Spyware / Malware / Virus Removal

Chrome Collapse.

14 min read

Looking for the outcome? Ask AI

Lp57 Topic Starter

Post #1April 8, 2011, 2:05 AM UTC last edited April 8, 2011, 4:45 AM UTC

Ok, the other day I'm watching a friend stream a video game and Adblock for Google Chrome crashes. Ermkay, click reload. Starts… crash. Load a page, chrome crashes. Close everything, restart chrome… crash. Load IE, sluggish and wont really do anything. Check Task manager for anything out of whack. Looks fine. Run Avast, no viruses.

End up rebooting. Everything seems fine. Infact it will run fine from noon till after 7pm. Anywhere between 7pm and 9:30pm it'll suffer the same type of crash. Adblock will crash, then chrome follow. Pages will load, but shortly after 'Aww snap'. Since it continues to crash I can't seem to figure it out.

I've searched threads about it, but can't seem to find anything that exactly matches. I've looked in Admin Tools > Event Log and nothing gets logged during the time of the crash. There's a couple other things that are goofed up during reboot, but after rebooting it runs fine. I've used CCleaner to clean up some things. And run both quick and full virus scans but can't seem to find what goes wrong.

A new thing is, if I try to reboot it wont go. The log off (winluowhattever.exe) will load in task manager, but it wont process. If I end the task a couple times it'll finally reboot. And things will be fine till the next evening.

I'm unaware of any tasks set to take place, and it changes everyday when it fails. Yesterday was around 8:35pm. Today 9:36pm. The other day was like 6pm or so. Also, chrome will give Bad Image error during the crash sometimes.

I just dunno. Can't figure it out on my own and you guys are usually a great help. A while back I was having ntvdm.exe issues eating up my resources, but it stopped. A friend said it sounded like a worm but I couldn't figure it out.

Anyways… here's my Hijack log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:04:44 PM, on 4/7/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17095)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\EeePC\ACPI\AsTray.exe
C:\Program Files\MSN\Toolbar\3.0.1125.0\mstbsvc.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
C:\Program Files\EeePC\ACPI\AsEPCMon.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Elantech\ETDDect.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dolores Clark\My Documents\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.myspace.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by MySpace
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: YSPManager - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\IEPro\IEProRecorder.dll
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe
O4 - HKLM\..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ETDWareDetect] C:\Program Files\Elantech\ETDDect.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallati…t;ver=10.0.1170
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Asus Power Management Utility.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O9 - Extra 'Tools' menuitem: Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O16 - DPF: ActiveGS.cab - http://activegs.freetoolsassociation.com/ActiveGS.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - http://srtest-cdn.systemrequirementslab.co…eqlabdetect.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {95A311CD-EC8E-452A-BCEC-B844EB616D03} (BejeweledTwist Control) - http://www.worldwinner.com/games/v51/bejew…eweledtwist.cab
O16 - DPF: {A021A215-6CDC-44B4-8C16-90491CED9605} (Clue Control) - http://www.worldwinner.com/games/v59/clue/clue.cab
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.com/play/classic/SimCityX.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos…ronGameHost.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - http://service.futuremark.com/gom/receiver/tc/FMSI.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://l.yimg.com/jh/games/web_games/popca…aploader_v6.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton Internet Security - Unknown owner - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 12747 bytes

Any help would be greatly appreciated.

Tomk

Post #2April 11, 2011, 6:10 PM UTC

Hi Lp57,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also please describe how your computer behaves at the moment.

Lp57

Post #3April 11, 2011, 6:53 PM UTC

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6335 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 4/11/2011 2:50:20 PM mbam-log-2011-04-11 (14-50-20).txt Scan type: Quick scan Objects scanned: 140165 Time elapsed: 6 minute(s), 36 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Tomk

Post #4April 11, 2011, 11:21 PM UTC

Lp57,

Well… that helped nothing…

Let's get a log that shows a bit more of what is going on.

Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Lp57

Post #5April 11, 2011, 11:41 PM UTC last edited April 12, 2011, 12:00 AM UTC

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 19:54:39.95 on Mon 04/11/2011
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.325 [GMT -4:00]
.
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\EeePC\ACPI\AsTray.exe
C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
C:\Program Files\EeePC\ACPI\AsEPCMon.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\Elantech\ETDDect.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\MSN\Toolbar\3.0.1125.0\mstbsvc.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Dolores Clark\My Documents\Downloads\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com
uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uWindow Title = Windows Internet Explorer provided by MySpace
uDefault_Page_URL = hxxp://www.myspace.com/
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
BHO: IE7Pro BHO: {00011268-e188-40df-a514-835fcd78b1bf} - c:\program files\iepro\iepro.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Yahooo Search Protection: {25bc7718-0bfa-40ea-b381-4b2d9732d686} - c:\program files\yahoo!\search protection\ysp.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\iepro\IEProRecorder.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Google Update] "c:\documents and settings\dolores clark\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [DAEMON Tools Pro Agent] "c:\program files\daemon tools pro\DTProAgent.exe"
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [AsusTray] c:\program files\eeepc\acpi\AsTray.exe
mRun: [AsusACPIServer] c:\program files\eeepc\acpi\AsAcpiSvr.exe
mRun: [AsusEPCMonitor] c:\program files\eeepc\acpi\AsEPCMon.exe
mRun: [ETDWare] c:\program files\elantech\ETDCtrl.exe
mRun: [ETDWareDetect] c:\program files\elantech\ETDDect.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallati…t;ver=10.0.1170
StartupFolder: c:\docume~1\dolore~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\asuspo~1.lnk - c:\program files\asus\eeepc\asus power management utility\Asus Power Management Utility.exe
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709} - c:\program files\iepro\iepro.dll
IE: {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - {B119EB0C-C021-46CF-85B0-34A760E0D5FE} - c:\program files\iepro\iepro.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - c:\program files\yahoo!\search protection\ysp.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: ActiveGS.cab - hxxp://activegs.freetoolsassociation.com/ActiveGS.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {95A311CD-EC8E-452A-BCEC-B844EB616D03} - hxxp://www.worldwinner.com/games/v51/bejeweledtwist/bejeweledtwist.cab
DPF: {A021A215-6CDC-44B4-8C16-90491CED9605} - hxxp://www.worldwinner.com/games/v59/clue/clue.cab
DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} - hxxp://simcity.ea.com/play/classic/SimCityX.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab
DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} - hxxp://service.futuremark.com/gom/receiver/tc/FMSI.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://l.yimg.com/jh/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-3-24 371544]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-12-20 301528]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-12-20 19544]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-12-20 42184]
R2 mstbsvc;MSN Toolbar Setup;c:\program files\msn\toolbar\3.0.1125.0\mstbsvc.exe [2009-2-9 104784]
R2 RPCQT;Remote Procedure Call (CQTPM);c:\windows\system32\svchost.exe -k netsvcs [2008-7-29 14336]
S2 Norton Internet Security;Norton Internet Security;"c:\program files\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 –> c:\program files\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?]
S3 cpuz130;cpuz130;\??\c:\docume~1\dolore~1\locals~1\temp\cpuz130\cpuz_x32.sys –> c:\docume~1\dolore~1\locals~1\temp\cpuz130\cpuz_x32.sys [?]
S3 dciiodrv;dciiodrv;c:\windows\system32\drivers\dciiodrv.sys [2011-3-29 2944]
S3 dump_wmimmc;dump_wmimmc;\??\c:\program files\gpotato\flyff\gameguard\dump_wmimmc.sys –> c:\program files\gpotato\flyff\gameguard\dump_wmimmc.sys [?]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\manycam.sys –> c:\windows\system32\drivers\ManyCam.sys [?]
S3 NAVENG;NAVENG;\??\c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20080829.024\naveng.sys –> c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20080829.024\NAVENG.SYS [?]
S3 NAVEX15;NAVEX15;\??\c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20080829.024\navex15.sys –> c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20080829.024\NAVEX15.SYS [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [2008-8-19 38272]
.
=============== Created Last 30 ================
.
2011-04-11 02:40:21 ——– d—–w- c:\program files\Ace of Spades
2011-04-11 00:16:10 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-04-08 21:46:50 ——– d—–w- c:\docume~1\alluse~1\applic~1\SplitMediaLabs
2011-04-08 21:44:28 ——– d—–w- c:\program files\SplitMediaLabs
2011-04-08 19:42:09 452668 —-a-w- c:\windows\Snowflakes (plug-in) Uninstaller.exe
2011-04-06 19:43:01 116224 -c–a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-04-06 19:42:53 23040 -c–a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-04-06 19:42:52 18944 -c–a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-04-06 19:42:44 27648 -c–a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-04-06 19:42:35 4608 -c–a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-04-06 19:42:23 99865 -c–a-w- c:\windows\system32\dllcache\xlog.exe
2011-04-06 19:42:14 16970 -c–a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-04-06 19:42:12 19455 -c–a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-04-06 19:42:05 12063 -c–a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-04-06 19:42:03 8192 -c–a-w- c:\windows\system32\dllcache\wshirda.dll
2011-04-06 19:41:39 8832 -c–a-w- c:\windows\system32\dllcache\wmiacpi.sys
2011-04-06 19:41:30 154624 -c–a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-04-06 19:41:22 34890 -c–a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-04-06 19:41:07 771581 -c–a-w- c:\windows\system32\dllcache\winacisa.sys
2011-04-06 19:39:54 16925 -c–a-w- c:\windows\system32\dllcache\w940nd.sys
2011-04-06 19:39:46 19016 -c–a-w- c:\windows\system32\dllcache\w926nd.sys
2011-04-06 19:39:37 19528 -c–a-w- c:\windows\system32\dllcache\w840nd.sys
2011-04-06 19:39:28 64605 -c–a-w- c:\windows\system32\dllcache\vvoice.sys
2011-04-06 19:39:19 397502 -c–a-w- c:\windows\system32\dllcache\vpctcom.sys
2011-04-06 19:39:10 604253 -c–a-w- c:\windows\system32\dllcache\vmodem.sys
2011-04-06 19:39:01 249402 -c–a-w- c:\windows\system32\dllcache\vinwm.sys
2011-04-06 19:38:53 24576 -c–a-w- c:\windows\system32\dllcache\viairda.sys
2011-04-06 19:38:50 5376 -c–a-w- c:\windows\system32\dllcache\viaide.sys
2011-04-06 19:38:50 42240 -c–a-w- c:\windows\system32\dllcache\viaagp.sys
2011-04-06 19:38:46 11325 -c–a-w- c:\windows\system32\dllcache\vchnt5.dll
2011-04-06 19:38:37 687999 -c–a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-04-06 19:38:27 765884 -c–a-w- c:\windows\system32\dllcache\usrti.sys
2011-04-06 19:38:19 113762 -c–a-w- c:\windows\system32\dllcache\usrpda.sys
2011-04-06 19:38:11 7556 -c–a-w- c:\windows\system32\dllcache\usroslba.sys
2011-04-06 19:38:02 224802 -c–a-w- c:\windows\system32\dllcache\usr1807a.sys
2011-04-06 19:37:54 794399 -c–a-w- c:\windows\system32\dllcache\usr1806v.sys
2011-04-06 19:37:46 793598 -c–a-w- c:\windows\system32\dllcache\usr1806.sys
2011-04-06 19:37:38 794654 -c–a-w- c:\windows\system32\dllcache\usr1801.sys
2011-04-06 19:37:36 26112 -c–a-w- c:\windows\system32\dllcache\usbser.sys
2011-04-06 19:37:34 25856 -c–a-w- c:\windows\system32\dllcache\usbprint.sys
2011-04-06 19:37:34 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2011-04-06 19:37:31 17152 -c–a-w- c:\windows\system32\dllcache\usbohci.sys
2011-04-06 19:37:28 12800 -c–a-w- c:\windows\system32\dllcache\usb8023x.sys
2011-04-06 19:37:26 32384 -c–a-w- c:\windows\system32\dllcache\usb101et.sys
2011-04-06 19:37:15 94720 -c–a-w- c:\windows\system32\dllcache\umaxud32.dll
2011-04-06 19:37:07 28160 -c–a-w- c:\windows\system32\dllcache\umaxu40.dll
2011-04-06 19:36:59 26624 -c–a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-04-06 19:36:51 69632 -c–a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-04-06 19:36:43 50688 -c–a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-04-06 19:36:35 22912 -c–a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-04-06 19:36:27 50176 -c–a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-04-06 19:36:19 47616 -c–a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-04-06 19:36:11 211968 -c–a-w- c:\windows\system32\dllcache\um54scan.dll
2011-04-06 19:36:03 216064 -c–a-w- c:\windows\system32\dllcache\um34scan.dll
2011-04-06 19:35:56 36736 -c–a-w- c:\windows\system32\dllcache\ultra.sys
2011-04-06 19:35:53 44672 -c–a-w- c:\windows\system32\dllcache\uagp35.sys
2011-04-06 19:35:45 11520 -c–a-w- c:\windows\system32\dllcache\twotrack.sys
2011-04-06 19:35:32 166784 -c–a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-04-06 19:35:24 525568 -c–a-w- c:\windows\system32\dllcache\tridxp.dll
2011-04-06 19:35:16 159232 -c–a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-04-06 19:35:08 440576 -c–a-w- c:\windows\system32\dllcache\tridkb.dll
2011-04-06 19:35:00 222336 -c–a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-04-06 19:34:52 315520 -c–a-w- c:\windows\system32\dllcache\trid3d.dll
2011-04-06 19:34:44 34375 -c–a-w- c:\windows\system32\dllcache\tpro4.sys
2011-04-06 19:34:36 42496 -c–a-w- c:\windows\system32\dllcache\tp4res.dll
2011-04-06 19:34:34 82944 -c–a-w- c:\windows\system32\dllcache\tp4mon.exe
2011-04-06 19:34:26 31744 -c–a-w- c:\windows\system32\dllcache\tp4.dll
2011-04-06 19:34:16 4992 -c–a-w- c:\windows\system32\dllcache\toside.sys
2011-04-06 19:34:09 230912 -c–a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-04-06 19:34:01 241664 -c–a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-04-06 19:33:53 28232 -c–a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-04-06 19:33:45 123995 -c–a-w- c:\windows\system32\dllcache\tjisdn.sys
2011-04-06 19:33:36 138528 -c–a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2011-04-06 19:33:27 81408 -c–a-w- c:\windows\system32\dllcache\tgiul50.dll
2011-04-06 19:33:25 149376 -c–a-w- c:\windows\system32\dllcache\tffsport.sys
2011-04-06 19:33:16 17129 -c–a-w- c:\windows\system32\dllcache\tdkcd31.sys
2011-04-06 19:33:09 37961 -c–a-w- c:\windows\system32\dllcache\tdk100b.sys
2011-04-06 19:32:59 30464 -c–a-w- c:\windows\system32\dllcache\tbatm155.sys
2011-04-06 19:32:50 7040 -c–a-w- c:\windows\system32\dllcache\tandqic.sys
2011-04-06 19:32:42 36640 -c–a-w- c:\windows\system32\dllcache\t2r4mini.sys
2011-04-06 19:32:35 172768 -c–a-w- c:\windows\system32\dllcache\t2r4disp.dll
2011-04-06 19:32:22 32640 -c–a-w- c:\windows\system32\dllcache\symc8xx.sys
2011-04-06 19:32:15 16256 -c–a-w- c:\windows\system32\dllcache\symc810.sys
2011-04-06 19:32:07 30688 -c–a-w- c:\windows\system32\dllcache\sym_u3.sys
2011-04-06 19:32:00 28384 -c–a-w- c:\windows\system32\dllcache\sym_hi.sys
2011-04-06 19:31:52 94293 -c–a-w- c:\windows\system32\dllcache\sxports.dll
2011-04-06 19:31:44 103936 -c–a-w- c:\windows\system32\dllcache\sx.sys
2011-04-06 19:31:37 3968 -c–a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-04-06 19:31:29 10240 -c–a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-04-06 19:31:22 10240 -c–a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-04-06 19:31:15 53760 -c–a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-04-06 19:31:07 41472 -c–a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-04-06 19:30:58 155648 -c–a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-04-06 19:30:51 53248 -c–a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-04-06 19:30:44 285760 -c–a-w- c:\windows\system32\dllcache\stlnata.sys
2011-04-06 19:30:36 16896 -c–a-w- c:\windows\system32\dllcache\stcusb.sys
2011-04-06 19:30:22 48736 -c–a-w- c:\windows\system32\dllcache\srwlnd5.sys
2011-04-06 19:30:14 99328 -c–a-w- c:\windows\system32\dllcache\srusd.dll
2011-04-06 19:30:02 24660 -c–a-w- c:\windows\system32\dllcache\spxupchk.dll
2011-04-06 19:29:52 61824 -c–a-w- c:\windows\system32\dllcache\speed.sys
2011-04-06 19:29:45 106584 -c–a-w- c:\windows\system32\dllcache\spdports.dll
2011-04-06 19:29:38 19072 -c–a-w- c:\windows\system32\dllcache\sparrow.sys
2011-04-06 19:29:29 7552 -c–a-w- c:\windows\system32\dllcache\sonypvu1.sys
2011-04-06 19:29:22 37040 -c–a-w- c:\windows\system32\dllcache\sonypi.sys
2011-04-06 19:29:15 114688 -c–a-w- c:\windows\system32\dllcache\sonypi.dll
2011-04-06 19:29:08 20752 -c–a-w- c:\windows\system32\dllcache\sonync.sys
2011-04-06 19:29:01 9600 -c–a-w- c:\windows\system32\dllcache\sonymc.sys
2011-04-06 19:29:00 7552 -c–a-w- c:\windows\system32\dllcache\sonyait.sys
2011-04-06 19:28:51 7040 -c–a-w- c:\windows\system32\dllcache\snyaitmc.sys
2011-04-06 19:28:34 58368 -c–a-w- c:\windows\system32\dllcache\smiminib.sys
2011-04-06 19:28:25 147200 -c–a-w- c:\windows\system32\dllcache\smidispb.dll
2011-04-06 19:28:18 25034 -c–a-w- c:\windows\system32\dllcache\smcpwr2n.sys
2011-04-06 19:28:10 35913 -c–a-w- c:\windows\system32\dllcache\smcirda.sys
2011-04-06 19:28:03 24576 -c–a-w- c:\windows\system32\dllcache\smc8000n.sys
2011-04-06 19:26:58 91294 -c–a-w- c:\windows\system32\dllcache\skfpwin.sys
2011-04-06 19:26:50 94698 -c–a-w- c:\windows\system32\dllcache\sk98xwin.sys
2011-04-06 19:26:43 157696 -c–a-w- c:\windows\system32\dllcache\sisv256.dll
2011-04-06 19:26:36 50432 -c–a-w- c:\windows\system32\dllcache\sisv.sys
2011-04-06 19:26:34 32768 -c–a-w- c:\windows\system32\dllcache\sisnic.sys
2011-04-06 19:26:27 238592 -c–a-w- c:\windows\system32\dllcache\sisgrv.dll
2011-04-06 19:26:19 104064 -c–a-w- c:\windows\system32\dllcache\sisgrp.sys
2011-04-06 19:26:18 40960 -c–a-w- c:\windows\system32\dllcache\sisagp.sys
2011-04-06 19:26:11 150144 -c–a-w- c:\windows\system32\dllcache\sis6306v.dll
2011-04-06 19:26:04 68608 -c–a-w- c:\windows\system32\dllcache\sis6306p.sys
2011-04-06 19:25:57 252032 -c–a-w- c:\windows\system32\dllcache\sis300iv.dll
2011-04-06 19:25:49 101760 -c–a-w- c:\windows\system32\dllcache\sis300ip.sys
2011-04-06 19:25:48 3901 -c–a-w- c:\windows\system32\dllcache\siint5.dll
2011-04-06 19:25:32 161568 -c–a-w- c:\windows\system32\dllcache\sgsmusb.sys
2011-04-06 19:25:25 18400 -c–a-w- c:\windows\system32\dllcache\sgsmld.sys
2011-04-06 19:25:18 98080 -c–a-w- c:\windows\system32\dllcache\sgiulnt5.sys
2011-04-06 19:25:11 386560 -c–a-w- c:\windows\system32\dllcache\sgiul50.dll
2011-04-06 19:25:04 36480 -c–a-w- c:\windows\system32\dllcache\sfmanm.sys
2011-04-06 19:24:54 6784 -c–a-w- c:\windows\system32\dllcache\serscan.sys
2011-04-06 19:24:47 17664 -c–a-w- c:\windows\system32\dllcache\sermouse.sys
2011-04-06 19:24:38 6912 -c–a-w- c:\windows\system32\dllcache\seaddsmc.sys
2011-04-06 19:24:37 11520 -c–a-w- c:\windows\system32\dllcache\scsiscan.sys
2011-04-06 19:24:29 11648 -c–a-w- c:\windows\system32\dllcache\scsiprnt.sys
2011-04-06 19:24:21 17280 -c–a-w- c:\windows\system32\dllcache\scr111.sys
2011-04-06 19:24:14 16640 -c–a-w- c:\windows\system32\dllcache\scmstcs.sys
2011-04-06 19:24:06 23936 -c–a-w- c:\windows\system32\dllcache\sccmusbm.sys
2011-04-06 19:23:59 23936 -c–a-w- c:\windows\system32\dllcache\sccmn50m.sys
2011-04-06 19:23:57 43904 -c–a-w- c:\windows\system32\dllcache\sbp2port.sys
2011-04-06 19:23:50 495616 -c–a-w- c:\windows\system32\dllcache\sblfx.dll
2011-04-06 19:23:41 75392 -c–a-w- c:\windows\system32\dllcache\s3savmxm.sys
2011-04-06 19:23:34 245632 -c–a-w- c:\windows\system32\dllcache\s3savmx.dll
2011-04-06 19:23:27 77824 -c–a-w- c:\windows\system32\dllcache\s3sav4m.sys
2011-04-06 19:23:20 198400 -c–a-w- c:\windows\system32\dllcache\s3sav4.dll
2011-04-06 19:23:13 61504 -c–a-w- c:\windows\system32\dllcache\s3sav3dm.sys
2011-04-06 19:23:06 179264 -c–a-w- c:\windows\system32\dllcache\s3sav3d.dll
2011-04-06 19:22:59 210496 -c–a-w- c:\windows\system32\dllcache\s3mvirge.dll
2011-04-06 19:22:52 62496 -c–a-w- c:\windows\system32\dllcache\s3mtrio.dll
2011-04-06 19:22:46 41216 -c–a-w- c:\windows\system32\dllcache\s3mt3d.sys
2011-04-06 19:22:38 182272 -c–a-w- c:\windows\system32\dllcache\s3mt3d.dll
2011-04-06 19:22:31 166720 -c–a-w- c:\windows\system32\dllcache\s3m.sys
2011-04-06 19:22:24 65664 -c–a-w- c:\windows\system32\dllcache\s3legacy.sys
2011-04-06 19:22:23 166912 -c–a-w- c:\windows\system32\dllcache\s3gnbm.sys
2011-04-06 19:22:22 397056 -c–a-w- c:\windows\system32\dllcache\s3gnb.dll
2011-04-06 19:22:15 82432 -c–a-w- c:\windows\system32\dllcache\rwia450.dll
2011-04-06 19:22:08 79872 -c–a-w- c:\windows\system32\dllcache\rwia430.dll
2011-04-06 19:22:05 29696 -c–a-w- c:\windows\system32\dllcache\rw450ext.dll
2011-04-06 19:22:02 27648 -c–a-w- c:\windows\system32\dllcache\rw430ext.dll
2011-04-06 19:21:59 20992 -c–a-w- c:\windows\system32\dllcache\rtl8139.sys
2011-04-06 19:21:52 19017 -c–a-w- c:\windows\system32\dllcache\rtl8029.sys
2011-04-06 19:21:45 30720 -c–a-w- c:\windows\system32\dllcache\rthwcls.sys
2011-04-06 19:21:36 9216 -c–a-w- c:\windows\system32\dllcache\rsmgrstr.dll
2011-04-06 19:21:28 3840 -c–a-w- c:\windows\system32\dllcache\rpfun.sys
2011-04-06 19:21:25 79104 -c–a-w- c:\windows\system32\dllcache\rocket.sys
2011-04-06 19:21:23 30592 -c–a-w- c:\windows\system32\dllcache\rndismpx.sys
2011-04-06 19:21:15 37563 -c–a-w- c:\windows\system32\dllcache\rlnet5.sys
2011-04-06 19:21:12 59136 -c–a-w- c:\windows\system32\dllcache\rfcomm.sys
2011-04-06 19:21:05 86097 -c–a-w- c:\windows\system32\dllcache\reslog32.dll
2011-04-06 19:20:59 13776 -c–a-w- c:\windows\system32\dllcache\recagent.sys
2011-04-06 19:20:46 19584 -c–a-w- c:\windows\system32\dllcache\rasirda.sys
2011-04-06 19:20:36 714762 -c–a-w- c:\windows\system32\dllcache\r2mdmkxx.sys
2011-04-06 19:20:29 899146 -c–a-w- c:\windows\system32\dllcache\r2mdkxga.sys
2011-04-06 19:20:22 41472 -c–a-w- c:\windows\system32\dllcache\qvusd.dll
2011-04-06 19:20:15 3328 -c–a-w- c:\windows\system32\dllcache\qv2kux.sys
2011-04-06 19:20:04 49024 -c–a-w- c:\windows\system32\dllcache\ql1280.sys
2011-04-06 19:19:57 40448 -c–a-w- c:\windows\system32\dllcache\ql1240.sys
2011-04-06 19:19:51 45312 -c–a-w- c:\windows\system32\dllcache\ql12160.sys
2011-04-06 19:19:43 33152 -c–a-w- c:\windows\system32\dllcache\ql10wnt.sys
2011-04-06 19:19:36 40320 -c–a-w- c:\windows\system32\dllcache\ql1080.sys
2011-04-06 19:19:34 6016 -c–a-w- c:\windows\system32\dllcache\qic157.sys
2011-04-06 19:19:25 130942 -c–a-w- c:\windows\system32\dllcache\ptserlv.sys
2011-04-06 19:19:19 112574 -c–a-w- c:\windows\system32\dllcache\ptserlp.sys
2011-04-06 19:19:12 128286 -c–a-w- c:\windows\system32\dllcache\ptserli.sys
2011-04-06 19:19:10 159232 -c–a-w- c:\windows\system32\dllcache\ptpusd.dll
2011-04-06 19:19:03 5632 -c–a-w- c:\windows\system32\dllcache\ptpusb.dll
2011-04-06 19:18:56 35328 -c–a-w- c:\windows\system32\dllcache\psisload.dll
2011-04-06 19:18:49 16128 -c–a-w- c:\windows\system32\dllcache\pscr.sys
2011-04-06 19:18:46 17664 -c–a-w- c:\windows\system32\dllcache\ppa3.sys
2011-04-06 19:18:39 8832 -c–a-w- c:\windows\system32\dllcache\powerfil.sys
2011-04-06 19:18:39 17792 -c–a-w- c:\windows\system32\dllcache\ppa.sys
2011-04-06 19:18:31 7168 -c–a-w- c:\windows\system32\dllcache\pnrmc.sys
2011-04-06 19:18:17 121344 -c–a-w- c:\windows\system32\dllcache\phvfwext.dll
2011-04-06 19:18:09 19840 -c–a-w- c:\windows\system32\dllcache\philtune.sys
2011-04-06 19:18:02 92416 -c–a-w- c:\windows\system32\dllcache\phildec.sys
2011-04-06 19:17:55 173696 -c–a-w- c:\windows\system32\dllcache\philcam2.sys
2011-04-06 19:17:49 75776 -c–a-w- c:\windows\system32\dllcache\philcam1.sys
2011-04-06 19:17:42 16384 -c–a-w- c:\windows\system32\dllcache\philcam1.dll
2011-04-06 19:17:34 259328 -c–a-w- c:\windows\system32\dllcache\perm3dd.dll
2011-04-06 19:17:32 28032 -c–a-w- c:\windows\system32\dllcache\perm3.sys
2011-04-06 19:17:31 211584 -c–a-w- c:\windows\system32\dllcache\perm2dll.dll
2011-04-06 19:17:30 27904 -c–a-w- c:\windows\system32\dllcache\perm2.sys
2011-04-06 19:17:22 5504 -c–a-w- c:\windows\system32\dllcache\perc2hib.sys
2011-04-06 19:17:15 27296 -c–a-w- c:\windows\system32\dllcache\perc2.sys
2011-04-06 19:17:12 169984 -c–a-w- c:\windows\system32\dllcache\pcx500.sys
2011-04-06 19:17:06 86016 -c–a-w- c:\windows\system32\dllcache\pctspk.exe
2011-04-06 19:16:59 35328 -c–a-w- c:\windows\system32\dllcache\pcntpci5.sys
2011-04-06 19:16:52 29769 -c–a-w- c:\windows\system32\dllcache\pcntn5m.sys
2011-04-06 19:16:46 30282 -c–a-w- c:\windows\system32\dllcache\pcntn5hl.sys
2011-04-06 19:16:38 26153 -c–a-w- c:\windows\system32\dllcache\pcmlm56.sys
2011-04-06 19:16:37 29502 -c–a-w- c:\windows\system32\dllcache\pca200e.sys
2011-04-06 19:16:30 30495 -c–a-w- c:\windows\system32\dllcache\pc100nds.sys
2011-04-06 19:16:20 41984 -c–a-w- c:\windows\system32\dllcache\ovui2rc.dll
2011-04-06 19:16:14 44544 -c–a-w- c:\windows\system32\dllcache\ovui2.dll
2011-04-06 19:16:07 25216 -c–a-w- c:\windows\system32\dllcache\ovsound2.sys
2011-04-06 19:16:00 39424 -c–a-w- c:\windows\system32\dllcache\ovcoms.exe
2011-04-06 19:15:54 20480 -c–a-w- c:\windows\system32\dllcache\ovcomc.dll
2011-04-06 19:15:46 351616 -c–a-w- c:\windows\system32\dllcache\ovcodek2.sys
2011-04-06 19:15:40 116736 -c–a-w- c:\windows\system32\dllcache\ovcodec2.dll
2011-04-06 19:15:33 31872 -c–a-w- c:\windows\system32\dllcache\ovce.sys
2011-04-06 19:15:26 28032 -c–a-w- c:\windows\system32\dllcache\ovcd.sys
2011-04-06 19:15:20 48000 -c–a-w- c:\windows\system32\dllcache\ovcam2.sys
2011-04-06 19:15:13 25088 -c–a-w- c:\windows\system32\dllcache\ovca.sys
2011-04-06 19:15:07 54186 -c–a-w- c:\windows\system32\dllcache\otcsercb.sys
2011-04-06 19:15:00 43689 -c–a-w- c:\windows\system32\dllcache\otceth5.sys
2011-04-06 19:14:53 27209 -c–a-w- c:\windows\system32\dllcache\otc06x5.sys
2011-04-06 19:14:46 54528 -c–a-w- c:\windows\system32\dllcache\opl3sax.sys
2011-04-06 19:14:41 61696 -c–a-w- c:\windows\system32\dllcache\ohci1394.sys
2011-04-06 19:14:35 1897408 -c–a-w- c:\windows\system32\dllcache\nv4_mini.sys
2011-04-06 19:14:33 4274816 -c–a-w- c:\windows\system32\dllcache\nv4_disp.dll
2011-04-06 19:14:27 198144 -c–a-w- c:\windows\system32\dllcache\nv3.sys
2011-04-06 19:14:21 123776 -c–a-w- c:\windows\system32\dllcache\nv3.dll
2011-04-06 19:14:17 180360 -c–a-w- c:\windows\system32\dllcache\ntmtlfax.sys
2011-04-06 19:14:04 51552 -c–a-w- c:\windows\system32\dllcache\ntgrip.sys
2011-04-06 19:13:56 9344 -c–a-w- c:\windows\system32\dllcache\ntapm.sys
2011-04-06 19:13:50 7552 -c–a-w- c:\windows\system32\dllcache\nsmmc.sys
2011-04-06 19:13:47 28672 -c–a-w- c:\windows\system32\dllcache\nscirda.sys
2011-04-06 19:13:37 87040 -c–a-w- c:\windows\system32\dllcache\nm6wdm.sys
2011-04-06 19:13:31 126080 -c–a-w- c:\windows\system32\dllcache\nm5a2wdm.sys
2011-04-06 19:13:23 32840 -c–a-w- c:\windows\system32\dllcache\ngrpci.sys
2011-04-06 19:13:20 132695 -c–a-w- c:\windows\system32\dllcache\netwlan5.sys
2011-04-06 19:13:10 65278 -c–a-w- c:\windows\system32\dllcache\netflx3.sys
2011-04-06 19:13:02 39264 -c–a-w- c:\windows\system32\dllcache\neo20xx.sys
2011-04-06 19:12:55 60480 -c–a-w- c:\windows\system32\dllcache\neo20xx.dll
2011-04-06 19:12:49 15872 -c–a-w- c:\windows\system32\dllcache\ne2000.sys
2011-04-06 19:12:39 91488 -c–a-w- c:\windows\system32\dllcache\n9i3disp.dll
2011-04-06 19:12:33 27936 -c–a-w- c:\windows\system32\dllcache\n9i3d.sys
2011-04-06 19:12:26 33088 -c–a-w- c:\windows\system32\dllcache\n9i128v2.sys
2011-04-06 19:12:20 59104 -c–a-w- c:\windows\system32\dllcache\n9i128v2.dll
2011-04-06 19:12:14 13664 -c–a-w- c:\windows\system32\dllcache\n9i128.sys
2011-04-06 19:12:08 35392 -c–a-w- c:\windows\system32\dllcache\n9i128.dll
2011-04-06 19:12:01 128000 -c–a-w- c:\windows\system32\dllcache\n100325.sys
2011-04-06 19:10:54 49024 -c–a-w- c:\windows\system32\dllcache\mstape.sys
2011-04-06 19:10:45 12416 -c–a-w- c:\windows\system32\dllcache\msriffwv.sys
2011-04-06 19:10:31 2944 -c–a-w- c:\windows\system32\dllcache\msmpu401.sys
2011-04-06 19:10:29 22016 -c–a-w- c:\windows\system32\dllcache\msircomm.sys
2011-04-06 19:10:14 35200 -c–a-w- c:\windows\system32\dllcache\msgame.sys
2011-04-06 19:10:08 6016 -c–a-w- c:\windows\system32\dllcache\msfsio.sys
2011-04-06 19:09:54 17280 -c–a-w- c:\windows\system32\dllcache\mraid35x.sys
2011-04-06 19:09:42 16128 -c–a-w- c:\windows\system32\dllcache\modemcsa.sys
2011-04-06 19:09:30 6528 -c–a-w- c:\windows\system32\dllcache\miniqic.sys
2011-04-06 19:09:19 320384 -c–a-w- c:\windows\system32\dllcache\mgaum.sys
2011-04-06 19:09:12 235648 -c–a-w- c:\windows\system32\dllcache\mgaud.dll
2011-04-06 19:09:09 26112 -c–a-w- c:\windows\system32\dllcache\memstpci.sys
2011-04-06 19:09:03 47616 -c–a-w- c:\windows\system32\dllcache\memgrp.dll
2011-04-06 19:08:57 8320 -c–a-w- c:\windows\system32\dllcache\memcard.sys
2011-04-06 19:08:50 164586 -c–a-w- c:\windows\system32\dllcache\mdgndis5.sys
2011-04-06 19:08:41 7424 -c–a-w- c:\windows\system32\dllcache\mammoth.sys
2011-04-06 19:08:33 48768 -c–a-w- c:\windows\system32\dllcache\maestro.sys
2011-04-06 19:08:27 58880 -c–a-w- c:\windows\system32\dllcache\m3092dc.dll
2011-04-06 19:08:21 58368 -c–a-w- c:\windows\system32\dllcache\m3091dc.dll
2011-04-06 19:08:15 22848 -c–a-w- c:\windows\system32\dllcache\lwusbhid.sys
2011-04-06 19:08:13 20864 -c–a-w- c:\windows\system32\dllcache\lwadihid.sys
2011-04-06 19:08:06 797500 -c–a-w- c:\windows\system32\dllcache\ltsmt.sys
2011-04-06 19:08:00 802683 -c–a-w- c:\windows\system32\dllcache\ltsm.sys
2011-04-06 19:07:59 7040 -c–a-w- c:\windows\system32\dllcache\ltotape.sys
2011-04-06 19:07:57 420992 -c–a-w- c:\windows\system32\dllcache\ltmdmntt.sys
2011-04-06 19:07:52 576746 -c–a-w- c:\windows\system32\dllcache\ltmdmntl.sys
2011-04-06 19:07:51 606684 -c–a-w- c:\windows\system32\dllcache\ltmdmnt.sys
2011-04-06 19:07:45 727786 -c–a-w- c:\windows\system32\dllcache\ltck000c.sys
2011-04-06 19:07:37 4992 -c–a-w- c:\windows\system32\dllcache\loop.sys
2011-04-06 19:07:29 70730 -c–a-w- c:\windows\system32\dllcache\lne100tx.sys
2011-04-06 19:07:23 20573 -c–a-w- c:\windows\system32\dllcache\lne100.sys
2011-04-06 19:07:16 25065 -c–a-w- c:\windows\system32\dllcache\lmndis3.sys
2011-04-06 19:07:10 15744 -c–a-w- c:\windows\system32\dllcache\lit220p.sys
2011-04-06 19:07:07 34688 -c–a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2011-04-06 19:07:02 26442 -c–a-w- c:\windows\system32\dllcache\lanepic5.sys
2011-04-06 19:06:56 19016 -c–a-w- c:\windows\system32\dllcache\ktc111.sys
2011-04-06 19:06:48 37376 -c–a-w- c:\windows\system32\dllcache\kousd.dll
2011-04-06 19:06:45 253952 -c–a-w- c:\windows\system32\dllcache\kdsusd.dll
2011-04-06 19:06:43 48640 -c–a-w- c:\windows\system32\dllcache\kdsui.dll
2011-04-06 19:06:31 14592 -c–a-w- c:\windows\system32\dllcache\kbdhid.sys
2011-04-06 19:06:15 26624 -c–a-w- c:\windows\system32\dllcache\irstusb.sys
2011-04-06 19:06:09 18688 -c–a-w- c:\windows\system32\dllcache\irsir.sys
2011-04-06 19:06:07 28160 -c–a-w- c:\windows\system32\dllcache\irmon.dll
2011-04-06 19:06:02 23552 -c–a-w- c:\windows\system32\dllcache\irmk7.sys
2011-04-06 19:06:01 151552 -c–a-w- c:\windows\system32\dllcache\irftp.exe
2011-04-06 19:05:59 88192 -c–a-w- c:\windows\system32\dllcache\irda.sys
2011-04-06 19:05:48 45632 -c–a-w- c:\windows\system32\dllcache\ip5515.sys
2011-04-06 19:05:42 90200 -c–a-w- c:\windows\system32\dllcache\io8ports.dll
2011-04-06 19:05:37 38784 -c–a-w- c:\windows\system32\dllcache\io8.sys
2011-04-06 19:05:29 13056 -c–a-w- c:\windows\system32\dllcache\inport.sys
2011-04-06 19:05:24 16000 -c–a-w- c:\windows\system32\dllcache\ini910u.sys
2011-04-06 19:05:02 372824 -c–a-w- c:\windows\system32\dllcache\iconf32.dll
2011-04-06 19:04:56 100992 -c–a-w- c:\windows\system32\dllcache\icam5usb.sys
2011-04-06 19:04:50 20480 -c–a-w- c:\windows\system32\dllcache\icam5ext.dll
2011-04-06 19:04:45 45056 -c–a-w- c:\windows\system32\dllcache\icam5com.dll
2011-04-06 19:04:39 154496 -c–a-w- c:\windows\system32\dllcache\icam4usb.sys
2011-04-06 19:04:34 61952 -c–a-w- c:\windows\system32\dllcache\icam4ext.dll
2011-04-06 19:04:29 91136 -c–a-w- c:\windows\system32\dllcache\icam4com.dll
2011-04-06 19:04:23 26624 -c–a-w- c:\windows\system32\dllcache\icam3ext.dll
2011-04-06 19:04:18 141056 -c–a-w- c:\windows\system32\dllcache\icam3.sys
2011-04-06 19:04:12 38528 -c–a-w- c:\windows\system32\dllcache\ibmvcap.sys
2011-04-06 19:04:07 109085 -c–a-w- c:\windows\system32\dllcache\ibmtrp.sys
2011-04-06 19:04:01 100936 -c–a-w- c:\windows\system32\dllcache\ibmtok.sys
2011-04-06 19:02:57 73279 -c–a-w- c:\windows\system32\dllcache\hsf_spkp.sys
2011-04-06 19:02:52 44863 -c–a-w- c:\windows\system32\dllcache\hsf_soar.sys
2011-04-06 19:02:47 57471 -c–a-w- c:\windows\system32\dllcache\hsf_samp.sys
2011-04-06 19:02:41 542879 -c–a-w- c:\windows\system32\dllcache\hsf_msft.sys
2011-04-06 19:02:36 391199 -c–a-w- c:\windows\system32\dllcache\hsf_k56k.sys
2011-04-06 19:02:31 9759 -c–a-w- c:\windows\system32\dllcache\hsf_inst.dll
2011-04-06 19:02:25 115807 -c–a-w- c:\windows\system32\dllcache\hsf_fsks.sys
2011-04-06 19:02:19 199711 -c–a-w- c:\windows\system32\dllcache\hsf_faxx.sys
2011-04-06 19:02:14 289887 -c–a-w- c:\windows\system32\dllcache\hsf_fall.sys
2011-04-06 19:02:09 67167 -c–a-w- c:\windows\system32\dllcache\hsf_bsc2.sys
2011-04-06 19:02:03 150239 -c–a-w- c:\windows\system32\dllcache\hsf_amos.sys
2011-04-06 19:01:57 19456 -c–a-w- c:\windows\system32\dllcache\hr1w.dll
2011-04-06 19:01:52 5760 -c–a-w- c:\windows\system32\dllcache\hpt4qic.sys
2011-04-06 19:01:46 13312 -c–a-w- c:\windows\system32\dllcache\hpsjmcro.dll
2011-04-06 19:01:41 324608 -c–a-w- c:\windows\system32\dllcache\hpojwia.dll
2011-04-06 19:01:36 25952 -c–a-w- c:\windows\system32\dllcache\hpn.sys
2011-04-06 19:01:31 32768 -c–a-w- c:\windows\system32\dllcache\hpgtmcro.dll
2011-04-06 19:01:26 68608 -c–a-w- c:\windows\system32\dllcache\hpgt53tk.dll
2011-04-06 19:01:21 165888 -c–a-w- c:\windows\system32\dllcache\hpgt53.dll
2011-04-06 19:01:16 31232 -c–a-w- c:\windows\system32\dllcache\hpgt42tk.dll
2011-04-06 19:01:11 93696 -c–a-w- c:\windows\system32\dllcache\hpgt42.dll
2011-04-06 19:01:05 126976 -c–a-w- c:\windows\system32\dllcache\hpgt34tk.dll
2011-04-06 19:01:00 101376 -c–a-w- c:\windows\system32\dllcache\hpgt34.dll
2011-04-06 18:59:55 17408 -c–a-w- c:\windows\system32\dllcache\gpr400.sys
2011-04-06 18:59:51 59136 -c–a-w- c:\windows\system32\dllcache\gckernel.sys
2011-04-06 18:59:49 10624 -c–a-w- c:\windows\system32\dllcache\gameenum.sys
2011-04-06 18:59:46 46464 -c–a-w- c:\windows\system32\dllcache\gagp30kx.sys
2011-04-06 18:59:41 322432 -c–a-w- c:\windows\system32\dllcache\g400m.sys
2011-04-06 18:59:37 1733120 -c–a-w- c:\windows\system32\dllcache\g400d.dll
2011-04-06 18:59:32 320384 -c–a-w- c:\windows\system32\dllcache\g200m.sys
2011-04-06 18:59:27 470144 -c–a-w- c:\windows\system32\dllcache\g200d.dll
2011-04-06 18:59:23 454912 -c–a-w- c:\windows\system32\dllcache\fxusbase.sys
2011-04-06 18:59:01 92160 -c–a-w- c:\windows\system32\dllcache\fuusd.dll
2011-04-06 18:58:56 455296 -c–a-w- c:\windows\system32\dllcache\fusbbase.sys
2011-04-06 18:58:52 455680 -c–a-w- c:\windows\system32\dllcache\fus2base.sys
2011-04-06 18:58:45 442240 -c–a-w- c:\windows\system32\dllcache\fpnpbase.sys
2011-04-06 18:58:39 441728 -c–a-w- c:\windows\system32\dllcache\fpcmbase.sys
2011-04-06 18:58:34 444416 -c–a-w- c:\windows\system32\dllcache\fpcibase.sys
2011-04-06 18:58:31 34173 -c–a-w- c:\windows\system32\dllcache\forehe.sys
2011-04-06 18:58:24 71680 -c–a-w- c:\windows\system32\dllcache\fnfilter.dll
2011-04-06 18:58:15 27165 -c–a-w- c:\windows\system32\dllcache\fetnd5.sys
2011-04-06 18:58:03 22090 -c–a-w- c:\windows\system32\dllcache\fem556n5.sys
2011-04-06 18:56:57 594238 -c–a-w- c:\windows\system32\dllcache\es56hpi.sys
2011-04-06 18:55:54 19996 -c–a-w- c:\windows\system32\dllcache\em556n4.sys
2011-04-06 18:54:58 50719 -c–a-w- c:\windows\system32\dllcache\e1000nt5.sys
2011-04-06 18:53:59 31305 -c–a-w- c:\windows\system32\dllcache\disrvpp.dll
2011-04-06 18:52:58 20928 -c–a-w- c:\windows\system32\dllcache\defpa.sys
2011-04-06 18:51:58 3072 -c–a-w- c:\windows\system32\dllcache\cwbase.sys
2011-04-06 18:50:59 91264 -c–a-w- c:\windows\system32\dllcache\cirrus.dll
2011-04-06 18:49:25 13824 -c–a-w- c:\windows\system32\dllcache\bulltlp3.sys
2011-04-06 18:48:59 81408 -c–a-w- c:\windows\system32\dllcache\brmfcwia.dll
2011-04-06 18:47:59 516768 -c–a-w- c:\windows\system32\dllcache\ativvaxx.dll
2011-04-06 18:46:59 63663 -c–a-w- c:\windows\system32\dllcache\ati1rvxx.sys
2011-04-06 18:45:59 10880 -c–a-w- c:\windows\system32\dllcache\admjoy.sys
2011-04-06 18:44:45 66048 -c–a-w- c:\windows\system32\dllcache\s3legacy.dll
2011-04-04 22:29:24 ——– d—–w- c:\program files\Hamachi
2011-03-29 14:41:01 2944 —ha-w- c:\windows\system32\drivers\dciiodrv.sys
2011-03-29 00:27:19 16896 —-a-r- c:\docume~1\dolore~1\applic~1\microsoft\installer\{96443f45-13e2-11d6-ac87-00d0b7a9e540}\Icon96443F453.exe
2011-03-29 00:25:18 ——– d—–w- c:\program files\JoWood
2011-03-26 21:47:59 ——– d—–w- c:\docume~1\dolore~1\applic~1\X-Chat 2
2011-03-26 21:46:25 ——– d—–w- c:\program files\X-Chat 2
2011-03-24 09:31:29 371544 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-03-22 05:34:35 1536 —-a-w- c:\windows\system32\drivers\GameNT.sys
2011-03-22 02:55:48 ——– d—–w- c:\program files\mektek.net
2011-03-20 07:32:16 ——– d—–w- C:\ZDaemon
2011-03-18 03:53:08 ——– d—–w- c:\program files\ManyCam
2011-03-17 01:15:34 ——– d—–w- c:\program files\Postal2
2011-03-15 03:54:51 ——– d—–w- c:\program files\Sony Online Entertainment
2011-03-14 07:21:30 ——– d—–w- C:\tmp
.
==================== Find3M ====================
.
2011-04-11 00:15:16 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-03-09 03:14:27 21840 —-a-w- c:\windows\system32\SIntfNT.dll
2011-03-09 03:14:27 17212 —-a-w- c:\windows\system32\SIntf32.dll
2011-03-09 03:14:27 12067 —-a-w- c:\windows\system32\SIntf16.dll
2011-02-23 14:04:21 40648 —-a-w- c:\windows\avastSS.scr
2011-02-09 13:53:52 270848 —-a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53:52 186880 —-a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58:35 2067456 —-a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57:06 677888 —-a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44:37 439296 —-a-w- c:\windows\system32\shimgvw.dll
2008-05-07 14:34:00 15523560 —-a-w- c:\program files\U1 Setup.exe
.
============= FINISH: 19:56:44.84 ===============

Attachments:

📎Attach.txt

Tomk

Post #6April 12, 2011, 1:06 AM UTC

It looks like on the 6th that most of your dllcache files were replaced. Maybe you ran a SFC scan?

Let's check some of that…

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Lp57

Post #7April 12, 2011, 2:02 AM UTC last edited April 12, 2011, 2:15 AM UTC

ComboFix 11-04-11.02 - Dolores Clark 04/11/2011 21:34:20.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.652 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Dolores Clark\_online.exe
c:\documents and settings\Dolores Clark\Application Data\MiniDm
c:\documents and settings\Dolores Clark\Application Data\MiniDm\conf.ini
c:\documents and settings\Dolores Clark\Application Data\MiniDm\history.dat
c:\documents and settings\Dolores Clark\Local Settings\Tempals_inst.exe
c:\documents and settings\Dolores Clark\WINDOWS
c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.2.inf
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\Thumbs.db
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_usnjsvc
.
.
((((((((((((((((((((((((( Files Created from 2011-03-12 to 2011-04-12 )))))))))))))))))))))))))))))))
.
.
2011-04-11 02:40 . 2011-04-11 02:42 ——– d—–w- c:\program files\Ace of Spades
2011-04-11 00:16 . 2011-04-11 00:16 ——– d—–w- c:\program files\Common Files\Java
2011-04-11 00:16 . 2011-04-11 00:15 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-04-11 00:15 . 2011-04-11 00:15 ——– d—–w- c:\program files\Java
2011-04-08 21:46 . 2011-04-08 21:46 ——– d—–w- c:\documents and settings\All Users\Application Data\SplitMediaLabs
2011-04-08 21:44 . 2011-04-08 21:44 ——– d—–w- c:\program files\SplitMediaLabs
2011-04-08 19:42 . 2011-04-08 19:42 452668 —-a-w- c:\windows\Snowflakes (plug-in) Uninstaller.exe
2011-04-06 19:43 . 2008-04-14 09:42 116224 -c–a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-04-06 19:42 . 2001-08-18 02:36 23040 -c–a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-04-06 19:42 . 2008-04-14 09:42 18944 -c–a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-04-06 19:42 . 2001-08-18 02:37 27648 -c–a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-04-06 19:42 . 2001-08-18 02:37 4608 -c–a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-04-06 19:42 . 2001-08-18 02:37 99865 -c–a-w- c:\windows\system32\dllcache\xlog.exe
2011-04-06 19:42 . 2001-08-17 16:11 16970 -c–a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-04-06 19:42 . 2008-04-14 02:04 19455 -c–a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-04-06 19:42 . 2008-04-14 02:04 12063 -c–a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-04-06 19:42 . 2008-04-14 09:42 8192 -c–a-w- c:\windows\system32\dllcache\wshirda.dll
2011-04-06 19:41 . 2008-04-14 04:06 8832 -c–a-w- c:\windows\system32\dllcache\wmiacpi.sys
2011-04-06 19:41 . 2008-04-14 02:05 154624 -c–a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-04-06 19:41 . 2001-08-17 16:12 34890 -c–a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-04-06 19:41 . 2001-08-17 17:28 771581 -c–a-w- c:\windows\system32\dllcache\winacisa.sys
2011-04-06 19:39 . 2001-08-17 16:13 16925 -c–a-w- c:\windows\system32\dllcache\w940nd.sys
2011-04-06 19:39 . 2001-08-17 16:13 19016 -c–a-w- c:\windows\system32\dllcache\w926nd.sys
2011-04-06 19:39 . 2001-08-17 16:13 19528 -c–a-w- c:\windows\system32\dllcache\w840nd.sys
2011-04-06 19:39 . 2001-08-17 17:28 64605 -c–a-w- c:\windows\system32\dllcache\vvoice.sys
2011-04-06 19:39 . 2001-08-17 17:28 397502 -c–a-w- c:\windows\system32\dllcache\vpctcom.sys
2011-04-06 19:39 . 2001-08-17 17:28 604253 -c–a-w- c:\windows\system32\dllcache\vmodem.sys
2011-04-06 19:39 . 2001-08-17 16:14 249402 -c–a-w- c:\windows\system32\dllcache\vinwm.sys
2011-04-06 19:38 . 2001-08-17 17:49 24576 -c–a-w- c:\windows\system32\dllcache\viairda.sys
2011-04-06 19:38 . 2008-04-14 04:10 5376 -c–a-w- c:\windows\system32\dllcache\viaide.sys
2011-04-06 19:38 . 2008-04-14 04:06 42240 -c–a-w- c:\windows\system32\dllcache\viaagp.sys
2011-04-06 19:38 . 2008-04-14 09:42 11325 -c–a-w- c:\windows\system32\dllcache\vchnt5.dll
2011-04-06 19:38 . 2001-08-17 17:28 687999 -c–a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-04-06 19:38 . 2001-08-17 17:28 765884 -c–a-w- c:\windows\system32\dllcache\usrti.sys
2011-04-06 19:38 . 2001-08-17 17:28 113762 -c–a-w- c:\windows\system32\dllcache\usrpda.sys
2011-04-06 19:38 . 2001-08-17 17:28 7556 -c–a-w- c:\windows\system32\dllcache\usroslba.sys
2011-04-06 19:38 . 2001-08-17 17:28 224802 -c–a-w- c:\windows\system32\dllcache\usr1807a.sys
2011-04-06 19:37 . 2001-08-17 17:28 794399 -c–a-w- c:\windows\system32\dllcache\usr1806v.sys
2011-04-06 19:37 . 2001-08-17 17:28 793598 -c–a-w- c:\windows\system32\dllcache\usr1806.sys
2011-04-06 19:37 . 2001-08-17 17:28 794654 -c–a-w- c:\windows\system32\dllcache\usr1801.sys
2011-04-06 19:37 . 2008-04-14 04:15 26112 -c–a-w- c:\windows\system32\dllcache\usbser.sys
2011-04-06 19:37 . 2008-04-14 04:17 25856 -c–a-w- c:\windows\system32\dllcache\usbprint.sys
2011-04-06 19:37 . 2008-04-14 04:15 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2011-04-06 19:37 . 2008-04-14 04:15 17152 -c–a-w- c:\windows\system32\dllcache\usbohci.sys
2011-04-06 19:37 . 2008-04-14 04:26 12800 -c–a-w- c:\windows\system32\dllcache\usb8023x.sys
2011-04-06 19:37 . 2008-04-14 02:05 32384 -c–a-w- c:\windows\system32\dllcache\usb101et.sys
2011-04-06 19:37 . 2001-08-18 02:36 94720 -c–a-w- c:\windows\system32\dllcache\umaxud32.dll
2011-04-06 19:37 . 2001-08-18 02:36 28160 -c–a-w- c:\windows\system32\dllcache\umaxu40.dll
2011-04-06 19:36 . 2001-08-18 02:36 26624 -c–a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-04-06 19:36 . 2001-08-18 02:36 69632 -c–a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-04-06 19:36 . 2001-08-18 02:36 50688 -c–a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-04-06 19:36 . 2001-08-17 17:58 22912 -c–a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-04-06 19:36 . 2001-08-18 02:36 50176 -c–a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-04-06 19:36 . 2001-08-18 02:36 47616 -c–a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-04-06 19:36 . 2001-08-18 02:36 211968 -c–a-w- c:\windows\system32\dllcache\um54scan.dll
2011-04-06 19:36 . 2001-08-18 02:36 216064 -c–a-w- c:\windows\system32\dllcache\um34scan.dll
2011-04-06 19:35 . 2001-08-17 17:52 36736 -c–a-w- c:\windows\system32\dllcache\ultra.sys
2011-04-06 19:35 . 2008-04-14 04:06 44672 -c–a-w- c:\windows\system32\dllcache\uagp35.sys
2011-04-06 19:35 . 2001-08-17 17:48 11520 -c–a-w- c:\windows\system32\dllcache\twotrack.sys
2011-04-06 19:35 . 2001-08-17 16:51 166784 -c–a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-04-06 19:35 . 2001-08-18 02:36 525568 -c–a-w- c:\windows\system32\dllcache\tridxp.dll
2011-04-06 19:35 . 2001-08-17 16:51 159232 -c–a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-04-06 19:35 . 2001-08-17 18:56 440576 -c–a-w- c:\windows\system32\dllcache\tridkb.dll
2011-04-06 19:35 . 2001-08-17 16:51 222336 -c–a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-04-06 19:34 . 2001-08-17 18:56 315520 -c–a-w- c:\windows\system32\dllcache\trid3d.dll
2011-04-06 19:34 . 2001-08-17 16:12 34375 -c–a-w- c:\windows\system32\dllcache\tpro4.sys
2011-04-06 19:34 . 2001-08-18 02:35 42496 -c–a-w- c:\windows\system32\dllcache\tp4res.dll
2011-04-06 19:34 . 2008-04-14 09:42 82944 -c–a-w- c:\windows\system32\dllcache\tp4mon.exe
2011-04-06 19:34 . 2001-08-18 02:36 31744 -c–a-w- c:\windows\system32\dllcache\tp4.dll
2011-04-06 19:34 . 2001-08-17 17:51 4992 -c–a-w- c:\windows\system32\dllcache\toside.sys
2011-04-06 19:34 . 2001-08-17 18:02 230912 -c–a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-04-06 19:34 . 2001-08-17 18:01 241664 -c–a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-04-06 19:33 . 2001-08-17 16:10 28232 -c–a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-04-06 19:33 . 2001-08-17 16:14 123995 -c–a-w- c:\windows\system32\dllcache\tjisdn.sys
2011-04-06 19:33 . 2001-08-17 16:51 138528 -c–a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2011-04-06 19:33 . 2001-08-17 18:56 81408 -c–a-w- c:\windows\system32\dllcache\tgiul50.dll
2011-04-06 19:33 . 2008-04-14 04:10 149376 -c–a-w- c:\windows\system32\dllcache\tffsport.sys
2011-04-06 19:33 . 2001-08-17 16:13 17129 -c–a-w- c:\windows\system32\dllcache\tdkcd31.sys
2011-04-06 19:33 . 2001-08-17 16:13 37961 -c–a-w- c:\windows\system32\dllcache\tdk100b.sys
2011-04-06 19:32 . 2001-08-17 17:49 30464 -c–a-w- c:\windows\system32\dllcache\tbatm155.sys
2011-04-06 19:32 . 2001-08-17 17:52 7040 -c–a-w- c:\windows\system32\dllcache\tandqic.sys
2011-04-06 19:32 . 2001-08-17 16:50 36640 -c–a-w- c:\windows\system32\dllcache\t2r4mini.sys
2011-04-06 19:32 . 2001-08-17 18:56 172768 -c–a-w- c:\windows\system32\dllcache\t2r4disp.dll
2011-04-06 19:32 . 2001-08-17 18:07 32640 -c–a-w- c:\windows\system32\dllcache\symc8xx.sys
2011-04-06 19:32 . 2001-08-17 18:07 16256 -c–a-w- c:\windows\system32\dllcache\symc810.sys
2011-04-06 19:32 . 2001-08-17 18:07 30688 -c–a-w- c:\windows\system32\dllcache\sym_u3.sys
2011-04-06 19:32 . 2001-08-17 18:07 28384 -c–a-w- c:\windows\system32\dllcache\sym_hi.sys
2011-04-06 19:31 . 2001-08-18 02:36 94293 -c–a-w- c:\windows\system32\dllcache\sxports.dll
2011-04-06 19:31 . 2001-08-17 17:50 103936 -c–a-w- c:\windows\system32\dllcache\sx.sys
2011-04-06 19:31 . 2001-08-17 18:02 3968 -c–a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-04-06 19:31 . 2001-08-18 02:36 10240 -c–a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-04-06 19:31 . 2001-08-18 02:36 10240 -c–a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-04-06 19:31 . 2001-08-18 02:36 53760 -c–a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-04-06 19:31 . 2001-08-18 02:36 41472 -c–a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-04-06 19:30 . 2001-08-18 02:36 155648 -c–a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-04-06 19:30 . 2001-08-18 02:36 53248 -c–a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-04-06 19:30 . 2001-08-17 16:18 285760 -c–a-w- c:\windows\system32\dllcache\stlnata.sys
2011-04-06 19:30 . 2001-08-17 17:51 16896 -c–a-w- c:\windows\system32\dllcache\stcusb.sys
2011-04-06 19:30 . 2001-08-17 16:11 48736 -c–a-w- c:\windows\system32\dllcache\srwlnd5.sys
2011-04-06 19:30 . 2001-08-18 02:36 99328 -c–a-w- c:\windows\system32\dllcache\srusd.dll
2011-04-06 19:30 . 2001-08-18 02:36 24660 -c–a-w- c:\windows\system32\dllcache\spxupchk.dll
2011-04-06 19:29 . 2001-08-17 17:51 61824 -c–a-w- c:\windows\system32\dllcache\speed.sys
2011-04-06 19:29 . 2001-08-18 02:36 106584 -c–a-w- c:\windows\system32\dllcache\spdports.dll
2011-04-06 19:29 . 2001-08-17 18:07 19072 -c–a-w- c:\windows\system32\dllcache\sparrow.sys
2011-04-06 19:29 . 2001-08-17 17:56 7552 -c–a-w- c:\windows\system32\dllcache\sonypvu1.sys
2011-04-06 19:29 . 2001-08-17 16:51 37040 -c–a-w- c:\windows\system32\dllcache\sonypi.sys
2011-04-06 19:29 . 2001-08-18 02:36 114688 -c–a-w- c:\windows\system32\dllcache\sonypi.dll
2011-04-06 19:29 . 2001-08-17 16:51 20752 -c–a-w- c:\windows\system32\dllcache\sonync.sys
2011-04-06 19:29 . 2001-08-17 17:53 9600 -c–a-w- c:\windows\system32\dllcache\sonymc.sys
2011-04-06 19:29 . 2008-04-14 04:10 7552 -c–a-w- c:\windows\system32\dllcache\sonyait.sys
2011-04-06 19:28 . 2001-08-17 17:53 7040 -c–a-w- c:\windows\system32\dllcache\snyaitmc.sys
2011-04-06 19:28 . 2001-08-17 16:51 58368 -c–a-w- c:\windows\system32\dllcache\smiminib.sys
2011-04-06 19:28 . 2001-08-17 18:56 147200 -c–a-w- c:\windows\system32\dllcache\smidispb.dll
2011-04-06 19:28 . 2001-08-17 16:12 25034 -c–a-w- c:\windows\system32\dllcache\smcpwr2n.sys
2011-04-06 19:28 . 2001-08-17 16:10 35913 -c–a-w- c:\windows\system32\dllcache\smcirda.sys
2011-04-06 19:28 . 2001-08-17 16:12 24576 -c–a-w- c:\windows\system32\dllcache\smc8000n.sys
2011-04-06 19:26 . 2001-08-17 16:12 91294 -c–a-w- c:\windows\system32\dllcache\skfpwin.sys
2011-04-06 19:26 . 2001-08-17 16:12 94698 -c–a-w- c:\windows\system32\dllcache\sk98xwin.sys
2011-04-06 19:26 . 2001-08-17 18:56 157696 -c–a-w- c:\windows\system32\dllcache\sisv256.dll
2011-04-06 19:26 . 2001-08-17 16:50 50432 -c–a-w- c:\windows\system32\dllcache\sisv.sys
2011-04-06 19:26 . 2008-04-14 02:05 32768 -c–a-w- c:\windows\system32\dllcache\sisnic.sys
2011-04-06 19:26 . 2001-08-18 02:36 238592 -c–a-w- c:\windows\system32\dllcache\sisgrv.dll
2011-04-06 19:26 . 2001-08-17 16:50 104064 -c–a-w- c:\windows\system32\dllcache\sisgrp.sys
2011-04-06 19:26 . 2008-04-14 04:06 40960 -c–a-w- c:\windows\system32\dllcache\sisagp.sys
2011-04-06 19:26 . 2001-08-17 18:56 150144 -c–a-w- c:\windows\system32\dllcache\sis6306v.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-11 00:15 . 2010-04-19 05:39 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-04-04 22:58 . 2009-09-28 10:33 17480 —-a-w- c:\windows\system32\drivers\hamachi.sys
2011-03-09 03:14 . 2011-03-09 03:14 21840 —-a-w- c:\windows\system32\SIntfNT.dll
2011-03-09 03:14 . 2011-03-09 03:14 17212 —-a-w- c:\windows\system32\SIntf32.dll
2011-03-09 03:14 . 2011-03-09 03:14 12067 —-a-w- c:\windows\system32\SIntf16.dll
2011-02-23 14:04 . 2010-12-21 00:30 40648 —-a-w- c:\windows\avastSS.scr
2011-02-23 14:04 . 2010-12-21 00:30 190016 —-a-w- c:\windows\system32\aswBoot.exe
2011-02-23 13:56 . 2010-12-21 00:31 301528 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-02-23 13:55 . 2010-12-21 00:31 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-02-23 13:55 . 2010-12-21 00:31 102232 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-02-23 13:55 . 2010-12-21 00:31 96344 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-02-23 13:55 . 2010-12-21 00:31 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-02-23 13:54 . 2010-12-21 00:31 30680 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-02-23 13:54 . 2010-12-21 00:31 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-02-09 13:53 . 2008-07-29 22:51 270848 —-a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2008-07-29 22:51 186880 —-a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2008-07-29 23:04 2067456 —-a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2008-07-29 23:04 677888 —-a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2008-07-29 22:51 439296 —-a-w- c:\windows\system32\shimgvw.dll
2008-05-07 14:34 . 2008-07-30 00:28 15523560 —-a-w- c:\program files\U1 Setup.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 14:04 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-28 136176]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-06-01 5252408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-24 100888]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-09-17 106496]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-09-16 593920]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2008-09-03 335872]
"ETDWareDetect"="c:\program files\Elantech\ETDDect.exe" [2008-08-28 204800]
"RTHDCPL"="RTHDCPL.EXE" [2008-03-06 16858112]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-02-23 3451496]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]
.
c:\documents and settings\Dolores Clark\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Asus Power Management Utility.lnk - c:\program files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe [2008-11-17 294912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
2009-02-02 17:46 251264 —-a-w- c:\program files\IncrediMail\bin\IncMail.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2007-10-18 18:34 5724184 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-16 23:44 1242448 —-a-w- c:\program files\Steam\Steam.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\zsnesw142\\zsnesw.exe"=
"c:\\Magic\\Manalink.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Baldur's Gate\\App\\BGtOS\\BGMain2.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Empire at War\\GameData\\sweaw.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"=
"c:\\MameKai\\kaillerasrv.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\avp\\AvP .exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\EA GAMES\\American McGee's Alice\\Alice.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=
"c:\\ZDaemon\\ZLauncher.exe"=
"c:\\ZDaemon\\zdaemon.exe"=
"c:\\Program Files\\mektek.net\\MTX\\mtx.exe"=
"c:\\Program Files\\mektek.net\\Mechwarrior Mercenaries - Mektek Mekpak\\MW4Mercs.exe"=
"c:\\Program Files\\X-Chat 2\\xchat.exe"=
"c:\\Program Files\\Taldren Software Inc\\Starfleet Command Orion Pirates\\StarFleetOP.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57158:TCP"= 57158:TCP:Pando Media Booster
"57158:UDP"= 57158:UDP:Pando Media Booster
"58962:TCP"= 58962:TCP:Pando Media Booster
"58962:UDP"= 58962:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/3/2009 1:52 AM 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [3/24/2011 5:31 AM 371544]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [12/20/2010 8:31 PM 301528]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/20/2010 8:31 PM 19544]
S3 cpuz130;cpuz130;\??\c:\docume~1\DOLORE~1\LOCALS~1\Temp\cpuz130\cpuz_x32.sys –> c:\docume~1\DOLORE~1\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 dciiodrv;dciiodrv;c:\windows\system32\drivers\dciiodrv.sys [3/29/2011 10:41 AM 2944]
S3 dump_wmimmc;dump_wmimmc;\??\c:\program files\Gpotato\Flyff\GameGuard\dump_wmimmc.sys –> c:\program files\Gpotato\Flyff\GameGuard\dump_wmimmc.sys [?]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys –> c:\windows\system32\DRIVERS\ManyCam.sys [?]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [8/19/2008 2:38 PM 38272]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
RPCQT
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-12 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 18:20]
.
2011-04-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1349882262-1105937718-339915021-1006Core.job
- c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-28 08:16]
.
2011-04-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1349882262-1105937718-339915021-1006UA.job
- c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-28 08:16]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Windows; Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: ActiveGS.cab - hxxp://activegs.freetoolsassociation.com/ActiveGS.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Birth of the Federation version 1.0.2 - c:\botf\Uninst.isu
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-11 21:50
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(980)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\MSN\Toolbar\3.0.1125.0\mstbsvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxext.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\msiexec.exe
c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
**************************************************************************
.
Completion time: 2011-04-11 21:59:19 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-12 01:59
.
Pre-Run: 15,771,049,984 bytes free
Post-Run: 15,660,126,208 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 5F7B4467F84450F76282F8612DDB50B8

There's that log, and yeah I did run SFC scan. Some thread that sounded like a similar problem suggested it. Didn't fix the problem tho.

Tomk

Post #8April 12, 2011, 5:06 AM UTC

Lp57,

SFC was a good thing to try.

ComboFix clean up a little bit of what appears just to be dross. Things look pretty good.

Let's try an online scan.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Lp57

Post #9April 12, 2011, 4:02 PM UTC

C:\Documents and Settings\Dolores Clark\My Documents\Azureus Downloads\Starfleet Command 2 - Orion Pirates\updates\SFCOP_DLL_Updater.exe probably a variant of Win32/IRCBot.MGYHQFS trojan C:\Program Files\mektek.net\Mechwarrior Mercenaries - Mektek Mekpak\MW4Mercs.exe probably a variant of Win32/StartPage.ENQZNMK trojan C:\Program Files\mektek.net\MTX\temp\games\mechwarrior4mercenaries.all.to.51.03.01.0017.mtx probably a variant of Win32/StartPage.ENQZNMK trojan C:\Program Files\Windows Live\Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application C:\Program Files\Windows Live\Messenger\riched20.dll Win32/Toolbar.MyWebSearch application Ok… it didn't generate a log file unless I goofed something up but.. these were the 'threats' found.

Tomk

Post #10April 12, 2011, 5:29 PM UTC

Lp57,

That get's me the info I need.

Let's get rid of those:

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
C:\Documents and Settings\Dolores Clark\My Documents\Azureus Downloads\Starfleet Command 2 - Orion Pirates\updates\SFCOP_DLL_Updater.exe C:\Program Files\mektek.net\Mechwarrior Mercenaries - Mektek Mekpak\MW4Mercs.exe 
C:\Program Files\mektek.net\MTX\temp\games\mechwarrior4mercenaries.all.to.51.03.01.0017.mtx 
C:\Program Files\Windows Live\Messenger\msimg32.dll 
C:\Program Files\Windows Live\Messenger\riched20.dll

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Also please advise whether or not you are noticing any improvement.

Lp57

Post #11April 12, 2011, 10:49 PM UTC

ComboFix 11-04-12.01 - Dolores Clark 04/12/2011 18:18:20.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.494 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dolores Clark\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\documents and settings\Dolores Clark\My Documents\Azureus Downloads\Starfleet Command 2 - Orion Pirates\updates\SFCOP_DLL_Updater.exe"
"c:\program files\mektek.net\Mechwarrior Mercenaries - Mektek Mekpak\MW4Mercs.exe"
"c:\program files\mektek.net\MTX\temp\games\mechwarrior4mercenaries.all.to.51.03.01.0017.mtx"
"c:\program files\Windows Live\Messenger\msimg32.dll"
"c:\program files\Windows Live\Messenger\riched20.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Dolores Clark\My Documents\Azureus Downloads\Starfleet Command 2 - Orion Pirates\updates\SFCOP_DLL_Updater.exe
c:\program files\mektek.net\Mechwarrior Mercenaries - Mektek Mekpak\MW4Mercs.exe
c:\program files\mektek.net\MTX\temp\games\mechwarrior4mercenaries.all.to.51.03.01.0017.mtx
c:\program files\Windows Live\Messenger\msimg32.dll
c:\program files\Windows Live\Messenger\riched20.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-03-12 to 2011-04-12 )))))))))))))))))))))))))))))))
.
.
2011-04-11 02:40 . 2011-04-11 02:42 ——– d—–w- c:\program files\Ace of Spades
2011-04-11 00:16 . 2011-04-11 00:16 ——– d—–w- c:\program files\Common Files\Java
2011-04-11 00:16 . 2011-04-11 00:15 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-04-11 00:15 . 2011-04-11 00:15 ——– d—–w- c:\program files\Java
2011-04-08 21:46 . 2011-04-08 21:46 ——– d—–w- c:\documents and settings\All Users\Application Data\SplitMediaLabs
2011-04-08 21:44 . 2011-04-08 21:44 ——– d—–w- c:\program files\SplitMediaLabs
2011-04-08 19:42 . 2011-04-08 19:42 452668 —-a-w- c:\windows\Snowflakes (plug-in) Uninstaller.exe
2011-04-06 19:43 . 2008-04-14 09:42 116224 -c–a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-04-06 19:42 . 2001-08-18 02:36 23040 -c–a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-04-06 19:42 . 2008-04-14 09:42 18944 -c–a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-04-06 19:42 . 2001-08-18 02:37 27648 -c–a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-04-06 19:42 . 2001-08-18 02:37 4608 -c–a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-04-06 19:42 . 2001-08-18 02:37 99865 -c–a-w- c:\windows\system32\dllcache\xlog.exe
2011-04-06 19:42 . 2001-08-17 16:11 16970 -c–a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-04-06 19:42 . 2008-04-14 02:04 19455 -c–a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-04-06 19:42 . 2008-04-14 02:04 12063 -c–a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-04-06 19:42 . 2008-04-14 09:42 8192 -c–a-w- c:\windows\system32\dllcache\wshirda.dll
2011-04-06 19:41 . 2008-04-14 04:06 8832 -c–a-w- c:\windows\system32\dllcache\wmiacpi.sys
2011-04-06 19:41 . 2008-04-14 02:05 154624 -c–a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-04-06 19:41 . 2001-08-17 16:12 34890 -c–a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-04-06 19:41 . 2001-08-17 17:28 771581 -c–a-w- c:\windows\system32\dllcache\winacisa.sys
2011-04-06 19:39 . 2001-08-17 16:13 16925 -c–a-w- c:\windows\system32\dllcache\w940nd.sys
2011-04-06 19:39 . 2001-08-17 16:13 19016 -c–a-w- c:\windows\system32\dllcache\w926nd.sys
2011-04-06 19:39 . 2001-08-17 16:13 19528 -c–a-w- c:\windows\system32\dllcache\w840nd.sys
2011-04-06 19:39 . 2001-08-17 17:28 64605 -c–a-w- c:\windows\system32\dllcache\vvoice.sys
2011-04-06 19:39 . 2001-08-17 17:28 397502 -c–a-w- c:\windows\system32\dllcache\vpctcom.sys
2011-04-06 19:39 . 2001-08-17 17:28 604253 -c–a-w- c:\windows\system32\dllcache\vmodem.sys
2011-04-06 19:39 . 2001-08-17 16:14 249402 -c–a-w- c:\windows\system32\dllcache\vinwm.sys
2011-04-06 19:38 . 2001-08-17 17:49 24576 -c–a-w- c:\windows\system32\dllcache\viairda.sys
2011-04-06 19:38 . 2008-04-14 04:10 5376 -c–a-w- c:\windows\system32\dllcache\viaide.sys
2011-04-06 19:38 . 2008-04-14 04:06 42240 -c–a-w- c:\windows\system32\dllcache\viaagp.sys
2011-04-06 19:38 . 2008-04-14 09:42 11325 -c–a-w- c:\windows\system32\dllcache\vchnt5.dll
2011-04-06 19:38 . 2001-08-17 17:28 687999 -c–a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-04-06 19:38 . 2001-08-17 17:28 765884 -c–a-w- c:\windows\system32\dllcache\usrti.sys
2011-04-06 19:38 . 2001-08-17 17:28 113762 -c–a-w- c:\windows\system32\dllcache\usrpda.sys
2011-04-06 19:38 . 2001-08-17 17:28 7556 -c–a-w- c:\windows\system32\dllcache\usroslba.sys
2011-04-06 19:38 . 2001-08-17 17:28 224802 -c–a-w- c:\windows\system32\dllcache\usr1807a.sys
2011-04-06 19:37 . 2001-08-17 17:28 794399 -c–a-w- c:\windows\system32\dllcache\usr1806v.sys
2011-04-06 19:37 . 2001-08-17 17:28 793598 -c–a-w- c:\windows\system32\dllcache\usr1806.sys
2011-04-06 19:37 . 2001-08-17 17:28 794654 -c–a-w- c:\windows\system32\dllcache\usr1801.sys
2011-04-06 19:37 . 2008-04-14 04:15 26112 -c–a-w- c:\windows\system32\dllcache\usbser.sys
2011-04-06 19:37 . 2008-04-14 04:17 25856 -c–a-w- c:\windows\system32\dllcache\usbprint.sys
2011-04-06 19:37 . 2008-04-14 04:15 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2011-04-06 19:37 . 2008-04-14 04:15 17152 -c–a-w- c:\windows\system32\dllcache\usbohci.sys
2011-04-06 19:37 . 2008-04-14 04:26 12800 -c–a-w- c:\windows\system32\dllcache\usb8023x.sys
2011-04-06 19:37 . 2008-04-14 02:05 32384 -c–a-w- c:\windows\system32\dllcache\usb101et.sys
2011-04-06 19:37 . 2001-08-18 02:36 94720 -c–a-w- c:\windows\system32\dllcache\umaxud32.dll
2011-04-06 19:37 . 2001-08-18 02:36 28160 -c–a-w- c:\windows\system32\dllcache\umaxu40.dll
2011-04-06 19:36 . 2001-08-18 02:36 26624 -c–a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-04-06 19:36 . 2001-08-18 02:36 69632 -c–a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-04-06 19:36 . 2001-08-18 02:36 50688 -c–a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-04-06 19:36 . 2001-08-17 17:58 22912 -c–a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-04-06 19:36 . 2001-08-18 02:36 50176 -c–a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-04-06 19:36 . 2001-08-18 02:36 47616 -c–a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-04-06 19:36 . 2001-08-18 02:36 211968 -c–a-w- c:\windows\system32\dllcache\um54scan.dll
2011-04-06 19:36 . 2001-08-18 02:36 216064 -c–a-w- c:\windows\system32\dllcache\um34scan.dll
2011-04-06 19:35 . 2001-08-17 17:52 36736 -c–a-w- c:\windows\system32\dllcache\ultra.sys
2011-04-06 19:35 . 2008-04-14 04:06 44672 -c–a-w- c:\windows\system32\dllcache\uagp35.sys
2011-04-06 19:35 . 2001-08-17 17:48 11520 -c–a-w- c:\windows\system32\dllcache\twotrack.sys
2011-04-06 19:35 . 2001-08-17 16:51 166784 -c–a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-04-06 19:35 . 2001-08-18 02:36 525568 -c–a-w- c:\windows\system32\dllcache\tridxp.dll
2011-04-06 19:35 . 2001-08-17 16:51 159232 -c–a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-04-06 19:35 . 2001-08-17 18:56 440576 -c–a-w- c:\windows\system32\dllcache\tridkb.dll
2011-04-06 19:35 . 2001-08-17 16:51 222336 -c–a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-04-06 19:34 . 2001-08-17 18:56 315520 -c–a-w- c:\windows\system32\dllcache\trid3d.dll
2011-04-06 19:34 . 2001-08-17 16:12 34375 -c–a-w- c:\windows\system32\dllcache\tpro4.sys
2011-04-06 19:34 . 2001-08-18 02:35 42496 -c–a-w- c:\windows\system32\dllcache\tp4res.dll
2011-04-06 19:34 . 2008-04-14 09:42 82944 -c–a-w- c:\windows\system32\dllcache\tp4mon.exe
2011-04-06 19:34 . 2001-08-18 02:36 31744 -c–a-w- c:\windows\system32\dllcache\tp4.dll
2011-04-06 19:34 . 2001-08-17 17:51 4992 -c–a-w- c:\windows\system32\dllcache\toside.sys
2011-04-06 19:34 . 2001-08-17 18:02 230912 -c–a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-04-06 19:34 . 2001-08-17 18:01 241664 -c–a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-04-06 19:33 . 2001-08-17 16:10 28232 -c–a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-04-06 19:33 . 2001-08-17 16:14 123995 -c–a-w- c:\windows\system32\dllcache\tjisdn.sys
2011-04-06 19:33 . 2001-08-17 16:51 138528 -c–a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2011-04-06 19:33 . 2001-08-17 18:56 81408 -c–a-w- c:\windows\system32\dllcache\tgiul50.dll
2011-04-06 19:33 . 2008-04-14 04:10 149376 -c–a-w- c:\windows\system32\dllcache\tffsport.sys
2011-04-06 19:33 . 2001-08-17 16:13 17129 -c–a-w- c:\windows\system32\dllcache\tdkcd31.sys
2011-04-06 19:33 . 2001-08-17 16:13 37961 -c–a-w- c:\windows\system32\dllcache\tdk100b.sys
2011-04-06 19:32 . 2001-08-17 17:49 30464 -c–a-w- c:\windows\system32\dllcache\tbatm155.sys
2011-04-06 19:32 . 2001-08-17 17:52 7040 -c–a-w- c:\windows\system32\dllcache\tandqic.sys
2011-04-06 19:32 . 2001-08-17 16:50 36640 -c–a-w- c:\windows\system32\dllcache\t2r4mini.sys
2011-04-06 19:32 . 2001-08-17 18:56 172768 -c–a-w- c:\windows\system32\dllcache\t2r4disp.dll
2011-04-06 19:32 . 2001-08-17 18:07 32640 -c–a-w- c:\windows\system32\dllcache\symc8xx.sys
2011-04-06 19:32 . 2001-08-17 18:07 16256 -c–a-w- c:\windows\system32\dllcache\symc810.sys
2011-04-06 19:32 . 2001-08-17 18:07 30688 -c–a-w- c:\windows\system32\dllcache\sym_u3.sys
2011-04-06 19:32 . 2001-08-17 18:07 28384 -c–a-w- c:\windows\system32\dllcache\sym_hi.sys
2011-04-06 19:31 . 2001-08-18 02:36 94293 -c–a-w- c:\windows\system32\dllcache\sxports.dll
2011-04-06 19:31 . 2001-08-17 17:50 103936 -c–a-w- c:\windows\system32\dllcache\sx.sys
2011-04-06 19:31 . 2001-08-17 18:02 3968 -c–a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-04-06 19:31 . 2001-08-18 02:36 10240 -c–a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-04-06 19:31 . 2001-08-18 02:36 10240 -c–a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-04-06 19:31 . 2001-08-18 02:36 53760 -c–a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-04-06 19:31 . 2001-08-18 02:36 41472 -c–a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-04-06 19:30 . 2001-08-18 02:36 155648 -c–a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-04-06 19:30 . 2001-08-18 02:36 53248 -c–a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-04-06 19:30 . 2001-08-17 16:18 285760 -c–a-w- c:\windows\system32\dllcache\stlnata.sys
2011-04-06 19:30 . 2001-08-17 17:51 16896 -c–a-w- c:\windows\system32\dllcache\stcusb.sys
2011-04-06 19:30 . 2001-08-17 16:11 48736 -c–a-w- c:\windows\system32\dllcache\srwlnd5.sys
2011-04-06 19:30 . 2001-08-18 02:36 99328 -c–a-w- c:\windows\system32\dllcache\srusd.dll
2011-04-06 19:30 . 2001-08-18 02:36 24660 -c–a-w- c:\windows\system32\dllcache\spxupchk.dll
2011-04-06 19:29 . 2001-08-17 17:51 61824 -c–a-w- c:\windows\system32\dllcache\speed.sys
2011-04-06 19:29 . 2001-08-18 02:36 106584 -c–a-w- c:\windows\system32\dllcache\spdports.dll
2011-04-06 19:29 . 2001-08-17 18:07 19072 -c–a-w- c:\windows\system32\dllcache\sparrow.sys
2011-04-06 19:29 . 2001-08-17 17:56 7552 -c–a-w- c:\windows\system32\dllcache\sonypvu1.sys
2011-04-06 19:29 . 2001-08-17 16:51 37040 -c–a-w- c:\windows\system32\dllcache\sonypi.sys
2011-04-06 19:29 . 2001-08-18 02:36 114688 -c–a-w- c:\windows\system32\dllcache\sonypi.dll
2011-04-06 19:29 . 2001-08-17 16:51 20752 -c–a-w- c:\windows\system32\dllcache\sonync.sys
2011-04-06 19:29 . 2001-08-17 17:53 9600 -c–a-w- c:\windows\system32\dllcache\sonymc.sys
2011-04-06 19:29 . 2008-04-14 04:10 7552 -c–a-w- c:\windows\system32\dllcache\sonyait.sys
2011-04-06 19:28 . 2001-08-17 17:53 7040 -c–a-w- c:\windows\system32\dllcache\snyaitmc.sys
2011-04-06 19:28 . 2001-08-17 16:51 58368 -c–a-w- c:\windows\system32\dllcache\smiminib.sys
2011-04-06 19:28 . 2001-08-17 18:56 147200 -c–a-w- c:\windows\system32\dllcache\smidispb.dll
2011-04-06 19:28 . 2001-08-17 16:12 25034 -c–a-w- c:\windows\system32\dllcache\smcpwr2n.sys
2011-04-06 19:28 . 2001-08-17 16:10 35913 -c–a-w- c:\windows\system32\dllcache\smcirda.sys
2011-04-06 19:28 . 2001-08-17 16:12 24576 -c–a-w- c:\windows\system32\dllcache\smc8000n.sys
2011-04-06 19:26 . 2001-08-17 16:12 91294 -c–a-w- c:\windows\system32\dllcache\skfpwin.sys
2011-04-06 19:26 . 2001-08-17 16:12 94698 -c–a-w- c:\windows\system32\dllcache\sk98xwin.sys
2011-04-06 19:26 . 2001-08-17 18:56 157696 -c–a-w- c:\windows\system32\dllcache\sisv256.dll
2011-04-06 19:26 . 2001-08-17 16:50 50432 -c–a-w- c:\windows\system32\dllcache\sisv.sys
2011-04-06 19:26 . 2008-04-14 02:05 32768 -c–a-w- c:\windows\system32\dllcache\sisnic.sys
2011-04-06 19:26 . 2001-08-18 02:36 238592 -c–a-w- c:\windows\system32\dllcache\sisgrv.dll
2011-04-06 19:26 . 2001-08-17 16:50 104064 -c–a-w- c:\windows\system32\dllcache\sisgrp.sys
2011-04-06 19:26 . 2008-04-14 04:06 40960 -c–a-w- c:\windows\system32\dllcache\sisagp.sys
2011-04-06 19:26 . 2001-08-17 18:56 150144 -c–a-w- c:\windows\system32\dllcache\sis6306v.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-11 00:15 . 2010-04-19 05:39 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-04-04 22:58 . 2009-09-28 10:33 17480 —-a-w- c:\windows\system32\drivers\hamachi.sys
2011-03-09 03:14 . 2011-03-09 03:14 21840 —-a-w- c:\windows\system32\SIntfNT.dll
2011-03-09 03:14 . 2011-03-09 03:14 17212 —-a-w- c:\windows\system32\SIntf32.dll
2011-03-09 03:14 . 2011-03-09 03:14 12067 —-a-w- c:\windows\system32\SIntf16.dll
2011-02-23 14:04 . 2010-12-21 00:30 40648 —-a-w- c:\windows\avastSS.scr
2011-02-23 14:04 . 2010-12-21 00:30 190016 —-a-w- c:\windows\system32\aswBoot.exe
2011-02-23 13:56 . 2010-12-21 00:31 301528 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-02-23 13:55 . 2010-12-21 00:31 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-02-23 13:55 . 2010-12-21 00:31 102232 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-02-23 13:55 . 2010-12-21 00:31 96344 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-02-23 13:55 . 2010-12-21 00:31 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-02-23 13:54 . 2010-12-21 00:31 30680 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-02-23 13:54 . 2010-12-21 00:31 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-02-09 13:53 . 2008-07-29 22:51 270848 —-a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2008-07-29 22:51 186880 —-a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2008-07-29 23:04 2067456 —-a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2008-07-29 23:04 677888 —-a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2008-07-29 22:51 439296 —-a-w- c:\windows\system32\shimgvw.dll
2008-05-07 14:34 . 2008-07-30 00:28 15523560 —-a-w- c:\program files\U1 Setup.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 14:04 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-28 136176]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-06-01 5252408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-24 100888]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-09-17 106496]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-09-16 593920]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2008-09-03 335872]
"ETDWareDetect"="c:\program files\Elantech\ETDDect.exe" [2008-08-28 204800]
"RTHDCPL"="RTHDCPL.EXE" [2008-03-06 16858112]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-02-23 3451496]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]
.
c:\documents and settings\Dolores Clark\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Asus Power Management Utility.lnk - c:\program files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe [2008-11-17 294912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
2009-02-02 17:46 251264 —-a-w- c:\program files\IncrediMail\bin\IncMail.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2007-10-18 18:34 5724184 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-16 23:44 1242448 —-a-w- c:\program files\Steam\Steam.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\zsnesw142\\zsnesw.exe"=
"c:\\Magic\\Manalink.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Baldur's Gate\\App\\BGtOS\\BGMain2.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Empire at War\\GameData\\sweaw.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"=
"c:\\MameKai\\kaillerasrv.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\avp\\AvP .exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\EA GAMES\\American McGee's Alice\\Alice.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=
"c:\\ZDaemon\\ZLauncher.exe"=
"c:\\ZDaemon\\zdaemon.exe"=
"c:\\Program Files\\mektek.net\\MTX\\mtx.exe"=
"c:\\Program Files\\X-Chat 2\\xchat.exe"=
"c:\\Program Files\\Taldren Software Inc\\Starfleet Command Orion Pirates\\StarFleetOP.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57158:TCP"= 57158:TCP:Pando Media Booster
"57158:UDP"= 57158:UDP:Pando Media Booster
"58962:TCP"= 58962:TCP:Pando Media Booster
"58962:UDP"= 58962:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/3/2009 1:52 AM 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [3/24/2011 5:31 AM 371544]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [12/20/2010 8:31 PM 301528]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/20/2010 8:31 PM 19544]
R2 mstbsvc;MSN Toolbar Setup;c:\program files\MSN\Toolbar\3.0.1125.0\mstbsvc.exe [2/9/2009 9:33 PM 104784]
R2 RPCQT;Remote Procedure Call (CQTPM);c:\windows\System32\svchost.exe -k netsvcs [7/29/2008 6:51 PM 14336]
S2 Norton Internet Security;Norton Internet Security;"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe" /s "Norton Internet Security" /m "c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll" /prefetch:1 –> c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [?]
S3 cpuz130;cpuz130;\??\c:\docume~1\DOLORE~1\LOCALS~1\Temp\cpuz130\cpuz_x32.sys –> c:\docume~1\DOLORE~1\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 dciiodrv;dciiodrv;c:\windows\system32\drivers\dciiodrv.sys [3/29/2011 10:41 AM 2944]
S3 dump_wmimmc;dump_wmimmc;\??\c:\program files\Gpotato\Flyff\GameGuard\dump_wmimmc.sys –> c:\program files\Gpotato\Flyff\GameGuard\dump_wmimmc.sys [?]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys –> c:\windows\system32\DRIVERS\ManyCam.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [8/19/2008 2:38 PM 38272]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
RPCQT
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-12 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 18:20]
.
2011-04-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1349882262-1105937718-339915021-1006Core.job
- c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-28 08:16]
.
2011-04-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1349882262-1105937718-339915021-1006UA.job
- c:\documents and settings\Dolores Clark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-28 08:16]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Windows; Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: ActiveGS.cab - hxxp://activegs.freetoolsassociation.com/ActiveGS.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-12 18:34
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2368)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxext.exe
c:\windows\system32\msiexec.exe
.
**************************************************************************
.
Completion time: 2011-04-12 18:43:49 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-12 22:43
ComboFix2.txt 2011-04-12 01:59
.
Pre-Run: 15,489,724,416 bytes free
Post-Run: 15,369,441,280 bytes free
.
- - End Of File - - 23943A011477E3AF5CB6C090B0AE4C99

Yesterday I didn't have a crash, will see if I get a crash today.

Tomk

Post #12April 13, 2011, 12:29 AM UTC

Lp57,

While your giving things a test drive, let's get an online scan.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Lp57

Post #13April 13, 2011, 5:16 AM UTC

C:\Qoobox\Quarantine\[4]-Submit_2011-04-12_18.17.49.zip multiple threats C:\Qoobox\Quarantine\C\Program Files\mektek.net\MTX\temp\games\mechwarrior4mercenaries.all.to.51.03.01.0017.mtx.vir probably a variant of Win32/StartPage.ENQZNMK trojan C:\System Volume Information\_restore{04178546-C85A-456E-86F0-015E98165390}\RP507\A0097686.dll Win32/Toolbar.MyWebSearch application no crash tonight either.

Tomk

Post #14April 13, 2011, 2:38 PM UTC

Lp57,

Those are all things we've already dealt with.

Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /Uninstall in the runbox and click OK
Note the space between the X and the U, it needs to be there.

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Please re-enable any security that was disabled.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Lp57

Post #15April 13, 2011, 7:59 PM UTC

No crashes so far. Hope it stays that way. Thanks helping! You guys are mah heros.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Chrome Collapse.

✨ Ask AI

Ask AI