[Closed] Web Download Slow

Thanks for the welcome Paws It's awfully late now, so I will try again tomorrow. Now I'm downloading ERUNT. If this helps I'll add this to this post RootRepeal, DDS and attach the other file zipped: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/31 01:46 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_iaStor.sys Image Path: C:\WINDOWS\System32\Drivers\dump_iaStor.sys Address: 0xBA8B2000 Size: 876544 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xF7507000 Size: 49152 File Visible: No Signed: - Status: - SSDT ——————- #: 041 Function Name: NtCreateKey Status: Hooked by "PCTCore.sys" at address 0xf7465514 #: 047 Function Name: NtCreateProcess Status: Hooked by "PCTCore.sys" at address 0xf7454282 #: 048 Function Name: NtCreateProcessEx Status: Hooked by "PCTCore.sys" at address 0xf7454474 #: 063 Function Name: NtDeleteKey Status: Hooked by "PCTCore.sys" at address 0xf7465d00 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "PCTCore.sys" at address 0xf7465fb8 #: 119 Function Name: NtOpenKey Status: Hooked by "PCTCore.sys" at address 0xf74643fa #: 192 Function Name: NtRenameKey Status: Hooked by "PCTCore.sys" at address 0xf7466422 #: 247 Function Name: NtSetValueKey Status: Hooked by "PCTCore.sys" at address 0xf74657d8 #: 257 Function Name: NtTerminateProcess Status: Hooked by "PCTCore.sys" at address 0xf7453f32 ==EOF== DDS (Ver_09-07-30.01) - NTFSx86 NETWORK Run by [removed] at 1:11:44.65 on 2009/08/31 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Home Edition 5.1.2600.3.932.81.1041.18.2046.1570 [GMT 9:00] AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\conime.exe C:\WINDOWS\explorer.exe D:\FireFox\firefox.exe C:\Documents and Settings\Administrator.CORNWELL.000\My Documents\Downloads\dds.pif C:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll BHO: {DA3D342F-FF20-4E31-9E82-22334155730C} - No File BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll TB: {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - No File TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll TB: Veoh Video Compass: {52836eb0-631a-47b1-94a6-61f9d9112dae} - c:\program files\veoh networks\veoh video compass\SearchRecsPlugin.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll TB: &Windows; Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll EB: &Yahoo;! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\progra~1\yahoo!\common\yhexbmesca.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10b.exe mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min dRun: [ctfmon.exe] ctfmon.exe dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t StartupFolder: c:\documents and settings\administrator.cornwell.000\ベタート メニュー\プロバラム\ベタートヂップ\E-Flyer.lnk.disabled StartupFolder: c:\documents and settings\administrator.cornwell.000\ベタート メニュー\プロバラム\ベタートヂップ\VAIOランチャー.lnk.disabled StartupFolder: c:\docume~1\alluse~1\ベター~1\プロバ~1\ベター~1\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\ベター~1\プロバ~1\ベター~1\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\ベター~1\プロバ~1\ベター~1\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe StartupFolder: c:\docume~1\alluse~1\ベター~1\プロバ~1\ベター~1\stimon.lnk - c:\program files\ucam-e130 series\STIMon.exe StartupFolder: c:\documents and settings\all users\ベタート メニュー\プロバラム\ベタートヂップ\VAIO Action Setup (サーバー).lnk.disabled StartupFolder: c:\documents and settings\all users\ベタート メニュー\プロバラム\ベタートヂップ\録画状態通知.lnk.disabled IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim95\aim.exe IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\heath\ベタート メニュー\プロバラム\imvu\Run IMVU.lnk IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - {4C171D40-8277-11D5-AD55-00010333D0AD} - c:\progra~1\yahoo!\common\yhexbmesca.dll IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll DPF: {4C68DACE-E6BC-4650-9C7E-D036720CA729} - hxxp://kr.gameguard.nprotect.com/inca/onscan//tyscan/nps.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} - hxxp://www.acclaim.com/cabs/acclaim_v6.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177475483250 DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} - hxxp://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} - hxxp://cdn1.acclaimdownloads.com/solidstateion.cab DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: igfxcui - igfxdev.dll Notify: VESWinlogon - VESWinlogon.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1.000\applic~1\mozilla\firefox\profiles\v1iyug3n.default\ FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll —- FIREFOX POLICIES —- d:\firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); d:\firefox\greprefs\all.js - pref("media.cache_size", 51200); d:\firefox\greprefs\all.js - pref("media.ogg.enabled", true); d:\firefox\greprefs\all.js - pref("media.wave.enabled", true); d:\firefox\greprefs\all.js - pref("media.autoplay.enabled", true); d:\firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); d:\firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); d:\firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); d:\firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); d:\firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); d:\firefox\greprefs\all.js - pref("layout.css.dpi", -1); d:\firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); d:\firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); d:\firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); d:\firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); d:\firefox\greprefs\all.js - pref("geo.enabled", true); d:\firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); d:\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); d:\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); d:\firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); d:\firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); d:\firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); d:\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); d:\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); d:\firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); d:\firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); d:\firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); d:\firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); d:\firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); d:\firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); d:\firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); d:\firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); d:\firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); d:\firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); d:\firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-8-30 130936] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R3 Sonyddpu;Sony FeliCa Reader/Writer;c:\windows\system32\drivers\Sonyddpu.sys [2005-11-9 49664] S1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-8-25 11608] S1 TxVDrv;TxVDrv;c:\windows\system32\drivers\TxVDrv.sys [2005-12-23 21504] S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-8-25 108289] S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-8-25 185089] S2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-8-25 55656] S2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-6-21 55152] S2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlservr.exe -svaio_vedb –> c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlservr.exe -sVAIO_VEDB [?] S2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512] S2 TxVDrvSvc;TXVDrv Service;c:\program files\justsystem\personalshelter\TxVDrvSvc.exe [2005-12-23 40960] S3 DCamUSBUVT;UCAM-E130 series;c:\windows\system32\drivers\Usbsmi.sys [2007-4-26 1648128] S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360] S3 getPlus® Helper;getPlus® Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-11-8 33752] S3 IODATA_USB;I-O DATA WN-B11USBSL;c:\windows\system32\drivers\Wnbusl51.sys [2008-3-26 634368] S3 KORGUMDS;KORG USB-MIDI Driver for Windows XP;c:\windows\system32\drivers\KORGUMDS.SYS [2008-9-9 14976] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?] S3 PxDtvPci;PIX-DTTV/P1W;c:\windows\system32\drivers\pxdtvpci.sys [2005-11-10 155008] S3 sdAuxService;PC Tools Auxiliary Service;d:\contents\downloadsapps\spyware doctor\pctsAuxs.exe [2009-8-30 348752] S3 sdCoreService;PC Tools Security Service;d:\contents\downloadsapps\spyware doctor\pctsSvc.exe [2009-8-30 1097096] S3 sisa;SISA Service;c:\windows\system32\drivers\sisa.sys [2005-11-9 1538816] S3 SonyEdc;SonyEdc;c:\windows\system32\drivers\SonyEdc.sys [2005-11-9 107392] S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlagent.exe -i vaio_vedb –> c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlagent.EXE -i VAIO_VEDB [?] S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys –> c:\windows\system32\vsdatant.sys [?] S3 w31smdm;Driver for w31smdm Device;c:\windows\system32\drivers\w31smdm.sys [2006-1-23 33152] S3 w31sser;Driver for w31sser Device;c:\windows\system32\drivers\w31sser.sys [2006-1-23 30464] ============== File Associations =============== regfile="regedit.exe" "%1" =============== Created Last 30 ================ 2009-08-30 21:10 159,600 a——- c:\windows\system32\drivers\pctgntdi.sys 2009-08-30 21:10 130,936 a——- c:\windows\system32\drivers\PCTCore.sys 2009-08-30 21:10 73,840 a——- c:\windows\system32\drivers\PCTAppEvent.sys 2009-08-30 21:10 64,392 a——- c:\windows\system32\drivers\pctplsg.sys 2009-08-30 21:10 –d—– c:\program files\common files\PC Tools 2009-08-30 21:10 –d—– c:\docume~1\alluse~1\applic~1\PC Tools 2009-08-30 10:39 82,944 a——- c:\windows\system32\IEDFix.C.exe 2009-08-30 10:39 80,384 a——- c:\windows\system32\o4Patch.exe 2009-08-30 10:39 78,336 a——- c:\windows\system32\Agent.OMZ.Fix.exe 2009-08-30 10:38 289,144 a——- c:\windows\system32\VCCLSID.exe 2009-08-30 10:38 288,417 a——- c:\windows\system32\SrchSTS.exe 2009-08-30 10:38 135,168 a——- c:\windows\system32\swreg.exe 2009-08-30 10:38 87,552 a——- c:\windows\system32\VACFix.exe 2009-08-30 10:38 82,944 a——- c:\windows\system32\IEDFix.exe 2009-08-30 10:38 82,432 a——- c:\windows\system32\404Fix.exe 2009-08-30 10:38 79,360 a——- c:\windows\system32\swxcacls.exe 2009-08-30 10:38 75,776 a——- c:\windows\system32\WS2Fix.exe 2009-08-30 10:38 53,248 a——- c:\windows\system32\Process.exe 2009-08-30 10:38 51,200 a——- c:\windows\system32\dumphive.exe 2009-08-25 01:40 –d—– C:\SmitfraudFix 2009-08-25 01:04 55,656 a——- c:\windows\system32\drivers\avgntflt.sys 2009-08-25 01:04 –d—– c:\program files\Avira 2009-08-25 01:04 –d—– c:\docume~1\alluse~1\applic~1\Avira 2009-08-16 23:07 1,559,685 -c—— c:\windows\system32\dllcache\ntprint.cat 2009-08-16 22:01 –d—– c:\windows\system32\XPSViewer 2009-08-16 22:01 1,676,288 -c—— c:\windows\system32\dllcache\xpssvcs.dll 2009-08-16 22:01 597,504 -c—— c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-08-16 22:01 575,488 -c—— c:\windows\system32\dllcache\xpsshhdr.dll 2009-08-16 22:01 89,088 -c—— c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-08-16 22:01 1,676,288 ——– c:\windows\system32\xpssvcs.dll 2009-08-16 22:01 575,488 ——– c:\windows\system32\xpsshhdr.dll 2009-08-16 22:01 117,760 ——– c:\windows\system32\prntvpt.dll 2009-08-15 12:26 –d—– c:\documents and settings\administrator.cornwell.000\Tracing 2009-08-13 11:34 128,512 -c—— c:\windows\system32\dllcache\dhtmled.ocx 2009-08-13 11:33 1,315,328 -c—— c:\windows\system32\dllcache\msoe.dll ==================== Find3M ==================== 2009-08-30 23:12 4,046 a——- c:\windows\system32\tmp.reg 2009-08-16 22:04 238,184 a——- c:\windows\system32\perfh011.dat 2009-08-16 22:04 79,628 a——- c:\windows\system32\perfc011.dat 2009-08-15 10:42 8,224 ac—— c:\windows\system32\GDIPFONTCACHEV1.DAT 2009-08-05 17:59 202,752 a——- c:\windows\system32\mswebdvd.dll 2009-07-29 13:34 119,808 a——- c:\windows\system32\t2embed.dll 2009-07-29 13:34 81,920 a——- c:\windows\system32\fontsub.dll 2009-07-18 04:01 58,880 a——- c:\windows\system32\atl.dll 2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll 2009-06-30 00:56 827,392 a——- c:\windows\system32\wininet.dll 2009-06-30 00:56 78,336 a——- c:\windows\system32\ieencode.dll 2009-06-30 00:56 17,408 ——– c:\windows\system32\corpol.dll 2009-06-15 19:44 88,576 a——- c:\windows\system32\telnet.exe 2009-06-10 23:13 84,992 a——- c:\windows\system32\avifil32.dll 2009-06-10 15:14 132,096 a——- c:\windows\system32\wkssvc.dll 2009-06-10 09:19 2,066,432 a——- c:\windows\system32\mstscax.dll 2009-06-05 11:42 2,060,288 a——- c:\windows\system32\usbaaplrc.dll 2009-06-04 04:09 1,279,488 a——- c:\windows\system32\quartz.dll 2008-02-27 03:06 32 ac—— c:\docume~1\alluse~1\applic~1\ezsid.dat 2008-07-30 19:36 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008073020080731\index.dat ============= FINISH: 1:12:04.37 ===============