Spyware / Malware / Virus Removal

[Resolved] .exe's no longer work - suspected Trojan

45 min read

Looking for the outcome? Ask AI

kirkie001

Post #16August 27, 2009, 6:50 PM UTC

Sorry - that'll teach me to cut and paste while running out the door!
First 2 steps done and logs below. Kapersky taking forever, so will follow once done… (2%, 17 miniutes in).
K
—————————————-
ComboFix 09-08-26.03 - Neil 27/08/2009 7:32.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.583 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Neil\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

FILE ::
"c:\windows\system32\SET1F.tmp"
"c:\windows\system32\SET20.tmp"
"c:\windows\system32\SET21.tmp"
"c:\windows\system32\SET22.tmp"
"c:\windows\system32\SET23.tmp"

file zipped: c:\windows\system32\uacbbr.dll
file zipped: c:\windows\system32\UACmxrallrhqe.dll
file zipped: c:\windows\system32\uacrem.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\uacbbr.dll
c:\windows\system32\UACmxrallrhqe.dll
c:\windows\system32\uacrem.dll

.
((((((((((((((((((((((((( Files Created from 2009-07-27 to 2009-08-27 )))))))))))))))))))))))))))))))
.

2009-08-27 06:26 . 2009-08-27 06:26 ——– d—–w- c:\windows\LastGood
2009-08-25 21:04 . 2009-08-26 17:26 ——– d-s—w- C:\ComboFix
2009-08-25 17:53 . 2009-08-25 17:54 ——– d—–w- c:\program files\ERUNT
2009-08-25 06:20 . 2009-08-25 06:20 ——– d-sh–w- c:\documents and settings\Kerti\IETldCache
2009-08-24 18:10 . 2009-08-24 18:09 102664 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2009-08-24 18:09 . 2009-08-24 18:10 ——– d—–w- c:\documents and settings\Neil\.housecall6.6
2009-08-23 18:11 . 2009-08-23 18:11 ——– d—–w- c:\documents and settings\Neil\Local Settings\Application Data\Mozilla
2009-08-23 17:36 . 2009-08-23 17:35 64160 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-08-23 17:34 . 2009-08-23 17:34 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-08-23 17:34 . 2009-03-12 08:17 2902048 -c–a-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-08-23 17:34 . 2009-08-23 17:34 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-08-21 18:57 . 2009-08-21 18:57 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-08-21 15:54 . 2009-08-21 15:54 ——– d-sh–w- c:\documents and settings\Neil_user_acc\IETldCache
2009-08-21 15:19 . 2009-08-21 15:19 ——– d-sh–w- c:\documents and settings\NDM1\IETldCache
2009-08-21 13:34 . 2009-08-21 13:40 ——– d—–w- c:\program files\Windows Live Safety Center
2009-08-21 13:32 . 2009-08-21 13:32 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-08-21 13:20 . 2009-08-21 13:20 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-21 13:19 . 2009-08-21 13:19 ——– d-sh–w- c:\documents and settings\Neil\IETldCache
2009-08-21 12:44 . 2009-08-21 12:44 61224 —-a-w- c:\documents and settings\Neil\GoToAssistDownloadHelper.exe
2009-08-21 12:38 . 2009-08-21 12:38 49152 —-a-r- c:\documents and settings\Neil\Application Data\Microsoft\Installer\{FCC07EEA-FA18-4A21-9105-9666603C6885}\IconFCC07EEA1.exe
2009-08-21 12:38 . 2009-08-21 12:38 49152 —-a-r- c:\documents and settings\Neil\Application Data\Microsoft\Installer\{FCC07EEA-FA18-4A21-9105-9666603C6885}\IconFCC07EEA.exe
2009-08-21 12:26 . 2009-08-21 12:26 ——– d—–w- C:\mfe
2009-08-21 12:09 . 2009-08-21 12:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Citrix
2009-08-21 12:06 . 2009-08-21 12:06 ——– d—–w- c:\documents and settings\Neil\Local Settings\Application Data\Citrix
2009-08-21 11:50 . 2009-07-13 00:42 286880 —-a-r- c:\documents and settings\Neil\Application Data\McAfee\Supportability\MVTLogs\Results\detect.dll
2009-08-20 19:57 . 2009-08-20 19:57 ——– d—–w- c:\documents and settings\Neil\Application Data\Macrovision
2009-08-12 17:46 . 2007-11-05 10:56 101120 —-a-r- c:\windows\system32\drivers\ewusbmdm.sys
2009-08-12 17:45 . 2009-08-12 17:45 ——– d—–w- c:\program files\Vodafone
2009-08-12 17:45 . 2009-08-12 17:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Macrovision
2009-08-12 17:44 . 2009-08-12 17:44 ——– d—–w- c:\documents and settings\Neil\Local Settings\Application Data\Downloaded Installations
2009-08-10 05:35 . 2009-08-10 05:35 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\SACore
2009-07-28 21:02 . 2009-05-13 22:25 40552 —-a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-07-28 21:02 . 2009-05-13 22:25 35272 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2009-07-28 21:02 . 2009-05-13 22:25 79816 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-07-28 21:02 . 2009-04-09 13:23 120136 —-a-w- c:\windows\system32\drivers\Mpfp.sys
2009-07-28 21:01 . 2009-07-28 21:02 ——– d—–w- c:\program files\Common Files\McAfee
2009-07-28 20:57 . 2009-05-13 22:24 34248 —-a-w- c:\windows\system32\drivers\mferkdk.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-27 06:26 . 2006-09-13 02:44 ——– d—–w- c:\program files\McAfee
2009-08-26 19:47 . 2006-09-23 11:36 2409 –sha-w- c:\windows\system32\mmf.sys
2009-08-23 18:04 . 2006-09-22 16:38 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-08-23 17:41 . 2006-09-22 16:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-23 17:34 . 2006-09-22 16:37 ——– d—–w- c:\program files\Lavasoft
2009-08-21 15:18 . 2006-12-01 12:41 ——– d—–w- c:\program files\Adware Away
2009-08-21 11:49 . 2006-12-01 02:47 ——– d—–w- c:\documents and settings\Neil\Application Data\McAfee
2009-08-21 11:49 . 2006-09-13 02:44 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-08-20 19:57 . 2008-09-21 11:50 ——– d—–w- c:\program files\Dl_cats
2009-08-20 17:18 . 2008-09-26 17:31 ——– d—–w- c:\documents and settings\LocalService\Application Data\SACore
2009-08-05 09:01 . 2005-08-16 09:18 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-02 10:36 . 2006-09-22 00:48 73264 -c–a-w- c:\documents and settings\Neil\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-28 21:01 . 2006-09-13 02:42 ——– d—–w- c:\program files\McAfee.com
2009-07-24 20:13 . 2009-07-24 20:13 ——– d—–w- c:\program files\TomTom DesktopSuite
2009-07-17 19:01 . 2005-08-16 09:18 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-13 22:43 . 2005-08-16 09:19 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-06-25 08:25 . 2005-08-16 09:18 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2005-08-16 09:18 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2005-08-16 09:18 147456 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2005-08-16 09:18 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2005-08-16 09:18 730112 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2005-08-16 09:18 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2005-08-16 09:18 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2005-08-16 09:18 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2005-08-16 09:18 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2005-08-16 09:18 80896 —-a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2005-08-16 09:18 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2005-08-16 09:18 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 08:19 . 2005-08-16 09:37 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2005-08-16 09:18 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2005-08-16 09:18 1291264 —-a-w- c:\windows\system32\quartz.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-26_18.11.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-01-29 08:58 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2009-06-25 08:25 . 2009-06-25 08:25 54272 c:\windows\system32\dllcache\wdigest.dll
- 2009-02-03 19:59 . 2009-02-03 19:59 56832 c:\windows\system32\dllcache\secur32.dll
+ 2009-02-03 19:59 . 2009-06-25 08:25 56832 c:\windows\system32\dllcache\secur32.dll
+ 2009-06-24 11:18 . 2009-06-24 11:18 92928 c:\windows\system32\dllcache\ksecdd.sys
- 2006-09-21 23:20 . 2009-08-26 17:33 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2006-09-21 23:20 . 2009-08-27 06:26 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-09-21 23:20 . 2009-08-26 17:33 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2006-09-21 23:20 . 2009-08-27 06:26 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-12-05 06:54 . 2009-06-25 08:25 147456 c:\windows\system32\dllcache\schannel.dll
+ 2009-06-25 08:25 . 2009-06-25 08:25 136192 c:\windows\system32\dllcache\msv1_0.dll
+ 2009-04-17 05:56 . 2009-06-25 08:25 730112 c:\windows\system32\dllcache\lsasrv.dll
+ 2009-06-25 08:25 . 2009-06-25 08:25 301568 c:\windows\system32\dllcache\kerberos.dll
+ 2009-08-21 13:20 . 2009-08-27 06:26 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-08-21 13:20 . 2009-08-26 17:33 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ISUSPM"="c:\documents and settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"DelayShred"="c:\program files\mcafee\mshr\ShrCL.EXE" [2009-04-09 113168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 602182]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728]
"dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-21 425984]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-05-01 645328]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-08-23 520024]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-24 282624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-9-13 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mnmsrvc"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [23/08/2009 18:36 64160]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [23/09/2006 12:36 2560]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [28/07/2009 22:05 210216]
S2 0308031251354413mcinstcleanup;McAfee Application Installer Cleanup (0308031251354413);c:\windows\TEMP\030803~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\windows\TEMP\030803~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 1029456]
S3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\drivers\AngelUsb.sys [13/09/2006 03:06 386560]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 17:35]

2009-07-28 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-07-28 07:57]

2009-07-28 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-07-28 07:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.bbc.co.uk/sport
uInternet Settings,ProxyOverride =
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
Trusted Zone: mcafee.com
FF - ProfilePath - c:\documents and settings\Neil\Application Data\Mozilla\Firefox\Profiles\3phat18v.default\
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-27 07:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\Ø* 2*]
"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\"

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]
"1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,c9,e0,20,43,a1,23,f2,
e3
"2"=hex:f1,df,16,de,80,08,0e,2a,78,a4,28,cb,d2,56,ff,58,a6,09,d8,fb,43,e9,d5,
e7,16,83,71,61,5d,be,d8,25
"3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,2b,92,4b,0d,22,14,9d,
cb,e3,f8,73,90,7d,a4,36,0d,7e,db,3a,16,4c,1a,45,81,b1,a5,77,31,f5,50,d6,e8

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\B144CCE307E78EB6EE53CA2196E4D0A2]
"1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
b0,36,d7,56,53,fe,9f,3d,f9
"2"=hex:7e,f0,d3,bf,a1,bf,44,67
"3"=hex:d6,63,e3,c8,3b,b7,12,e4,c7,f3,0c,0b,51,c7,58,25,ec,0a,07,69,71,28,be,
c3,06,3f,39,c4,0b,97,bc,2b,39,d4,76,a0,d3,b1,2f,56,af,d6,75,9c,9f,2c,db,8a,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
b0,8f,11,0c,96,c4,fa,d8,91,c4,88,47,3c,b6,d7,23,fc,c9,b2,b2,e7,02,fa,d0,25,\
"7"=hex:6b,96,68,24,0f,2f,9e,94,e8,ce,54,f3,3b,80,63,3a,1b,c3,e7,ed,44,3a,1d,
97,9f,f9,03,77,68,81,1b,0c,00,99,b2,a5,1c,c7,0c,37
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,73,7e,45,c6,9f,9e,10,
63,a0,2f,06,c2,a3,e9,62,70,90,4c,ec,d6,92,e1,28,ba,e5,5d,0d,25,ef,fb,b7,21,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:4b,72,8f,bc,6c,3f,e4,15
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:4a,f9,1b,d3,8e,b9,24,97,69,ee,6f,ff,c5,d2,97,44,52,b4,87,41,3b,69,7f,
a5,4a,77,39,69,df,6c,a5,b6,ba,73,cf,15,31,7c,39,9a,a7,15,95,31,e1,bb,bb,58,\
"13"=hex:16,db,07,8a,0d,3e,d3,5b,9f,75,9b,c2,6c,70,b9,71,1f,6b,ec,ea,d0,6a,9c,
14
"14"=hex:56,9f,0c,87,43,ea,8d,f7,6c,01,ea,a3,05,cf,93,b7
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:8f,cc,fe,d5,16,e1,02,b4,22,ab,0d,3f,b7,55,32,53
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:99,1d,94,3b,ab,7e,ce,4b,bd,92,77,c4,09,7a,df,8c,f8,f6,23,9f,94,3f,16,
f2,4b,97,25,eb,91,da,33,2c,fc,03,5e,44,70,b6,99,14,88,36,97,f2,62,b2,4c,01,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F]
"1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,c2,97,86,6a,a5,82,f8,
d5,44,f7,88,8f,b5,4c,1b,f9,3e,da,c2,d2,eb,69,77,32,91,02,8c,84,09,5e,d2,d3
"2"=hex:f1,df,16,de,80,08,0e,2a,d1,38,b5,6f,94,ca,dc,d2,b3,e8,d2,40,6c,6f,61,
5e,d2,5e,7f,21,14,b5,b2,29
"3"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,c2,97,86,6a,a5,82,f8,
d5,f2,55,76,c8,bc,53,92,25,3f,d1,b6,bc,00,35,73,43,96,90,79,f6,5b,97,35,47,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F3F0046F119EFA4F\37539B6D352ECF5C006214859EC1AF0C]
"1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
b0,c8,c9,f6,99,f8,a7,b9,da
"2"=hex:76,4e,1c,cc,2e,81,b8,f3
"3"=hex:f1,2d,e6,4f,20,41,68,3d,a3,4a,7f,ea,bb,4e,34,21,81,fc,57,3e,47,8d,19,
6c,4b,34,df,68,73,58,74,59,24,4b,5c,55,dd,64,0e,db,fb,7a,c4,66,cb,06,30,2f,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
b0,13,d6,a9,04,9e,fe,4b,b3,10,e4,eb,ef,c4,3c,01,7c,da,ad,aa,35,c5,9e,af,7d,\
"7"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
b0,f5,de,1e,04,6d,6b,1c,69
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,6b,8d,dd,0b,84,72,f6,
f2,3d,a6,3c,a0,07,7d,db,f3,88,a8,6c,3f,5c,60,94,94,89,77,0c,65,96,1c,ff,8e,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:4b,72,8f,bc,6c,3f,e4,15
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:9f,e5,86,4c,9e,88,11,96,ce,c0,5f,f9,67,f6,44,75,e6,1e,e2,02,c9,3d,b2,
83,3d,f7,ae,19,9a,cf,b1,4d,2d,a7,01,45,5f,4c,c3,c6,ab,68,d7,43,20,73,a3,37,\
"13"=hex:cc,91,cd,ea,97,0e,7b,35,ad,df,f5,9e,c6,15,34,ea,d4,9a,91,15,22,64,f4,
77
"14"=hex:6c,3a,76,3b,92,16,dd,60
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:30,f5,26,86,d0,44,70,82,93,10,96,e9,72,6e,6b,18
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:58,b8,ec,1c,80,dc,1c,f0,49,05,f8,37,70,8d,b2,51,5f,80,84,35,94,5d,18,
3a,50,30,d6,a3,ba,42,33,66,0e,5c,6d,ca,8c,86,7f,58,d2,d3,95,44,0b,ac,2f,8a,\
.
Completion time: 2009-08-27 7:52
ComboFix-quarantined-files.txt 2009-08-27 06:52
ComboFix2.txt 2009-08-26 18:23

Pre-Run: 7,845,232,640 bytes free
Post-Run: 7,803,490,304 bytes free

352 — E O F — 2009-08-26 18:18
Upload was successful
———————————
Malwarebytes' Anti-Malware 1.40
Database version: 2706
Windows 5.1.2600 Service Pack 3

27/08/2009 19:01:50
mbam-log-2009-08-27 (19-01-50).txt

Scan type: Quick Scan
Objects scanned: 123505
Time elapsed: 7 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 21

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\AV Care (Rogue.AVCare) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adware away v3.0.2_is1 (Rogue.AdwareAway) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Adware Away (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Adware Away (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Documents and Settings\Neil\Start Menu\Programs\AV Care (Rogue.AVCare) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\99 (Rogue.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\AdAway.dll (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\AdAway.exe (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\AdwareAway.chm (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\EnumAutoRun.exe (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\EnumDlls.exe (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\EProcess.exe (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\global.dll (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\overall.log (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\process.tmp (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\ScanAtStartup.exe (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\screenshot.exe (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\service.tmp (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\unins000.dat (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\unins000.exe (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Program Files\Adware Away\Update.exe (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Adware Away\Adware Away.lnk (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Adware Away\Uninstall.lnk (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Adware Away\User Manual.lnk (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\Documents and Settings\Neil\Desktop\Adware Away.lnk (Rogue.AdwareAway) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UACerrors.log (Trojan.Agent) -> Quarantined and deleted successfully.

kirkie001

Post #17August 27, 2009, 9:27 PM UTC

And here is the Kapersky log: ———————————————————— ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Thursday, August 27, 2009 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Thursday, August 27, 2009 20:39:15 Records in database: 2692678 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 197131 Threats found: 9 Infected objects found: 20 Suspicious objects found: 0 Scan duration: 02:40:53 File name / Threat / Threats count C:\Documents and Settings\Kerti\Application Data\sdra64.exe Infected: Trojan-Spy.Win32.Zbot.gen 1 C:\Documents and Settings\Neil\.housecall6.6\Quarantine\UAC3d5e.tmp.bac_a00548 Infected: Trojan.Win32.Tdss.anrc 1 C:\Documents and Settings\Neil\.housecall6.6\Quarantine\UACa53a.tmp.bac_a00548 Infected: Trojan.Win32.Patched.hb 1 C:\Documents and Settings\Neil\.housecall6.6\Quarantine\UACb5a1.tmp.bac_a00548 Infected: Trojan.Win32.Tdss.anrc 1 C:\Documents and Settings\Neil\.housecall6.6\Quarantine\UACjhokkkahlo.sys.bac_a00548 Infected: Rootkit.Win32.Agent.oxr 1 C:\Documents and Settings\Neil\.housecall6.6\Quarantine\UACmxrallrhqe.dll.bac_a00548 Infected: Trojan.Win32.TDSS.amwo 1 C:\Documents and Settings\Neil\.housecall6.6\Quarantine\UACuwmtaxwdkc.dll.bac_a00548 Infected: Trojan.Win32.Tdss.anrc 1 C:\Documents and Settings\Neil\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5404ed29-19c1f9d0.zip Infected: Exploit.Java.Gimsh.b 1 C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys2\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmbckltndj.dll.vir Infected: Trojan.Win32.Tdss.aplz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmtqsgtvsp.dll.vir Infected: Trojan.Win32.Tdss.aplz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmuqosxhdv.dll.vir Infected: Trojan.Win32.Tdss.aply 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmvpyyucap.dll.vir Infected: Trojan.Win32.Tdss.aply 1 C:\Qoobox\Quarantine\[4]-Submit_2009-08-27_07.31.47.zip Infected: Trojan.Win32.Tdss.anrc 1 C:\Qoobox\Quarantine\[4]-Submit_2009-08-27_07.31.47.zip Infected: Trojan.Win32.TDSS.amwo 1 C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP624\A0056273.dll Infected: Trojan.Win32.Tdss.aply 1 C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP624\A0056274.dll Infected: Trojan.Win32.Tdss.aplz 1 C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP624\A0056308.dll Infected: Trojan.Win32.Tdss.aplz 1 C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP624\A0056309.dll Infected: Trojan.Win32.Tdss.aply 1 Selected area has been scanned.

CatByte

Post #18August 27, 2009, 10:30 PM UTC

Hi

There are just a few files to delete, the rest are in quarantine.

Please do the following:

Please download OTM by OldTimer.

Save it to your desktop.
Please click OTM and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe
:Services
:Reg
:Files
C:\Documents and Settings\Kerti\Application Data\sdra64.exe
C:\Documents and Settings\Neil\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5404ed29-19c1f9d0.zip 
C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys2\WebSys.mmz 
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz 
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

NEXT

post a fresh DDS and attach.txt and advise how your computer is running now and if there are any outstanding issues

kirkie001

Post #19August 28, 2009, 6:00 AM UTC

All progs run: logs below.
Stll can't get IE7, or the scans on my McAfee to work. Sypot S&D, however, will now load, which is progress!

K
—————–
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\Kerti\Application Data\sdra64.exe moved successfully.
C:\Documents and Settings\Neil\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5404ed29-19c1f9d0.zip moved successfully.
C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys2\WebSys.mmz moved successfully.
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: Kerti
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->Java cache emptied: 101243 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 262278 bytes

User: NDM1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->Java cache emptied: 1330 bytes

User: Neil
->Temp folder emptied: 77705681 bytes
->Temporary Internet Files folder emptied: 2826792 bytes
->Java cache emptied: 1881634 bytes
->FireFox cache emptied: 60959181 bytes

User: Neil_user_acc
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

%systemdrive% .tmp files removed: 0 bytes
Folder delete failed. C:\WINDOWS\msdownld.tmp scheduled to be deleted on reboot.
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 320048 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 137.69 mb

OTM by OldTimer - Version 3.0.0.6 log created on 08282009_065020

Files moved on Reboot…
C:\WINDOWS\msdownld.tmp moved successfully.

Registry entries deleted on Reboot…
————————————————————

DDS (Ver_09-07-30.01) - NTFSx86
Run by [removed] at 6:54:12.04 on 28/08/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.437 [GMT 1:00]

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\runservice.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell AIO 810\dlcgmon.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\agent.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Neil\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.bbc.co.uk/sport
uInternet Settings,ProxyOverride =
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - No File
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ISUSPM] "c:\documents and settings\all users\application data\macrovision\flexnet connect\6\ISUSPM.exe" -scheduler
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [DelayShred] "c:\program files\mcafee\mshr\shrcl.exe" /p7 /q c:\docume~1\neil\locals~1\tempor~1\content.ie5\g0rh2w0d\type_c~1.sh! c:\docume~1\neil\locals~1\tempor~1\content.ie5\id5kll73\page55~1.sh! c:\docume~1\neil\locals~1\tempor~1\content.ie5\btglhxwr\main_1~1.sh! c:\docume~1\neil\locals~1\tempor~1\content.ie5\0jjlcppb\b21313~1.sh! c:\docume~1\neil\locals~1\tempor~1\content.ie5\id5kll73\ads_1_~1.sh! c:\docume~1\neil\locals~1\tempor~1\content.ie5\0jjlcppb\rss-fe~1.sh! c:\docume~1\neil\locals~1\tempor~1\content.ie5\0jjlcppb\ADS_2_~1.SH!
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_06\bin\jusched.exe
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [DLCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCGtime.dll,_RunDLLEntry@16
mRun: [dlcgmon.exe] "c:\program files\dell aio 810\dlcgmon.exe"
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: mcafee.com
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\neil\applic~1\mozilla\firefox\profiles\3phat18v.default\
FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-23 64160]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-5-13 214024]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2006-9-23 2560]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-7-28 210216]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-7-28 359952]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-7-28 144704]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-7-28 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-7-28 35272]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
S3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\drivers\AngelUsb.sys [2006-9-13 386560]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-7-28 34248]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-7-28 40552]
S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-7-28 606736]

=============== Created Last 30 ================

2009-08-28 06:50 –d—– C:\_OTM
2009-08-27 18:50 –d—– c:\docume~1\neil\applic~1\Malwarebytes
2009-08-27 18:50 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-27 18:50 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-08-27 18:50 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-08-27 18:50 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-08-26 19:21 –d—– c:\windows\system32\dllcache\cache
2009-08-26 18:39 a-dshr– C:\cmdcons
2009-08-25 22:04 –ds—- C:\ComboFix
2009-08-25 21:01 229,376 a——- c:\windows\PEV.exe
2009-08-25 21:01 161,792 a——- c:\windows\SWREG.exe
2009-08-25 21:01 98,816 a——- c:\windows\sed.exe
2009-08-24 19:10 102,664 a——- c:\windows\system32\drivers\tmcomm.sys
2009-08-24 19:09 –d—– c:\documents and settings\neil\.housecall6.6
2009-08-23 18:36 64,160 a——- c:\windows\system32\drivers\Lbd.sys
2009-08-23 18:34 -cd-h— c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-08-21 14:19 –dsh— c:\documents and settings\neil\IETldCache
2009-08-21 13:44 61,224 a——- c:\documents and settings\neil\GoToAssistDownloadHelper.exe
2009-08-21 13:26 –d—– C:\mfe
2009-08-21 13:09 –d—– c:\docume~1\alluse~1\applic~1\Citrix
2009-08-20 20:57 –d—– c:\docume~1\neil\applic~1\Macrovision
2009-08-12 18:46 101,120 a—-r– c:\windows\system32\drivers\ewusbmdm.sys
2009-08-12 18:45 –d—– c:\program files\Vodafone
2009-08-11 19:03 128,512 ——– c:\windows\system32\dllcache\dhtmled.ocx

==================== Find3M ====================

2009-08-28 06:52 2,409 a–sh— c:\windows\system32\mmf.sys
2009-08-05 10:01 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-08-05 10:01 204,800 a——- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-17 20:01 58,880 a——- c:\windows\system32\atl.dll
2009-07-17 20:01 58,880 ——– c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 10,841,088 ——– c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 ——– c:\windows\system32\dllcache\wmpdxm.dll
2009-07-10 14:27 1,315,328 a——- c:\windows\system32\dllcache\msoe.dll
2009-06-29 17:12 133,120 a——- c:\windows\system32\dllcache\extmgr.dll
2009-06-29 12:07 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe
2009-06-25 09:25 730,112 a——- c:\windows\system32\lsasrv.dll
2009-06-25 09:25 301,568 a——- c:\windows\system32\kerberos.dll
2009-06-25 09:25 147,456 a——- c:\windows\system32\schannel.dll
2009-06-25 09:25 136,192 a——- c:\windows\system32\msv1_0.dll
2009-06-25 09:25 56,832 a——- c:\windows\system32\secur32.dll
2009-06-25 09:25 54,272 a——- c:\windows\system32\wdigest.dll
2009-06-25 09:25 730,112 ——– c:\windows\system32\dllcache\lsasrv.dll
2009-06-25 09:25 301,568 ——– c:\windows\system32\dllcache\kerberos.dll
2009-06-25 09:25 147,456 ——– c:\windows\system32\dllcache\schannel.dll
2009-06-25 09:25 136,192 ——– c:\windows\system32\dllcache\msv1_0.dll
2009-06-25 09:25 56,832 ——– c:\windows\system32\dllcache\secur32.dll
2009-06-25 09:25 54,272 ——– c:\windows\system32\dllcache\wdigest.dll
2009-06-24 12:18 92,928 ——– c:\windows\system32\dllcache\ksecdd.sys
2009-06-16 15:36 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 15:36 81,920 a——- c:\windows\system32\fontsub.dll
2009-06-16 15:36 81,920 a——- c:\windows\system32\dllcache\fontsub.dll
2009-06-16 15:36 119,808 ——– c:\windows\system32\dllcache\t2embed.dll
2009-06-12 13:31 80,896 a——- c:\windows\system32\tlntsess.exe
2009-06-12 13:31 80,896 a——- c:\windows\system32\dllcache\tlntsess.exe
2009-06-12 13:31 76,288 a——- c:\windows\system32\telnet.exe
2009-06-12 13:31 76,288 a——- c:\windows\system32\dllcache\telnet.exe
2009-06-10 15:13 84,992 a——- c:\windows\system32\avifil32.dll
2009-06-10 15:13 84,992 ——– c:\windows\system32\dllcache\avifil32.dll
2009-06-10 09:19 2,066,432 a——- c:\windows\system32\mstscax.dll
2009-06-10 09:19 2,066,432 ——– c:\windows\system32\dllcache\mstscax.dll
2009-06-10 07:14 132,096 a——- c:\windows\system32\wkssvc.dll
2009-06-10 07:14 132,096 ——– c:\windows\system32\dllcache\wkssvc.dll
2009-06-03 20:09 1,291,264 a——- c:\windows\system32\quartz.dll
2009-06-03 20:09 1,291,264 ——– c:\windows\system32\dllcache\quartz.dll
2009-03-05 22:52 5,642 ac—— c:\docume~1\neil\applic~1\wklnhst.dat
2008-11-09 12:18 32,768 ac-sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008110920081110\index.dat

============= FINISH: 6:55:19.71 ===============

Attachments:

📎Attach.txt

kirkie001

Post #20August 28, 2009, 6:21 AM UTC

Small up date on how things are running: - can't get McAfee to scan (same error as before), and automatic updates for it appear to fail. It suggests reinstalling McAfee Security Centre? - opening a new program seems to run VERY slowly (i.e. Spybot took about 2 minutes to open, and same to close) - can't get IE7 to run yet. - iexplore.exe within program files/internet explorer is still a with folder with a top blue border icon, rather than the normal executable file icon. - no other real symptoms - but these were the main ones anyway.

CatByte

Post #21August 28, 2009, 11:15 AM UTC

Hi,

McAfee was likely damaged by the malware. It is probably best to remove it completely from your machine, then re-install it.

(if you don't wish to keep McAfee and would like recommendations on a free antivirus - let me know)

Use this removal tool after removing McAfee from Add/Remove programs:

McAfee Removal Tool

For IE7 - please do this:

Click Start, click Run, type iexplore about:blank in the Open box, and then click OK.
If Internet Explorer does not start that way then click Start, point to All Programs, point to Accessories, point to System Tools, and then click Internet Explorer (No Add-ons). To continue to your home page, click the Home button.

Please advise if IE opens this way - If it does not, then it too has been corrupted and will need to be re-installed.

NEXT

Visit ADOBEand download the latest version of Acrobat Reader (version 9.1)
Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

Please download JavaRa to your desktop and unzip it to its own folder.

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
Scroll down to the Java SE Runtime Environment (JRE) option.
Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 16)

kirkie001

Post #22August 28, 2009, 3:59 PM UTC

Many thanks, CatByte. Fully removed then reinstalled McAfee; that works fine now (and a quick scan showed no baddies). I have 11 months on a subscription still to go on it; so think I'll stick with it at least until it runs out. No luck on IE though. Tried both your methods; don't work, and I still get the errors. Can you advise how to reinstall? Acrobat updated. Tried JavaRe - when it gets to the 'open webpage' part to get Java SE Runtime Environment; nothing opens. Can you give me a direct link to where I need to go? Any other checks I need to run; or protection I should install (or reinstall)? I have 2 qu's: - am I nasty-free sufficiently to do internet banking (I haven't used it at all since problems first noted) - Am a little worried that there may be other corrupt .exe files in there that I haven't found yet as I haven't tried to use them. If I do come across them, what shoud I do? Many thanks!

CatByte

Post #23August 28, 2009, 4:18 PM UTC last edited August 28, 2009, 4:21 PM UTC

Hi,

Java
For manual download go here
http://www.java.com/en/download/manual.jsp

To uninstall IE7

Important: If you installed Windows XP SP3 on your computer after you installed Internet Explorer 7, you need to uninstall Windows XP Service Pack 3 before you can uninstall Internet Explorer 7.

Step 1: Make hidden files and hidden folders visible

Click Start, and then click My Documents.
On the Tools menu, click Folder Options.
Click the View tab.
In the Advanced settings list, under Hidden files and folders, click Show hidden files and folders, and then click OK.

Step 2: Uninstall Internet Explorer 7

Click Start, and then click Run.
In the Open box, type %windir%\ie7\spuninst\spuninst.exe, and then click OK.
Follow the wizard instructions to uninstall Internet Explorer 7.

Now download and reinstall IE 7

If that fails…try downloading and installing IE8.

http://www.microsoft.com/Downloads/details…;displaylang=en

~~~~~~~~~~~~~~~~~~~~~~~~~~~~

There are some cleanup procedures I have yet to give you where we clean up all the tools used and then I will give you more recommendations for keeping your computer clean.

As a precaution, I would change all your passwords before doing internet banking.

I just wanted to make sure all the issues are resolved before the final cleanup

If you do find certain programs not working - usually uninstalling them through add/remove programs then reinstalling will fix the issues, but you will probably be OK

kirkie001

Post #24August 28, 2009, 5:39 PM UTC

Thanks - Java safely reinstalled and updated. Having problems with IE7. Your Run command points to a file that doesn't exist on my computer. Can't remove from add/delete programs. Can't reinstall IE7 over the top of it; and trying to update to IE8 seems to fail (I have a windows update which is waiting for me; trying (and failing) to do just that. Any ideas? [Now that I've downloaded firefox I can of course browse and have all my bookmarks - I'd just rather that my computer was working "as it should"…..] Many thanks K

CatByte

Post #25August 28, 2009, 5:52 PM UTC

Hi,

There is a guide here for using Dial a Fix to repair Windows Updates

http://www.bleepingcomputer.com/forums/topic160132.html

follow the instructions for downloading and using dial a fix and let me know if that fixes the windows update and IE 7 issue

kirkie001

Post #26August 28, 2009, 7:46 PM UTC

Hi CatByte - no, I'm afraid not. Several errors came up when running - sounded ike missing or corrupted files. K

CatByte

Post #27August 28, 2009, 10:18 PM UTC

did you happen to get any information as to the files that may be missing, we can look for replacements

kirkie001

Post #28August 29, 2009, 2:00 PM UTC

Found a log file (it was taking too long to write everything out by hand!) - have attached. Does this give you any ideas or clues? K

Attachments:

📎dial_a_fix.txt

CatByte

Post #29August 29, 2009, 2:10 PM UTC

Hi,

There are some corrupted files there, lets see if we can find some clean copies.

Please do the following:

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:filefind
*iesetup*
*imgutil*
*inseng*
*mshtml*
*msrating*
*occache*
*pngfilt*
*webcheck*
*shdocvw*

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

kirkie001

Post #30August 29, 2009, 3:15 PM UTC

SystemLook log as requested…… SystemLook v1.0 by jpshortstuff (28.08.09) Log created at 16:05 on 29/08/2009 by Neil (Administrator - Elevation successful) ========== filefind ========== Searching for "*iesetup*" C:\i386\iesetup.dll –a–c 62976 bytes [23:54 22/09/2006] [10:00 10/08/2004] 6ADA26CCF909C1618EEE74958387B61F C:\WINDOWS\ServicePackFiles\i386\iesetup.dll —–c 62976 bytes [19:55 04/09/2008] [00:11 14/04/2008] B27B17301D91905EE879BEC8E57DA3B8 C:\WINDOWS\system32\dllcache\iesetup.dll –a— 71680 bytes [09:18 16/08/2005] [03:32 08/03/2009] 1B6FF5B9A21DE2E89BB014932A414E7E C:\WINDOWS\system32\en-US\iesetup.dll.mui –a— 77824 bytes [01:44 27/10/2006] [13:22 08/03/2009] 45E2A3D434E511A82EC2D18C76EE2913 C:\WINDOWS\system32\iesetup.dll –a— 71680 bytes [09:18 16/08/2005] [03:32 08/03/2009] 1B6FF5B9A21DE2E89BB014932A414E7E Searching for "*imgutil*" C:\i386\imgutil.dll –a–c 35840 bytes [23:55 22/09/2006] [10:00 10/08/2004] 2921A7FFF61C08BE9D358C0B67D53E66 C:\WINDOWS\ServicePackFiles\i386\imgutil.dll —–c 35840 bytes [19:55 04/09/2008] [00:11 14/04/2008] A4DD6C951201F5AA105EEF561BEAA342 C:\WINDOWS\system32\dllcache\imgutil.dll –a— 34816 bytes [11:57 17/10/2006] [03:31 08/03/2009] 42B928FC8518D793BF7A5EAFC57B1D8B C:\WINDOWS\system32\imgutil.dll –a— 34816 bytes [09:18 16/08/2005] [03:31 08/03/2009] 42B928FC8518D793BF7A5EAFC57B1D8B Searching for "*inseng*" C:\i386\inseng.dll –a–c 96256 bytes [23:53 22/09/2006] [05:25 10/05/2006] 6CA6C74B53769E837A87BF8C928AE963 C:\WINDOWS\$NtUninstallKB918899$\inseng.dll —–c 96256 bytes [16:12 23/09/2006] [05:25 10/05/2006] 6CA6C74B53769E837A87BF8C928AE963 C:\WINDOWS\$NtUninstallKB922760$\inseng.dll —–c 96256 bytes [12:54 17/11/2006] [11:25 23/06/2006] 96CACA6EB4D982B638F7912BB0C550D5 C:\WINDOWS\$NtUninstallKB925454$\inseng.dll —–c 96256 bytes [02:15 15/12/2006] [08:31 14/09/2006] F6A4A83E52AEEA032BD1E4D7ECE9DE29 C:\WINDOWS\$NtUninstallKB928090$\inseng.dll —–c 96256 bytes [12:32 20/02/2007] [15:34 23/10/2006] AE06C961DF988CC9EE1BC76F1A17C6E1 C:\WINDOWS\$NtUninstallKB931768$\inseng.dll —–c 96256 bytes [10:51 10/05/2007] [14:05 04/01/2007] C88C541D63AA1CE5AC3FCA4090C71527 C:\WINDOWS\$NtUninstallKB933566$\inseng.dll —–c 96256 bytes [05:58 14/06/2007] [09:52 20/02/2007] 833784903AD33A4F1A24489ED9C0D61B C:\WINDOWS\ServicePackFiles\i386\inseng.dll —–c 96256 bytes [19:55 04/09/2008] [00:11 14/04/2008] 29A25391153F0784694241A270C0EB69 C:\WINDOWS\system32\dllcache\inseng.dll –a— 94720 bytes [09:18 16/08/2005] [03:32 08/03/2009] 8FAAFF28147935E5847F980607965FFE C:\WINDOWS\system32\en-US\inseng.dll.mui –a— 3584 bytes [01:43 27/10/2006] [13:22 08/03/2009] 4A78D50FCF0E424F627E545A812E772D C:\WINDOWS\system32\inseng.dll –a— 94720 bytes [09:18 16/08/2005] [03:32 08/03/2009] 8FAAFF28147935E5847F980607965FFE Searching for "*mshtml*" C:\i386\mshtml.dll –a–c 3055104 bytes [23:53 22/09/2006] [15:06 19/05/2006] 8687E029BE63C77D4919485068C54D77 C:\i386\mshtml.tlb –a–c 1351168 bytes [23:57 22/09/2006] [10:00 10/08/2004] 543C9E17D5DFBD2E484662BCD75A60AD C:\i386\mshtmled.dll –a–c 448512 bytes [23:53 22/09/2006] [05:25 10/05/2006] BB4E3F7976C30A659E9E52B772EFB903 C:\i386\mshtmler.dll –a–c 56832 bytes [23:57 22/09/2006] [10:00 10/08/2004] 7F18ED46956794A0870CFF519A10279C C:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\mshtml.dll –a–c 3584000 bytes [09:25 08/05/2007] [09:25 08/05/2007] 1D4E3B86C601A2497C99790CC4D7DF26 C:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\mshtmled.dll –a–c 477696 bytes [09:08 25/04/2007] [09:08 25/04/2007] 06599A32F6194369420673B24B52CE3B C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\mshtml.dll –a–c 3584000 bytes [21:09 18/07/2007] [21:09 18/07/2007] 7CE243CFD47AD0DC431586CB8C542A11 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\mshtmled.dll –a–c 477696 bytes [14:40 27/06/2007] [14:40 27/06/2007] 87AABF0D9122E317948CABB70BDBAEFA C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\mshtml.dll –a–c 3592192 bytes [10:02 20/08/2007] [10:02 20/08/2007] AA8A4BD78D24FCDB96DDAEE3756AA372 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\mshtmled.dll –a–c 478208 bytes [10:02 20/08/2007] [10:02 20/08/2007] 6D04C046671C16184A63C9BDC5051C88 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\mshtml.dll –a–c 3593216 bytes [23:48 30/10/2007] [23:48 30/10/2007] 54D8B404F17AA74C666F7F3AEF2AE459 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\mshtmled.dll –a–c 478208 bytes [23:47 10/10/2007] [23:47 10/10/2007] E39C9B9E8A96E30F8C20D4AC490C4EF6 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\mshtml.dll –a–c 3593216 bytes [02:01 07/12/2007] [02:01 07/12/2007] 976C46ED4A75FC66D9C596778898CE1E C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\mshtmled.dll –a–c 478208 bytes [02:01 07/12/2007] [02:01 07/12/2007] 80916C2B447C4005A107FDDE572D9E50 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\mshtml.dll –a–c 3593216 bytes [06:03 09/04/2008] [13:03 01/03/2008] 4EE273E2B09317C1217EF0DB91F93534 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\mshtmled.dll –a–c 478208 bytes [06:03 09/04/2008] [13:03 01/03/2008] 744AFD9B6DA1292852AEF8D1D7653EBB C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\mshtml.dll –a–c 3593728 bytes [20:45 24/06/2008] [03:35 23/04/2008] 4D612FF5D3B7EEF200595AE6F95D5E68 C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\mshtmled.dll –a–c 478208 bytes [20:45 24/06/2008] [03:35 23/04/2008] AD0223CF2C940DF11A9C3CF7BA628765 C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\mshtml.dll –a–c 3594240 bytes [17:40 13/08/2008] [16:01 23/06/2008] 28B8231CA8D55FC85E027A57C90F5C88 C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\mshtmled.dll –a–c 477696 bytes [17:40 13/08/2008] [16:01 23/06/2008] 9B95DA7C3E951746441A8D9B3DF3A476 C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\mshtml.dll –a–c 3594752 bytes [09:08 26/08/2008] [09:08 26/08/2008] 25CC085720EE3617FD1F8AB9E2F7CAB2 C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\mshtmled.dll –a–c 477696 bytes [09:08 26/08/2008] [09:08 26/08/2008] 9BD8C5E7E4DE488AC4F3E09124EA569D C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll –a–c 3595264 bytes [22:13 10/12/2008] [20:24 16/10/2008] B74F31A4BD83797D7A083F922169287D C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE\mshtmled.dll –a–c 477696 bytes [22:14 10/12/2008] [20:24 16/10/2008] 2D9C863B5AED3ACBB5F092CD100919E4 C:\WINDOWS\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll –a–c 3594752 bytes [21:47 17/12/2008] [06:26 13/12/2008] C79FAD61CD4A26ED5AA8C16D991C6FBD C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll –a–c 3596288 bytes [06:33 11/02/2009] [16:24 16/01/2009] CC9D001B7370B292C35B366CA05B12B4 C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE\mshtmled.dll –a–c 477696 bytes [06:33 11/02/2009] [23:55 20/12/2008] 720DDA329061EC1025A080844D4DBB64 C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\mshtml.dll –a— 3596800 bytes [07:39 21/02/2009] [07:39 21/02/2009] 1BB754AB47B327DE8DBF2FA18C36357C C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\mshtmled.dll –a— 477696 bytes [18:09 20/02/2009] [18:09 20/02/2009] CDA3C090B47DCA2AEA9F4277F94F3D40 C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\mshtml.dll –a— 3598336 bytes [04:49 29/04/2009] [04:49 29/04/2009] C6FD770D518FB024245A0EE217D72BC1 C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\mshtmled.dll –a— 477696 bytes [04:49 29/04/2009] [04:49 29/04/2009] 9FE7AEF35EED73AE09B082CD705DB122 C:\WINDOWS\$hf_mig$\KB972260-IE7\SP3QFE\mshtml.dll –a— 3600384 bytes [13:31 19/07/2009] [13:31 19/07/2009] F6098CC1B1C3858D53F20F3CB5774F3B C:\WINDOWS\$hf_mig$\KB972260-IE7\SP3QFE\mshtmled.dll –a— 477696 bytes [16:23 29/06/2009] [16:23 29/06/2009] 9A66A468A761CCDE0D4E31A1194C2EAF C:\WINDOWS\$NtUninstallKB918899$\mshtml.dll —–c 3055104 bytes [16:12 23/09/2006] [15:06 19/05/2006] 8687E029BE63C77D4919485068C54D77 C:\WINDOWS\$NtUninstallKB918899$\mshtmled.dll —–c 448512 bytes [16:12 23/09/2006] [05:25 10/05/2006] BB4E3F7976C30A659E9E52B772EFB903 C:\WINDOWS\$NtUninstallKB922760$\mshtml.dll —–c 3058176 bytes [12:54 17/11/2006] [11:30 28/07/2006] D251679BD9EF0250201FB899EC40FD32 C:\WINDOWS\$NtUninstallKB922760$\mshtmled.dll —–c 448512 bytes [12:54 17/11/2006] [11:25 23/06/2006] 7DE2A0740FE4A539DD7F36676E94F1DF C:\WINDOWS\$NtUninstallKB925454$\mshtml.dll —–c 3058688 bytes [02:15 15/12/2006] [08:31 14/09/2006] CEFEA1C301139A817931BE132F0359FE C:\WINDOWS\$NtUninstallKB925454$\mshtmled.dll —–c 448512 bytes [02:15 15/12/2006] [08:31 14/09/2006] 8904ED8F68CF3A46AFE51E11874DC5F9 C:\WINDOWS\$NtUninstallKB928090$\mshtml.dll —–c 3061248 bytes [12:32 20/02/2007] [15:34 23/10/2006] 88E1C15BB1A9ED3CBA4D6F2F408D5010 C:\WINDOWS\$NtUninstallKB928090$\mshtmled.dll —–c 448512 bytes [12:32 20/02/2007] [15:34 23/10/2006] 0AD02989AB89F4193805981C395EA606 C:\WINDOWS\$NtUninstallKB931768$\mshtml.dll —–c 3062272 bytes [10:51 10/05/2007] [14:05 04/01/2007] 1C45525574EF206346FBAFCAAC7CC4A5 C:\WINDOWS\$NtUninstallKB931768$\mshtmled.dll —–c 449024 bytes [10:51 10/05/2007] [14:05 04/01/2007] 4500A91911367CC9C2268DA5A7B51396 C:\WINDOWS\$NtUninstallKB933566$\mshtml.dll —–c 3063296 bytes [05:58 14/06/2007] [05:52 20/02/2007] 2991727809C7AC3A33E4178CC73244D8 C:\WINDOWS\$NtUninstallKB933566$\mshtmled.dll —–c 449024 bytes [05:58 14/06/2007] [09:52 20/02/2007] C7B2CBD34ABC04BD83C07BC07DFFAB63 C:\WINDOWS\ie7updates\KB933566-IE7\mshtml.dll —–c 3577856 bytes [22:07 09/08/2007] [14:09 27/10/2006] 7C91F9D79EC63BEA7CCC23F58F2C7182 C:\WINDOWS\ie7updates\KB933566-IE7\mshtmled.dll —–c 475648 bytes [22:07 09/08/2007] [14:09 27/10/2006] 711B550A78250F221CD9B76D0C3D94A6 C:\WINDOWS\ie7updates\KB937143-IE7\mshtml.dll —–c 3583488 bytes [06:00 16/08/2007] [09:24 08/05/2007] 5D90A7200F72DACE663EE78DE234FCC7 C:\WINDOWS\ie7updates\KB937143-IE7\mshtmled.dll —–c 477696 bytes [06:00 16/08/2007] [08:41 25/04/2007] 907C002CD3FD67A1AB3B8A933494B3B4 C:\WINDOWS\ie7updates\KB939653-IE7\mshtml.dll —–c 3583488 bytes [02:05 11/10/2007] [06:59 19/07/2007] BD609A26B683332A0E0E1445C5724851 C:\WINDOWS\ie7updates\KB939653-IE7\mshtmled.dll —–c 477696 bytes [02:05 11/10/2007] [14:34 27/06/2007] FA74C08F79568FD3C90A93265E42BDD7 C:\WINDOWS\ie7updates\KB942615-IE7\mshtml.dll —–c 3584512 bytes [20:49 12/12/2007] [10:04 20/08/2007] E267EE248CDA7667C19001C069DE867B C:\WINDOWS\ie7updates\KB942615-IE7\mshtmled.dll —–c 477696 bytes [20:49 12/12/2007] [10:04 20/08/2007] A129D5EE84ED91013F906D3B2ECCE3FA C:\WINDOWS\ie7updates\KB944533-IE7\mshtml.dll —–c 3590656 bytes [06:43 14/02/2008] [23:42 30/10/2007] 8AB7ECF59D6EBBE986277B65ED4A40A1 C:\WINDOWS\ie7updates\KB944533-IE7\mshtmled.dll —–c 478208 bytes [06:43 14/02/2008] [23:55 10/10/2007] 67AEC681AE6131BA00119FB1C9C6C83C C:\WINDOWS\ie7updates\KB947864-IE7\mshtml.dll —–c 3592192 bytes [06:03 10/04/2008] [05:21 08/12/2007] A097C36412455F0C7E42377FAF8809B7 C:\WINDOWS\ie7updates\KB947864-IE7\mshtmled.dll —–c 478208 bytes [06:03 10/04/2008] [02:21 07/12/2007] E97296987109272708AADB3CE208408D C:\WINDOWS\ie7updates\KB950759-IE7\mshtml.dll —–c 3591680 bytes [05:49 25/06/2008] [17:36 01/03/2008] AB2C88167D78D71D93558ACECB24CC7A C:\WINDOWS\ie7updates\KB950759-IE7\mshtmled.dll —–c 478208 bytes [05:49 25/06/2008] [13:06 01/03/2008] D876377D08C9DD0A6E3C656E7A616280 C:\WINDOWS\ie7updates\KB953838-IE7\mshtml.dll —–c 3591680 bytes [05:54 14/08/2008] [21:16 23/04/2008] 8976CAB317105F7431B08EA32AB73C65 C:\WINDOWS\ie7updates\KB953838-IE7\mshtmled.dll —–c 478208 bytes [05:54 14/08/2008] [04:16 23/04/2008] BEF280CA92B539F991BF0FBF8A8CE6D8 C:\WINDOWS\ie7updates\KB956390-IE7\mshtml.dll —–c 3592192 bytes [05:23 16/10/2008] [09:57 24/06/2008] EC936148284F557F19C333178768109B C:\WINDOWS\ie7updates\KB956390-IE7\mshtmled.dll —–c 477696 bytes [05:23 16/10/2008] [16:57 23/06/2008] 30AE3AB45873B35DB7D8FEDBE1525389 C:\WINDOWS\ie7updates\KB958215-IE7\mshtml.dll —–c 3593216 bytes [08:46 11/12/2008] [08:24 27/08/2008] 1AD035E04A7068EC2820B055A3131ED8 C:\WINDOWS\ie7updates\KB958215-IE7\mshtmled.dll —–c 477696 bytes [08:46 11/12/2008] [07:24 26/08/2008] 01DB3FB4A32EA7A1B7184F9550CED8E5 C:\WINDOWS\ie7updates\KB960714-IE7\mshtml.dll —–c 3593216 bytes [22:22 17/12/2008] [02:08 17/10/2008] EACAEDEF6FA2A969DE5B36190D45396F C:\WINDOWS\ie7updates\KB961260-IE7\mshtml.dll —–c 3593216 bytes [06:36 12/02/2009] [06:40 13/12/2008] 121EC39A64D64205A88C2C45B034B455 C:\WINDOWS\ie7updates\KB961260-IE7\mshtmled.dll —–c 477696 bytes [06:36 12/02/2009] [20:38 16/10/2008] F9CCDEBD2C487BC2438680D7C9AE4C76 C:\WINDOWS\ie7updates\KB963027-IE7\mshtml.dll —–c 3594752 bytes [07:28 18/04/2009] [21:35 16/01/2009] 3B413267DA8AE71C20E5EF3E54F74728 C:\WINDOWS\ie7updates\KB963027-IE7\mshtmled.dll —–c 477696 bytes [07:28 18/04/2009] [23:15 20/12/2008] 8AB0C832F7DD5A8767A96D4938F28242 C:\WINDOWS\ie7updates\KB969897-IE7\mshtml.dll —–c 3595264 bytes [06:00 12/06/2009] [18:09 20/02/2009] C7C3E41CC2F6EB4A629FE2184136C098 C:\WINDOWS\ie7updates\KB969897-IE7\mshtmled.dll —–c 477696 bytes [06:00 12/06/2009] [18:09 20/02/2009] BC48AC41E851C5418E829ECCB81D35B1 C:\WINDOWS\ie7updates\KB972260-IE7\mshtml.dll —–c 3596288 bytes [05:49 30/07/2009] [04:56 29/04/2009] 2B4315EC9E3124408A2A5074C4B97700 C:\WINDOWS\ie7updates\KB972260-IE7\mshtmled.dll —–c 477696 bytes [05:49 30/07/2009] [04:56 29/04/2009] B00289378E76D322CDE32BDB28032FD5 C:\WINDOWS\ServicePackFiles\i386\mshtml.dll —–c 3066880 bytes [19:56 04/09/2008] [00:11 14/04/2008] A706E122B398FE1AB85CB9B75D044223 C:\WINDOWS\ServicePackFiles\i386\mshtml.tlb —–c 1351168 bytes [19:56 04/09/2008] [16:26 13/04/2008] 229E7CC39192FAC170AEC20208A3F3FF C:\WINDOWS\ServicePackFiles\i386\mshtmled.dll —–c 449024 bytes [19:56 04/09/2008] [00:11 14/04/2008] 2BE3DDEF0F6C854D48AC60F3B073617B C:\WINDOWS\ServicePackFiles\i386\mshtmler.dll —–c 56832 bytes [19:56 04/09/2008] [16:26 13/04/2008] 0933CE6880A3651EF99CF1725134BCA5 C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3GDR\mshtml.dll –a— 3597824 bytes [18:03 19/07/2009] [18:03 19/07/2009] 758C8BEDAB7CE5F9070C85E2E57CBD80 C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3GDR\mshtmled.dll –a— 477696 bytes [17:23 28/08/2009] [16:12 29/06/2009] 7185033C5ACED3A55F8991E700F87D84 C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3QFE\mshtml.dll –a— 3600384 bytes [17:23 28/08/2009] [13:31 19/07/2009] F6098CC1B1C3858D53F20F3CB5774F3B C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3QFE\mshtmled.dll –a— 477696 bytes [17:23 28/08/2009] [16:23 29/06/2009] 9A66A468A761CCDE0D4E31A1194C2EAF C:\WINDOWS\SoftwareDistribution\Download\8aff2c132bea63255d1cab83ef37c507\SP3GDR\mshtml.dll –a— 5937152 bytes [13:14 21/08/2009] [13:18 19/07/2009] 5A32B43A48D6DCA339BF24105D9A028F C:\WINDOWS\SoftwareDistribution\Download\8aff2c132bea63255d1cab83ef37c507\SP3QFE\mshtml.dll –a— 5938176 bytes [13:14 21/08/2009] [13:17 19/07/2009] F25D866DD486AD30E05E5596CB363C3E C:\WINDOWS\system32\dllcache\cache\mshtml.dll –a— 5937152 bytes [18:21 26/08/2009] [03:41 08/03/2009] D469A0EBA2EF5C6BEE8065B7E3196E5E C:\WINDOWS\system32\dllcache\mshtml.dll –a— 5937152 bytes [02:27 13/09/2006] [03:41 08/03/2009] D469A0EBA2EF5C6BEE8065B7E3196E5E C:\WINDOWS\system32\dllcache\mshtml.tlb –a— 1638912 bytes [11:19 17/10/2006] [03:31 08/03/2009] 29DE97770503ACBD60392A9DBF6A7894 C:\WINDOWS\system32\dllcache\mshtmled.dll –a— 66560 bytes [02:27 13/09/2006] [03:31 08/03/2009] 7C9AAF547A0AF93C3F1BB7DC3AED4ECC C:\WINDOWS\system32\dllcache\mshtmler.dll –a— 48128 bytes [09:18 16/08/2005] [03:31 08/03/2009] EA817DC2C977376369547295B7212C43 C:\WINDOWS\system32\en-US\mshtml.dll.mui –a— 12288 bytes [11:56 17/10/2006] [13:22 08/03/2009] 7C3765AB98610490A28C1A7478F6B2B1 C:\WINDOWS\system32\en-US\mshtmled.dll.mui —–c 3584 bytes [11:56 17/10/2006] [11:56 17/10/2006] F3945B30887670ECEB1312E63CC03D62 C:\WINDOWS\system32\en-US\mshtmler.dll.mui –a— 57344 bytes [11:28 17/10/2006] [13:21 08/03/2009] E0EBBE5A70C79351F95633E1BEBDD8F2 C:\WINDOWS\system32\mshtml.dll —— 5937152 bytes [09:18 16/08/2005] [03:41 08/03/2009] D469A0EBA2EF5C6BEE8065B7E3196E5E C:\WINDOWS\system32\mshtml.tlb –a— 1638912 bytes [09:18 16/08/2005] [03:31 08/03/2009] 29DE97770503ACBD60392A9DBF6A7894 C:\WINDOWS\system32\mshtmled.dll –a— 66560 bytes [09:18 16/08/2005] [03:31 08/03/2009] 7C9AAF547A0AF93C3F1BB7DC3AED4ECC C:\WINDOWS\system32\mshtmler.dll –a— 48128 bytes [09:18 16/08/2005] [03:31 08/03/2009] EA817DC2C977376369547295B7212C43 Searching for "*msrating*" C:\i386\msrating.dll –a–c 146432 bytes [23:53 22/09/2006] [05:25 10/05/2006] 5D89E5E9C8B585DE90A60683F991FDBC C:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [09:08 25/04/2007] [09:08 25/04/2007] AFF11C5F5091193658C7A2F52E298669 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [14:40 27/06/2007] [14:40 27/06/2007] 14DDA52714DEB1F6533072C92277B8C9 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [10:02 20/08/2007] [10:02 20/08/2007] 331588903B58FBFA6BDEF4546E15CBB0 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [23:47 10/10/2007] [23:47 10/10/2007] 7BB30AC597F22FCA300000B263FBD5EB C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [02:01 07/12/2007] [02:01 07/12/2007] 823312067B8E737ED25286782137829B C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [06:03 09/04/2008] [13:03 01/03/2008] 0F13259B42C556A1C9A91CE0685CC434 C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [20:45 24/06/2008] [03:35 23/04/2008] 5D0601189869D5979C5F9676751283D5 C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [17:40 13/08/2008] [16:01 23/06/2008] 53CC40CF252EE5AADFCECB7763405065 C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [09:08 26/08/2008] [09:08 26/08/2008] 4ABB7335478E6C3A10B67AFACC11EA7E C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [22:14 10/12/2008] [20:24 16/10/2008] 0F064A4C1C7E639755943D74F764A6F3 C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE\msrating.dll –a–c 193024 bytes [06:33 11/02/2009] [23:55 20/12/2008] 7D702F0DA0B6163415906635458D93AE C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\msrating.dll –a— 193024 bytes [18:09 20/02/2009] [18:09 20/02/2009] A92B7D5F7D1650F7D2B640FC6FF7588D C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\msrating.dll –a— 193024 bytes [04:49 29/04/2009] [04:49 29/04/2009] A224A135CA428F6A9170B12A2B260E61 C:\WINDOWS\$hf_mig$\KB972260-IE7\SP3QFE\msrating.dll –a— 193024 bytes [16:23 29/06/2009] [16:23 29/06/2009] D8EBCC836444F59C4EACE2652C155231 C:\WINDOWS\$NtUninstallKB918899$\msrating.dll —–c 146432 bytes [16:12 23/09/2006] [05:25 10/05/2006] 5D89E5E9C8B585DE90A60683F991FDBC C:\WINDOWS\$NtUninstallKB922760$\msrating.dll —–c 146432 bytes [12:54 17/11/2006] [11:25 23/06/2006] 3F2E554D595DAA275A54E4B00F689698 C:\WINDOWS\$NtUninstallKB925454$\msrating.dll —–c 146432 bytes [02:15 15/12/2006] [08:31 14/09/2006] 57DE14ADE6516E4F1E58816DF1281013 C:\WINDOWS\$NtUninstallKB928090$\msrating.dll —–c 146432 bytes [12:32 20/02/2007] [15:34 23/10/2006] 6C8B5C547C8BD32AB6B8307391503628 C:\WINDOWS\$NtUninstallKB931768$\msrating.dll —–c 146432 bytes [10:51 10/05/2007] [14:05 04/01/2007] 429922FDD01F6D0045CE584ED6ED0D62 C:\WINDOWS\$NtUninstallKB933566$\msrating.dll —–c 146432 bytes [05:58 14/06/2007] [09:52 20/02/2007] C13E69FC973611DFC09791AC78D239CF C:\WINDOWS\ie7updates\KB933566-IE7\msrating.dll —–c 192000 bytes [22:07 09/08/2007] [12:05 17/10/2006] 9F304DB8AFCE702E60C421F52FF11A39 C:\WINDOWS\ie7updates\KB937143-IE7\msrating.dll —–c 193024 bytes [06:00 16/08/2007] [08:41 25/04/2007] 1BB2FB7256E0538F4DB2A227BBDAC20A C:\WINDOWS\ie7updates\KB939653-IE7\msrating.dll —–c 193024 bytes [02:05 11/10/2007] [14:34 27/06/2007] 97A5162F8EA1D688186CE9810FC29633 C:\WINDOWS\ie7updates\KB942615-IE7\msrating.dll —–c 193024 bytes [20:49 12/12/2007] [10:04 20/08/2007] D32D1080F9189E3BD32CE7E4E9A2F614 C:\WINDOWS\ie7updates\KB944533-IE7\msrating.dll —–c 193024 bytes [06:43 14/02/2008] [23:55 10/10/2007] 200AE001B46148FFB37F0A2C12A9AD39 C:\WINDOWS\ie7updates\KB947864-IE7\msrating.dll —–c 193024 bytes [06:03 10/04/2008] [02:21 07/12/2007] E2E453568DEBEDB7DCCC992287DC1213 C:\WINDOWS\ie7updates\KB950759-IE7\msrating.dll —–c 193024 bytes [05:49 25/06/2008] [13:06 01/03/2008] 1E2EB98E4380F50FCA87C763B1DA7CE2 C:\WINDOWS\ie7updates\KB953838-IE7\msrating.dll —–c 193024 bytes [05:54 14/08/2008] [04:16 23/04/2008] 8CE5B6B6DF73F325CEC3A39DE121401C C:\WINDOWS\ie7updates\KB956390-IE7\msrating.dll —–c 193024 bytes [05:23 16/10/2008] [16:57 23/06/2008] 8F769FFA3A27AAACC932380413EAEA8E C:\WINDOWS\ie7updates\KB958215-IE7\msrating.dll —–c 193024 bytes [08:46 11/12/2008] [07:24 26/08/2008] C93343884EC6D6CA7D410975224517C7 C:\WINDOWS\ie7updates\KB961260-IE7\msrating.dll —–c 193024 bytes [06:36 12/02/2009] [20:38 16/10/2008] 45FABFA298A0FEAAD2E1FE43E5CDCFE7 C:\WINDOWS\ie7updates\KB963027-IE7\msrating.dll —–c 193024 bytes [07:28 18/04/2009] [23:15 20/12/2008] D144D4F78A8C31175147A3B025BD1A1C C:\WINDOWS\ie7updates\KB969897-IE7\msrating.dll —–c 193024 bytes [06:00 12/06/2009] [18:09 20/02/2009] 3D75E050F78389FF62CD4D332AA449E8 C:\WINDOWS\ie7updates\KB972260-IE7\msrating.dll —–c 193024 bytes [05:49 30/07/2009] [04:56 29/04/2009] E7D24A7E3937DD76B64864E390B26F3A C:\WINDOWS\ServicePackFiles\i386\msrating.dll —–c 146432 bytes [19:56 04/09/2008] [00:12 14/04/2008] 3B3F666673A08571C2845F7FA3D9B9E1 C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3GDR\msrating.dll –a— 193024 bytes [17:23 28/08/2009] [16:12 29/06/2009] 498C5336FED3932C2F6B0CEA609849F3 C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3QFE\msrating.dll –a— 193024 bytes [17:23 28/08/2009] [16:23 29/06/2009] D8EBCC836444F59C4EACE2652C155231 C:\WINDOWS\system32\dllcache\msrating.dll –a— 193536 bytes [02:27 13/09/2006] [03:34 08/03/2009] 29BD913D8FD1FEB6728DC9B43B55C1D2 C:\WINDOWS\system32\en-US\msrating.dll.mui –a— 49152 bytes [12:04 17/10/2006] [13:22 08/03/2009] 5895E11854382F5DBF7DC9DA893C5D33 C:\WINDOWS\system32\msrating.dll –a— 193536 bytes [09:18 16/08/2005] [03:34 08/03/2009] 29BD913D8FD1FEB6728DC9B43B55C1D2 C:\WINDOWS\system32\msrating.dll.mui —— 49152 bytes [13:22 08/03/2009] [13:22 08/03/2009] 5895E11854382F5DBF7DC9DA893C5D33 Searching for "*occache*" C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ProcCache.sbc –a— 10584 bytes [10:40 20/09/2008] [15:10 29/08/2009] 47EA4CD37AF200163B067A87284EED2E C:\i386\occache.dll –a–c 96256 bytes [23:57 22/09/2006] [10:00 10/08/2004] CF10608051A010FA75E5668F0CC40BD6 C:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\occache.dll –a–c 102400 bytes [09:08 25/04/2007] [09:08 25/04/2007] B4644CEAC5CC6CE38DC0840E4CC10A69 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\occache.dll –a–c 102400 bytes [14:40 27/06/2007] [14:40 27/06/2007] 593C66F9DFFB4210CBB3252B00A1109A C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\occache.dll –a–c 102400 bytes [10:02 20/08/2007] [10:02 20/08/2007] AACE7CF9C353FC048C252D31F0A312EA C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\occache.dll –a–c 102912 bytes [23:47 10/10/2007] [23:47 10/10/2007] 3839A0D4995858F6363065A5DCA44835 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\occache.dll –a–c 102912 bytes [02:01 07/12/2007] [02:01 07/12/2007] A337EF2D015E4367A3C1D87B33F80E29 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\occache.dll –a–c 102912 bytes [06:03 09/04/2008] [13:03 01/03/2008] 32B265BCBAF3A3A8EA2ECC8A788E2D7B C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\occache.dll –a–c 102912 bytes [20:45 24/06/2008] [03:35 23/04/2008] 1055258930141DC0259D29D84CABC4F7 C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\occache.dll –a–c 102912 bytes [17:40 13/08/2008] [16:01 23/06/2008] C06E505A9AA5B4BF3ED517AFD56F374F C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\occache.dll –a–c 102912 bytes [09:08 26/08/2008] [09:08 26/08/2008] 82E4BAEFE8AAB11F22D9C6EA92A2354F C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE\occache.dll –a–c 102912 bytes [22:14 10/12/2008] [20:24 16/10/2008] 285ABC3DE90D29E1DDC1B4827654246C C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE\occache.dll –a–c 102912 bytes [06:33 11/02/2009] [23:55 20/12/2008] 82E1BAE0983CB4AB93A96B947319200C C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\occache.dll –a— 102912 bytes [18:09 20/02/2009] [18:09 20/02/2009] F1ADAFCDA9CDD249DA8591D6B281CA1D C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\occache.dll –a— 102912 bytes [04:49 29/04/2009] [04:49 29/04/2009] 98C97DE9134D36CE7AD35EACF177CC2A C:\WINDOWS\$hf_mig$\KB972260-IE7\SP3QFE\occache.dll –a— 102912 bytes [16:23 29/06/2009] [16:23 29/06/2009] 6216DA938D12528C3FBF7584A8836DE7 C:\WINDOWS\ie7updates\KB933566-IE7\occache.dll —–c 101376 bytes [22:07 09/08/2007] [12:04 17/10/2006] CFA30908E2A151E47A3B5854E181E88F C:\WINDOWS\ie7updates\KB937143-IE7\occache.dll —–c 102400 bytes [06:00 16/08/2007] [08:41 25/04/2007] 1A464637D8839E097E0CB4EFEF69A1B7 C:\WINDOWS\ie7updates\KB939653-IE7\occache.dll —–c 102400 bytes [02:05 11/10/2007] [14:34 27/06/2007] 21D4F0386EFE6EAA7967B7B6B743052A C:\WINDOWS\ie7updates\KB942615-IE7\occache.dll —–c 102400 bytes [20:49 12/12/2007] [10:04 20/08/2007] A9B6F82A7557F75C9DAD6EB452CAA993 C:\WINDOWS\ie7updates\KB944533-IE7\occache.dll —–c 102400 bytes [06:43 14/02/2008] [23:55 10/10/2007] BFB113A5029E07C7307817A98835806D C:\WINDOWS\ie7updates\KB947864-IE7\occache.dll —–c 102912 bytes [06:03 10/04/2008] [02:21 07/12/2007] F43DB3C92A1389F52B201D46C88FF5AC C:\WINDOWS\ie7updates\KB950759-IE7\occache.dll —–c 102912 bytes [05:49 25/06/2008] [13:06 01/03/2008] 5814F64F7DAEFE133A8F84EAE5A988E2 C:\WINDOWS\ie7updates\KB953838-IE7\occache.dll —–c 102912 bytes [05:54 14/08/2008] [04:16 23/04/2008] 36538F76CDD29D4979FF3ED2B11AC146 C:\WINDOWS\ie7updates\KB956390-IE7\occache.dll —–c 102912 bytes [05:23 16/10/2008] [16:57 23/06/2008] A67FD7F3FAF9583C112F5BDFA7FC438B C:\WINDOWS\ie7updates\KB958215-IE7\occache.dll —–c 102912 bytes [08:46 11/12/2008] [07:24 26/08/2008] 6B72C87D621E81282A2B4B2FF5A92109 C:\WINDOWS\ie7updates\KB961260-IE7\occache.dll —–c 102912 bytes [06:36 12/02/2009] [20:38 16/10/2008] 23156D036142AF46A17700DFD2EC028B C:\WINDOWS\ie7updates\KB963027-IE7\occache.dll —–c 102912 bytes [07:28 18/04/2009] [23:15 20/12/2008] A716DCCF51AF07439849DF33569929D7 C:\WINDOWS\ie7updates\KB969897-IE7\occache.dll —–c 102912 bytes [06:00 12/06/2009] [18:09 20/02/2009] 195CAD2CB489BC086FDE75E1EA7B597B C:\WINDOWS\ie7updates\KB972260-IE7\occache.dll —–c 102912 bytes [05:49 30/07/2009] [04:56 29/04/2009] 46D8F29E5A80626CA7CF30898940C729 C:\WINDOWS\ServicePackFiles\i386\occache.dll —–c 96256 bytes [19:56 04/09/2008] [00:12 14/04/2008] F546151B89BC6925067802A9116D5764 C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3GDR\occache.dll –a— 102912 bytes [17:23 28/08/2009] [16:12 29/06/2009] 5AC2777AC8EB01E829C1A1FEEC09D74D C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3QFE\occache.dll –a— 102912 bytes [17:23 28/08/2009] [16:23 29/06/2009] 6216DA938D12528C3FBF7584A8836DE7 C:\WINDOWS\SoftwareDistribution\Download\8aff2c132bea63255d1cab83ef37c507\SP3GDR\occache.dll –a— 206848 bytes [13:14 21/08/2009] [17:09 03/07/2009] 504D2C8277B9A9BEECA779460D5E647D C:\WINDOWS\SoftwareDistribution\Download\8aff2c132bea63255d1cab83ef37c507\SP3QFE\occache.dll –a— 206848 bytes [13:14 21/08/2009] [17:06 03/07/2009] 049C50FE1687EC1BE0679B02D783DCFC C:\WINDOWS\system32\dllcache\occache.dll –a— 109568 bytes [12:04 17/10/2006] [03:34 08/03/2009] 9DA08300F5D41783E69452AE77AA76A1 C:\WINDOWS\system32\en-US\occache.dll.mui –a— 20480 bytes [12:04 17/10/2006] [13:21 08/03/2009] 5744F49B8F7C38852961495BA5A1438C C:\WINDOWS\system32\occache.dll –a— 109568 bytes [09:18 16/08/2005] [03:34 08/03/2009] 9DA08300F5D41783E69452AE77AA76A1 Searching for "*pngfilt*" C:\i386\pngfilt.dll –a–c 39424 bytes [23:53 22/09/2006] [05:25 10/05/2006] 8DC12DA44BF31F8A3D9D8FC90AC0EE43 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\pngfilt.dll –a–c 44544 bytes [05:57 11/01/2008] [05:57 11/01/2008] 8FECCE762CA573D58978E2CA4A39057A C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\pngfilt.dll –a–c 44544 bytes [06:03 09/04/2008] [13:03 01/03/2008] B07EB6BC71CF729E4CB63FA043DB6F02 C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\pngfilt.dll –a–c 44544 bytes [20:45 24/06/2008] [03:35 23/04/2008] E82EE6FE2737097A2719EAE8AD3CD841 C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\pngfilt.dll –a–c 44544 bytes [17:40 13/08/2008] [16:01 23/06/2008] 56C4307C85D1680F6E58D725DB04D6B7 C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\pngfilt.dll –a–c 44544 bytes [09:08 26/08/2008] [09:08 26/08/2008] 8BF38C3F99B0BD8004D9E6BE5ADE4B33 C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE\pngfilt.dll –a–c 44544 bytes [22:14 10/12/2008] [20:24 16/10/2008] 2985466E9D5699AB15FB0446D2B5FDCB C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE\pngfilt.dll –a–c 44544 bytes [06:33 11/02/2009] [23:55 20/12/2008] 707B49BD067B905E391034C41DCA6C9E C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\pngfilt.dll –a— 44544 bytes [18:09 20/02/2009] [18:09 20/02/2009] 243D650E71606E4074DE1BD2C98F607C C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\pngfilt.dll –a— 44544 bytes [04:49 29/04/2009] [04:49 29/04/2009] 76F192828F2873501E6F49B100AF83D0 C:\WINDOWS\$hf_mig$\KB972260-IE7\SP3QFE\pngfilt.dll –a— 44544 bytes [16:23 29/06/2009] [16:23 29/06/2009] 628928490D86186CB5D03B2B9FD55CB2 C:\WINDOWS\$NtUninstallKB918899$\pngfilt.dll —–c 39424 bytes [16:12 23/09/2006] [05:25 10/05/2006] 8DC12DA44BF31F8A3D9D8FC90AC0EE43 C:\WINDOWS\$NtUninstallKB922760$\pngfilt.dll —–c 39424 bytes [12:54 17/11/2006] [11:25 23/06/2006] 29F9B55E3A6F02575432CE3909FC921C C:\WINDOWS\$NtUninstallKB925454$\pngfilt.dll —–c 39424 bytes [02:15 15/12/2006] [08:31 14/09/2006] 1E0003F5B7C77EA5987CDB94712A3FE3 C:\WINDOWS\$NtUninstallKB928090$\pngfilt.dll —–c 39424 bytes [12:32 20/02/2007] [15:34 23/10/2006] 3F688AAC123EC48BEFB24B85BF2CE34E C:\WINDOWS\$NtUninstallKB931768$\pngfilt.dll —–c 39424 bytes [10:51 10/05/2007] [14:05 04/01/2007] 9AFC81204723088A0C5E7F1EB9DD77D7 C:\WINDOWS\$NtUninstallKB933566$\pngfilt.dll —–c 39424 bytes [05:58 14/06/2007] [09:52 20/02/2007] 28C9E8934120EF5AE823FD3DC3E00E12 C:\WINDOWS\ie7updates\KB944533-IE7\pngfilt.dll —–c 44544 bytes [06:43 14/02/2008] [11:58 17/10/2006] EBA6E877B64FDF40F65256F29A103A69 C:\WINDOWS\ie7updates\KB947864-IE7\pngfilt.dll —–c 44544 bytes [06:03 10/04/2008] [05:53 11/01/2008] 7965FCECDBBA805ED03E1B37C570733F C:\WINDOWS\ie7updates\KB950759-IE7\pngfilt.dll —–c 44544 bytes [05:49 25/06/2008] [13:06 01/03/2008] C7FF7E4DF9795E03B4A01550C33D561E C:\WINDOWS\ie7updates\KB953838-IE7\pngfilt.dll —–c 44544 bytes [05:54 14/08/2008] [04:16 23/04/2008] C009D532D96765C46E60502C66CE400C C:\WINDOWS\ie7updates\KB956390-IE7\pngfilt.dll —–c 44544 bytes [05:23 16/10/2008] [16:57 23/06/2008] 3A53C7717F82ABED1756A69B824CB32B C:\WINDOWS\ie7updates\KB958215-IE7\pngfilt.dll —–c 44544 bytes [08:46 11/12/2008] [07:24 26/08/2008] 79D8C2AF348871493B4A00813323886A C:\WINDOWS\ie7updates\KB961260-IE7\pngfilt.dll —–c 44544 bytes [06:36 12/02/2009] [20:38 16/10/2008] B0F994795297BA5EA38A488EDFF63DFD C:\WINDOWS\ie7updates\KB963027-IE7\pngfilt.dll —–c 44544 bytes [07:28 18/04/2009] [23:15 20/12/2008] 07F01C898F58F4D7C91E3738F443A070 C:\WINDOWS\ie7updates\KB969897-IE7\pngfilt.dll —–c 44544 bytes [06:00 12/06/2009] [18:09 20/02/2009] 776DFD28F737B73FC3E599F82B62CAE5 C:\WINDOWS\ie7updates\KB972260-IE7\pngfilt.dll —–c 44544 bytes [05:49 30/07/2009] [04:56 29/04/2009] F190D43AF44A80FC531F0614B29CB303 C:\WINDOWS\ServicePackFiles\i386\pngfilt.dll —–c 39424 bytes [19:56 04/09/2008] [00:12 14/04/2008] C230562517FEE2FC4B472CD9B84E5BCB C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3GDR\pngfilt.dll –a— 44544 bytes [17:23 28/08/2009] [16:12 29/06/2009] D4C1FFB27076F4D1792FD431BB734B30 C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3QFE\pngfilt.dll –a— 44544 bytes [17:23 28/08/2009] [16:23 29/06/2009] 628928490D86186CB5D03B2B9FD55CB2 C:\WINDOWS\system32\dllcache\pngfilt.dll –a— 46592 bytes [02:27 13/09/2006] [03:31 08/03/2009] E5FA1B044DAC5F6F600A1742D73F6936 C:\WINDOWS\system32\pngfilt.dll –a— 46592 bytes [09:18 16/08/2005] [03:31 08/03/2009] E5FA1B044DAC5F6F600A1742D73F6936 Searching for "*webcheck*" C:\i386\webcheck.dll –a–c 276480 bytes [00:00 23/09/2006] [10:00 10/08/2004] 6501DB5182D5A8C0F1F1707286161D66 C:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\webcheck.dll –a–c 232960 bytes [09:08 25/04/2007] [09:08 25/04/2007] 969B9F9435859FFA32D05D9CAAF9B1AF C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\webcheck.dll –a–c 232960 bytes [14:40 27/06/2007] [14:40 27/06/2007] B72024C12DBD31A38B4B4F961E1F2B4D C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\webcheck.dll –a–c 232960 bytes [10:02 20/08/2007] [10:02 20/08/2007] AEF317DE525086A207E255BBAB633029 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\webcheck.dll –a–c 233472 bytes [23:47 10/10/2007] [23:47 10/10/2007] AC053BFB899B4F284B349BF109F784F5 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\webcheck.dll –a–c 233472 bytes [02:01 07/12/2007] [02:01 07/12/2007] 881601B67D2F6C48D3F9E1397F8903D2 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\webcheck.dll –a–c 233472 bytes [06:03 09/04/2008] [13:03 01/03/2008] 4DFBBE80E8309E72885173A4DDF725A6 C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\webcheck.dll –a–c 233472 bytes [20:45 24/06/2008] [03:35 23/04/2008] 51F08C61AD0312A84FA5696937D49B62 C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\webcheck.dll –a–c 233472 bytes [17:40 13/08/2008] [16:01 23/06/2008] 1BA9C844B7BC1BEA00DF2B528608223C C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\webcheck.dll –a–c 233472 bytes [09:08 26/08/2008] [09:08 26/08/2008] 0B49C8AE42BDFC0710ACB20F820EE97C C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE\webcheck.dll –a–c 233472 bytes [22:14 10/12/2008] [20:24 16/10/2008] 28A3427D1A3CD285FA964769D6532694 C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE\webcheck.dll –a–c 233472 bytes [06:33 11/02/2009] [23:55 20/12/2008] DCDC718BCA5C9CAE985CEDE8778362CB C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\webcheck.dll –a— 233472 bytes [18:09 20/02/2009] [18:09 20/02/2009] E783AADC2615E00ED20E8EF7D0F77073 C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\webcheck.dll –a— 233472 bytes [04:49 29/04/2009] [04:49 29/04/2009] 61D5B58B7BBF40CD12B4D23E46B6D22F C:\WINDOWS\$hf_mig$\KB972260-IE7\SP3QFE\webcheck.dll –a— 233472 bytes [16:23 29/06/2009] [16:23 29/06/2009] 11B07FE3958BBFF9CF85D7DF5E12D60F C:\WINDOWS\ie7updates\KB933566-IE7\webcheck.dll —–c 231424 bytes [22:07 09/08/2007] [14:09 27/10/2006] D7256CE18090BE360F7AFAEB3F41836D C:\WINDOWS\ie7updates\KB937143-IE7\webcheck.dll —–c 232960 bytes [06:00 16/08/2007] [08:41 25/04/2007] BDAB069DED8C5846FB9A78525CDAC7B2 C:\WINDOWS\ie7updates\KB939653-IE7\webcheck.dll —–c 232960 bytes [02:05 11/10/2007] [14:34 27/06/2007] 8EDFA38859D8841852239AC92FBDCED2 C:\WINDOWS\ie7updates\KB942615-IE7\webcheck.dll —–c 232960 bytes [20:49 12/12/2007] [10:04 20/08/2007] 5413D21D50DD7BF07AC7A3AAC6AB0C73 C:\WINDOWS\ie7updates\KB944533-IE7\webcheck.dll —–c 232960 bytes [06:43 14/02/2008] [23:56 10/10/2007] 513FC3EB51B70D65B52860C7A0CCDE61 C:\WINDOWS\ie7updates\KB947864-IE7\webcheck.dll —–c 233472 bytes [06:03 10/04/2008] [02:21 07/12/2007] 992ED6DC1DECA739822C28EAFDE92CA4 C:\WINDOWS\ie7updates\KB950759-IE7\webcheck.dll —–c 233472 bytes [05:49 25/06/2008] [13:06 01/03/2008] F8412FB61B2B81E73774DA4CEFDEBC45 C:\WINDOWS\ie7updates\KB953838-IE7\webcheck.dll —–c 233472 bytes [05:54 14/08/2008] [04:16 23/04/2008] 963362C552A52BF5A9885E8F68703C07 C:\WINDOWS\ie7updates\KB956390-IE7\webcheck.dll —–c 233472 bytes [05:23 16/10/2008] [16:57 23/06/2008] A957A1F45374C4499029527599F3948D C:\WINDOWS\ie7updates\KB958215-IE7\webcheck.dll —–c 233472 bytes [08:46 11/12/2008] [07:24 26/08/2008] 34A0E365ACA457F7938892122D2B2ED1 C:\WINDOWS\ie7updates\KB961260-IE7\webcheck.dll —–c 233472 bytes [06:36 12/02/2009] [20:38 16/10/2008] D0A015B71925EA131FA60D15648B9806 C:\WINDOWS\ie7updates\KB963027-IE7\webcheck.dll —–c 233472 bytes [07:28 18/04/2009] [23:15 20/12/2008] 52EFDAB456EE729D039A683AFD11106C C:\WINDOWS\ie7updates\KB969897-IE7\webcheck.dll —–c 233472 bytes [06:00 12/06/2009] [18:09 20/02/2009] 0517333FF78DAF51C3C9181418B6B827 C:\WINDOWS\ie7updates\KB972260-IE7\webcheck.dll —–c 233472 bytes [05:49 30/07/2009] [04:56 29/04/2009] 15A5A2FA2AE4BAD85D0D5C2741AF1090 C:\WINDOWS\ServicePackFiles\i386\webcheck.dll —–c 276480 bytes [19:57 04/09/2008] [00:12 14/04/2008] E535E0A413655208D7180154150881C6 C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3GDR\webcheck.dll –a— 233472 bytes [17:23 28/08/2009] [16:12 29/06/2009] D9FDA81B45AE8063639B7144B6C4A5B1 C:\WINDOWS\SoftwareDistribution\Download\33ec000c08e174dc768520b0fd388192\SP3QFE\webcheck.dll –a— 233472 bytes [17:23 28/08/2009] [16:23 29/06/2009] 11B07FE3958BBFF9CF85D7DF5E12D60F C:\WINDOWS\system32\dllcache\webcheck.dll –a— 236544 bytes [14:09 27/10/2006] [03:34 08/03/2009] CC8915DB4E33E8FB29CA0D2DBF75306E C:\WINDOWS\system32\en-US\webcheck.dll.mui –a— 40960 bytes [12:04 17/10/2006] [13:22 08/03/2009] 2F92A6981E51593FA06DD98F87250CA7 C:\WINDOWS\system32\webcheck.dll –a— 236544 bytes [09:18 16/08/2005] [03:34 08/03/2009] CC8915DB4E33E8FB29CA0D2DBF75306E Searching for "*shdocvw*" C:\i386\shdocvw.bak –a–c 1496576 bytes [23:58 22/09/2006] [15:32 29/05/2006] 27A59B0A529850EC746293E6753D4C5C C:\i386\shdocvw.dll –a–c 1496576 bytes [23:53 22/09/2006] [15:32 29/05/2006] 27A59B0A529850EC746293E6753D4C5C C:\WINDOWS\$NtServicePackUninstall$\shdocvw.dll —–c 1498112 bytes [10:55 09/11/2008] [12:46 18/04/2007] 62137AD7EBB6C3AE9C23D2700FA3ABAC C:\WINDOWS\$NtUninstallKB918899$\shdocvw.dll —–c 1496576 bytes [16:12 23/09/2006] [15:32 29/05/2006] 27A59B0A529850EC746293E6753D4C5C C:\WINDOWS\$NtUninstallKB924496$\shdocvw.dll —–c 1497088 bytes [13:36 15/10/2006] [11:25 23/06/2006] 6D285A0C3AD4FB2A14E283CA2BC4F6B1 C:\WINDOWS\$NtUninstallKB925454$\shdocvw.dll —–c 1497088 bytes [02:15 15/12/2006] [06:12 04/09/2006] 559B2D22A1EE947A7EAED530C7FF9320 C:\WINDOWS\$NtUninstallKB928090$\shdocvw.dll —–c 1497600 bytes [12:32 20/02/2007] [15:34 23/10/2006] CFEF31ED1AEC7CE1F0D7B781441D864F C:\WINDOWS\$NtUninstallKB931768$\shdocvw.dll —–c 1498112 bytes [10:51 10/05/2007] [14:05 04/01/2007] 2039074B74116904FD2D46110C1DFE8B C:\WINDOWS\$NtUninstallKB933566$\shdocvw.dll —–c 1498112 bytes [05:58 14/06/2007] [09:52 20/02/2007] C3A912CBB1E5EBAAA2C630B25BBEDA8A C:\WINDOWS\ServicePackFiles\i386\shdocvw.dll —–c 1499136 bytes [19:56 04/09/2008] [00:12 14/04/2008] 26CB10FA893F940AB09713FF46DCDADE C:\WINDOWS\system32\dllcache\shdocvw.dll —— 1497088 bytes [17:20 07/01/2009] [17:20 07/01/2009] 559B2D22A1EE947A7EAED530C7FF9320 C:\WINDOWS\system32\shdocvw.bak –a–c 1496576 bytes [02:35 13/09/2006] [15:32 29/05/2006] 27A59B0A529850EC746293E6753D4C5C C:\WINDOWS\system32\shdocvw.dll –a— 1499136 bytes [09:18 16/08/2005] [00:12 14/04/2008] 26CB10FA893F940AB09713FF46DCDADE -=End Of File=-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] .exe's no longer work - suspected Trojan

✨ Ask AI

Ask AI