32\dllcache\ieproxy.dll
- 2009-06-29 14:28 . 2009-04-30 21:22 246272 c:\windows\system32\dllcache\ieproxy.dll
+ 2004-08-04 05:56 . 2009-07-03 17:09 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2004-08-04 05:56 . 2009-07-03 17:09 386048 c:\windows\system32\dllcache\iedkcs32.dll
+ 2004-08-04 05:56 . 2009-07-03 11:01 173056 c:\windows\system32\dllcache\ie4uinit.exe
- 2004-08-04 05:56 . 2009-04-30 11:21 173056 c:\windows\system32\dllcache\ie4uinit.exe
- 2007-10-25 01:04 . 2009-07-16 03:32 294912 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-10-25 01:04 . 2009-08-01 18:40 294912 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-06-29 14:23 . 2009-07-16 03:32 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2009-06-29 14:23 . 2009-08-01 18:40 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2008-08-21 18:48 . 2007-03-06 01:23 371424 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\update\updspapi.dll
+ 2008-08-21 18:48 . 2007-03-06 01:22 716000 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\update\update.exe
+ 2008-08-21 18:48 . 2007-03-06 01:22 213216 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\spuninst.exe
+ 2008-08-21 18:48 . 2008-06-23 16:01 827904 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\wininet.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 233472 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\webcheck.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 105984 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\url.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 102912 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\occache.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 671232 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\mstime.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 193024 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\msrating.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 477696 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\mshtmled.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 459264 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\msfeeds.dll
+ 2008-08-21 18:48 . 2008-06-23 08:23 625664 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\iexplore.exe
+ 2008-08-21 18:48 . 2008-06-23 16:01 267776 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\iertutil.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 388608 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\iedkcs32.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 383488 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\ieapfltr.dll
+ 2008-08-21 18:48 . 2008-06-21 05:23 161792 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\ieakui.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 230400 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\ieaksie.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 153088 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\ieakeng.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 132608 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\extmgr.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 214528 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\dxtrans.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 347136 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\dxtmsft.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 124928 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\advpack.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 826368 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\wininet.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 233472 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\webcheck.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 105984 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\url.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 102912 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\occache.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 671232 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\mstime.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 193024 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\msrating.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 477696 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\mshtmled.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 459264 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\msfeeds.dll
+ 2008-08-21 18:48 . 2008-06-23 09:20 625664 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\iexplore.exe
+ 2008-08-21 18:48 . 2008-06-23 16:57 267776 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\iertutil.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 384512 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\iedkcs32.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 383488 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\ieapfltr.dll
+ 2008-08-21 18:48 . 2008-06-21 05:23 161792 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\ieakui.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 230400 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\ieaksie.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 153088 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\ieakeng.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 133120 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\extmgr.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 214528 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\dxtrans.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 347136 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\dxtmsft.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 124928 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\advpack.dll
+ 2009-07-14 19:22 . 2008-07-09 07:38 382840 c:\windows\SD_OLD\Download\cfb5c33fcc73ed7dcd60250b085691a5\update\updspapi.dll
+ 2009-07-14 19:22 . 2008-07-09 07:38 755576 c:\windows\SD_OLD\Download\cfb5c33fcc73ed7dcd60250b085691a5\update\update.exe
+ 2009-07-14 19:22 . 2008-07-08 13:02 231288 c:\windows\SD_OLD\Download\cfb5c33fcc73ed7dcd60250b085691a5\spuninst.exe
+ 2008-08-21 18:49 . 2007-11-30 11:18 382840 c:\windows\SD_OLD\Download\cb5a6e6205e8e4bf4d746b7f5bcdd148\update\updspapi.dll
+ 2008-08-21 18:49 . 2007-11-30 11:18 755576 c:\windows\SD_OLD\Download\cb5a6e6205e8e4bf4d746b7f5bcdd148\update\update.exe
+ 2008-08-21 18:49 . 2007-11-30 12:39 231288 c:\windows\SD_OLD\Download\cb5a6e6205e8e4bf4d746b7f5bcdd148\spuninst.exe
+ 2008-08-21 18:49 . 2007-03-06 01:23 371424 c:\windows\SD_OLD\Download\c286b650f35378bdc0c45de56f787772\update\updspapi.dll
+ 2008-08-21 18:49 . 2007-03-06 01:22 716000 c:\windows\SD_OLD\Download\c286b650f35378bdc0c45de56f787772\update\update.exe
+ 2008-08-21 18:49 . 2007-03-06 01:22 213216 c:\windows\SD_OLD\Download\c286b650f35378bdc0c45de56f787772\spuninst.exe
+ 2008-02-26 11:48 . 2008-02-26 11:48 297984 c:\windows\SD_OLD\Download\c286b650f35378bdc0c45de56f787772\sp2qfe\msctf.dll
+ 2008-02-26 11:59 . 2008-02-26 11:59 294912 c:\windows\SD_OLD\Download\c286b650f35378bdc0c45de56f787772\sp2gdr\msctf.dll
+ 2008-08-20 20:35 . 2007-03-06 01:23 371424 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\update\updspapi.dll
+ 2008-08-20 20:35 . 2007-03-06 01:22 716000 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\update\update.exe
+ 2008-08-20 20:35 . 2007-03-06 01:22 213216 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\spuninst.exe
+ 2008-08-20 20:35 . 2004-08-04 05:56 348189 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msxbde40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 614429 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\mswstr10.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 831519 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\mswdat10.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 258077 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\mstext40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 552989 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msrepl40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 315423 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msrd3x40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 421919 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msrd2x40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 348189 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\mspbde40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 213023 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msltus40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 241693 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msjtes40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 151583 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msjint40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 319517 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msexcl40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 512029 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msexch40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 348189 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msxbde40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 614429 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\mswstr10.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 831519 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\mswdat10.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 258077 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\mstext40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 552989 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msrepl40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 315423 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msrd3x40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 421919 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msrd2x40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 348189 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\mspbde40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 213023 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msltus40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 241693 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msjtes40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 151583 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msjint40.dll
+ 2008-08-20 20:35 . 2004-07-17 16:34 358976 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msjetol1.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 319517 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msexcl40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 512029 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msexch40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 561179 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\dao360.dll
+ 2009-07-14 19:22 . 2008-07-08 13:02 382840 c:\windows\SD_OLD\Download\97f18c7ac91916468f96bb79c87bff6c\update\updspapi.dll
+ 2009-07-14 19:22 . 2008-07-08 13:02 755576 c:\windows\SD_OLD\Download\97f18c7ac91916468f96bb79c87bff6c\update\update.exe
+ 2009-07-14 19:22 . 2008-07-08 13:02 231288 c:\windows\SD_OLD\Download\97f18c7ac91916468f96bb79c87bff6c\spuninst.exe
+ 2009-07-14 19:22 . 2009-05-26 11:40 382840 c:\windows\SD_OLD\Download\40fc5c00ee89ac515590995374843d78\update\updspapi.dll
+ 2009-07-14 19:22 . 2009-05-26 11:40 755576 c:\windows\SD_OLD\Download\40fc5c00ee89ac515590995374843d78\update\update.exe
+ 2009-07-14 19:22 . 2008-07-08 13:02 231288 c:\windows\SD_OLD\Download\40fc5c00ee89ac515590995374843d78\spuninst.exe
+ 2009-06-16 14:43 . 2009-06-16 14:43 119808 c:\windows\SD_OLD\Download\40fc5c00ee89ac515590995374843d78\sp3qfe\t2embed.dll
+ 2009-06-16 14:36 . 2009-06-16 14:36 119808 c:\windows\SD_OLD\Download\40fc5c00ee89ac515590995374843d78\sp3gdr\t2embed.dll
+ 2007-10-25 19:51 . 2005-10-12 23:12 371424 c:\windows\SD_OLD\Download\355f788b6de8a3ec79e9aa172e6317f1\update\updspapi.dll
+ 2007-10-25 19:51 . 2005-10-12 23:12 716000 c:\windows\SD_OLD\Download\355f788b6de8a3ec79e9aa172e6317f1\update\update.exe
+ 2007-10-25 19:51 . 2005-10-12 23:12 213216 c:\windows\SD_OLD\Download\355f788b6de8a3ec79e9aa172e6317f1\spuninst.exe
+ 2009-05-01 15:15 . 2007-11-30 12:39 382840 c:\windows\SD_OLD\Download\127e503e3f80c0d9923e937ca2857f6b\update\updspapi.dll
+ 2009-05-01 15:15 . 2007-11-30 12:39 755576 c:\windows\SD_OLD\Download\127e503e3f80c0d9923e937ca2857f6b\update\update.exe
+ 2009-05-01 15:15 . 2007-11-30 12:39 231288 c:\windows\SD_OLD\Download\127e503e3f80c0d9923e937ca2857f6b\spuninst.exe
+ 2009-05-01 15:15 . 2009-02-28 04:55 105984 c:\windows\SD_OLD\Download\127e503e3f80c0d9923e937ca2857f6b\SP3QFE\iecompat.dll
+ 2009-05-01 15:15 . 2009-02-28 04:55 105984 c:\windows\SD_OLD\Download\127e503e3f80c0d9923e937ca2857f6b\SP3GDR\iecompat.dll
+ 2007-10-25 19:51 . 2005-10-12 23:12 371424 c:\windows\SD_OLD\Download\0facce6115ab861022eae3087e064a2a\update\updspapi.dll
+ 2007-10-25 19:51 . 2005-10-12 23:12 716000 c:\windows\SD_OLD\Download\0facce6115ab861022eae3087e064a2a\update\update.exe
+ 2007-10-25 19:51 . 2005-10-12 23:12 213216 c:\windows\SD_OLD\Download\0facce6115ab861022eae3087e064a2a\spuninst.exe
+ 2007-10-25 19:51 . 2006-10-10 06:12 214528 c:\windows\SD_OLD\Download\0facce6115ab861022eae3087e064a2a\SP2QFE\xpsp3res.dll
+ 2007-10-25 19:51 . 2006-10-10 12:44 557568 c:\windows\SD_OLD\Download\0facce6115ab861022eae3087e064a2a\SP2QFE\xpnetdg.exe
+ 2007-10-25 19:52 . 2007-03-06 01:23 371424 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\update\updspapi.dll
+ 2007-10-25 19:52 . 2007-03-06 01:22 716000 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\update\update.exe
+ 2007-10-25 19:52 . 2007-03-06 01:22 213216 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\spuninst.exe
+ 2007-10-25 19:52 . 2007-08-20 10:02 825344 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\wininet.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 232960 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\webcheck.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 105984 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\url.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 102400 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\occache.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 671232 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\mstime.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 193024 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\msrating.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 478208 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\mshtmled.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 459264 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\msfeeds.dll
+ 2007-10-25 19:52 . 2007-08-17 10:12 625152 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\iexplore.exe
+ 2007-10-25 19:52 . 2007-08-20 10:02 267776 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\iertutil.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 387584 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\iedkcs32.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 383488 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\ieapfltr.dll
+ 2007-10-25 19:52 . 2007-08-17 07:29 161792 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\ieakui.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 230400 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\ieaksie.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 153088 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\ieakeng.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 132608 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\extmgr.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 214528 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\dxtrans.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 124928 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\advpack.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 824832 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\wininet.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 232960 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\webcheck.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 105984 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\url.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 102400 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\occache.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 671232 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\mstime.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 193024 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\msrating.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 477696 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\mshtmled.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 459264 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\msfeeds.dll
+ 2007-10-25 19:52 . 2007-08-17 10:21 625152 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\iexplore.exe
+ 2007-10-25 19:52 . 2007-08-20 10:04 267776 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\iertutil.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 384512 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\iedkcs32.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 383488 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\ieapfltr.dll
+ 2007-10-25 19:52 . 2007-08-17 07:34 161792 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\ieakui.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 230400 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\ieaksie.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 153088 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\ieakeng.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 132608 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\extmgr.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 214528 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\dxtrans.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 124928 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\advpack.dll
+ 2009-07-20 17:17 . 2009-07-20 17:17 102400 c:\windows\Installer\{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}\iTunesIco.exe
+ 2009-07-29 16:32 . 2009-05-13 05:15 915456 c:\windows\ie8updates\KB972260-IE8\wininet.dll
+ 2009-07-29 16:32 . 2009-05-26 11:40 382840 c:\windows\ie8updates\KB972260-IE8\spuninst\updspapi.dll
+ 2009-07-29 16:32 . 2009-05-26 11:40 231288 c:\windows\ie8updates\KB972260-IE8\spuninst\spuninst.exe
+ 2009-07-29 16:32 . 2009-03-08 09:34 109568 c:\windows\ie8updates\KB972260-IE8\occache.dll
+ 2009-07-29 16:32 . 2009-03-08 09:32 594432 c:\windows\ie8updates\KB972260-IE8\msfeeds.dll
+ 2009-07-29 16:32 . 2009-04-30 21:22 246272 c:\windows\ie8updates\KB972260-IE8\ieproxy.dll
+ 2009-07-29 16:32 . 2009-03-08 09:31 183808 c:\windows\ie8updates\KB972260-IE8\iepeers.dll
+ 2009-07-29 16:32 . 2009-04-30 21:22 385536 c:\windows\ie8updates\KB972260-IE8\iedkcs32.dll
+ 2009-07-29 16:32 . 2009-04-30 11:21 173056 c:\windows\ie8updates\KB972260-IE8\ie4uinit.exe
+ 2004-08-04 05:56 . 2009-07-03 17:09 1208832 c:\windows\system32\urlmon.dll
+ 2004-08-04 05:56 . 2009-07-19 13:18 5937152 c:\windows\system32\mshtml.dll
+ 2007-08-13 23:34 . 2009-07-03 17:09 1985536 c:\windows\system32\iertutil.dll
+ 2004-08-04 05:56 . 2009-07-03 17:09 1208832 c:\windows\system32\dllcache\urlmon.dll
+ 2004-08-04 05:56 . 2009-07-19 13:18 5937152 c:\windows\system32\dllcache\mshtml.dll
+ 2007-10-25 19:54 . 2009-07-03 17:09 1985536 c:\windows\system32\dllcache\iertutil.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 1162752 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\urlmon.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 3594240 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\mshtml.dll
+ 2008-08-21 18:48 . 2008-06-23 16:01 6068736 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\ieframe.dll
+ 2008-08-21 18:48 . 2007-04-17 09:32 2455488 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2QFE\ieapfltr.dat
+ 2008-08-21 18:48 . 2008-06-23 16:57 1159680 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\urlmon.dll
+ 2008-06-24 15:57 . 2008-06-24 15:57 3592192 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\mshtml.dll
+ 2008-08-21 18:48 . 2008-06-23 16:57 6066176 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\ieframe.dll
+ 2008-08-21 18:48 . 2007-04-17 09:32 2455488 c:\windows\SD_OLD\Download\f6d390a5c8cb03ef1624d5e3583de48b\SP2GDR\ieapfltr.dat
+ 2009-06-03 19:12 . 2009-06-03 19:12 1291264 c:\windows\SD_OLD\Download\cfb5c33fcc73ed7dcd60250b085691a5\sp3qfe\quartz.dll
+ 2009-06-03 19:09 . 2009-06-03 19:09 1291264 c:\windows\SD_OLD\Download\cfb5c33fcc73ed7dcd60250b085691a5\sp3gdr\quartz.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 1507356 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2qfe\msjet40.dll
+ 2008-08-20 20:35 . 2004-08-04 05:56 1507356 c:\windows\SD_OLD\Download\b0264899240408ce315fe572c84c0e59\backup\sp2gdr\msjet40.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 1161728 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\urlmon.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 3592192 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\mshtml.dll
+ 2007-10-25 19:52 . 2007-08-20 10:02 6066176 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\ieframe.dll
+ 2007-10-25 19:52 . 2007-04-17 09:32 2455488 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2QFE\ieapfltr.dat
+ 2007-10-25 19:52 . 2007-08-20 10:04 1152000 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\urlmon.dll
+ 2007-08-20 20:34 . 2007-08-20 20:34 3584512 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\mshtml.dll
+ 2007-10-25 19:52 . 2007-08-20 10:04 6058496 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\ieframe.dll
+ 2007-10-25 19:52 . 2007-04-17 09:32 2455488 c:\windows\SD_OLD\Download\0eda838ef8ec599d822155030a70ecac\SP2GDR\ieapfltr.dat
+ 2009-07-20 17:17 . 2009-07-20 17:17 4945408 c:\windows\Installer\c6edb2d.msi
+ 2009-07-20 17:15 . 2009-07-20 17:15 3295232 c:\windows\Installer\c6ed7e1.msi
+ 2009-07-29 16:32 . 2009-04-30 21:22 1207808 c:\windows\ie8updates\KB972260-IE8\urlmon.dll
+ 2009-07-29 16:32 . 2009-05-13 05:15 5936128 c:\windows\ie8updates\KB972260-IE8\mshtml.dll
+ 2009-07-29 16:32 . 2009-04-30 21:22 1985024 c:\windows\ie8updates\KB972260-IE8\iertutil.dll
+ 2007-08-13 23:54 . 2009-07-19 22:48 11067392 c:\windows\system32\ieframe.dll
+ 2007-10-25 19:54 . 2009-07-19 22:48 11067392 c:\windows\system32\dllcache\ieframe.dll
+ 2009-07-29 16:32 . 2009-04-30 21:22 11064832 c:\windows\ie8updates\KB972260-IE8\ieframe.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2007-06-19 101144]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2007-06-19 84760]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2007-06-19 125720]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-14 815104]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-01-20 159744]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 507904]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2006-06-08 131072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-24 136600]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-16 1948440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-11-16 88209]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-6 561213]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-16 23:53 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]
2006-03-03 20:08 434176 —-a-w- c:\windows\system32\IfxWlxEN.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\C:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3689:TCP"= 3689:TCP:iTunes

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/16/2009 7:53 PM 335752]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/16/2009 7:53 PM 108552]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [11/29/2005 5:56 PM 36768]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/16/2009 7:53 PM 907032]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/16/2009 7:52 PM 298776]
R2 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [5/12/2009 2:13 PM 61328]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [10/25/2007 4:50 PM 88192]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [10/21/2005 12:19 PM 36352]
S2 AntipPro2009_12;AntipyPro_12;c:\windows\svchast.exe –> c:\windows\svchast.exe [?]
S3 PCX500;Cisco Wireless LAN Adapters Driver;c:\windows\system32\drivers\pcx500.sys [10/24/2007 9:08 PM 169984]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-rbadza.sys


.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uStart Page = hxxp://denethor2.is.uindy.edu/cp/home/loginf
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = *.local
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-01 14:54
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(688)
geyekrnagyrahh.dll 10000000 32768 \\?\globalroot\systemroot\system32\geyekrnagyrahh.dll
c:\windows\system32\WININET.dll
c:\windows\system32\IfxWlxEN.dll

- - - - - - - > 'lsass.exe'(748)
geyekrnagyrahh.dll 10000000 32768 \\?\globalroot\systemroot\system32\geyekrnagyrahh.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(1020)
c:\windows\system32\WININET.dll
geyekrnagyrahh.dll 10000000 32768 \\?\globalroot\systemroot\system32\geyekrnagyrahh.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\scardsvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\IFXSPMGT.exe
c:\windows\system32\IFXTCS.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ProtectTools\Embedded Security Software\PSDrt.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-08-01 14:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-01 18:59
ComboFix2.txt 2009-07-16 08:08

Pre-Run: 51,264,872,448 bytes free
Post-Run: 51,396,292,608 bytes free

526 — E O F — 2009-07-29 16:33
Post #8

Overlay aborted … Please run ComboFix once more


Message inside ComboFix that it needs running once more - please do so

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)


This MUST be disabled before running ComboFix

Please open the AVG 8 Control Center, by right clicking on the AVG 8 icon on the task bar.
  • Click on Tools.
  • Select Advanced Settings.
  • In the left hand pane, scroll down to "Resident Shield".
  • In the main pane, deselect the option to "Enable Resident Shield."
  • To re-enable AVG 8, please select "Enable Resident Shield" again.
Post #9
Here's the second log with the AVG Disabled. Question, does combo-fix delete or quarantine the hidden infected files?

ComboFix 09-08-01.09 - CE User 08/02/2009 12:34.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.645 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((( Files Created from 2009-07-02 to 2009-08-02 )))))))))))))))))))))))))))))))
.

2009-07-31 06:35 . 2008-11-27 22:47 ——– d—a-w- c:\windows\system32\images
2009-07-31 04:24 . 2009-07-31 06:31 4 —-a-w- c:\windows\system32\bincd32.dat
2009-07-30 17:21 . 2009-07-30 17:21 36 —-a-w- c:\windows\system32\sysnet.dat
2009-07-30 17:21 . 2009-07-31 06:35 65536 —-a-w- c:\windows\system32\desot.exe
2009-07-30 17:21 . 2009-07-31 06:35 64 —-a-w- c:\windows\ppp4.dat
2009-07-30 17:21 . 2009-07-31 06:35 2 —-a-w- c:\windows\ppp3.dat
2009-07-24 22:10 . 2009-07-24 22:10 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\WMTools Downloaded Files
2009-07-21 16:05 . 2009-07-26 16:08 ——– d–h–w- C:\$AVG8.VAULT$
2009-07-20 17:17 . 2009-07-20 17:17 ——– d—–w- c:\program files\iPod
2009-07-20 17:17 . 2009-07-20 17:17 ——– d—–w- c:\program files\iTunes
2009-07-17 19:32 . 2009-07-17 19:33 ——– d—–w- c:\program files\LimeWire
2009-07-17 05:45 . 2009-07-17 05:45 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\Ahead
2009-07-17 01:03 . 2009-07-17 01:03 ——– d—–w- c:\program files\Trend Micro
2009-07-17 00:58 . 2009-07-17 01:10 ——– d—–w- c:\documents and settings\CE User\Application Data\Uniblue
2009-07-17 00:58 . 2009-07-17 01:10 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\DriverScanner
2009-07-17 00:18 . 2009-07-17 00:18 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\Help
2009-07-17 00:16 . 2009-07-21 16:05 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\SecTaskMan
2009-07-17 00:15 . 2009-07-24 17:01 ——– d—–w- c:\program files\Security Task Manager
2009-07-16 23:53 . 2009-07-16 23:53 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-07-16 23:53 . 2009-07-16 23:53 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-07-16 23:53 . 2009-07-17 18:02 335752 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-16 23:53 . 2009-07-16 23:53 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-16 23:53 . 2009-08-02 16:03 ——– d—–w- c:\windows\system32\drivers\Avg
2009-07-16 23:52 . 2009-07-16 23:52 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-16 08:16 . 2009-07-16 08:16 ——– d—–w- c:\documents and settings\CE User\Application Data\Malwarebytes
2009-07-16 08:16 . 2009-07-13 17:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-16 08:16 . 2009-07-16 08:16 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-16 08:16 . 2009-07-16 08:16 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-07-16 08:16 . 2009-07-13 17:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-16 00:47 . 2009-07-16 03:07 ——– d—a-w- c:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-07-16 00:39 . 2009-07-17 00:26 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-07-15 21:50 . 2009-07-15 21:50 ——– d-sh–w- c:\windows\system32\config\systemprofile\PrivacIE
2009-07-15 21:07 . 2009-07-15 21:07 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2009-07-15 20:58 . 2009-07-15 20:58 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-07-15 20:55 . 2009-07-17 01:12 ——– d—–w- c:\program files\Windows Live Safety Center
2009-07-15 20:39 . 2009-07-16 04:15 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\SITEguard
2009-07-15 20:38 . 2009-07-15 20:38 ——– d—–w- c:\program files\STOPzilla!
2009-07-15 20:38 . 2009-07-15 20:38 ——– d—–w- c:\program files\Common Files\iS3
2009-07-15 20:38 . 2009-08-02 16:26 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\STOPzilla!
2009-07-15 20:13 . 2009-07-15 20:14 ——– d—–w- C:\Temp
2009-07-15 20:12 . 2009-07-15 20:12 ——– d—–w- c:\documents and settings\CE User\Application Data\Syntrillium
2009-07-15 20:12 . 2001-10-19 18:40 438608 —-a-w- c:\windows\system32\wmv8dmod.dll
2009-07-15 20:12 . 2001-10-19 18:40 665424 —-a-w- c:\windows\system32\wmv8dmoe.dll
2009-07-15 20:12 . 2001-10-19 18:40 1683792 —-a-w- c:\windows\system32\wmvcore2.dll
2009-07-15 20:12 . 2001-10-19 18:39 572752 —-a-w- c:\windows\system32\wmvdmoe.dll
2009-07-15 19:58 . 2009-07-15 19:58 4 —-a-w- c:\documents and settings\CE User\Application Data\NP.sys
2009-07-15 03:34 . 2009-07-15 05:55 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\FullTiltPoker
2009-07-15 03:33 . 2009-07-22 20:28 ——– d—–w- c:\program files\Full Tilt Poker
2009-07-13 19:08 . 2009-07-13 19:08 17408 —-a-r- c:\windows\system32\SZIO5.dll
2009-07-13 19:07 . 2009-07-13 19:07 311296 —-a-r- c:\windows\system32\SZBase5.dll
2009-07-13 19:06 . 2009-07-13 19:06 540672 —-a-r- c:\windows\system32\SZComp5.dll
2009-07-13 17:12 . 2009-07-13 17:12 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-07-09 19:52 . 2009-07-09 19:52 126976 —-a-r- c:\windows\system32\IS3HTUI5.dll
2009-07-09 19:52 . 2009-07-09 19:52 393216 —-a-r- c:\windows\system32\IS3DBA5.dll
2009-07-09 19:51 . 2009-07-09 19:51 385024 —-a-r- c:\windows\system32\IS3UI5.dll
2009-07-09 19:51 . 2009-07-09 19:51 61440 —-a-r- c:\windows\system32\IS3Hks5.dll
2009-07-09 19:51 . 2009-07-09 19:51 23040 —-a-r- c:\windows\system32\IS3XDat5.dll
2009-07-09 19:50 . 2009-07-09 19:50 225280 —-a-r- c:\windows\system32\IS3Win325.dll
2009-07-09 19:50 . 2009-07-09 19:50 94208 —-a-r- c:\windows\system32\IS3Inet5.dll
2009-07-09 19:50 . 2009-07-09 19:50 90112 —-a-r- c:\windows\system32\IS3Svc5.dll
2009-07-09 19:47 . 2009-07-09 19:47 724992 —-a-r- c:\windows\system32\IS3Base5.dll
2009-07-07 08:57 . 2009-07-07 08:57 ——– d—–w- c:\documents and settings\CE User\Application Data\CyberLink
2009-07-05 04:44 . 2009-07-05 04:44 ——– d—–w- c:\windows\Sun
2009-07-04 23:10 . 2009-07-04 23:10 ——– d—–w- c:\windows\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-02 03:57 . 2009-07-01 04:07 1 —-a-w- c:\documents and settings\CE User\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-07-31 19:49 . 2009-07-31 19:49 596 —-a-w- c:\program files\waazce.txt
2009-07-24 20:00 . 2009-07-01 20:07 ——– d—–w- c:\documents and settings\CE User\Application Data\LimeWire
2009-07-20 17:17 . 2009-07-01 02:49 ——– d—–w- c:\program files\Common Files\Apple
2009-07-17 00:41 . 2009-07-17 00:41 156 —-a-w- c:\program files\zwsgk.txt
2009-07-15 03:33 . 2007-10-25 20:26 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-05 11:47 . 2009-07-03 01:35 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\NOS
2009-07-05 11:47 . 2009-07-03 01:35 ——– d—–w- c:\program files\NOS
2009-07-03 17:09 . 2004-08-04 05:56 915456 —-a-w- c:\windows\system32\wininet.dll
2009-07-03 01:37 . 2009-07-03 01:37 ——– d—–w- c:\program files\Common Files\Adobe
2009-07-03 01:36 . 2009-07-03 01:36 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-07-01 04:52 . 2009-07-01 04:52 0 —-a-w- c:\windows\nsreg.dat
2009-07-01 04:06 . 2009-07-01 04:06 ——– d—–w- c:\documents and settings\CE User\Application Data\OpenOffice.org
2009-07-01 03:07 . 2009-07-01 02:51 ——– d—–w- c:\documents and settings\CE User\Application Data\Apple Computer
2009-07-01 02:51 . 2009-07-01 02:51 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-01 02:51 . 2009-07-01 02:50 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Apple Computer
2009-07-01 02:50 . 2009-07-01 02:50 ——– d—–w- c:\program files\Bonjour
2009-07-01 02:50 . 2009-07-01 02:50 ——– d—–w- c:\program files\QuickTime
2009-07-01 02:50 . 2009-07-01 02:50 ——– d—–w- c:\program files\Apple Software Update
2009-07-01 02:49 . 2009-07-01 02:49 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Apple
2009-07-01 02:40 . 2009-07-01 02:40 18864 —-a-w- c:\documents and settings\CE User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 14:28 . 2009-06-29 14:28 ——– d—–w- c:\program files\AVG
2009-06-16 14:36 . 2004-08-04 05:56 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2003-03-31 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-03 19:09 . 2004-08-04 05:56 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-12 18:13 . 2009-05-12 18:13 61328 —-a-r- c:\windows\system32\drivers\SZKG.sys
2009-05-07 15:32 . 2004-08-04 05:56 345600 —-a-w- c:\windows\system32\localspl.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2007-06-19 101144]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2007-06-19 84760]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2007-06-19 125720]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-14 815104]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-01-20 159744]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 507904]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2006-06-08 131072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-24 136600]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-16 1948440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-11-16 88209]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-6 561213]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-16 23:53 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]
2006-03-03 20:08 434176 —-a-w- c:\windows\system32\IfxWlxEN.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\C:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3689:TCP"= 3689:TCP:iTunes

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/16/2009 7:53 PM 335752]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/16/2009 7:53 PM 108552]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [11/29/2005 5:56 PM 36768]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/16/2009 7:53 PM 907032]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/16/2009 7:52 PM 298776]
R2 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [5/12/2009 2:13 PM 61328]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [10/25/2007 4:50 PM 88192]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [10/21/2005 12:19 PM 36352]
S2 AntipPro2009_12;AntipyPro_12;c:\windows\svchast.exe –> c:\windows\svchast.exe [?]
S3 PCX500;Cisco Wireless LAN Adapters Driver;c:\windows\system32\drivers\pcx500.sys [10/24/2007 9:08 PM 169984]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uStart Page = hxxp://denethor2.is.uindy.edu/cp/home/loginf
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = *.local
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-02 12:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(692)
geyekrnagyrahh.dll 10000000 32768 \\?\globalroot\systemroot\system32\geyekrnagyrahh.dll
c:\windows\system32\WININET.dll
c:\windows\system32\IfxWlxEN.dll

- - - - - - - > 'lsass.exe'(752)
geyekrnagyrahh.dll 10000000 32768 \\?\globalroot\systemroot\system32\geyekrnagyrahh.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2152)
c:\windows\system32\WININET.dll
geyekrnagyrahh.dll 10000000 32768 \\?\globalroot\systemroot\system32\geyekrnagyrahh.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
SystemRoot\System32\smss.exe [592]
??\c:\windows\system32\csrss.exe [664]
??\c:\windows\system32\winlogon.exe [692]
c:\windows\system32\services.exe [740]
c:\windows\system32\lsass.exe [752]
c:\windows\system32\svchost.exe [920]
c:\windows\system32\svchost.exe [1044]
c:\windows\System32\svchost.exe [1164]
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [1212]
c:\windows\system32\svchost.exe [1600]
c:\windows\system32\svchost.exe [1700]
c:\windows\system32\spoolsv.exe [188]
c:\windows\System32\SCardSvr.exe [240]
c:\windows\system32\svchost.exe [516]
c:\windows\system32\CF8979.exe [1544]
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [560]
c:\progra~1\AVG\AVG8\avgwdsvc.exe [636]
c:\program files\Bonjour\mDNSResponder.exe [756]
c:\windows\system32\IFXSPMGT.exe [512]
c:\windows\system32\IFXTCS.exe [1068]
c:\program files\Java\jre6\bin\jqs.exe [1396]
c:\program files\ProtectTools\Embedded Security Software\PSDsrvc.EXE [1480]
c:\windows\system32\hkcmd.exe [1968]
c:\windows\system32\igfxpers.exe [1980]
c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe [1976]
c:\program files\Synaptics\SynTP\SynTPEnh.exe [1772]
c:\windows\AGRSMMSG.exe [1960]
c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [316]
c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [564]
c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE [340]
c:\program files\Java\jre6\bin\jusched.exe [368]
c:\program files\CyberLink\PowerDVD\PDVDServ.exe [388]
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe [448]
c:\progra~1\AVG\AVG8\avgtray.exe [1840]
c:\program files\iTunes\iTunesHelper.exe [1564]
c:\windows\system32\ctfmon.exe [212]
c:\program files\Analog Devices\SoundMAX\SMAgent.exe [492]
c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [116]
c:\progra~1\AVG\AVG8\avgrsx.exe [1112]
c:\progra~1\AVG\AVG8\avgnsx.exe [968]
c:\progra~1\AVG\AVG8\avgemc.exe [2200]
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe [2284]
c:\program files\AVG\AVG8\avgcsrvx.exe [2468]
c:\windows\system32\wscntfy.exe [2776]
c:\program files\iPod\bin\iPodService.exe [2788]
c:\windows\system32\wbem\wmiprvse.exe [2980]
c:\windows\System32\alg.exe [3508]
c:\program files\ProtectTools\Embedded Security Software\PSDrt.exe [3632]
c:\progra~1\hpq\Shared\HPQTOA~1.EXE [2916]
c:\windows\System32\svchost.exe [3188]
c:\windows\system32\wuauclt.exe [1552]
c:\windows\explorer.exe [2152]
c:\combo-fix\catchme.cfexe [1464]
.
**************************************************************************
.
Completion time: 2009-08-02 12:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-02 16:51
ComboFix2.txt 2009-08-01 18:59
ComboFix3.txt 2009-07-16 08:08

Pre-Run: 51,380,752,384 bytes free
Post-Run: 51,391,705,088 bytes free

259 — E O F — 2009-07-29 16:33
Post #10 last edited
Hi,

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Search_Hijacker_H_C_windows_system32_geyekrnagyrahh_dll_t105711.html&view=findpost&p=584036#entry584036

Collect::
c:\windows\system32\bincd32.dat
c:\windows\system32\sysnet.dat
c:\windows\system32\desot.exe
c:\windows\ppp4.dat
c:\windows\ppp3.dat
c:\windows\svchast.exe

KillAll::

DirLook::
c:\windows\system32\images

Driver::
AntipPro2009_12

Rootkit::
c:\windows\system32\geyekrnagyrahh.dll

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.


NEXT

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\documents and settings\CE User\Application Data\NP.sys

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.


Do you recognize the following files:

c:\program files\waazce.txt
c:\program files\zwsgk.txt

If you don't recognize then, please upload them to Virus total also.
Post #11
Every dayam time I try to drag the file to combo-fix.exe it starts, then stops. Then an error message pops up and says "It is not safe to continue" The contents of the Combo-fix package has been compromised. Please download a fresh copy at www.bleepingcomputer.com. Note: You may be infected with a file patching virus 'Virut' This thing is really starting to make me mad. Please let me know what I should do.
Post #12
Delete the copy of ComboFix that you have on your desktop (right click > delete)

Make sure your Antivirus is totally disabled and all other windows are closed before trying to run the script.

download a fresh copy from one of these links

Link 1
Link 2

don't rename it this time.


Then open a run box (windows key + R) > paste the following command into the run box and press enter

"%userprofile%\Desktop\ComboFix.exe" "%userprofile%\Desktop\CFScript.txt"


If you still get that warning message, then you could very well be infected with Virut although there was no previous indication in your log, so we will need to confirm that.

Please up load the following files for analysis



  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\windows\system32\userinit.exe

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.

Do the same for the following files:

c:\windows\system32\svchost.exe
c:\windows\explorer.exe
c:\windows\system32\ctfmon.exe
c:\windows\system32\spoolsv.exe
Post #13
It failed to work again. So i did then next thing you told me to do. Here are the scan logs.

VirSCAN.org Scanned Report :
Scanned time : 2009/07/21 15:11:03 (EDT)
Scanner results: All Scanners reported not find malware!
File Name : spoolsv.exe
File Size : 57856 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : d8e14a61acc1d4a6cd0d38aebac7fa3b
SHA1 : 0e5d1a09a103eae3bd693c7a1c7531fde2e2402b
Online report : http://virscan.org/report/736ba1edefb51933…78c5c94935.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090721221323 2009-07-21 0.34 -
AhnLab V3 2009.07.21.06 2009.07.21 2009-07-21 0.89 -
AntiVir 8.2.0.222 7.1.5.12 2009-07-21 0.54 -
Antiy 2.0.18 20090721.2629703 2009-07-21 0.12 -
Arcavir 2009 200907211243 2009-07-21 0.04 -
Authentium 5.1.1 200907211609 2009-07-21 1.12 -
AVAST! 4.7.4 090720-0 2009-07-20 0.01 -
AVG 8.5.288 270.13.21/2252 2009-07-21 0.30 -
BitDefender 7.81008.3818995 7.26730 2009-07-22 3.36 -
CA (VET) 9.0.0.143 31.6.6629 2009-07-21 8.89 -
ClamAV 0.95.2 9598 2009-07-21 0.02 -
Comodo 3.10 1729 2009-07-21 0.70 -
CP Secure 1.1.0.715 2009.07.21 2009-07-21 11.29 -
Dr.Web 4.44.0.9170 2009.07.21 2009-07-21 4.92 -
F-Prot 4.4.4.56 20090721 2009-07-21 1.15 -
F-Secure 5.51.6100 2009.07.21.08 2009-07-21 6.21 -
Fortinet 2.81-3.120 10.629 2009-07-21 0.22 -
GData 19.6610/19.406 20090721 2009-07-21 4.57 -
ViRobot 20090716 2009.07.16 2009-07-16 0.42 -
Ikarus T3.1.01.64 2009.07.21.73076 2009-07-21 3.34 -
JiangMin 11.0.800 2009.07.21 2009-07-21 4.67 -
Kaspersky 5.5.10 2009.07.21 2009-07-21 0.11 -
KingSoft 2009.2.5.15 2009.7.21.20 2009-07-21 0.53 -
McAfee 5.3.00 5683 2009-07-21 3.02 -
Microsoft 1.4803 2009.07.21 2009-07-21 5.14 -
mks_vir 2.01 2009.07.15 2009-07-15 3.25 -
Norman 6.01.09 6.01.00 2009-07-16 4.01 -
Panda 9.05.01 2009.07.21 2009-07-21 2.04 -
Trend Micro 8.700-1004 6.298.02 2009-07-21 0.03 -
Quick Heal 10.00 2009.07.21 2009-07-21 1.05 -
Rising 20.0 21.39.14.00 2009-07-21 0.96 -
Sophos 2.88.0 4.43 2009-07-22 2.90 -
Sunbelt 5273 5273 2009-07-20 0.97 -
Symantec 1.3.0.24 20090721.006 2009-07-21 0.06 -
nProtect 20090721.02 4877014 2009-07-21 6.45 -
The Hacker 6.3.4.3 v00372 2009-07-21 0.66 -
VBA32 3.12.10.8 20090720.1442 2009-07-20 1.79 -
VirusBuster 4.5.11.10 10.109.6/1824416 2009-07-21 2.21 -


All the results looked the same. Nothing suspicious.
Post #14
Please do the following:

Please download OTM by OldTimer.
  • Save it to your desktop.
  • Please click OTM and then click >> run.
  • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services
AntipPro2009_12

:Files
c:\windows\system32\bincd32.dat
c:\windows\system32\sysnet.dat
c:\windows\system32\desot.exe
c:\windows\ppp4.dat
c:\windows\ppp3.dat
c:\windows\svchast.exe
c:\windows\system32\geyekrnagyrahh.dll

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM
Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



NEXT

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :dir
c:\windows\system32\images /s
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt


NEXT

  • Please run GMER once again, using these instructions.
  • Double click GMER.exe.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then proceed as indicated below to set it up for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #15
once again…i tried to run gmer.exe. i clicked to let it run, then it hesitated and the icon deleted itself like before. here are the logs from the first two steps. All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== SERVICES/DRIVERS ========== Service\Driver AntipPro2009_12 deleted successfully. ========== FILES ========== c:\windows\system32\bincd32.dat moved successfully. c:\windows\system32\sysnet.dat moved successfully. c:\windows\system32\desot.exe moved successfully. c:\windows\ppp4.dat moved successfully. c:\windows\ppp3.dat moved successfully. File/Folder c:\windows\svchast.exe not found. File/Folder c:\windows\system32\geyekrnagyrahh.dll not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: CE User ->Temp folder emptied: 1104961 bytes ->Temporary Internet Files folder emptied: 51818874 bytes ->Java cache emptied: 1119102 bytes ->FireFox cache emptied: 2976663 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 32902 bytes ->Java cache emptied: 12 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2162283 bytes %systemroot%\System32 .tmp files removed: 2577 bytes Windows Temp folder emptied: 311962 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 56.80 mb OTM by OldTimer - Version 3.0.0.5 log created on 08032009_171017 Files moved on Reboot… Registry entries deleted on Reboot… ___________________________________________________________________________ Here's the system look log. Log created at 17:16 on 03/08/2009 by CE User (Administrator - Elevation successful) ========== dir ========== c:\windows\system32\images - Parameters: "/s" —Files— i1.gif –a— 1744 bytes [06:35 31/07/2009] [21:17 21/11/2008] i2.gif –a— 1663 bytes [06:35 31/07/2009] [21:17 21/11/2008] i3.gif –a— 1689 bytes [06:35 31/07/2009] [21:17 21/11/2008] j1.gif –a— 3957 bytes [06:35 31/07/2009] [21:12 21/11/2008] j2.gif –a— 47 bytes [06:35 31/07/2009] [21:12 21/11/2008] j3.gif –a— 3857 bytes [06:35 31/07/2009] [22:33 27/11/2008] jj1.gif –a— 114 bytes [06:35 31/07/2009] [21:14 21/11/2008] jj2.gif –a— 48 bytes [06:35 31/07/2009] [21:14 21/11/2008] jj3.gif –a— 105 bytes [06:35 31/07/2009] [21:40 21/11/2008] l1.gif –a— 3749 bytes [06:35 31/07/2009] [20:39 21/11/2008] l2.gif –a— 92 bytes [06:35 31/07/2009] [20:39 21/11/2008] l3.gif –a— 468 bytes [06:35 31/07/2009] [20:40 21/11/2008] pix.gif –a— 70 bytes [06:35 31/07/2009] [21:44 21/11/2008] t1.gif –a— 621 bytes [06:35 31/07/2009] [20:47 21/11/2008] t2.gif –a— 1015 bytes [06:35 31/07/2009] [21:17 21/11/2008] up1.gif –a— 5568 bytes [06:35 31/07/2009] [20:28 21/11/2008] up2.gif –a— 696 bytes [06:35 31/07/2009] [20:29 21/11/2008] w1.gif –a— 3028 bytes [06:35 31/07/2009] [20:56 21/11/2008] w11.gif –a— 3431 bytes [06:35 31/07/2009] [21:08 21/11/2008] w2.gif –a— 47 bytes [06:35 31/07/2009] [20:56 21/11/2008] w3.gif –a— 3430 bytes [06:35 31/07/2009] [22:30 27/11/2008] w3.jpg –a— 1912 bytes [06:35 31/07/2009] [22:34 27/11/2008] wt1.gif –a— 176 bytes [06:35 31/07/2009] [20:57 21/11/2008] wt2.gif –a— 51 bytes [06:35 31/07/2009] [20:57 21/11/2008] wt3.gif –a— 119 bytes [06:35 31/07/2009] [20:57 21/11/2008] No folders found. -=End Of File=-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI