Superantispyware finds Rogue.agent/GEN - Nullo[dll]

I see.

Here:

ComboFix 11-08-23.03 - my pc 6/2011 Fri 20:01:44.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.936.86.1033.18.2047.1331 [GMT 8:00]
执行位置: d:\documents and settings\my pc\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Pass LEGAL for license information. Built Sat Jun 25 23:20 2011d:\windows\system32\11552421841.dll
.
.
((((((((((((((((((((((((( 2011-07-26 至 2011-08-26 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-08-26 11:55 . 2011-08-26 11:55 24983 —-a-w- d:\windows\system32\11552421841.dll
2011-08-25 13:59 . 2011-08-25 13:59 ——– d—–w- d:\program files\Microsoft Silverlight
2011-08-24 06:03 . 2011-08-24 06:03 ——– d—a-w- D:\.Trash-999
2011-08-23 15:11 . 2011-07-29 05:54 19840 —-a-w- d:\windows\system32\EuEpmGdi.dll
2011-08-23 15:11 . 2011-08-02 12:48 2469248 —-a-w- d:\windows\system32\BootMan.exe
2011-08-23 15:11 . 2011-07-29 05:54 86408 —-a-w- d:\windows\system32\setupempdrv03.exe
2011-08-23 15:11 . 2011-07-29 05:54 8456 —-a-w- d:\windows\system32\EuGdiDrv.sys
2011-08-23 15:11 . 2011-07-29 05:54 13192 —-a-w- d:\windows\system32\epmntdrv.sys
2011-08-23 15:10 . 2011-08-23 15:10 ——– d—–w- d:\program files\EASEUS
2011-08-23 11:50 . 2010-11-03 18:08 237568 —-a-w- d:\windows\system32\yv12vfw.dll
2011-08-23 11:50 . 2011-06-24 14:44 243200 —-a-w- d:\windows\system32\xvidvfw.dll
2011-08-23 11:50 . 2011-06-24 14:28 650752 —-a-w- d:\windows\system32\xvidcore.dll
2011-08-23 11:50 . 2011-08-08 08:00 74752 —-a-w- d:\windows\system32\ff_vfw.dll
2011-08-20 08:06 . 2011-08-20 08:06 896 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\databasepath.reg
2011-08-20 08:06 . 2011-08-20 08:06 3008 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\bgregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 2600 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\exefix.reg
2011-08-20 08:06 . 2011-08-20 08:06 951291 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\remregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 890 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\Remove-itRestorePoint.vbs
2011-08-20 08:06 . 2011-08-20 08:06 5228 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\nfig.reg
2011-08-20 08:06 . 2011-08-20 08:06 4994 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\s.reg
2011-08-20 08:06 . 2011-08-20 08:06 4512 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\hpregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 18308 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\IEDef.reg
2011-08-20 08:06 . 2011-08-20 08:06 1754 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\regf.reg
2011-08-20 07:06 . 2008-05-02 13:25 465920 -c—-w- d:\windows\system32\dllcache\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 465920 ——w- d:\windows\system32\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 -c—-w- d:\windows\system32\dllcache\imapi2.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 ——w- d:\windows\system32\imapi2.dll
2011-08-20 06:55 . 2011-08-20 07:11 ——– d—–w- d:\documents and settings\LocalService\Application Data\360safe
2011-08-20 04:09 . 2011-08-20 04:09 ——– d—–w- d:\program files\Chaos Group
2011-08-20 03:34 . 2009-07-21 12:24 14080 —-a-w- d:\windows\system32\drivers\36040.tmp
2011-08-20 03:34 . 2009-06-03 14:26 27400 —-a-w- d:\windows\system32\drivers\3603F.tmp
2011-08-20 03:33 . 2011-08-20 08:54 ——– d—–w- d:\documents and settings\All Users\Application Data\360safe
2011-08-20 03:27 . 2011-08-20 03:27 ——– d—–w- d:\documents and settings\All Users\Application Data\360SD
2011-08-20 03:27 . 2011-08-20 08:35 ——– d—–w- d:\program files\360
2011-08-19 12:51 . 2011-08-19 13:36 ——– d—–w- d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-08-19 12:51 . 2011-08-19 12:59 ——– d—–w- d:\program files\Spybot - Search & Destroy
2011-08-16 15:50 . 2011-08-18 11:49 ——– d—–w- d:\program files\SpywareBlaster
2011-08-16 15:47 . 2011-08-16 15:47 ——– d—–w- d:\program files\ESET
2011-08-16 15:29 . 2009-06-30 02:37 28552 —-a-w- d:\windows\system32\drivers\pavboot.sys
2011-08-16 15:29 . 2011-08-16 15:29 ——– d—–w- d:\program files\Panda Security
2011-08-16 14:20 . 2010-05-25 07:59 96488 —-a-w- d:\windows\system32\drivers\ssadbus.sys
2011-08-16 14:20 . 2010-05-25 07:59 30312 —-a-w- d:\windows\system32\drivers\ssadadb.sys
2011-08-16 14:20 . 2010-05-25 07:59 1416680 —-a-w- d:\windows\system32\WdfCoInstaller01005.dll
2011-08-16 14:20 . 2010-05-25 07:59 12776 —-a-w- d:\windows\system32\drivers\ssadmdfl.sys
2011-08-16 14:20 . 2010-05-25 07:59 121576 —-a-w- d:\windows\system32\drivers\ssadmdm.sys
2011-08-16 14:20 . 2010-05-25 07:59 10344 —-a-w- d:\windows\system32\drivers\ssadcmnt.sys
2011-08-16 14:20 . 2010-05-25 07:59 10216 —-a-w- d:\windows\system32\drivers\ssadwhnt.sys
2011-08-13 05:16 . 2011-08-13 05:16 ——– d—–w- d:\program files\FileHippo.com
2011-08-13 04:46 . 2011-08-13 04:46 ——– d—–w- d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com
2011-08-13 04:46 . 2011-08-23 13:24 ——– d—–w- d:\program files\SUPERAntiSpyware
2011-08-13 04:46 . 2011-08-13 04:46 ——– d—–w- d:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconF7A21AF7.exe
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconD7F16134.exe
2011-08-13 03:40 . 2011-08-18 13:31 ——– d—–w- D:\sh4ldr
2011-08-13 03:40 . 2011-08-13 03:40 ——– d—–w- d:\program files\Enigma Software Group
2011-08-13 03:39 . 2011-08-13 03:40 ——– d—–w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2011-08-13 03:39 . 2011-08-13 03:39 ——– d—–w- d:\program files\Common Files\Wise Installation Wizard
2011-08-12 14:16 . 2008-04-13 21:41 81920 ——w- d:\windows\system32\ieencode.dll
2011-08-12 14:15 . 2006-12-28 16:31 19569 —-a-w- d:\windows\000001_.tmp
2011-08-11 15:03 . 2001-08-17 14:36 53760 -c–a-w- d:\windows\system32\dllcache\wiamsmud.dll
2011-08-11 15:02 . 2001-08-17 05:28 687999 -c–a-w- d:\windows\system32\dllcache\usrwdxjs.sys
2011-08-11 15:01 . 2001-08-17 14:36 216064 -c–a-w- d:\windows\system32\dllcache\um34scan.dll
2011-08-11 15:00 . 2001-08-17 04:14 123995 -c–a-w- d:\windows\system32\dllcache\tjisdn.sys
2011-08-11 14:59 . 2001-08-17 14:36 10240 -c–a-w- d:\windows\system32\dllcache\swpidflt.dll
2011-08-11 14:58 . 2001-08-17 05:53 9600 -c–a-w- d:\windows\system32\dllcache\sonymc.sys
2011-08-11 14:57 . 2001-08-17 04:50 50432 -c–a-w- d:\windows\system32\dllcache\sisv.sys
2011-08-11 14:56 . 2001-08-17 05:51 16640 -c–a-w- d:\windows\system32\dllcache\scmstcs.sys
2011-08-11 14:55 . 2001-08-17 04:12 19017 -c–a-w- d:\windows\system32\dllcache\rtl8029.sys
2011-08-11 14:54 . 2001-08-17 05:28 112574 -c–a-w- d:\windows\system32\dllcache\ptserlp.sys
2011-08-11 14:53 . 2001-08-17 04:11 35328 -c–a-w- d:\windows\system32\dllcache\pcntpci5.sys
2011-08-11 14:52 . 2001-08-17 04:50 198144 -c–a-w- d:\windows\system32\dllcache\nv3.sys
2011-08-11 14:51 . 2001-08-17 04:11 128000 -c–a-w- d:\windows\system32\dllcache\n100325.sys
2011-08-11 14:50 . 2001-08-17 05:57 16128 -c–a-w- d:\windows\system32\dllcache\modemcsa.sys
2011-08-11 14:49 . 2001-08-17 04:12 20573 -c–a-w- d:\windows\system32\dllcache\lne100.sys
2011-08-11 14:48 . 2001-08-17 14:36 372824 -c–a-w- d:\windows\system32\dllcache\iconf32.dll
2011-08-11 14:47 . 2001-08-17 05:28 44863 -c–a-w- d:\windows\system32\dllcache\hsf_soar.sys
2011-08-11 14:46 . 2001-08-17 06:02 2688 -c–a-w- d:\windows\system32\dllcache\hidswvd.sys
2011-08-11 14:45 . 2001-08-17 04:11 12362 -c–a-w- d:\windows\system32\dllcache\f3ab18xi.sys
2011-08-11 14:44 . 2001-08-17 04:11 69194 -c–a-w- d:\windows\system32\dllcache\el656cd5.sys
2011-08-11 14:43 . 2001-08-17 14:36 24064 -c–a-w- d:\windows\system32\dllcache\devldr32.exe
2011-08-11 14:42 . 2001-08-17 04:13 27164 -c–a-w- d:\windows\system32\dllcache\ce3n5.sys
2011-08-10 13:34 . 2008-04-13 16:06 14208 -c–a-w- d:\windows\system32\dllcache\battc.sys
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Local Settings\Application Data\Octoshape
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Application Data\Octoshape
2011-08-09 03:12 . 2011-08-09 03:13 ——– d—–w- d:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-08-09 03:12 . 2011-08-09 03:12 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Search
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\windows\system32\winrm
2011-08-09 03:11 . 2011-08-09 03:11 ——– dc-h–w- d:\windows\$968930Uinstall_KB968930$
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Desktop Search
2011-08-09 03:10 . 2011-08-11 15:10 ——– d—–w- d:\program files\Windows Desktop Search
2011-08-09 03:10 . 2011-08-09 03:10 ——– d—–w- d:\windows\system32\GroupPolicy
2011-08-09 00:52 . 2011-08-09 00:52 ——– d—–w- d:\program files\Microsoft.NET
2011-08-07 02:15 . 2011-08-07 02:15 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA Corporation
2011-08-07 02:14 . 2011-08-09 05:09 ——– d—–w- d:\documents and settings\UpdatusUser
2011-08-07 02:14 . 2011-08-07 02:14 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA
2011-08-07 02:13 . 2011-05-25 06:09 543336 —-a-w- d:\windows\system32\easyupdatusapiu.dll
2011-08-07 02:13 . 2011-08-18 12:55 273344 —-a-w- d:\windows\system32\nvdrsdb1.bin
2011-08-07 02:13 . 2011-08-18 12:55 1 —-a-w- d:\windows\system32\nvdrssel.bin
2011-08-07 02:13 . 2011-08-18 12:55 273344 —-a-w- d:\windows\system32\nvdrsdb0.bin
2011-08-07 02:12 . 2011-05-25 06:09 61440 —-a-w- d:\windows\system32\OpenCL.dll
2011-08-07 02:12 . 2011-05-25 06:09 865896 —-a-w- d:\windows\system32\nvgenco322090.dll
2011-08-07 02:12 . 2011-05-25 06:09 899688 —-a-w- d:\windows\system32\nvdispco3220150.dll
2011-08-07 02:12 . 2011-05-25 06:09 2808936 —-a-w- d:\windows\system32\nvcuvid.dll
2011-08-07 02:12 . 2011-05-25 06:09 2082408 —-a-w- d:\windows\system32\nvcuvenc.dll
2011-08-07 02:12 . 2011-05-25 06:09 5332992 —-a-w- d:\windows\system32\nvcuda.dll
2011-08-07 02:12 . 2011-05-25 06:09 13004800 —-a-w- d:\windows\system32\nvcompiler.dll
2011-08-07 02:12 . 2011-08-18 12:52 ——– d—–w- d:\program files\NVIDIA Corporation
2011-07-29 14:09 . 2011-07-29 14:09 ——– d—–w- D:\656008adc7c9fc63a82d60b0e996
2011-07-29 13:47 . 2010-02-27 01:08 101376 —-a-w- d:\windows\system32\rld.dll
2011-07-29 13:47 . 2010-02-27 01:08 101376 —-a-w- d:\windows\system\rld.dll
2011-07-29 12:56 . 2011-07-29 12:56 ——– d—–w- d:\program files\Electronic Arts
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-20 08:06 . 2006-02-28 12:00 4224 —-a-w- d:\windows\system32\drivers\beep.sys
2011-08-20 07:53 . 2011-06-25 00:10 404640 —-a-w- d:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2008-10-09 22:35 456320 —-a-w- d:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-10-09 22:35 10496 —-a-w- d:\windows\system32\drivers\ndistapi.sys
2011-07-06 11:52 . 2010-10-16 00:47 41272 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 11:52 . 2010-10-16 00:47 22712 —-a-w- d:\windows\system32\drivers\mbam.sys
2011-06-28 13:09 . 2010-10-23 04:52 138192 —-a-w- d:\windows\system32\drivers\avipbb.sys
2011-06-28 13:09 . 2010-10-23 04:52 66616 —-a-w- d:\windows\system32\drivers\avgntflt.sys
2011-06-24 14:10 . 2008-10-09 22:35 139656 —-a-w- d:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2006-02-28 12:00 916480 —-a-w- d:\windows\system32\wininet.dll
2011-06-23 18:36 . 2006-02-28 12:00 43520 —-a-w- d:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2006-02-28 12:00 1469440 ——w- d:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2006-02-28 12:00 385024 —-a-w- d:\windows\system32\html.iec
2011-06-20 17:44 . 2006-02-28 12:00 293376 —-a-w- d:\windows\system32\winsrv.dll
2011-06-07 03:13 . 2011-06-16 13:43 4659712 —-a-w- d:\windows\system32\Redemption.dll
2011-06-07 03:13 . 2011-06-07 03:13 974848 —-a-w- d:\windows\system32\cis-2.4.dll
2011-06-07 03:13 . 2011-06-07 03:13 90112 —-a-w- d:\windows\MAMCityDownload.ocx
2011-06-07 03:13 . 2011-06-07 03:13 81920 —-a-w- d:\windows\system32\issacapi_bs-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 65536 —-a-w- d:\windows\system32\issacapi_pe-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MTXSYNCICON.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\issacapi_se-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 569344 —-a-w- d:\windows\system32\muzdecode.ax
2011-06-07 03:13 . 2011-06-07 03:13 491520 —-a-w- d:\windows\system32\muzapp.dll
2011-06-07 03:13 . 2011-06-07 03:13 49152 —-a-w- d:\windows\system32\MaJGUILib.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MaXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MTTELECHIP.dll
2011-06-07 03:13 . 2011-06-07 03:13 352256 —-a-w- d:\windows\system32\MSLUR71.dll
2011-06-07 03:13 . 2011-06-07 03:13 325552 —-a-w- d:\windows\MASetupCaller.dll
2011-06-07 03:13 . 2011-06-07 03:13 30568 —-a-w- d:\windows\MusiccityDownload.exe
2011-06-07 03:13 . 2011-06-07 03:13 24576 —-a-w- d:\windows\system32\MASetupCleaner.exe
2011-06-07 03:13 . 2011-06-07 03:13 200704 —-a-w- d:\windows\system32\muzwmts.dll
2011-06-07 03:13 . 2011-06-07 03:13 155648 —-a-w- d:\windows\system32\MSFLib.dll
2011-06-07 03:13 . 2011-06-07 03:13 143360 —-a-w- d:\windows\system32\3DAudio.ax
2011-06-07 03:13 . 2011-06-07 03:13 14336 —-a-w- d:\windows\system32\avrt.dll
2011-06-07 03:13 . 2011-06-07 03:13 135168 —-a-w- d:\windows\system32\muzaf1.dll
2011-06-07 03:13 . 2011-06-07 03:13 131072 —-a-w- d:\windows\system32\muzmpgsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 122880 —-a-w- d:\windows\system32\muzeffect.ax
2011-06-07 03:13 . 2011-06-07 03:13 118784 —-a-w- d:\windows\system32\MaDRM.dll
2011-06-07 03:13 . 2011-06-07 03:13 110592 —-a-w- d:\windows\system32\muzmp4sp.ax
2011-06-07 03:13 . 2011-06-16 13:43 821824 —-a-w- d:\windows\system32\dgderapi.dll
2011-06-07 03:13 . 2011-06-16 13:43 319456 —-a-w- d:\windows\system32\DIFxAPI.dll
2011-06-07 03:13 . 2011-06-16 13:43 20032 —-a-w- d:\windows\system32\drivers\dgderdrv.sys
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MK_Lyric.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MACXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MAMACExtract.dll
2011-06-07 03:13 . 2011-06-07 03:13 258048 —-a-w- d:\windows\system32\muzoggsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 245760 —-a-w- d:\windows\system32\MSCLib.dll
2011-06-02 14:02 . 2008-10-09 22:35 1858944 —-a-w- d:\windows\system32\win32k.sys
2011-04-24 04:10 . 2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
2011-08-12 05:57 . 2011-08-19 23:55 134104 —-a-w- d:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 –sha-r- d:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 –sha-r- d:\windows\system32\msfDX.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-24_12.44.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-25 13:59 . 2011-08-25 13:59 38400 d:\windows\Installer\7f9eed.msi
+ 2011-08-25 13:59 . 2011-08-25 13:59 49152 d:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2011-08-25 13:59 . 2011-08-25 13:59 20333056 d:\windows\Installer\7f9ef6.msp
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Online Files]
@="{B82655E9-B81D-4A97-8154-0D84A4C048E4}"
[HKEY_CLASSES_ROOT\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}]
2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"nwiz"="d:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-05-04 1632360]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2011-05-25 13895272]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2008-04-13 15360]
.
d:\documents and settings\my pc\Start Menu\Programs\Startup\
BitTorrent (2).lnk - c:\program files\BitTorrent\bittorrent.exe [N/A]
Dropbox.lnk - d:\documents and settings\my pc\Application Data\Dropbox\bin\Dropbox.exe [2011-5-26 24176560]
.
d:\documents and settings\All Users\Start Menu\Programs\Startup\
Wireless Utility.lnk - d:\program files\Wireless\Common\Utility.exe [2010-12-29 602112]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "d:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 —-a-w- d:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-10-10 13:51 10792 —-a-w- d:\program files\Citrix\GoToAssist\480\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=d:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=d:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^JCMATTHEW WLAN.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\JCMATTHEW WLAN.lnk
backup=d:\windows\pss\JCMATTHEW WLAN.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk]
backup=d:\windows\pss\Nokia Nseries PC Suite.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=d:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=d:\windows\pss\Adobe Gamma.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Dropbox.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\Dropbox.lnk
backup=d:\windows\pss\Dropbox.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^MagicDisc.lnk]
backup=d:\windows\pss\MagicDisc.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^启动迅雷5.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\启动迅雷5.lnk
backup=d:\windows\pss\启动迅雷5.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
d:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-09-12 08:31 357384 —-a-w- d:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 17:04 39792 —-a-w- d:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2010-05-10 13:53 611712 —-a-w- d:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2008-11-20 13:30 2356088 —-a-w- d:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]
2010-08-10 07:10 2349776 —-a-w- d:\program files\IObit\Advanced SystemCare 3\AWC.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ——r- d:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-01 02:21 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2008-02-19 00:22 1089536 —-a-r- d:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-12-21 09:57 86016 —-a-w- d:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 21:42 15360 —-a-w- d:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56 1230704 —-a-w- d:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
2011-01-26 12:03 7508440 —-a-w- d:\program files\easyMule\emule.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
2010-08-09 12:47 248832 —-a-w- d:\program files\FileHippo.com\UpdateChecker.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2006-02-28 12:00 208952 —-a-w- d:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-10-11 11:01 46368 —-a-w- d:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 08:50 221184 —-a-w- d:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 08:15 81920 —-a-w- d:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-01 13:45 421160 —-a-w- d:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2011-06-09 10:52 940944 —-a-w- d:\program files\Samsung\Kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2011-06-09 10:52 20880 —-a-w- d:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2011-06-09 10:52 3373968 —-a-w- d:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 11:52 449584 —-a-w- d:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 21:42 1695232 —-a-w- d:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-16 14:12 3872080 —-a-w- d:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2006-02-28 12:00 59392 —-a-w- d:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 07:57 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-05-25 06:09 13895272 —-a-w- d:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-05-25 06:09 111208 —-a-w- d:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2011-05-04 16:02 1632360 —-a-w- d:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
2009-01-08 13:44 70936 —-a-w- d:\documents and settings\my pc\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-10-11 11:03 29984 —-a-w- d:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPS Accelerator]
2010-02-24 03:25 214408 —-a-w- d:\progra~1\PPStream\PPSAP.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 09:38 421888 —-a-w- d:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 01:00 1116920 —-a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-06-13 06:49 16377344 ——r- d:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
2007-10-11 11:12 94208 —-a-w- d:\program files\SimpleCenter\bin\win\sclauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
2010-06-28 10:05 3021720 —-a-w- d:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 01:03 210472 —-a-w- d:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-08-12 21:37 4603264 —-a-w- d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Thunder]
2011-05-27 10:14 1002672 —-a-w- d:\program files\Thunder Network\Thunder\Program\Thunder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-08-13 06:42 273544 —-a-w- d:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-09-12 08:30 5048488 —-a-w- d:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mi-raysat_3dsmax9_32"=2 (0x2)
"mi-raysat_3dsMax2008_32"=2 (0x2)
"Bonjour Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"aawservice"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"Autodesk Licensing Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"stllssvr"=3 (0x3)
"ServiceLayer"=3 (0x3)
"SeaPort"=2 (0x2)
"ose"=3 (0x3)
"NMIndexingService"=3 (0x3)
"mi-raysat_3dsMax2009_32"=2 (0x2)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"GoToAssist"=3 (0x3)
"fsssvc"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"afcdpsrv"=2 (0x2)
"SpyHunter 4 Service"=2 (0x2)
"YahooAUService"=2 (0x2)
"iPod Service"=3 (0x3)
"AcrSch2Svc"=2 (0x2)
"!SASCORE"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Program Files\\ArchVision\\ArchVision Content Manager\\rpcACMapp.exe"=
"d:\\Program Files\\ArchVision\\ArchVision Content Manager\\rpcACMftp.exe"=
"d:\\Program Files\\TVAnts\\Tvants.exe"=
"d:\\Program Files\\SimpleCenter\\Home Media Server.exe"=
"%windir%\\system32\\sessmgr.exe"=
"$INSTDIR\\FlvDetector.exe"= d:\\Program Files\\FlashGet Network\\FlashGet 3\\FlvDetector.exe
"d:\\Program Files\\JCMATTHEW WLAN\\RtWLan.exe"=
"d:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"d:\\Program Files\\Codemasters\\OF Dragon Rising\\OFDR.exe"=
"d:\\Program Files\\QvodPlayer\\QvodTerminal.exe"=
"d:\\Documents and Settings\\my pc\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"d:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 2009\\3dsmax.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"d:\\Program Files\\PPStream\\PPStream.exe"=
"d:\\Program Files\\PPStream\\PPSAP.exe"=
"d:\\Program Files\\PPSGame\\PPSGame.exe"=
"d:\\Program Files\\王者在线电影\\QvodTerminal.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\Program Files\\easyMule\\emule.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"d:\\Program Files\\Thunder Network\\Thunder\\XLDoctor\\7.1.7.2244_2\\Program\\XLDoctorUI.exe"=
"d:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"d:\\Program Files\\Thunder Network\\Thunder\\XLDoctor\\7.1.8.2302_3\\Program\\XLDoctorUI.exe"=
"d:\\Program Files\\Thunder Network\\Thunder\\Program\\Thunder.exe"=
"d:\\Program Files\\Thunder Network\\Thunder\\Program\\ThunderLiveUD.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\TP\\Ver1\\1.1.2.67_1111\\ThunderPlatform.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\TP\\Ver1\\1.1.2.67_1111\\ThunderLiveUD.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\TP\\Ver1\\1.1.2.67_1111\\XLBugReport.exe"=
"d:\\Program Files\\Thunder Network\\Xmp4\\Program\\Xmp.exe"=
"d:\\Program Files\\Thunder Network\\Xmp4\\Program\\XLBugReport.exe"=
"d:\\Program Files\\Thunder Network\\Xmp4\\Program\\ThunderLiveUD.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\KanKan\\ThunderServiceLite.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\KanKan\\xmp.exe"=
"d:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"d:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"d:\\Documents and Settings\\my pc\\Application Data\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1542:TCP"= 1542:TCP:Realtek WPS TCP Prot
"1542:UDP"= 1542:UDP:Realtek WPS UDP Prot
"53:UDP"= 53:UDP:Realtek AP UDP Prot
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"33674:UDP"= 33674:UDP:ThunderLAN(UDP)
"33673:TCP"= 33673:TCP:ThunderLAN(TCP)
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 pavboot;pavboot;d:\windows\system32\drivers\pavboot.sys [8/16/2011 11:29 PM 28552]
R0 tdrpman251;Acronis Try&Decide; and Restore Points filter (build 251);d:\windows\system32\drivers\tdrpm251.sys [12/5/2010 7:58 AM 902432]
R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [7/23/2011 12:27 AM 12880]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/13/2011 5:55 AM 67664]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\program files\Avira\AntiVir Desktop\sched.exe [10/23/2010 12:52 PM 136360]
R2 BBUpdate;BBUpdate;d:\program files\Microsoft\BingBar\SeaPort.EXE [6/15/2011 5:33 PM 249648]
R2 nvUpdatusService;NVIDIA Update Service Daemon;d:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [8/7/2011 10:14 AM 2214504]
R2 XLDoctor Service;XLDoctor Service;d:\windows\system32\svchost -k DoctorService –> d:\windows\system32\svchost -k DoctorService [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;d:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 afcdp;afcdp;d:\windows\system32\drivers\afcdp.sys [12/5/2010 7:59 AM 159168]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;d:\windows\system32\drivers\ssadadb.sys [8/16/2011 10:20 PM 30312]
S3 BBSvc;Bing Bar Update Service;d:\program files\Microsoft\BingBar\BBSvc.EXE [7/7/2011 7:31 PM 195336]
S3 dgderdrv;dgderdrv;d:\windows\system32\drivers\dgderdrv.sys [6/16/2011 9:43 PM 20032]
S3 epmntdrv;epmntdrv;d:\windows\system32\epmntdrv.sys [8/23/2011 11:11 PM 13192]
S3 esgiguard;esgiguard;d:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [1/27/2010 6:10 PM 5248]
S3 EuGdiDrv;EuGdiDrv;d:\windows\system32\EuGdiDrv.sys [8/23/2011 11:11 PM 8456]
S3 FsUsbExDisk;FsUsbExDisk;d:\windows\system32\FsUsbExDisk.Sys [7/12/2010 9:57 PM 36640]
S3 gupdatem;Google Update Service (gupdatem);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 MBAMProtector;MBAMProtector;d:\windows\system32\drivers\mbam.sys [10/16/2010 8:47 AM 22712]
S3 MBAMSwissArmy;MBAMSwissArmy;d:\windows\system32\drivers\mbamswissarmy.sys [10/16/2010 8:47 AM 41272]
S3 Revoflt;Revoflt;d:\windows\system32\drivers\revoflt.sys [8/14/2010 9:33 AM 27064]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;d:\windows\system32\drivers\usbscan.sys [10/10/2008 6:35 AM 15104]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);d:\windows\system32\drivers\ssadbus.sys [8/16/2011 10:20 PM 96488]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);d:\windows\system32\drivers\ssadmdfl.sys [8/16/2011 10:20 PM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;d:\windows\system32\drivers\ssadmdm.sys [8/16/2011 10:20 PM 121576]
S3 StumbleUponUpdateService;StumbleUponUpdateService;d:\program files\StumbleUpon\StumbleUponUpdateService.exe [4/14/2011 6:10 AM 103336]
S3 WinRM;Windows Remote Management (WS-Management);d:\windows\system32\svchost.exe -k WINRM [2/28/2006 8:00 PM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;d:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S4 !SASCORE;SAS Core Service;d:\program files\SUPERAntiSpyware\SASCore.exe [8/12/2011 7:38 AM 116608]
S4 afcdpsrv;Acronis Nonstop Backup service;d:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [12/5/2010 7:59 AM 2326920]
S4 MBAMService;MBAMService;"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe" –> c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [?]
S4 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [3/10/2008 12:04 AM 65536]
S4 sptd;sptd;d:\windows\system32\drivers\sptd.sys [12/27/2007 6:59 PM 685816]
S4 SpyHunter 4 Service;SpyHunter 4 Service;d:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [5/18/2010 5:06 PM 327064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
DoctorService REG_MULTI_SZ XLDoctor Service
WINRM REG_MULTI_SZ WINRM
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-07 20:32 128512 —-a-w- d:\windows\system32\advpack.dll
.
‘计划任务’ 文件夹 里的内容
.
2011-08-26 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-08-25 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-08-26 d:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-08-15 d:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-08-25 d:\windows\Tasks\User_Feed_Synchronization-{BC65CFD2-BBB2-4EA9-8129-77D470F20F96}.job
- d:\windows\system32\msfeedssync.exe [2007-08-13 20:31]
.
.
——- 而外的扫描 ——-
.
uStart Page = hxxp://sg.yahoo.com/?fr=fp-yie8/
uInternet Settings,ProxyOverride = *.local
DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.daum-img.net/cab9_1/dmcc2.cab?Version=1,0,0,10
FF - ProfilePath - d:\documents and settings\my pc\Application Data\Mozilla\Firefox\Profiles\emub2jur.default\
FF - prefs.js: browser.startup.homepage - hxxp://sg.yahoo.com/?fr=fp-yie8/
FF - prefs.js: network.proxy.type - 0
.
.
——- 文件类型 ——-
.
.scr=AutoCADScriptFile
.txt=
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{B0E2F470-0B07-48f0-B3B1-5749505FAE9B} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-26 20:16
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程 。。。
.
扫描被隐藏的启动组 。。。
.
扫描被隐藏的文件 。。。
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer]
@DACL=(02 0000)
@=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B0E2F470-0B07-48f0-B3B1-5749505FAE9B}]
@DACL=(02 0000)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}]
@DACL=(02 0000)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
@DACL=(02 0000)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\SUPER *]
"DisplayName"="SUPER ?Version 2007.bld.23 (July 4, 2007)"
"UninstallString"="d:\\PROGRA~1\\ERIGHT~1\\SUPER\\Setup.exe /remove /q0"
"InstallDate"="2008-06-15 17:06"
"InstallLocation"="d:\\Program Files\\eRightSoft\\SUPER"
"InstallSource"="f:\\exe"
"DisplayIcon"="d:\\Program Files\\eRightSoft\\SUPER\\SUPER.exe"
"DisplayVersion"="Version 2007.bld.23 (July 4, 2007)"
"VersionMajor"=dword:00000000
"VersionMinor"=dword:00000000
"Publisher"="eRightSoft"
"HelpLink"="http://www.eRightSoft.com"
"URLInfoAbout"="http://www.eRightSoft.com"
"URLUpdateInfo"="http://www.eRightSoft.com"
"Contact"="[removed]"
.
——————— 运行进程下的动态链接库 ———————
.
- - - - - - - > 'winlogon.exe'(796)
d:\program files\SUPERAntiSpyware\SASWINLO.DLL
d:\windows\system32\WININET.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
d:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll
.
- - - - - - - > 'lsass.exe'(852)
d:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
完成时间: 2011-08-26 20:20:24
ComboFix-quarantined-files.txt 2011-08-26 12:20
ComboFix2.txt 2011-08-24 14:58
ComboFix3.txt 2011-08-24 12:49
.
Pre-Run: 193,694,306,304 bytes free
Post-Run: 193,655,414,784 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - CEAF52EE7D01A01E2BB4AE03CDE6FF7B

i just click close the error and combofix continued,

here is the log:

ComboFix 11-08-27.01 - my pc 7/2011 Sat 8:42.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.936.86.1033.18.2047.1228 [GMT 8:00]
执行位置: d:\documents and settings\my pc\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\windows\system32\0354465641.dll
.
.
((((((((((((((((((((((((( 2011-07-27 至 2011-08-27 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-08-27 01:11 . 2011-08-27 01:11 24983 —-a-w- d:\windows\system32\1113134341.dll
2011-08-25 13:59 . 2011-08-25 13:59 ——– d—–w- d:\program files\Microsoft Silverlight
2011-08-24 06:03 . 2011-08-24 06:03 ——– d—a-w- D:\.Trash-999
2011-08-23 15:11 . 2011-07-29 05:54 19840 —-a-w- d:\windows\system32\EuEpmGdi.dll
2011-08-23 15:11 . 2011-08-02 12:48 2469248 —-a-w- d:\windows\system32\BootMan.exe
2011-08-23 15:11 . 2011-07-29 05:54 86408 —-a-w- d:\windows\system32\setupempdrv03.exe
2011-08-23 15:11 . 2011-07-29 05:54 8456 —-a-w- d:\windows\system32\EuGdiDrv.sys
2011-08-23 15:11 . 2011-07-29 05:54 13192 —-a-w- d:\windows\system32\epmntdrv.sys
2011-08-23 15:10 . 2011-08-23 15:10 ——– d—–w- d:\program files\EASEUS
2011-08-23 11:50 . 2010-11-03 18:08 237568 —-a-w- d:\windows\system32\yv12vfw.dll
2011-08-23 11:50 . 2011-06-24 14:44 243200 —-a-w- d:\windows\system32\xvidvfw.dll
2011-08-23 11:50 . 2011-06-24 14:28 650752 —-a-w- d:\windows\system32\xvidcore.dll
2011-08-23 11:50 . 2011-08-08 08:00 74752 —-a-w- d:\windows\system32\ff_vfw.dll
2011-08-20 08:06 . 2011-08-20 08:06 896 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\databasepath.reg
2011-08-20 08:06 . 2011-08-20 08:06 3008 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\bgregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 2600 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\exefix.reg
2011-08-20 08:06 . 2011-08-20 08:06 951291 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\remregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 890 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\Remove-itRestorePoint.vbs
2011-08-20 08:06 . 2011-08-20 08:06 5228 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\nfig.reg
2011-08-20 08:06 . 2011-08-20 08:06 4994 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\s.reg
2011-08-20 08:06 . 2011-08-20 08:06 4512 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\hpregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 18308 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\IEDef.reg
2011-08-20 08:06 . 2011-08-20 08:06 1754 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\regf.reg
2011-08-20 07:06 . 2008-05-02 13:25 465920 -c—-w- d:\windows\system32\dllcache\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 465920 ——w- d:\windows\system32\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 -c—-w- d:\windows\system32\dllcache\imapi2.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 ——w- d:\windows\system32\imapi2.dll
2011-08-20 06:55 . 2011-08-20 07:11 ——– d—–w- d:\documents and settings\LocalService\Application Data\360safe
2011-08-20 04:09 . 2011-08-20 04:09 ——– d—–w- d:\program files\Chaos Group
2011-08-20 03:34 . 2009-07-21 12:24 14080 —-a-w- d:\windows\system32\drivers\36040.tmp
2011-08-20 03:34 . 2009-06-03 14:26 27400 —-a-w- d:\windows\system32\drivers\3603F.tmp
2011-08-20 03:33 . 2011-08-20 08:54 ——– d—–w- d:\documents and settings\All Users\Application Data\360safe
2011-08-20 03:27 . 2011-08-20 03:27 ——– d—–w- d:\documents and settings\All Users\Application Data\360SD
2011-08-20 03:27 . 2011-08-20 08:35 ——– d—–w- d:\program files\360
2011-08-19 12:51 . 2011-08-19 13:36 ——– d—–w- d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-08-19 12:51 . 2011-08-19 12:59 ——– d—–w- d:\program files\Spybot - Search & Destroy
2011-08-16 15:50 . 2011-08-18 11:49 ——– d—–w- d:\program files\SpywareBlaster
2011-08-16 15:47 . 2011-08-16 15:47 ——– d—–w- d:\program files\ESET
2011-08-16 15:29 . 2009-06-30 02:37 28552 —-a-w- d:\windows\system32\drivers\pavboot.sys
2011-08-16 15:29 . 2011-08-16 15:29 ——– d—–w- d:\program files\Panda Security
2011-08-16 14:20 . 2010-05-25 07:59 96488 —-a-w- d:\windows\system32\drivers\ssadbus.sys
2011-08-16 14:20 . 2010-05-25 07:59 30312 —-a-w- d:\windows\system32\drivers\ssadadb.sys
2011-08-16 14:20 . 2010-05-25 07:59 1416680 —-a-w- d:\windows\system32\WdfCoInstaller01005.dll
2011-08-16 14:20 . 2010-05-25 07:59 12776 —-a-w- d:\windows\system32\drivers\ssadmdfl.sys
2011-08-16 14:20 . 2010-05-25 07:59 121576 —-a-w- d:\windows\system32\drivers\ssadmdm.sys
2011-08-16 14:20 . 2010-05-25 07:59 10344 —-a-w- d:\windows\system32\drivers\ssadcmnt.sys
2011-08-16 14:20 . 2010-05-25 07:59 10216 —-a-w- d:\windows\system32\drivers\ssadwhnt.sys
2011-08-13 05:16 . 2011-08-13 05:16 ——– d—–w- d:\program files\FileHippo.com
2011-08-13 04:46 . 2011-08-13 04:46 ——– d—–w- d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com
2011-08-13 04:46 . 2011-08-23 13:24 ——– d—–w- d:\program files\SUPERAntiSpyware
2011-08-13 04:46 . 2011-08-13 04:46 ——– d—–w- d:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconF7A21AF7.exe
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconD7F16134.exe
2011-08-13 03:40 . 2011-08-18 13:31 ——– d—–w- D:\sh4ldr
2011-08-13 03:40 . 2011-08-13 03:40 ——– d—–w- d:\program files\Enigma Software Group
2011-08-13 03:39 . 2011-08-13 03:40 ——– d—–w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2011-08-13 03:39 . 2011-08-13 03:39 ——– d—–w- d:\program files\Common Files\Wise Installation Wizard
2011-08-12 14:16 . 2008-04-13 21:41 81920 ——w- d:\windows\system32\ieencode.dll
2011-08-12 14:15 . 2006-12-28 16:31 19569 —-a-w- d:\windows\000001_.tmp
2011-08-11 15:03 . 2001-08-17 14:36 53760 -c–a-w- d:\windows\system32\dllcache\wiamsmud.dll
2011-08-11 15:02 . 2001-08-17 05:28 687999 -c–a-w- d:\windows\system32\dllcache\usrwdxjs.sys
2011-08-11 15:01 . 2001-08-17 14:36 216064 -c–a-w- d:\windows\system32\dllcache\um34scan.dll
2011-08-11 15:00 . 2001-08-17 04:14 123995 -c–a-w- d:\windows\system32\dllcache\tjisdn.sys
2011-08-11 14:59 . 2001-08-17 14:36 10240 -c–a-w- d:\windows\system32\dllcache\swpidflt.dll
2011-08-11 14:58 . 2001-08-17 05:53 9600 -c–a-w- d:\windows\system32\dllcache\sonymc.sys
2011-08-11 14:57 . 2001-08-17 04:50 50432 -c–a-w- d:\windows\system32\dllcache\sisv.sys
2011-08-11 14:56 . 2001-08-17 05:51 16640 -c–a-w- d:\windows\system32\dllcache\scmstcs.sys
2011-08-11 14:55 . 2001-08-17 04:12 19017 -c–a-w- d:\windows\system32\dllcache\rtl8029.sys
2011-08-11 14:54 . 2001-08-17 05:28 112574 -c–a-w- d:\windows\system32\dllcache\ptserlp.sys
2011-08-11 14:53 . 2001-08-17 04:11 35328 -c–a-w- d:\windows\system32\dllcache\pcntpci5.sys
2011-08-11 14:52 . 2001-08-17 04:50 198144 -c–a-w- d:\windows\system32\dllcache\nv3.sys
2011-08-11 14:51 . 2001-08-17 04:11 128000 -c–a-w- d:\windows\system32\dllcache\n100325.sys
2011-08-11 14:50 . 2001-08-17 05:57 16128 -c–a-w- d:\windows\system32\dllcache\modemcsa.sys
2011-08-11 14:49 . 2001-08-17 04:12 20573 -c–a-w- d:\windows\system32\dllcache\lne100.sys
2011-08-11 14:48 . 2001-08-17 14:36 372824 -c–a-w- d:\windows\system32\dllcache\iconf32.dll
2011-08-11 14:47 . 2001-08-17 05:28 44863 -c–a-w- d:\windows\system32\dllcache\hsf_soar.sys
2011-08-11 14:46 . 2001-08-17 06:02 2688 -c–a-w- d:\windows\system32\dllcache\hidswvd.sys
2011-08-11 14:45 . 2001-08-17 04:11 12362 -c–a-w- d:\windows\system32\dllcache\f3ab18xi.sys
2011-08-11 14:44 . 2001-08-17 04:11 69194 -c–a-w- d:\windows\system32\dllcache\el656cd5.sys
2011-08-11 14:43 . 2001-08-17 14:36 24064 -c–a-w- d:\windows\system32\dllcache\devldr32.exe
2011-08-11 14:42 . 2001-08-17 04:13 27164 -c–a-w- d:\windows\system32\dllcache\ce3n5.sys
2011-08-10 13:34 . 2008-04-13 16:06 14208 -c–a-w- d:\windows\system32\dllcache\battc.sys
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Local Settings\Application Data\Octoshape
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Application Data\Octoshape
2011-08-09 03:12 . 2011-08-09 03:13 ——– d—–w- d:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-08-09 03:12 . 2011-08-09 03:12 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Search
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\windows\system32\winrm
2011-08-09 03:11 . 2011-08-09 03:11 ——– dc-h–w- d:\windows\$968930Uinstall_KB968930$
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Desktop Search
2011-08-09 03:10 . 2011-08-11 15:10 ——– d—–w- d:\program files\Windows Desktop Search
2011-08-09 03:10 . 2011-08-09 03:10 ——– d—–w- d:\windows\system32\GroupPolicy
2011-08-09 00:52 . 2011-08-09 00:52 ——– d—–w- d:\program files\Microsoft.NET
2011-08-07 02:15 . 2011-08-07 02:15 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA Corporation
2011-08-07 02:14 . 2011-08-09 05:09 ——– d—–w- d:\documents and settings\UpdatusUser
2011-08-07 02:14 . 2011-08-07 02:14 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA
2011-08-07 02:13 . 2011-05-25 06:09 543336 —-a-w- d:\windows\system32\easyupdatusapiu.dll
2011-08-07 02:13 . 2011-08-18 12:55 273344 —-a-w- d:\windows\system32\nvdrsdb1.bin
2011-08-07 02:13 . 2011-08-18 12:55 1 —-a-w- d:\windows\system32\nvdrssel.bin
2011-08-07 02:13 . 2011-08-18 12:55 273344 —-a-w- d:\windows\system32\nvdrsdb0.bin
2011-08-07 02:12 . 2011-05-25 06:09 61440 —-a-w- d:\windows\system32\OpenCL.dll
2011-08-07 02:12 . 2011-05-25 06:09 865896 —-a-w- d:\windows\system32\nvgenco322090.dll
2011-08-07 02:12 . 2011-05-25 06:09 899688 —-a-w- d:\windows\system32\nvdispco3220150.dll
2011-08-07 02:12 . 2011-05-25 06:09 2808936 —-a-w- d:\windows\system32\nvcuvid.dll
2011-08-07 02:12 . 2011-05-25 06:09 2082408 —-a-w- d:\windows\system32\nvcuvenc.dll
2011-08-07 02:12 . 2011-05-25 06:09 5332992 —-a-w- d:\windows\system32\nvcuda.dll
2011-08-07 02:12 . 2011-05-25 06:09 13004800 —-a-w- d:\windows\system32\nvcompiler.dll
2011-08-07 02:12 . 2011-08-18 12:52 ——– d—–w- d:\program files\NVIDIA Corporation
2011-07-29 14:09 . 2011-07-29 14:09 ——– d—–w- D:\656008adc7c9fc63a82d60b0e996
2011-07-29 13:47 . 2010-02-27 01:08 101376 —-a-w- d:\windows\system32\rld.dll
2011-07-29 13:47 . 2010-02-27 01:08 101376 —-a-w- d:\windows\system\rld.dll
2011-07-29 12:56 . 2011-07-29 12:56 ——– d—–w- d:\program files\Electronic Arts
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-20 08:06 . 2006-02-28 12:00 4224 —-a-w- d:\windows\system32\drivers\beep.sys
2011-08-20 07:53 . 2011-06-25 00:10 404640 —-a-w- d:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2008-10-09 22:35 456320 —-a-w- d:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-10-09 22:35 10496 —-a-w- d:\windows\system32\drivers\ndistapi.sys
2011-07-06 11:52 . 2010-10-16 00:47 41272 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 11:52 . 2010-10-16 00:47 22712 —-a-w- d:\windows\system32\drivers\mbam.sys
2011-06-28 13:09 . 2010-10-23 04:52 138192 —-a-w- d:\windows\system32\drivers\avipbb.sys
2011-06-28 13:09 . 2010-10-23 04:52 66616 —-a-w- d:\windows\system32\drivers\avgntflt.sys
2011-06-24 14:10 . 2008-10-09 22:35 139656 —-a-w- d:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2006-02-28 12:00 916480 —-a-w- d:\windows\system32\wininet.dll
2011-06-23 18:36 . 2006-02-28 12:00 43520 —-a-w- d:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2006-02-28 12:00 1469440 ——w- d:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2006-02-28 12:00 385024 —-a-w- d:\windows\system32\html.iec
2011-06-20 17:44 . 2006-02-28 12:00 293376 —-a-w- d:\windows\system32\winsrv.dll
2011-06-07 03:13 . 2011-06-16 13:43 4659712 —-a-w- d:\windows\system32\Redemption.dll
2011-06-07 03:13 . 2011-06-07 03:13 974848 —-a-w- d:\windows\system32\cis-2.4.dll
2011-06-07 03:13 . 2011-06-07 03:13 90112 —-a-w- d:\windows\MAMCityDownload.ocx
2011-06-07 03:13 . 2011-06-07 03:13 81920 —-a-w- d:\windows\system32\issacapi_bs-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 65536 —-a-w- d:\windows\system32\issacapi_pe-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MTXSYNCICON.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\issacapi_se-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 569344 —-a-w- d:\windows\system32\muzdecode.ax
2011-06-07 03:13 . 2011-06-07 03:13 491520 —-a-w- d:\windows\system32\muzapp.dll
2011-06-07 03:13 . 2011-06-07 03:13 49152 —-a-w- d:\windows\system32\MaJGUILib.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MaXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MTTELECHIP.dll
2011-06-07 03:13 . 2011-06-07 03:13 352256 —-a-w- d:\windows\system32\MSLUR71.dll
2011-06-07 03:13 . 2011-06-07 03:13 325552 —-a-w- d:\windows\MASetupCaller.dll
2011-06-07 03:13 . 2011-06-07 03:13 30568 —-a-w- d:\windows\MusiccityDownload.exe
2011-06-07 03:13 . 2011-06-07 03:13 24576 —-a-w- d:\windows\system32\MASetupCleaner.exe
2011-06-07 03:13 . 2011-06-07 03:13 200704 —-a-w- d:\windows\system32\muzwmts.dll
2011-06-07 03:13 . 2011-06-07 03:13 155648 —-a-w- d:\windows\system32\MSFLib.dll
2011-06-07 03:13 . 2011-06-07 03:13 143360 —-a-w- d:\windows\system32\3DAudio.ax
2011-06-07 03:13 . 2011-06-07 03:13 14336 —-a-w- d:\windows\system32\avrt.dll
2011-06-07 03:13 . 2011-06-07 03:13 135168 —-a-w- d:\windows\system32\muzaf1.dll
2011-06-07 03:13 . 2011-06-07 03:13 131072 —-a-w- d:\windows\system32\muzmpgsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 122880 —-a-w- d:\windows\system32\muzeffect.ax
2011-06-07 03:13 . 2011-06-07 03:13 118784 —-a-w- d:\windows\system32\MaDRM.dll
2011-06-07 03:13 . 2011-06-07 03:13 110592 —-a-w- d:\windows\system32\muzmp4sp.ax
2011-06-07 03:13 . 2011-06-16 13:43 821824 —-a-w- d:\windows\system32\dgderapi.dll
2011-06-07 03:13 . 2011-06-16 13:43 319456 —-a-w- d:\windows\system32\DIFxAPI.dll
2011-06-07 03:13 . 2011-06-16 13:43 20032 —-a-w- d:\windows\system32\drivers\dgderdrv.sys
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MK_Lyric.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MACXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MAMACExtract.dll
2011-06-07 03:13 . 2011-06-07 03:13 258048 —-a-w- d:\windows\system32\muzoggsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 245760 —-a-w- d:\windows\system32\MSCLib.dll
2011-06-02 14:02 . 2008-10-09 22:35 1858944 —-a-w- d:\windows\system32\win32k.sys
2011-04-24 04:10 . 2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
2011-08-12 05:57 . 2011-08-19 23:55 134104 —-a-w- d:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 –sha-r- d:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 –sha-r- d:\windows\system32\msfDX.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-24_12.44.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-25 13:59 . 2011-08-25 13:59 38400 d:\windows\Installer\7f9eed.msi
+ 2011-08-25 13:59 . 2011-08-25 13:59 49152 d:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2011-08-25 13:59 . 2011-08-25 13:59 20333056 d:\windows\Installer\7f9ef6.msp
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0A0DDBD3-6641-40B9-873F-BBDD26D6C14E}]
2011-01-26 04:04 180696 —-a-w- d:\program files\easyMule\modules\IE2EM.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Online Files]
@="{B82655E9-B81D-4A97-8154-0D84A4C048E4}"
[HKEY_CLASSES_ROOT\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}]
2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"nwiz"="d:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-05-04 1632360]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2011-05-25 13895272]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2008-04-13 15360]
.
d:\documents and settings\my pc\Start Menu\Programs\Startup\
BitTorrent (2).lnk - c:\program files\BitTorrent\bittorrent.exe [N/A]
Dropbox.lnk - d:\documents and settings\my pc\Application Data\Dropbox\bin\Dropbox.exe [2011-5-26 24176560]
.
d:\documents and settings\All Users\Start Menu\Programs\Startup\
Wireless Utility.lnk - d:\program files\Wireless\Common\Utility.exe [2010-12-29 602112]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "d:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 —-a-w- d:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-10-10 13:51 10792 —-a-w- d:\program files\Citrix\GoToAssist\480\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=d:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=d:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^JCMATTHEW WLAN.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\JCMATTHEW WLAN.lnk
backup=d:\windows\pss\JCMATTHEW WLAN.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk]
backup=d:\windows\pss\Nokia Nseries PC Suite.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=d:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=d:\windows\pss\Adobe Gamma.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Dropbox.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\Dropbox.lnk
backup=d:\windows\pss\Dropbox.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^MagicDisc.lnk]
backup=d:\windows\pss\MagicDisc.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^启动迅雷5.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\启动迅雷5.lnk
backup=d:\windows\pss\启动迅雷5.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
d:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-09-12 08:31 357384 —-a-w- d:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 17:04 39792 —-a-w- d:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2010-05-10 13:53 611712 —-a-w- d:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2008-11-20 13:30 2356088 —-a-w- d:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]
2010-08-10 07:10 2349776 —-a-w- d:\program files\IObit\Advanced SystemCare 3\AWC.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ——r- d:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-01 02:21 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2008-02-19 00:22 1089536 —-a-r- d:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-12-21 09:57 86016 —-a-w- d:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 21:42 15360 —-a-w- d:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56 1230704 —-a-w- d:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
2011-01-26 12:03 7508440 —-a-w- d:\program files\easyMule\emule.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
2010-08-09 12:47 248832 —-a-w- d:\program files\FileHippo.com\UpdateChecker.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2006-02-28 12:00 208952 —-a-w- d:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-10-11 11:01 46368 —-a-w- d:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 08:50 221184 —-a-w- d:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 08:15 81920 —-a-w- d:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-01 13:45 421160 —-a-w- d:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2011-06-09 10:52 940944 —-a-w- d:\program files\Samsung\Kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2011-06-09 10:52 20880 —-a-w- d:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2011-06-09 10:52 3373968 —-a-w- d:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 11:52 449584 —-a-w- d:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 21:42 1695232 —-a-w- d:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-16 14:12 3872080 —-a-w- d:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2006-02-28 12:00 59392 —-a-w- d:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 07:57 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-05-25 06:09 13895272 —-a-w- d:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-05-25 06:09 111208 —-a-w- d:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2011-05-04 16:02 1632360 —-a-w- d:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
2009-01-08 13:44 70936 —-a-w- d:\documents and settings\my pc\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-10-11 11:03 29984 —-a-w- d:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPS Accelerator]
2010-02-24 03:25 214408 —-a-w- d:\progra~1\PPStream\PPSAP.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 09:38 421888 —-a-w- d:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 01:00 1116920 —-a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-06-13 06:49 16377344 ——r- d:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
2007-10-11 11:12 94208 —-a-w- d:\program files\SimpleCenter\bin\win\sclauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
2010-06-28 10:05 3021720 —-a-w- d:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 01:03 210472 —-a-w- d:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-08-12 21:37 4603264 —-a-w- d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Thunder]
2011-05-27 10:14 1002672 —-a-w- d:\program files\Thunder Network\Thunder\Program\Thunder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-08-13 06:42 273544 —-a-w- d:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-09-12 08:30 5048488 —-a-w- d:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mi-raysat_3dsmax9_32"=2 (0x2)
"mi-raysat_3dsMax2008_32"=2 (0x2)
"Bonjour Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"aawservice"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"Autodesk Licensing Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"stllssvr"=3 (0x3)
"ServiceLayer"=3 (0x3)
"SeaPort"=2 (0x2)
"ose"=3 (0x3)
"NMIndexingService"=3 (0x3)
"mi-raysat_3dsMax2009_32"=2 (0x2)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"GoToAssist"=3 (0x3)
"fsssvc"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"afcdpsrv"=2 (0x2)
"SpyHunter 4 Service"=2 (0x2)
"YahooAUService"=2 (0x2)
"iPod Service"=3 (0x3)
"AcrSch2Svc"=2 (0x2)
"!SASCORE"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Program Files\\ArchVision\\ArchVision Content Manager\\rpcACMapp.exe"=
"d:\\Program Files\\ArchVision\\ArchVision Content Manager\\rpcACMftp.exe"=
"d:\\Program Files\\TVAnts\\Tvants.exe"=
"d:\\Program Files\\SimpleCenter\\Home Media Server.exe"=
"%windir%\\system32\\sessmgr.exe"=
"$INSTDIR\\FlvDetector.exe"= d:\\Program Files\\FlashGet Network\\FlashGet 3\\FlvDetector.exe
"d:\\Program Files\\JCMATTHEW WLAN\\RtWLan.exe"=
"d:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"d:\\Program Files\\Codemasters\\OF Dragon Rising\\OFDR.exe"=
"d:\\Program Files\\QvodPlayer\\QvodTerminal.exe"=
"d:\\Documents and Settings\\my pc\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"d:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Autodesk\\3ds Max 2009\\3dsmax.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"d:\\Program Files\\PPStream\\PPStream.exe"=
"d:\\Program Files\\PPStream\\PPSAP.exe"=
"d:\\Program Files\\PPSGame\\PPSGame.exe"=
"d:\\Program Files\\王者在线电影\\QvodTerminal.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\Program Files\\easyMule\\emule.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"d:\\Program Files\\Thunder Network\\Thunder\\XLDoctor\\7.1.7.2244_2\\Program\\XLDoctorUI.exe"=
"d:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"d:\\Program Files\\Thunder Network\\Thunder\\XLDoctor\\7.1.8.2302_3\\Program\\XLDoctorUI.exe"=
"d:\\Program Files\\Thunder Network\\Thunder\\Program\\Thunder.exe"=
"d:\\Program Files\\Thunder Network\\Thunder\\Program\\ThunderLiveUD.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\TP\\Ver1\\1.1.2.67_1111\\ThunderPlatform.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\TP\\Ver1\\1.1.2.67_1111\\ThunderLiveUD.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\TP\\Ver1\\1.1.2.67_1111\\XLBugReport.exe"=
"d:\\Program Files\\Thunder Network\\Xmp4\\Program\\Xmp.exe"=
"d:\\Program Files\\Thunder Network\\Xmp4\\Program\\XLBugReport.exe"=
"d:\\Program Files\\Thunder Network\\Xmp4\\Program\\ThunderLiveUD.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\KanKan\\ThunderServiceLite.exe"=
"d:\\Program Files\\Common Files\\Thunder Network\\KanKan\\xmp.exe"=
"d:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"d:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"d:\\Documents and Settings\\my pc\\Application Data\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1542:TCP"= 1542:TCP:Realtek WPS TCP Prot
"1542:UDP"= 1542:UDP:Realtek WPS UDP Prot
"53:UDP"= 53:UDP:Realtek AP UDP Prot
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"33674:UDP"= 33674:UDP:ThunderLAN(UDP)
"33673:TCP"= 33673:TCP:ThunderLAN(TCP)
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 pavboot;pavboot;d:\windows\system32\drivers\pavboot.sys [8/16/2011 11:29 PM 28552]
R0 tdrpman251;Acronis Try&Decide; and Restore Points filter (build 251);d:\windows\system32\drivers\tdrpm251.sys [12/5/2010 7:58 AM 902432]
R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [7/23/2011 12:27 AM 12880]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/13/2011 5:55 AM 67664]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\program files\Avira\AntiVir Desktop\sched.exe [10/23/2010 12:52 PM 136360]
R2 BBUpdate;BBUpdate;d:\program files\Microsoft\BingBar\SeaPort.EXE [6/15/2011 5:33 PM 249648]
R2 nvUpdatusService;NVIDIA Update Service Daemon;d:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [8/7/2011 10:14 AM 2214504]
R2 XLDoctor Service;XLDoctor Service;d:\windows\system32\svchost -k DoctorService –> d:\windows\system32\svchost -k DoctorService [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;d:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 afcdp;afcdp;d:\windows\system32\drivers\afcdp.sys [12/5/2010 7:59 AM 159168]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;d:\windows\system32\drivers\ssadadb.sys [8/16/2011 10:20 PM 30312]
S3 BBSvc;Bing Bar Update Service;d:\program files\Microsoft\BingBar\BBSvc.EXE [7/7/2011 7:31 PM 195336]
S3 dgderdrv;dgderdrv;d:\windows\system32\drivers\dgderdrv.sys [6/16/2011 9:43 PM 20032]
S3 epmntdrv;epmntdrv;d:\windows\system32\epmntdrv.sys [8/23/2011 11:11 PM 13192]
S3 esgiguard;esgiguard;d:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [1/27/2010 6:10 PM 5248]
S3 EuGdiDrv;EuGdiDrv;d:\windows\system32\EuGdiDrv.sys [8/23/2011 11:11 PM 8456]
S3 FsUsbExDisk;FsUsbExDisk;d:\windows\system32\FsUsbExDisk.Sys [7/12/2010 9:57 PM 36640]
S3 gupdatem;Google Update Service (gupdatem);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 MBAMProtector;MBAMProtector;d:\windows\system32\drivers\mbam.sys [10/16/2010 8:47 AM 22712]
S3 MBAMSwissArmy;MBAMSwissArmy;d:\windows\system32\drivers\mbamswissarmy.sys [10/16/2010 8:47 AM 41272]
S3 Revoflt;Revoflt;d:\windows\system32\drivers\revoflt.sys [8/14/2010 9:33 AM 27064]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;d:\windows\system32\drivers\usbscan.sys [10/10/2008 6:35 AM 15104]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);d:\windows\system32\drivers\ssadbus.sys [8/16/2011 10:20 PM 96488]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);d:\windows\system32\drivers\ssadmdfl.sys [8/16/2011 10:20 PM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;d:\windows\system32\drivers\ssadmdm.sys [8/16/2011 10:20 PM 121576]
S3 StumbleUponUpdateService;StumbleUponUpdateService;d:\program files\StumbleUpon\StumbleUponUpdateService.exe [4/14/2011 6:10 AM 103336]
S3 WinRM;Windows Remote Management (WS-Management);d:\windows\system32\svchost.exe -k WINRM [2/28/2006 8:00 PM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;d:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S4 !SASCORE;SAS Core Service;d:\program files\SUPERAntiSpyware\SASCore.exe [8/12/2011 7:38 AM 116608]
S4 afcdpsrv;Acronis Nonstop Backup service;d:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [12/5/2010 7:59 AM 2326920]
S4 MBAMService;MBAMService;"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe" –> c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [?]
S4 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [3/10/2008 12:04 AM 65536]
S4 sptd;sptd;d:\windows\system32\drivers\sptd.sys [12/27/2007 6:59 PM 685816]
S4 SpyHunter 4 Service;SpyHunter 4 Service;d:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [5/18/2010 5:06 PM 327064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
DoctorService REG_MULTI_SZ XLDoctor Service
WINRM REG_MULTI_SZ WINRM
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-07 20:32 128512 —-a-w- d:\windows\system32\advpack.dll
.
‘计划任务’ 文件夹 里的内容
.
2011-08-27 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-08-27 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-08-27 d:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-08-15 d:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-08-26 d:\windows\Tasks\User_Feed_Synchronization-{BC65CFD2-BBB2-4EA9-8129-77D470F20F96}.job
- d:\windows\system32\msfeedssync.exe [2007-08-13 20:31]
.
.
——- 而外的扫描 ——-
.
uStart Page = hxxp://sg.yahoo.com/?fr=fp-yie8/
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.1.254
DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.daum-img.net/cab9_1/dmcc2.cab?Version=1,0,0,10
FF - ProfilePath - d:\documents and settings\my pc\Application Data\Mozilla\Firefox\Profiles\emub2jur.default\
FF - prefs.js: browser.startup.homepage - hxxp://sg.yahoo.com/?fr=fp-yie8/
FF - prefs.js: network.proxy.type - 0
.
.
——- 文件类型 ——-
.
.scr=AutoCADScriptFile
.txt=
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - (no file)
BHO-{B0E2F470-0B07-48f0-B3B1-5749505FAE9B} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-27 09:21
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程 。。。
.
扫描被隐藏的启动组 。。。
.
扫描被隐藏的文件 。。。
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\SUPER *]
"DisplayName"="SUPER ?Version 2007.bld.23 (July 4, 2007)"
"UninstallString"="d:\\PROGRA~1\\ERIGHT~1\\SUPER\\Setup.exe /remove /q0"
"InstallDate"="2008-06-15 17:06"
"InstallLocation"="d:\\Program Files\\eRightSoft\\SUPER"
"InstallSource"="f:\\exe"
"DisplayIcon"="d:\\Program Files\\eRightSoft\\SUPER\\SUPER.exe"
"DisplayVersion"="Version 2007.bld.23 (July 4, 2007)"
"VersionMajor"=dword:00000000
"VersionMinor"=dword:00000000
"Publisher"="eRightSoft"
"HelpLink"="http://www.eRightSoft.com"
"URLInfoAbout"="http://www.eRightSoft.com"
"URLUpdateInfo"="http://www.eRightSoft.com"
"Contact"="[removed]"
.
——————— 运行进程下的动态链接库 ———————
.
- - - - - - - > 'winlogon.exe'(792)
d:\program files\SUPERAntiSpyware\SASWINLO.DLL
d:\windows\system32\WININET.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
d:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll
.
- - - - - - - > 'lsass.exe'(848)
d:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
完成时间: 2011-08-27 09:25:30
ComboFix-quarantined-files.txt 2011-08-27 01:25
ComboFix2.txt 2011-08-26 12:20
ComboFix3.txt 2011-08-24 14:58
ComboFix4.txt 2011-08-24 12:49
.
Pre-Run: 193,664,929,792 bytes free
Post-Run: 193,668,587,520 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - 9090A8971E44CAC4A9A5FC650D3BAB84

Recieved a warning sign.
Gmer scan log:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-28 17:57:50
Windows 5.1.2600 Service Pack 3 Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-17 ST3500418AS rev.CC38
Running: gmer.exe; Driver: D:\DOCUME~1\MYPC~1\LOCALS~1\Temp\uxtdqpog.sys


—- System - GMER 1.0.15 —-

SSDT B871D5EC ZwClose
SSDT B871D5A6 ZwCreateKey
SSDT B871D5F6 ZwCreateSection
SSDT B871D59C ZwCreateThread
SSDT B871D5AB ZwDeleteKey
SSDT B871D5B5 ZwDeleteValueKey
SSDT B871D5E7 ZwDuplicateObject
SSDT B871D5BA ZwLoadKey
SSDT B871D588 ZwOpenProcess
SSDT B871D58D ZwOpenThread
SSDT B871D5C4 ZwReplaceKey
SSDT B871D5BF ZwRestoreKey
SSDT B871D5FB ZwSetContextThread
SSDT B871D5B0 ZwSetValueKey
SSDT B871D597 ZwTerminateProcess

—- Kernel code sections - GMER 1.0.15 —-

.text D:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB6F273A0, 0x88C445, 0xE8000020]

—- User code sections - GMER 1.0.15 —-

.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AC9 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB3C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E2546A6 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5337 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5269 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E52D4 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E513A D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E519C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E539A D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E51FE D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDB98 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[540] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E569F D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[908] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[908] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB3C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[908] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5337 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[908] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5269 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[908] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E52D4 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[908] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E513A D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[908] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E519C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[908] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E539A D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[908] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E51FE D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\WINDOWS\system32\SearchIndexer.exe[1900] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C D:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text D:\WINDOWS\Explorer.EXE[3300] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 0269E5D7 D:\Program Files\Common Files\Data\hd16_module.dat
.text D:\WINDOWS\Explorer.EXE[3300] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 0269E5A2 D:\Program Files\Common Files\Data\hd16_module.dat
.text D:\WINDOWS\Explorer.EXE[3300] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 0269E56D D:\Program Files\Common Files\Data\hd16_module.dat
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AC9 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB3C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E2546A6 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5337 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5269 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E52D4 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E513A D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E519C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E539A D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E51FE D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDB98 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[4528] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E569F D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AC9 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB3C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E2546A6 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5337 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5269 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E52D4 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E513A D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E519C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E539A D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E51FE D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDB98 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[5404] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E569F D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

—- User IAT/EAT - GMER 1.0.15 —-

IAT D:\Program Files\Internet Explorer\iexplore.exe[540] @ D:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] D:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT D:\Program Files\Internet Explorer\iexplore.exe[4528] @ D:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] D:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT D:\Program Files\Internet Explorer\iexplore.exe[5404] @ D:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] D:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs tdrpm251.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 tdrpm251.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 tdrpm251.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 tdrpm251.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 tdrpm251.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Roxio)
—- Processes - GMER 1.0.15 —-

Library D:\Program (*** hidden *** ) @ D:\WINDOWS\Explorer.EXE [3300] 0x31300000

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF7 0xD5 0xB2 0x16 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF1 0x7B 0x78 0x04 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF7 0xD5 0xB2 0x16 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF1 0x7B 0x78 0x04 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF7 0xD5 0xB2 0x16 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF1 0x7B 0x78 0x04 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF7 0xD5 0xB2 0x16 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF1 0x7B 0x78 0x04 …
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF7 0xD5 0xB2 0x16 …
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF1 0x7B 0x78 0x04 …
Reg HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF7 0xD5 0xB2 0x16 …
Reg HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF1 0x7B 0x78 0x04 …
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer@ 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @DisplayName SUPER ?Version 2007.bld.23 (July 4, 2007)
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @UninstallString D:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @InstallDate 2008-06-15 17:06:33
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @InstallLocation D:\Program Files\eRightSoft\SUPER
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @InstallSource F:\exe
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @DisplayIcon D:\Program Files\eRightSoft\SUPER\SUPER.exe
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @DisplayVersion Version 2007.bld.23 (July 4, 2007)
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @VersionMajor 0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @VersionMinor 0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @Publisher eRightSoft
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @HelpLink http://www.eRightSoft.com
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @URLInfoAbout http://www.eRightSoft.com
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @URLUpdateInfo http://www.eRightSoft.com
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SUPER @Contact [removed]
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@FriendlyName Indeo? video 5.10 Compression Filter
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@CLSID {1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@FilterData 0x02 0x00 0x00 0x00 …
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@EncoderType 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Acronis\Acronis
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Acronis\Acronis@Order 0x08 0x00 0x00 0x00 …

—- EOF - GMER 1.0.15 —-

does this helped to remove the agents?

sorry i went to search and read regarding the Windows Explorer error and downloaded Norman Malware Cleaner to do a quick scan for Malicious objects. and here is the log:

N o r m a n M a l w a r e C l e a n e r v 2 . 0 2 . 0 1

C o p y r i g h t 1 9 9 0 - 2 0 1 1 , N o r m a n A S A .



N o r m a n S c a n n e r E n g i n e V e r s i o n : 6 . 0 7 . 1 0

n v c b i n . d e f : V e r s i o n : 6 . 0 7 . 0 0 , D a t e : 2 0 1 1 / 0 8 / 2 7 1 8 : 0 0 : 4 0 , V a r i a n t s : 1 1 1 7 6 6 3 2

n v c m a c r o . d e f : V e r s i o n : 6 . 0 7 . 0 0 , D a t e : 2 0 1 1 / 0 2 / 0 1 2 2 : 2 1 : 3 1 , V a r i a n t s : 2 0 4 6 5



O p e r a t i n g S y s t e m : W i n d o w s X P S e r v i c e P a c k 3



S w i t c h e s : / i a g r e e / n o s b



S c a n s t a r t e d : 2 0 1 1 / 0 8 / 2 8 2 1 : 3 1 : 0 9



R u n n i n g p r e - s c a n c l e a n u p r o u t i n e . . .

P o t e n t i a l l y u n w a n t e d r e g i s t r y v a l u e : ' H K C R \ . s c r - - > ( n u l l ) = A u t o C A D S c r i p t F i l e '

M o d i f i e d r e g i s t r y v a l u e : H K C R \ . s c r - - > ( D e f a u l t ) f r o m ' A u t o C A D S c r i p t F i l e ' t o ' s c r f i l e '

P o t e n t i a l l y u n w a n t e d r e g i s t r y v a l u e : ' H K U \ S - 1 - 5 - 1 9 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e R e g i s t r y T o o l s = 0 x 0 0 0 0 0 0 0 0 '

D e l e t e d r e g i s t r y v a l u e : H K U \ S - 1 - 5 - 1 9 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e R e g i s t r y T o o l s = 0 x 0 0 0 0 0 0 0 0

P o t e n t i a l l y u n w a n t e d r e g i s t r y v a l u e : ' H K U \ S - 1 - 5 - 2 0 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e R e g i s t r y T o o l s = 0 x 0 0 0 0 0 0 0 0 '

D e l e t e d r e g i s t r y v a l u e : H K U \ S - 1 - 5 - 2 0 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e R e g i s t r y T o o l s = 0 x 0 0 0 0 0 0 0 0

P o t e n t i a l l y u n w a n t e d r e g i s t r y v a l u e : ' H K L M \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e R e g i s t r y T o o l s = 0 x 0 0 0 0 0 0 0 0 '

D e l e t e d r e g i s t r y v a l u e : H K L M \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e R e g i s t r y T o o l s = 0 x 0 0 0 0 0 0 0 0

P o t e n t i a l l y u n w a n t e d r e g i s t r y v a l u e : ' H K U \ S - 1 - 5 - 1 9 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e T a s k M g r = 0 x 0 0 0 0 0 0 0 0 '

D e l e t e d r e g i s t r y v a l u e : H K U \ S - 1 - 5 - 1 9 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e T a s k M g r = 0 x 0 0 0 0 0 0 0 0

P o t e n t i a l l y u n w a n t e d r e g i s t r y v a l u e : ' H K U \ S - 1 - 5 - 2 0 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e T a s k M g r = 0 x 0 0 0 0 0 0 0 0 '

D e l e t e d r e g i s t r y v a l u e : H K U \ S - 1 - 5 - 2 0 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m - - > D i s a b l e T a s k M g r = 0 x 0 0 0 0 0 0 0 0

P o t e n t i a l l y u n w a n t e d r e g i s t r y v a l u e : ' H K U \ S - 1 - 5 - 2 1 - 2 9 9 5 0 2 2 6 7 - 1 7 8 8 2 2 3 6 4 8 - 7 2 5 3 4 5 5 4 3 - 1 0 0 4 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x p l o r e r - - > N o D r i v e s = 0 x 0 0 0 0 0 0 0 0 '

D e l e t e d r e g i s t r y v a l u e : H K U \ S - 1 - 5 - 2 1 - 2 9 9 5 0 2 2 6 7 - 1 7 8 8 2 2 3 6 4 8 - 7 2 5 3 4 5 5 4 3 - 1 0 0 4 \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x p l o r e r - - > N o D r i v e s = 0 x 0 0 0 0 0 0 0 0

P o t e n t i a l l y u n w a n t e d r e g i s t r y v a l u e : ' H K L M \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x p l o r e r - - > N o D r i v e s = 0 x 0 0 0 0 0 0 0 0 '

D e l e t e d r e g i s t r y v a l u e : H K L M \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x p l o r e r - - > N o D r i v e s = 0 x 0 0 0 0 0 0 0 0

P o t e n t i a l l y u n w a n t e d r e g i s t r y v a l u e : ' H K L M \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x p l o r e r - - > N o R e s o l v e S e a r c h = 0 x 0 0 0 0 0 0 0 1 '

D e l e t e d r e g i s t r y v a l u e : H K L M \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x p l o r e r - - > N o R e s o l v e S e a r c h = 0 x 0 0 0 0 0 0 0 1



N u m b e r o f m a l i c i o u s o b j e c t s f o u n d : 9

N u m b e r o f m a l i c i o u s o b j e c t s c l e a n e d : 9

S c a n n i n g t i m e : 0 s



S c a n n i n g s y s t e m f o r F a k e A V . . .



N u m b e r o f m a l i c i o u s o b j e c t s f o u n d : 0

N u m b e r o f m a l i c i o u s o b j e c t s c l e a n e d : 0

N u m b e r o f m a l i c i o u s f i l e s f o u n d : 0

N u m b e r o f m a l i c i o u s f i l e s c l e a n e d : 0

S c a n n i n g t i m e : 0 s



S c a n n i n g s y s t e m f o r a c t i v e r o o t k i t a c t i v i t y . . .



N u m b e r o f m a l i c i o u s o b j e c t s f o u n d : 0

N u m b e r o f m a l i c i o u s o b j e c t s c l e a n e d : 0

N u m b e r o f m a l i c i o u s f i l e s f o u n d : 0

N u m b e r o f m a l i c i o u s f i l e s c l e a n e d : 0

S c a n n i n g t i m e : 0 s



S c a n n i n g r u n n i n g p r o c e s s e s a n d p r o c e s s m e m o r y . . .

D : \ P r o g r a m F i l e s \ C o m m o n F i l e s \ D a t a \ h d 1 6 _ m o d u l e . d a t : E r r o r o p e n i n g f i l e f o r r e a d : 0 x 0 0 0 0 0 0 2 0



N u m b e r o f o b j e c t s f o u n d : 1 3 0 5

N u m b e r o f o b j e c t s s c a n n e d : 1 3 0 4

N u m b e r o f o b j e c t s n o t s c a n n e d : 1

N u m b e r o f m a l i c i o u s m e m o r y o b j e c t s f o u n d : 0

N u m b e r o f m a l i c i o u s o b j e c t s c l e a n e d : 0

N u m b e r o f m a l i c i o u s f i l e s f o u n d : 0

N u m b e r o f m a l i c i o u s f i l e s c l e a n e d : 0

S c a n n i n g t i m e : 1 m 5 7 s



R u n n i n g q u i c k s c a n . . .



N u m b e r o f f i l e s f o u n d : 3 2 4 0

N u m b e r o f a r c h i v e s u n p a c k e d : 5

N u m b e r o f o b j e c t s f o u n d : 3 3 9 1

N u m b e r o f o b j e c t s s c a n n e d : 3 3 9 1

N u m b e r o f o b j e c t s n o t s c a n n e d : 0

N u m b e r o f m a l i c i o u s o b j e c t s f o u n d : 0

N u m b e r o f m a l i c i o u s o b j e c t s c l e a n e d : 0

N u m b e r o f m a l i c i o u s f i l e s f o u n d : 0

N u m b e r o f m a l i c i o u s f i l e s c l e a n e d : 0

S c a n n i n g t i m e : 4 m 4 0 s



R u n n i n g p o s t - s c a n c l e a n u p r o u t i n e . . .



N u m b e r o f m a l i c i o u s o b j e c t s f o u n d : 0

N u m b e r o f m a l i c i o u s o b j e c t s c l e a n e d : 0

S c a n n i n g t i m e : 0 s



R e s u l t s :

T o t a l n u m b e r o f f i l e s f o u n d : 3 2 4 0

T o t a l n u m b e r o f a r c h i v e s u n p a c k e d : 5

T o t a l n u m b e r o f o b j e c t s f o u n d : 4 6 9 6

T o t a l n u m b e r o f o b j e c t s s c a n n e d : 4 6 9 5

T o t a l n u m b e r o f o b j e c t s n o t s c a n n e d : 1

T o t a l n u m b e r o f m a l i c i o u s o b j e c t s f o u n d : 9

T o t a l n u m b e r o f m a l i c i o u s o b j e c t s c l e a n e d : 9

T o t a l n u m b e r o f m a l i c i o u s f i l e s f o u n d : 0

T o t a l n u m b e r o f m a l i c i o u s f i l e s c l e a n e d : 0

T o t a l n u m b e r o f o b j e c t s q u a r a n t i n e d : 9

T o t a l s c a n n i n g t i m e : 6 m 3 7 s