Trojan Took over My PC

please u can also reply by email I have Windows 7 Home Premium, Im in safe Mode right now, I was infected dont know how, my PC Tools network security software is compromised, would not let me install COMBOFIX, new boot added to C:/ DRIVE I cannot delete says I dont have proper rights, I boot up to DOS mode to try and get rid of shares and users "Command Prompt tells me server services not turned on" EXITED And booted to safe mode with internet, context menu is in japanese wont allow me to shred new boot folder I cant get rid or deny rights to new unkown users,theres a ways apparently to recieve I can see these things yet when I run my antivirus it says Im clean My Administrater rights are over denigrated by something called Hereditary rights, Creator, Home Group but these groups and users dont show up in administrator tools only when I click to add users using advanced search of users I can see the dirty bastards there are about 10 users with varying access rights I CANT GET RID OF THEM Im denied access and get this Im the only one who uses this machine,I created a user myself and logged in as that user, because when I log in as administrator the viruses get worse and worse ……………I NEED HELP Oh I would send screen shots but access is denied I used combofix and PCTools security essentials and they got rid of about 30 infections…….now things got worse I could only send 1 file as the other one was denied says I have to get administrator permission DDS (Ver_10-03-17.01) - NTFSx86 NETWORK Run by [removed] at 12:48:24.63 on Tue 07/06/2010 Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_20 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.3082.18.960.505 [GMT -7:00] ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\Explorer.EXE C:\Windows\system32\ctfmon.exe C:\Windows\helppane.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Users\Albertgonzo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\48MJA86O\dds[1].scr C:\Windows\system32\conhost.exe ============== Pseudo HJT Report =============== uStart Page = prodigy.msn.com mURLSearchHooks: H - No File BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\pc tools internet security\bdt\PCTBrowserDefender.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll BHO: TweakMASTER Component: {7daac7de-9ef0-4ff0-bfa5-aff3e899054c} - c:\progra~1\tweakm~1\TweakBHO.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools internet security\bdt\PCTBrowserDefender.dll mRun: [ATIModeChange] Ati2mdxx.exe mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin mRun: [TweakMASTER] "c:\program files\tweakmaster\TMTray.exe" mRun: [ATICustomerCare] "c:\program files\ati\aticustomercare\ATICustomerCare.exe" mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [ISTray] "c:\program files\pc tools internet security\pctsTray.exe" StartupFolder: c:\users\albert~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\sanyos~1.lnk - c:\users\albert~1\appdata\roaming\microsoft\installer\{59498f87-43f8-4a02-aae6-dd91519a9d05}\_53DB54D1AAC28DB5D10AED.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: {D028A39E-2F61-4D9C-9EE6-6A31F46CB9DA} = 208.67.222.222,208.67.220.220 TCP: {DF033FA8-51FE-4036-8F1B-E854390D1823} = 208.67.222.222,208.67.220.220 Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Notify: AtiExtEvent - Ati2evxx.dll ================= FIREFOX =================== FF - ProfilePath - c:\users\albert~1\appdata\roaming\mozilla\firefox\profiles\qktfq8ea.default\ FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157 FF - prefs.js: network.proxy.type - 0 FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-7-5 218592] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2010-7-5 233136] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128] R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [2010-7-5 58816] S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2010-7-5 51984] S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2010-7-5 59664] S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\pc tools internet security\bdt\BDTUpdateService.exe [2010-7-5 112592] S2 IsaMonitor;ISA Monitor Service;c:\program files\asistente infinitum\IsaMonitor.exe [2010-6-29 185856] S2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2010-7-5 88040] S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools internet security\pctsAuxs.exe [2010-7-5 366840] S2 sdCoreService;PC Tools Security Service;c:\program files\pc tools internet security\pctsSvc.exe [2010-7-5 1143784] S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2010-6-14 1051976] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888] S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2010-7-5 78264] S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2010-7-5 115216] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2010-7-5 63360] S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-5-28 14896] S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2010-7-5 33552] S3 ThreatFire;ThreatFire;c:\program files\pc tools internet security\tfengine\tfservice.exe service –> c:\program files\pc tools internet security\tfengine\TFService.exe service [?] S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2010-2-24 10064] S3 WatAdminSvc;Servicio de tecnologías de activación de Windows;c:\windows\system32\wat\WatAdminSvc.exe [2010-6-29 1343400] =============== Created Last 30 ================ 2010-07-06 16:53:50 0 d—–w- c:\users\albert~1\appdata\roaming\SumatraPDF 2010-07-06 16:02:19 0 d—–w- c:\program files\Sophos 2010-07-06 06:13:51 0 d—–w- c:\program files\SANYO 2010-07-06 02:06:58 0 d—–w- c:\users\albert~1\appdata\roaming\PCToolsFirewallPlus 2010-07-06 02:06:24 0 d—–w- c:\users\albert~1\appdata\roaming\Spam Monitor 2010-07-05 21:12:21 524288 –sha-w- c:\users\albertgonzo\NTUSER.DAT{4f46f599-8879-11df-bc4a-00a0d1b6f3dd}.TMContainer00000000000000000002.regtrans-ms 2010-07-05 21:12:20 524288 –sha-w- c:\users\albertgonzo\NTUSER.DAT{4f46f599-8879-11df-bc4a-00a0d1b6f3dd}.TMContainer00000000000000000001.regtrans-ms 2010-07-05 21:12:18 65536 –sha-w- c:\users\albertgonzo\NTUSER.DAT{4f46f599-8879-11df-bc4a-00a0d1b6f3dd}.TM.blf 2010-07-05 20:58:37 767952 —-a-w- c:\windows\BDTSupport.dll 2010-07-05 20:58:36 882 —-a-w- c:\windows\RegSDImport.xml 2010-07-05 20:58:36 879 —-a-w- c:\windows\RegISSImport.xml 2010-07-05 20:58:36 165840 —-a-w- c:\windows\PCTBDRes.dll 2010-07-05 20:58:36 1652688 —-a-w- c:\windows\PCTBDCore.dll 2010-07-05 20:58:36 149456 —-a-w- c:\windows\SGDetectionTool.dll 2010-07-05 20:58:36 131 —-a-w- c:\windows\IDB.zip 2010-07-05 20:58:36 1152444 —-a-w- c:\windows\UDB.zip 2010-07-05 20:57:22 88040 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2010-07-05 20:57:22 7412 —-a-w- c:\windows\system32\drivers\PCTAppEvent.cat 2010-07-05 20:57:22 7383 —-a-w- c:\windows\system32\drivers\pctcore.cat 2010-07-05 20:57:22 218592 —-a-w- c:\windows\system32\drivers\PCTCore.sys 2010-07-05 20:57:19 7387 —-a-w- c:\windows\system32\drivers\pctgntdi.cat 2010-07-05 20:57:19 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys 2010-07-05 20:57:19 100136 —-a-w- c:\windows\system32\drivers\pctwfpfilter.sys 2010-07-05 20:57:11 0 d—a-w- c:\programdata\TEMP 2010-07-05 20:57:02 59664 —-a-w- c:\windows\system32\drivers\TfSysMon.sys 2010-07-05 20:57:02 51984 —-a-w- c:\windows\system32\drivers\TfFsMon.sys 2010-07-05 20:57:02 33552 —-a-w- c:\windows\system32\drivers\TfNetMon.sys 2010-07-05 20:56:54 78264 —-a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys 2010-07-05 20:56:54 7435 —-a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.cat 2010-07-05 20:56:54 7399 —-a-w- c:\windows\system32\drivers\pctNdis-DNS.cat 2010-07-05 20:56:54 7383 —-a-w- c:\windows\system32\drivers\pctplsg.cat 2010-07-05 20:56:54 7383 —-a-w- c:\windows\system32\drivers\pctplfw.cat 2010-07-05 20:56:54 63360 —-a-w- c:\windows\system32\drivers\pctplsg.sys 2010-07-05 20:56:54 58816 —-a-w- c:\windows\system32\drivers\pctNdis.sys 2010-07-05 20:56:54 32808 —-a-w- c:\windows\system32\drivers\pctNdis-DNS.sys 2010-07-05 20:56:53 115216 —-a-w- c:\windows\system32\drivers\pctplfw.sys 2010-07-05 20:56:46 0 d—–w- c:\program files\common files\PC Tools 2010-07-05 20:56:04 0 d—–w- c:\users\albert~1\appdata\roaming\PC Tools 2010-07-05 20:56:04 0 d—–w- c:\programdata\PC Tools 2010-07-05 20:56:04 0 d—–w- c:\program files\PC Tools Internet Security 2010-07-05 20:35:02 0 d-sh–w- C:\$RECYCLE.BIN 2010-07-05 09:51:41 0 d—–w- c:\users\albert~1\appdata\roaming\TuneUp Software 2010-07-05 08:55:47 0 d—–w- c:\users\albert~1\appdata\roaming\Estsoft 2010-07-05 07:58:37 0 d—–w- c:\program files\CPUID 2010-07-05 03:41:42 0 d—–w- c:\program files\common files\ATI Technologies 2010-07-05 03:38:03 0 d—–w- c:\programdata\ATI 2010-07-04 21:39:33 970240 —-a-w- c:\windows\system32\msmpeg2adec.dll.bak 2010-07-04 21:11:33 90480 —-a-w- c:\windows\system32\drivers\meiudf.sys 2010-07-04 10:01:33 98816 —-a-w- c:\windows\sed.exe 2010-07-04 10:01:33 77312 —-a-w- c:\windows\MBR.exe 2010-07-04 10:01:33 256512 —-a-w- c:\windows\PEV.exe 2010-07-04 10:01:33 161792 —-a-w- c:\windows\SWREG.exe 2010-07-04 02:24:30 0 d—–w- c:\program files\OpenDNS Updater 2010-07-03 21:18:54 0 d—–w- c:\program files\CyberTweak 2010-07-03 19:31:43 0 d—–w- c:\programdata\Hagel Technologies 2010-07-03 19:31:04 0 d—–w- c:\program files\TweakMASTER 2010-07-03 14:35:24 0 d—–w- c:\programdata\Estsoft 2010-07-03 10:41:49 0 d—–w- c:\programdata\Adobe 2010-07-03 10:27:14 0 d—–w- c:\program files\common files\Macrovision Shared 2010-07-03 09:07:08 0 d—–w- c:\program files\ESTsoft 2010-07-03 04:02:22 0 d—–w- c:\program files\KeePass Password Safe 2 2010-07-03 03:46:42 74072 —-a-w- c:\windows\system32\XAPOFX1_5.dll 2010-07-03 03:46:42 527192 —-a-w- c:\windows\system32\XAudio2_7.dll 2010-07-03 03:46:37 239960 —-a-w- c:\windows\system32\xactengine3_7.dll 2010-07-03 03:46:33 2106216 —-a-w- c:\windows\system32\D3DCompiler_43.dll 2010-07-03 03:46:27 1868128 —-a-w- c:\windows\system32\d3dcsx_43.dll 2010-07-03 03:46:24 248672 —-a-w- c:\windows\system32\d3dx11_43.dll 2010-07-03 03:46:20 470880 —-a-w- c:\windows\system32\d3dx10_43.dll 2010-07-03 03:46:16 1998168 —-a-w- c:\windows\system32\D3DX9_43.dll 2010-07-03 03:39:27 0 d–h–w- c:\windows\msdownld.tmp 2010-07-03 03:39:21 0 d—–w- c:\windows\system32\directx 2010-07-03 03:34:26 0 d—–w- c:\program files\XBMC 2010-07-03 02:33:29 0 d—–w- c:\programdata\Sun 2010-07-03 02:31:06 411368 —-a-w- c:\windows\system32\deployJava1.dll 2010-07-03 01:57:59 118784 —-a-w- c:\windows\system32\MSSTDFMT.DLL 2010-07-03 01:57:58 253952 —-a-w- c:\windows\system32\histogram.ocx 2010-07-03 01:57:57 389120 —-a-w- c:\windows\system32\actskn43.ocx 2010-07-03 01:57:57 1435272 —-a-w- c:\windows\system32\flash8.ocx 2010-07-03 01:57:56 188416 —-a-w- c:\windows\system32\actsplash.ocx 2010-07-03 01:57:55 1081616 —-a-w- c:\windows\system32\mscomctl.ocx 2010-07-03 01:57:54 647872 —-a-w- c:\windows\system32\MSCOMCT2.OCX 2010-07-03 01:57:53 101888 —-a-w- c:\windows\system32\VB6STKIT.DLL 2010-07-03 01:57:51 344064 —-a-w- c:\windows\system32\Msvcr70.dll 2010-07-02 20:29:23 0 d—–w- c:\program files\JDownloader 2010-07-02 19:42:27 0 d—–w- c:\program files\Secunia 2010-07-02 12:33:48 0 d—–w- c:\program files\ATI 2010-07-02 12:30:22 0 d—–w- C:\ATI 2010-07-02 10:35:31 0 d—–w- c:\program files\SumatraPDF 2010-07-02 10:30:18 74072 —-a-w- c:\windows\system32\XAPOFX1_4.dll 2010-07-02 10:30:18 528216 —-a-w- c:\windows\system32\XAudio2_6.dll 2010-07-02 10:30:16 238936 —-a-w- c:\windows\system32\xactengine3_6.dll 2010-07-02 10:30:15 22360 —-a-w- c:\windows\system32\X3DAudio1_7.dll 2010-07-02 10:30:13 69464 —-a-w- c:\windows\system32\XAPOFX1_3.dll 2010-07-02 10:30:13 515416 —-a-w- c:\windows\system32\XAudio2_5.dll 2010-07-02 10:30:11 238936 —-a-w- c:\windows\system32\xactengine3_5.dll 2010-07-02 10:30:08 1974616 —-a-w- c:\windows\system32\D3DCompiler_42.dll 2010-07-02 10:30:03 5501792 —-a-w- c:\windows\system32\d3dcsx_42.dll 2010-07-02 10:30:00 235344 —-a-w- c:\windows\system32\d3dx11_42.dll 2010-07-02 10:28:59 1491992 —-a-w- c:\windows\system32\D3DCompiler_38.dll 2010-07-02 10:27:56 237848 —-a-w- c:\windows\system32\xactengine2_4.dll 2010-07-02 10:27:56 15128 —-a-w- c:\windows\system32\x3daudio1_1.dll 2010-07-02 10:27:54 2414360 —-a-w- c:\windows\system32\d3dx9_31.dll 2010-07-02 10:27:51 236824 —-a-w- c:\windows\system32\xactengine2_3.dll 2010-07-02 10:27:49 62744 —-a-w- c:\windows\system32\xinput1_2.dll 2010-07-02 10:26:51 2297552 —-a-w- c:\windows\system32\d3dx9_26.dll 2010-07-02 08:44:45 0 d—–w- c:\programdata\TrueCrypt 2010-07-02 08:44:24 223440 —-a-w- c:\windows\system32\drivers\truecrypt.sys 2010-07-02 08:43:23 0 d—–w- c:\program files\TrueCrypt 2010-07-02 05:13:57 0 d—–w- C:\IPSwap 2010-07-02 03:40:53 73728 —-a-w- c:\windows\system32\RtNicProp32.dll 2010-07-02 03:40:53 43008 —-a-w- c:\windows\system32\drivers\Rtnicxp.sys 2010-07-02 03:22:25 3426072 —-a-w- c:\windows\system32\d3dx9_32.dll 2010-07-02 03:22:06 0 d—–w- c:\program files\Microsoft SQL Server Compact Edition 2010-07-02 03:22:05 20 —-a-w- c:\windows\ìøy 2010-07-02 03:21:04 0 d—–w- c:\program files\Microsoft 2010-07-02 03:20:35 0 d—–w- c:\program files\Windows Live SkyDrive 2010-07-02 03:19:13 0 d—–w- c:\windows\PCHEALTH 2010-07-02 02:52:32 0 d—–w- c:\program files\common files\Windows Live 2010-07-02 01:41:28 0 d—–w- c:\program files\GIMP-2.0 2010-07-02 00:18:03 5 —-a-w- c:\windows\treeskp.sys 2010-07-02 00:18:03 5 —-a-w- c:\windows\sbacknt.bin 2010-07-02 00:17:45 152904 —-a-w- c:\windows\system32\vghd.scr 2010-07-01 14:38:12 0 d—–w- c:\program files\Belarc 2010-07-01 11:12:12 0 d—–w- C:\PFiles 2010-07-01 06:22:50 12800 —-a-w- c:\windows\system32\drivers\sffp_sd.sys 2010-06-30 14:55:04 0 d—–w- c:\program files\ATI Technologies 2010-06-30 14:53:00 0 d—–w- C:\Chipset Display.temp 2010-06-30 14:45:36 0 d—–w- C:\DVD RAM.temp 2010-06-30 08:24:38 0 d—–w- c:\program files\common files\xing shared 2010-06-30 08:20:16 0 d—–w- c:\program files\common files\Real 2010-06-30 08:20:12 0 d—–w- c:\programdata\Real 2010-06-30 07:51:50 0 d—–w- c:\program files\Win7codecs 2010-06-30 07:49:26 0 d—–w- c:\programdata\Win7codecs 2010-06-30 07:03:37 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf 2010-06-29 20:11:24 0 d—–w- c:\program files\Eusing Free Registry Cleaner 2010-06-29 14:09:30 10240 —-a-w- c:\windows\system32\ftlx041e.dll 2010-06-29 14:09:29 9216 —-a-w- c:\windows\system32\ftlx0411.dll 2010-06-29 14:09:29 296960 —-a-w- c:\windows\winhlp32.exe 2010-06-29 14:09:29 195072 —-a-w- c:\windows\system32\ftsrch.dll 2010-06-29 13:43:18 257024 —-a-w- c:\windows\system32\msv1_0.dll 2010-06-29 13:41:55 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll 2010-06-29 13:41:54 49472 —-a-w- c:\windows\system32\netfxperf.dll 2010-06-29 13:41:54 297808 —-a-w- c:\windows\system32\mscoree.dll 2010-06-29 13:41:54 295264 —-a-w- c:\windows\system32\PresentationHost.exe 2010-06-29 13:41:54 1130824 —-a-w- c:\windows\system32\dfshim.dll 2010-06-29 12:13:35 0 d—–w- c:\program files\Asistente Infinitum 2010-06-29 12:04:03 0 d—–w- C:\ISA 2010-06-29 12:00:02 608448 —-a-r- c:\windows\system32\comctl32.ocx 2010-06-29 11:28:51 194488 —-a-w- c:\windows\system32\drivers\fvevol.sys 2010-06-29 11:19:29 2614272 —-a-w- c:\windows\explorer.exe 2010-06-29 11:19:27 285696 —-a-w- c:\windows\system32\winlogon.exe 2010-06-29 11:19:04 1037312 —-a-w- c:\windows\system32\lsasrv.dll 2010-06-29 11:19:02 133720 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2010-06-29 11:18:07 740864 —-a-w- c:\windows\system32\inetcomm.dll 2010-06-29 11:18:00 1286456 —-a-w- c:\windows\system32\ntdll.dll 2010-06-29 11:17:27 728648 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2010-06-29 11:17:25 1320960 —-a-w- c:\windows\system32\CertEnroll.dll 2010-06-29 11:17:19 507568 —-a-w- c:\windows\system32\winload.exe 2010-06-29 11:17:14 442920 —-a-w- c:\windows\system32\winresume.exe 2010-06-29 11:17:04 12625408 —-a-w- c:\windows\system32\wmploc.DLL 2010-06-29 11:16:26 2048 —-a-w- c:\windows\system32\tzres.dll 2010-06-29 11:15:16 34816 —-a-w- c:\windows\system32\msasn1.dll 2010-06-29 11:15:02 1328640 —-a-w- c:\windows\system32\quartz.dll 2010-06-29 11:14:58 84480 —-a-w- c:\windows\system32\mciavi32.dll 2010-06-29 11:14:56 31744 —-a-w- c:\windows\system32\msvidc32.dll 2010-06-29 11:14:54 91648 —-a-w- c:\windows\system32\avifil32.dll 2010-06-29 11:14:53 50176 —-a-w- c:\windows\system32\iyuv_32.dll 2010-06-29 11:14:52 22016 —-a-w- c:\windows\system32\msyuv.dll 2010-06-29 11:14:51 13312 —-a-w- c:\windows\system32\msrle32.dll 2010-06-29 11:14:50 12288 —-a-w- c:\windows\system32\tsbyuv.dll 2010-06-29 11:14:33 30536 —-a-w- c:\windows\system32\TURegOpt.exe 2010-06-29 11:14:28 30024 —-a-w- c:\windows\system32\uxtuneup.dll 2010-06-29 11:14:28 21320 —-a-w- c:\windows\system32\authuitu.dll 2010-06-29 11:10:04 0 d—–w- c:\program files\TuneUp Utilities 2010 2010-06-29 11:05:25 0 d—–w- c:\programdata\TuneUp Software 2010-06-29 11:04:59 0 d-sh–w- c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC} 2010-06-29 11:03:31 67584 —-a-w- c:\windows\system32\asycfilt.dll 2010-06-29 11:03:09 641536 —-a-w- c:\windows\system32\CPFilters.dll 2010-06-29 11:03:03 204288 —-a-w- c:\windows\system32\MSNP.ax 2010-06-29 11:03:02 417792 —-a-w- c:\windows\system32\msdri.dll 2010-06-29 11:02:54 199680 —-a-w- c:\windows\system32\mpg2splt.ax 2010-06-29 11:02:53 465408 —-a-w- c:\windows\system32\psisdecd.dll 2010-06-29 11:01:48 310784 —-a-w- c:\windows\system32\drivers\srv.sys 2010-06-29 11:01:47 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys 2010-06-29 11:01:40 108544 —-a-w- c:\windows\system32\t2embed.dll 2010-06-29 11:00:45 977920 —-a-w- c:\windows\system32\wininet.dll 2010-06-29 11:00:20 3899280 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-06-29 11:00:18 3954568 —-a-w- c:\windows\system32\ntkrnlpa.exe 2010-06-29 11:00:11 427520 —-a-w- c:\windows\system32\vbscript.dll 2010-06-29 11:00:03 365568 —-a-w- c:\windows\system32\secproc_isv.dll 2010-06-29 11:00:01 369152 —-a-w- c:\windows\system32\secproc.dll 2010-06-29 10:59:58 324608 —-a-w- c:\windows\system32\RMActivate_isv.exe 2010-06-29 10:59:57 320512 —-a-w- c:\windows\system32\RMActivate.exe 2010-06-29 10:59:56 85504 —-a-w- c:\windows\system32\secproc_ssp_isv.dll 2010-06-29 10:59:55 85504 —-a-w- c:\windows\system32\secproc_ssp.dll 2010-06-29 10:59:53 277504 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe 2010-06-29 10:59:50 280064 —-a-w- c:\windows\system32\RMActivate_ssp.exe 2010-06-29 10:59:34 2326528 —-a-w- c:\windows\system32\win32k.sys 2010-06-29 10:34:08 221568 ——w- c:\windows\system32\MpSigStub.exe 2010-06-29 10:25:00 95744 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys 2010-06-29 10:25:00 221696 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2010-06-29 10:25:00 123392 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-06-29 10:24:34 70656 —-a-w- c:\windows\system32\fontsub.dll 2010-06-29 10:24:34 34304 —-a-w- c:\windows\system32\atmlib.dll 2010-06-29 10:24:34 293888 —-a-w- c:\windows\system32\atmfd.dll 2010-06-29 10:24:03 0 d-sh–w- c:\windows\Installer 2010-06-29 10:16:30 34 —-a-w- c:\windows\bA 2010-06-29 10:16:18 113543 —-a-w- c:\windows\system32\slmgr.vbs 2010-06-29 10:15:21 0 d—–w- c:\windows\system32\bak 2010-06-29 10:08:52 0 d—–w- c:\windows\system32\Wat 2010-06-29 10:08:25 1530242 —-a-w- c:\windows\system32\PerfStringBackup.INI 2010-06-29 10:05:46 0 d—–w- c:\windows\system32\wbem\Performance 2010-06-29 09:51:28 172032 —-a-w- c:\windows\system32\wintrust.dll 2010-06-29 09:50:50 132608 —-a-w- c:\windows\system32\cabview.dll 2010-06-29 09:46:14 0 d-sh–we c:\programdata\Plantillas 2010-06-29 09:46:14 0 d-sh–we c:\programdata\Menú Inicio 2010-06-29 09:46:14 0 d-sh–we c:\programdata\Favoritos 2010-06-29 09:46:14 0 d-sh–we c:\programdata\Escritorio 2010-06-29 09:46:14 0 d-sh–we c:\programdata\Documentos 2010-06-29 09:46:14 0 d-sh–we c:\programdata\Datos de programa 2010-06-29 09:46:14 0 d-sh–we c:\program files\Archivos comunes 2010-06-29 09:46:14 0 d-sh–we C:\Archivos de programa 2010-06-29 09:46:14 0 d—–w- C:\Recovery 2010-06-29 01:24:59 0 d—–w- c:\windows\Panther 2010-06-29 01:24:47 8192 –sha-r- C:\BOOTSECT.BAK 2010-06-29 01:24:43 383562 –sha-r- C:\bootmgr 2010-06-29 01:24:43 0 d—–w- C:\Boot 2010-06-29 01:17:14 354 –sha-r- C:\Boot.ini.saved 2010-06-29 01:08:36 0 d—–w- C:\Windows.old 2010-06-23 19:35:52 790528 —-a-w- c:\windows\system32\xvidcore.dll 2010-06-23 19:35:52 59392 —-a-w- c:\windows\system32\xvid.ax 2010-06-23 19:35:52 134144 —-a-w- c:\windows\system32\xvidvfw.dll 2010-06-22 04:04:56 2539520 —-a-w- c:\windows\system32\VSFilter.dll ==================== Find3M ==================== 2010-07-01 16:37:50 249856 —-a-w- c:\windows\system32\uxtheme.dll 2010-07-01 16:37:49 2755072 —-a-w- c:\windows\system32\themeui.dll 2010-07-01 16:37:46 37376 —-a-w- c:\windows\system32\themeservice.dll 2010-06-30 08:20:37 348160 —-a-w- c:\windows\system32\msvcr71.dll 2010-06-30 08:20:36 499712 —-a-w- c:\windows\system32\msvcp71.dll 2010-06-30 07:05:12 694324 —-a-w- c:\windows\system32\perfh00A.dat 2010-06-30 07:05:12 134434 —-a-w- c:\windows\system32\perfc00A.dat 2010-06-29 10:15:34 13824 —-a-w- c:\windows\system32\slwga.dll 2010-06-29 10:15:25 179712 —-a-w- c:\windows\system32\notepad.exe 2010-06-29 10:15:25 179712 —-a-w- c:\windows\system32\nn.dat 2010-06-29 10:15:25 179712 —-a-w- c:\windows\notepad.exe 2010-06-03 02:41:44 3600384 —-a-w- c:\windows\system32\GPhotos.scr 2010-05-28 11:04:52 14896 —-a-w- c:\windows\system32\drivers\psi_mf.sys 2010-05-18 08:47:52 108032 —-a-w- c:\windows\system32\ff_vfw.dll 2010-04-17 08:14:24 307056 —-a-w- c:\windows\WLXPGSS.SCR 2009-07-14 08:48:21 41390 —-a-w- c:\windows\inf\perflib\0c0a\perfd.dat 2009-07-14 08:48:21 41390 —-a-w- c:\windows\inf\perflib\0c0a\perfc.dat 2009-07-14 08:48:21 341432 —-a-w- c:\windows\inf\perflib\0c0a\perfi.dat 2009-07-14 08:48:21 341432 —-a-w- c:\windows\inf\perflib\0c0a\perfh.dat 2009-07-14 04:41:57 174 –sha-w- c:\program files\desktop.ini 2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2009-06-10 21:26:35 9633792 –sha-r- c:\windows\fonts\StaticCache.dat 2009-07-14 01:14:45 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe ============= FINISH: 12:48:57.77 ===============